Asana Workspace SAML Optional

AnalysisType: rule
Description: An Asana user made SAML optional for your organization.
DisplayName: "Asana Workspace SAML Optional"
Enabled: true
Filename: asana_workspace_saml_optional.py
Runbook: Confirm this user acted with valid business intent and determine whether this activity was authorized.
Reference: https://help.asana.com/hc/en-us/articles/14075208738587-Premium-Business-and-Enterprise-authentication#gl-saml:~:text=to%20your%20organization.-,SAML,-If%20your%20company
Severity: Medium
Tests:
  - ExpectedResult: false
    Log:
      actor:
        actor_type: user
        email: homer.simpson@example.io
        gid: "1234"
        name: Homer Simpson
      context:
        client_ip_address: 12.12.12.12
        context_type: web
        user_agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
      created_at: "2022-12-16 19:31:36.289"
      details:
        new_value: required
        old_value: optional
      event_category: admin_settings
      event_type: workspace_saml_settings_changed
      gid: "1234"
      resource:
        gid: "1234"
        name: example.io
        resource_type: email_domain
    Name: SAML required
  - ExpectedResult: true
    Log:
      actor:
        actor_type: user
        email: homer.simpson@example.io
        gid: "1234"
        name: Homer Simpson
      context:
        client_ip_address: 12.12.12.12
        context_type: web
        user_agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
      created_at: "2022-12-16 19:31:36.289"
      details:
        new_value: optional
        old_value: required
      event_category: admin_settings
      event_type: workspace_saml_settings_changed
      gid: "1234"
      resource:
        gid: "1234"
        name: example.io
        resource_type: email_domain
    Name: SAML optional
DedupPeriodMinutes: 60
LogTypes:
  - Asana.Audit
RuleID: "Asana.Workspace.SAML.Optional"
Threshold: 1


# ------ paired body: asana_workspace_saml_optional.py ------

def rule(event):
    old_val = event.deep_get("details", "old_value", default="<OLD_VAL_NOT_FOUND>")
    new_val = event.deep_get("details", "new_value", default="<NEW_VAL_NOT_FOUND>")
    return all(
        [
            event.get("event_type", "<NO_EVENT_TYPE_FOUND>") == "workspace_saml_settings_changed",
            old_val == "required",
            new_val == "optional",
        ]
    )


def title(event):
    actor_email = event.deep_get("actor", "email", default="<ACTOR_NOT_FOUND>")
    return f"Asana user [{actor_email}] made SAML optional for your organization."