Panther rules: zia

from panther_zscaler_helpers import zia_alert_context, zia_success

SENSITIVE_CATEGORIES = ["ADMINISTRATOR_MANAGEMENT", "ROLE_MANAGEMENT"]


def rule(event):
    if not zia_success(event):
        return False
    event_data = event.get("event", {})
    return (
        event_data.get("action", "ACTION_NOT_FOUND") == "DELETE"
        and event_data.get("category", "CATEGORY_NOT_FOUND") in SENSITIVE_CATEGORIES
    )


def title(event):
    return (
        f"[Zscaler.ZIA]: Admin account was deleted by admin with id "
        f"[{event.deep_get('event', 'adminid', default='<ADMIN_ID_NOT_FOUND>')}]"
    )


def alert_context(event):
    return zia_alert_context(event)

AnalysisType: rule
RuleID: ZIA.Account.Access.Removed
Description: This rule detects when admin user/role was deleted.
DisplayName: ZIA Account Access Removed
Runbook: Verify that this change was planned. If not, revert the change and ensure this doesn't happen again.
Reference: https://help.zscaler.com/zia/authentication-administration/administrator-role-management
Enabled: true
Filename: zia_account_access_removal.py
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0040:T1531 # Account Access removal
LogTypes:
  - Zscaler.ZIA.AdminAuditLog
DedupPeriodMinutes: 60
Threshold: 1

from panther_zscaler_helpers import zia_alert_context, zia_success


def rule(event):
    if not zia_success(event):
        return False
    event_data = event.get("event", {})
    return (
        event_data.get("action", "ACTION_NOT_FOUND") == "CREATE"
        and event_data.get("category", "CATEGORY_NOT_FOUND") == "ROLE_MANAGEMENT"
    )


def title(event):
    return (
        f"[Zscaler.ZIA]: Additional cloud role was created by admin with id "
        f"[{event.deep_get('event', 'adminid', default='<ADMIN_ID_NOT_FOUND>')}]"
    )


def alert_context(event):
    return zia_alert_context(event)

AnalysisType: rule
RuleID: ZIA.Additional.Cloud.Roles
Description: This rule detects when an additional cloud role was created.
DisplayName: ZIA Additional Cloud Roles
Runbook: Verify that this change was planned. If not, revert the change and ensure this doesn't happen again.
Reference: https://help.zscaler.com/zia/about-role-management
Enabled: true
Filename: zia_additional_cloud_roles.py
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0003:T1098.003 # Persistence: Additional Cloud Roles
    - TA0004:T1098.003 # Priv Escalation: Additional Cloud Roles
LogTypes:
  - Zscaler.ZIA.AdminAuditLog
DedupPeriodMinutes: 60
Threshold: 1

from panther_zscaler_helpers import zia_alert_context, zia_success


def rule(event):
    if not zia_success(event):
        return False
    action = event.deep_get("event", "action", default="ACTION_NOT_FOUND")
    category = event.deep_get("event", "category", default="CATEGORY_NOT_FOUND")
    if action == "DELETE" and category == "BACKUP_AND_RESTORE":
        return True
    return False


def title(event):
    return (
        f"[Zscaler.ZIA]: Backup was deleted by admin with id "
        f"[{event.deep_get('event', 'adminid', default='<ADMIN_ID_NOT_FOUND>')}]"
    )


def alert_context(event):
    return zia_alert_context(event)

AnalysisType: rule
RuleID: ZIA.Backup.Deleted
Description: This rule detects when ZIA backup data was deleted.
DisplayName: ZIA Backup Deleted
Runbook: Verify that this change was planned. If not, make sure to restore the backup.
Reference: https://help.zscaler.com/zia/about-backup-and-restore
Enabled: true
Filename: zia_backup_deleted.py
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0005:T1562.008 # Disable or Modify Cloud Logs
LogTypes:
  - Zscaler.ZIA.AdminAuditLog
DedupPeriodMinutes: 60
Threshold: 1

from panther_zscaler_helpers import zia_alert_context, zia_success


def rule(event):
    if not zia_success(event):
        return False
    action = event.deep_get("event", "action", default="ACTION_NOT_FOUND")
    category = event.deep_get("event", "category", default="CATEGORY_NOT_FOUND")
    role_name = event.deep_get(
        "event", "postaction", "role", "name", default="<ROLE_NAME_NOT_FOUND>"
    ).lower()
    if (
        action == "CREATE"
        and category == "ADMINISTRATOR_MANAGEMENT"
        and ("admin" in role_name or "audit" in role_name)
    ):
        return True
    return False


def title(event):
    return (
        f"[Zscaler.ZIA]: New admin role was created by admin with id "
        f"[{event.deep_get('event', 'adminid', default='<ADMIN_ID_NOT_FOUND>')}]"
    )


def alert_context(event):
    return zia_alert_context(event)

