Asana Team Privacy Public

Description

An Asana team's privacy setting was changed to public to the organization (not public to internet)

Query · python

def rule(event):
    return (
        event.get("event_type") == "team_privacy_settings_changed"
        and event.deep_get("details", "new_value") == "public"
    )


def title(event):
    team = event.deep_get("resource", "name", default="<TEAM_NOT_FOUND>")
    actor = event.deep_get("actor", "email", default="<ACTOR_NOT_FOUND>")
    return f"Asana team [{team}] has been made public to the org by [{actor}]."
Raw source Asana Team Privacy Public · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Description: An Asana team's privacy setting was changed to public to the organization (not public to internet)
DisplayName: "Asana Team Privacy Public"
Enabled: true
Filename: asana_team_privacy_public.py
Reference: https://help.asana.com/hc/en-us/articles/14211433439387-Team-permissions
Severity: Low
Tests:
  - ExpectedResult: true
    Log:
      actor:
        actor_type: user
        email: homer.simpson@panther.io
        gid: "12345"
        name: Homer Simpson
      context:
        client_ip_address: 12.12.12.12
        context_type: web
        user_agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
      created_at: "2022-12-16 19:35:21.026"
      details:
        new_value: public
      event_category: access_control
      event_type: team_privacy_settings_changed
      gid: "12345"
      resource:
        gid: "12345"
        name: Example Team Name
        resource_type: team
      p_log_type: Asana.Audit
    Name: Team made public
  - ExpectedResult: false
    Log:
      actor:
        actor_type: user
        email: homer.simpsons@simpsons.com
        gid: "1234567890"
        name: Homer Simpson
      context:
        client_ip_address: 1.2.3.4
        context_type: web
        user_agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
      created_at: "2023-02-01 18:05:08.413"
      details:
        method:
          - SAML
      event_category: logins
      event_type: user_login_succeeded
      gid: "123456789"
      resource:
        email: homer.simpsons@simpsons.com
        gid: "1234567890"
        name: Homer Simpson
        resource_type: user
      p_log_type: Asana.Audit
    Name: Other event
DedupPeriodMinutes: 60
LogTypes:
  - Asana.Audit
RuleID: "Asana.Team.Privacy.Public"
Threshold: 1


# ------ paired body: asana_team_privacy_public.py ------

def rule(event):
    return (
        event.get("event_type") == "team_privacy_settings_changed"
        and event.deep_get("details", "new_value") == "public"
    )


def title(event):
    team = event.deep_get("resource", "name", default="<TEAM_NOT_FOUND>")
    actor = event.deep_get("actor", "email", default="<ACTOR_NOT_FOUND>")
    return f"Asana team [{team}] has been made public to the org by [{actor}]."

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.