Auth0 Post Login Action Flow Updated

Description

An Auth0 User updated a post login action flow for your organization's tenant.

Query · python

from panther_auth0_helpers import auth0_alert_context, is_auth0_config_event
from panther_base_helpers import deep_get


def rule(event):

    data_description = event.deep_get("data", "description", default="<NO_DATA_DESCRIPTION_FOUND>")
    request_path = event.deep_get(
        "data", "details", "request", "path", default="<NO_REQUEST_PATH_FOUND>"
    )

    return all(
        [
            data_description == "Update trigger bindings",
            request_path == "/api/v2/actions/triggers/post-login/bindings",
            is_auth0_config_event(event),
        ]
    )


def title(event):
    user = event.deep_get(
        "data", "details", "request", "auth", "user", "email", default="<NO_USER_FOUND>"
    )
    p_source_label = event.get("p_source_label", "<NO_P_SOURCE_LABEL_FOUND>")
    request_bindings = event.deep_get("data", "details", "request", "body", "bindings", default=[])
    response_bindings = event.deep_get(
        "data", "details", "response", "body", "bindings", default=[]
    )

    actions_added_list = []
    for binding in request_bindings:
        if "display_name" in binding:
            # check to see if actions were added to the flow
            actions_added_list.append(binding.get("display_name", ""))

    # otherwise, actions were removed from the action flow and we want
    # to grab what's still present in the flow
    actions_remaining_list = []
    for binding in response_bindings:
        if deep_get(binding, "display_name"):
            actions_remaining_list.append(
                deep_get(binding, "display_name", default="<NO_DISPLAYNAME>")
            )

    if actions_added_list:
        return (
            f"Auth0 User [{user}] added action(s) [{actions_added_list}] to a post-login action "
            f"flow for your organization’s tenant [{p_source_label}]."
        )

    if actions_remaining_list:
        return (
            f"Auth0 User [{user}] removed action(s) "
            f"to a post-login action flow for your organization’s tenant [{p_source_label}], "
            f"remaining actions include [{actions_remaining_list}]."
        )

    # no actions remain in the flow
    return (
        f"Auth0 User [{user}] removed all actions "
        f"from a post-login action flow for your organization’s tenant [{p_source_label}]."
    )


def alert_context(event):
    return auth0_alert_context(event)

Analyst notes

Assess if this was done by the user for a valid business reason. Be sure to replace any steps that were removed without authorization.

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: Medium
Status: Stable
Query type: python
Created: 2023-06-23
Modified: 2024-04-02
Authored by: panther-labs
Source ID
Upstream: rules/auth0_rules/auth0_post_login_action_flow.yml
Type: rule
Version: 1
References: https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow/api-object
Data sources: Auth0.Events

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.