Asana Service Account Created

Description

An Asana service account was created by someone in your organization.

Query · python

def rule(event):
    return event.get("event_type", "<NO_EVENT_TYPE_FOUND>") == "service_account_created"


def title(event):
    actor_email = event.deep_get("actor", "email", default="<ACTOR_NOT_FOUND>")
    svc_acct_name = event.deep_get("resource", "name", default="<SVC_ACCT_NAME_NOT_FOUND>")
    return f"Asana user [{actor_email}] created a new service account [{svc_acct_name}]."

Analyst notes

Confirm this user acted with valid business intent and determine whether this activity was authorized.

Raw source Asana Service Account Created · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Description: An Asana service account was created by someone in your organization.
DisplayName: "Asana Service Account Created"
Enabled: true
Filename: asana_service_account_created.py
Runbook: Confirm this user acted with valid business intent and determine whether this activity was authorized.
Reference: https://help.asana.com/hc/en-us/articles/14217496838427-Service-Accounts
Severity: Medium
Tests:
  - ExpectedResult: false
    Log:
      actor:
        actor_type: user
        email: homer.simpson@example.io
        gid: "12345"
        name: Homer Simpson
      context:
        client_ip_address: 12.12.12.12
        context_type: web
        user_agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
      created_at: "2022-12-16 19:30:26.15"
      details:
        new_value: test.com
      event_category: admin_settings
      event_type: workspace_associated_email_domain_added
      gid: "12345"
      resource:
        gid: "12345"
        name: Example IO
        resource_type: workspace
    Name: New domain created
  - ExpectedResult: true
    Log:
      actor:
        actor_type: user
        email: homer.simpson@panther.io
        gid: "12345"
        name: Homer Simpson
      context:
        client_ip_address: 12.12.12.12
        context_type: web
        user_agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
      created_at: "2022-12-16 19:28:18.396"
      details: {}
      event_category: apps
      event_type: service_account_created
      gid: "12345"
      resource:
        gid: "12345"
        name: Slack Service Account
        resource_type: user
    Name: Slack svc acct
  - ExpectedResult: true
    Log:
      actor:
        actor_type: user
        email: homer.simpson@panther.io
        gid: "12345"
        name: Homer Simpson
      context:
        client_ip_address: 12.12.12.12
        context_type: web
        user_agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
      created_at: "2022-12-16 19:28:18.396"
      details: {}
      event_category: apps
      event_type: service_account_created
      gid: "12345"
      resource:
        gid: "12345"
        name: Datadog Service Account
        resource_type: user
    Name: Datadog svc acct
DedupPeriodMinutes: 60
LogTypes:
  - Asana.Audit
RuleID: "Asana.Service.Account.Created"
Threshold: 1


# ------ paired body: asana_service_account_created.py ------

def rule(event):
    return event.get("event_type", "<NO_EVENT_TYPE_FOUND>") == "service_account_created"


def title(event):
    actor_email = event.deep_get("actor", "email", default="<ACTOR_NOT_FOUND>")
    svc_acct_name = event.deep_get("resource", "name", default="<SVC_ACCT_NAME_NOT_FOUND>")
    return f"Asana user [{actor_email}] created a new service account [{svc_acct_name}]."

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.