AnalysisType: rule
RuleID: ZIA.Cloud.Account.Created
Description: This rule detects when new cloud account was created.
DisplayName: ZIA Cloud Account Created
Runbook: Verify that this change was planned. If not, revert the change and ensure this doesn't happen again.
Reference: https://help.zscaler.com/zia/choosing-provisioning-and-authentication-methods
Enabled: true
Filename: zia_create_cloud_account.py
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0003:T1136.003 # Persistence: Create Cloud Account
LogTypes:
  - Zscaler.ZIA.AdminAuditLog
DedupPeriodMinutes: 60
Threshold: 1

from panther_zscaler_helpers import zia_alert_context, zia_success


def rule(event):
    if not zia_success(event):
        return False
    action = event.deep_get("event", "action", default="ACTION_NOT_FOUND")
    category = event.deep_get("event", "category", default="CATEGORY_NOT_FOUND")
    golden_restore_point_pre = event.deep_get(
        "event",
        "preaction",
        "goldenRestorePoint",
        default="<PRE_RESTORE_POINT_NOT_FOUND>",
    )
    golden_restore_point_post = event.deep_get(
        "event",
        "postaction",
        "goldenRestorePoint",
        default="<POPT_RESTORE_POINT_NOT_FOUND>",
    )
    if (
        action == "UPDATE"
        and category == "BACKUP_AND_RESTORE"
        and golden_restore_point_pre is True
        and golden_restore_point_post is False
    ):
        return True
    return False


def title(event):
    return (
        f"[Zscaler.ZIA]: goldenRestorePoint was dropped by admin with id "
        f"[{event.deep_get('event', 'adminid', default='<ADMIN_ID_NOT_FOUND>')}]"
    )


def alert_context(event):
    return zia_alert_context(event)

AnalysisType: rule
RuleID: ZIA.Golden.Restore.Point.Dropped
Description: This rule detects when ZIA goldenRestorePoint was dropped. 
  It means that some piece of information that was impossible to delete before, now is deletable
DisplayName: ZIA Golden Restore Point Dropped
Runbook: Verify that this change was planned. If not, revert the change.
Reference: https://help.zscaler.com/zia/about-backup-and-restore
Enabled: true
Filename: zia_golden_restore_point_dropped.py
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0005:T1562.008 # Disable or Modify Cloud Logs
LogTypes:
  - Zscaler.ZIA.AdminAuditLog
DedupPeriodMinutes: 60
Threshold: 1

from panther_zscaler_helpers import zia_alert_context, zia_success


def rule(event):
    if not zia_success(event):
        return False
    auth_frequency = event.deep_get(
        "event",
        "postaction",
        "authFrequency",
        default="<AUTH_FREQUENCY_NOT_FOUND>",
    )
    password_expiry = event.deep_get(
        "event",
        "postaction",
        "passwordExpiry",
        default="<PASSWORD_EXPIRY_NOT_FOUND>",
    )
    password_strength = event.deep_get(
        "event",
        "postaction",
        "passwordStrength",
        default="<PASSWORD_STRENGTH_NOT_FOUND>",
    )
    if (
        auth_frequency == "PERMANENT_COOKIE"
        or password_expiry == "NEVER"  # nosec bandit B105
        or password_strength == "NONE"  # nosec bandit B105
    ):
        return True
    return False


def dedup(event):
    return event.deep_get("event", "adminid", default="<ADMIN_ID_NOT_FOUND>")


def title(event):
    return (
        f"[Zscaler.ZIA]: Password settings are insecure for admin with id "
        f"[{event.deep_get('event', 'adminid', default='<ADMIN_ID_NOT_FOUND>')}]"
    )


def alert_context(event):
    return zia_alert_context(event)

AnalysisType: rule
RuleID: ZIA.Insecure.Password.Settings
Description: This rule detects when password settings are insecure.
DisplayName: ZIA Insecure Password Settings
Runbook: Set the secure password configurations.
Reference: https://help.zscaler.com/zia/customizing-your-admin-account-settings
Enabled: true
Filename: zia_insecure_password_settings.py
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0005:T1556.009 # Defense Evasion: Modify Authentication Process: Conditional Access Policies
LogTypes:
  - Zscaler.ZIA.AdminAuditLog
DedupPeriodMinutes: 60
Threshold: 1

from panther_zscaler_helpers import zia_alert_context, zia_success


def rule(event):
    if not zia_success(event):
        return False
    action = event.deep_get("event", "action", default="ACTION_NOT_FOUND")
    category = event.deep_get("event", "category", default="CATEGORY_NOT_FOUND")
    if action == "DELETE" and category == "NSS":
        return True
    return False


def title(event):
    cloud_connection_url = event.deep_get(
        "event",
        "preaction",
        "cloudNssSiemConfiguration",
        "connectionURL",
        default="<CLOUD_CONNECTION_URL_NOT_FOUND>",
    )
    return (
        f"[Zscaler.ZIA]: Log streaming for location [{cloud_connection_url}] "
        f"was deleted by admin with id "
        f"[{event.deep_get('event', 'adminid', default='<ADMIN_ID_NOT_FOUND>')}]"
    )


def alert_context(event):
    return zia_alert_context(event)

