Auth0 Delete Tenant Member

Description

A tenant member was deleted.

Query · python

from panther_auth0_helpers import auth0_alert_context, is_auth0_config_event


def rule(event):

    data_description = event.deep_get("data", "description", default="<NO_DATA_DESCRIPTION_FOUND>")

    return all(
        [
            is_auth0_config_event(event),
            data_description == "Delete tenant member",
        ]
    )


def alert_context(event):
    return auth0_alert_context(event)
Raw source Auth0 Delete Tenant Member · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Filename: auth0_delete_tenant_member.py
RuleID: Auth0.Delete.TenantMember
DisplayName: Auth0 Delete Tenant Member
Enabled: true
LogTypes:
  - Auth0.Events
Severity: Info
CreateAlert: false
Reports:
  MITRE ATT&CK:
    - TA0010:T1041
Description: A tenant member was deleted.
Reference: 
  https://github.com/auth0/auth0-customer-detections/blob/main/detections/risk_of_tenant_takeover.yml
Tests:
  - ExpectedResult: true
    Log:
      data:
        client_id: 1HXWWGKk1Zj3JF8GvMrnCSirccDs4qvr
        client_name: ""
        date: "2025-10-10 10:27:51.149000000"
        description: Delete tenant member
        details:
          request:
            auth:
              credentials:
                jti: 0000000000311abf72f7a0ce7a303592
              strategy: jwt
              user:
                email: denethor@lotr.com
                name: Homer Simpson
                user_id: google-oauth2|105261262156475850461
            body:
              integration_id: 64bee519-818f-4473-ab08-7c380f28da77
              roles: ['owner', 'user']
            channel: https://manage.auth0.com/
            ip: 12.12.12.12
            method: post
            path: /api/v2/integrations/installed
            query: {}
            userAgent: >-
              Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36
              (KHTML, like Gecko) Chrome/1.2.3.4 Safari/537.36
          response:
            body:
              integration_id: 64bee519-818f-4473-ab08-7c380f28da77
            statusCode: 200
        ip: 12.12.12.12
        log_id: "90020230523204756343781000000000000001223372037583230452"
        type: signup_pwd_leak
        user_agent: >-
          Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML,
          like Gecko) Chrome/1.2.3.4 Safari/537.36
        user_id: google-oauth2|105261262156475850461
      log_id: "90020230523204756343781000000000000001223372037583230452"
    Name: Tenant Member Deletion
  - ExpectedResult: false
    Log:
      data:
        client_id: 1HXWWGKk1Zj3JF8GvMrnCSirccDs4qvr
        client_name: ""
        date: "2025-10-10 10:27:51.149000000"
        description: Create tenant invitations for a given client
        details:
          request:
            auth:
              credentials:
                jti: 0000000000311abf72f7a0ce7a303592
              strategy: jwt
              user:
                email: denethor@lotr.com
                name: Homer Simpson
                user_id: google-oauth2|105261262156475850461
            body:
              integration_id: 64bee519-818f-4473-ab08-7c380f28da77
              roles: ['user', 'user']
            channel: https://manage.auth0.com/
            ip: 12.12.12.12
            method: post
            path: /api/v2/integrations/installed
            query: {}
            userAgent: >-
              Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36
              (KHTML, like Gecko) Chrome/1.2.3.4 Safari/537.36
          response:
            body:
              integration_id: 64bee519-818f-4473-ab08-7c380f28da77
            statusCode: 200
        ip: 12.12.12.12
        log_id: "90020230523204756343781000000000000001223372037583230452"
        type: signup_pwd_leak
        user_agent: >-
          Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML,
          like Gecko) Chrome/1.2.3.4 Safari/537.36
        user_id: google-oauth2|105261262156475850461
      log_id: "90020230523204756343781000000000000001223372037583230452"
    Name: Other Event

# ------ paired body: auth0_delete_tenant_member.py ------

from panther_auth0_helpers import auth0_alert_context, is_auth0_config_event


def rule(event):

    data_description = event.deep_get("data", "description", default="<NO_DATA_DESCRIPTION_FOUND>")

    return all(
        [
            is_auth0_config_event(event),
            data_description == "Delete tenant member",
        ]
    )


def alert_context(event):
    return auth0_alert_context(event)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.