Axonius External User Added

AnalysisType: rule
Filename: axonius_add_external_user.py
RuleID: Axonius.AddExternalUser
DisplayName: Axonius External User Added
Enabled: true
LogTypes:
  - Axonius.Activity
Tags:
  - Axonius
Severity: Low
Description: Detects when an external user is added in Axonius
Runbook: Review if the external user is authorized
Tests:
  - Name: External User Created
    ExpectedResult: True
    Log:
      {
        "event": {
          "action": "AuditAction.AddExternalUser",
          "category": "AuditCategory.UserManagement",
          "params": {
            "source": "SAM-XYX",
            "user_name": "external-user@axonius.com"
          },
          "type": "info"
        },
        "source": "axonius",
        "time": 1747795144.253623
      }

# ------ paired body: axonius_add_external_user.py ------

def rule(event):
    action = event.deep_get("event", "action", default="")
    category = event.deep_get("event", "category", default="")
    if action == "AuditAction.AddExternalUser" and category == "AuditCategory.UserManagement":
        return True
    return False


def title(event):
    username = event.deep_get("event", "params", "user_name", default="")
    source = event.deep_get("event", "params", "source", default="")
    return f"[Axonius] External User {username} added from {source}"


def alert_context(event):
    username = event.deep_get("event", "params", "user_name", default="")
    source = event.deep_get("event", "params", "source", default="")
    context = {
        "username": username,
        "source": source,
    }
    return context