AnalysisType: rule
RuleID: ZIA.Log.Streaming.Disabled
Description: This rule detects when ZIA log streaming was disabled.
DisplayName: ZIA Log Streaming Disabled
Runbook: Verify that this change was planned. If not, make sure to restore previous settings.
Reference: https://help.zscaler.com/zia/about-nss-feeds
Enabled: true
Filename: zia_log_streaming_disabled.py
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0005:T1562.008 # Disable or Modify Cloud Logs
LogTypes:
  - Zscaler.ZIA.AdminAuditLog
DedupPeriodMinutes: 60
Threshold: 1

from panther_zscaler_helpers import zia_alert_context, zia_success


def rule(event):
    if not zia_success(event):
        return False
    action = event.deep_get("event", "action", default="ACTION_NOT_FOUND")
    category = event.deep_get("event", "category", default="CATEGORY_NOT_FOUND")
    if action == "DOWNLOAD" and category == "AUDIT_LOGS":
        return True
    return False


def title(event):
    return (
        f"[Zscaler.ZIA]: Audit logs were downloaded by admin with id "
        f"[{event.deep_get('event', 'adminid', default='<ADMIN_ID_NOT_FOUND>')}]"
    )


def alert_context(event):
    return zia_alert_context(event)

AnalysisType: rule
RuleID: ZIA.Logs.Downloaded
Description: This rule detects when ZIA Audit Logs were downloaded.
DisplayName: ZIA Logs Downloaded
Runbook: Verify that this change was planned. If not, make sure no sensitive information was leaked.
Reference: https://help.zscaler.com/zia/about-audit-logs
Enabled: true
Filename: zia_logs_downloaded.py
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0007:T1654 # Log Enumeration
LogTypes:
  - Zscaler.ZIA.AdminAuditLog
DedupPeriodMinutes: 60
Threshold: 1

from panther_zscaler_helpers import zia_alert_context, zia_success


def rule(event):
    if not zia_success(event):
        return False
    action = event.deep_get("event", "action", default="ACTION_NOT_FOUND")
    category = event.deep_get("event", "category", default="CATEGORY_NOT_FOUND")
    password_exp_pre = event.deep_get(
        "event",
        "preaction",
        "passwordExpirationEnabled",
        default="",
    )
    password_exp_post = event.deep_get(
        "event",
        "postaction",
        "passwordExpirationEnabled",
        default="",
    )
    if action == "UPDATE" and category == "LOGIN" and password_exp_pre != password_exp_post:
        return True
    return False


def title(event):
    return (
        f"[Zscaler.ZIA]: Password expiration setting was changed by admin with id "
        f"[{event.deep_get('event', 'adminid', default='<ADMIN_ID_NOT_FOUND>')}]"
    )


def alert_context(event):
    return zia_alert_context(event)

AnalysisType: rule
RuleID: ZIA.Password.Expiration
Description: This rule detects when password expiration was set/removed.
DisplayName: ZIA Password Expiration
Runbook: Verify that this change was planned. If not, revert the change and ensure this doesn't happen again.
Reference: https://help.zscaler.com/zia/configuring-password-expiration
Enabled: true
Filename: zia_password_expiration.py
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0007:T1201 # Password Policy Discovery
LogTypes:
  - Zscaler.ZIA.AdminAuditLog
DedupPeriodMinutes: 60
Threshold: 1

from panther_zscaler_helpers import zia_alert_context, zia_success


def rule(event):
    if not zia_success(event):
        return False
    action = event.deep_get("event", "action", default="ACTION_NOT_FOUND")
    category = event.deep_get("event", "category", default="CATEGORY_NOT_FOUND")
    saml_enabled_pre = event.deep_get("event", "preaction", "samlEnabled", default="")
    saml_enabled_post = event.deep_get("event", "postaction", "samlEnabled", default="")
    # Only alert if both fields are present and have different values
    if (
        action == "UPDATE"
        and category == "ADMINISTRATOR_MANAGEMENT"
        and saml_enabled_pre != ""
        and saml_enabled_post != ""
        and saml_enabled_pre != saml_enabled_post
    ):
        return True
    return False


def title(event):
    return (
        f"[Zscaler.ZIA]: SAML configuration was changed by admin with id "
        f"[{event.deep_get('event', 'adminid', default='<ADMIN_ID_NOT_FOUND>')}]"
    )


def alert_context(event):
    return zia_alert_context(event)

AnalysisType: rule
RuleID: ZIA.Trust.Modification
Description: This rule detects when SAML authentication was enabled/disabled.
DisplayName: ZIA Trust Modification
Runbook: Verify that this change was planned. If not, revert the change and ensure this doesn't happen again.
Reference: https://help.zscaler.com/zia/configuring-saml
Enabled: true
Filename: zia_trust_modification.py
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0004:T1484.002 # Domain or Tenant Policy Modification: Trust Modification
LogTypes:
  - Zscaler.ZIA.AdminAuditLog
DedupPeriodMinutes: 60
Threshold: 1