Axonius API Key Reset

AnalysisType: rule
Filename: axonius_resetapikey.py
RuleID: Axonius.ResetApiKey
DisplayName: Axonius API Key Reset
Enabled: true
LogTypes:
  - Axonius.Activity
Tags:
  - Axonius
Severity: Low
Description: Detects an Axonius API Key Reset
Runbook: Review the actions taken, check credentials/service user used and escalate.
Tests:
  - Name: API Key Reset
    ExpectedResult: True
    Log:
      {
        "event": {
          "action": "AuditAction.ResetApiKey",
          "category": "AuditCategory.Settings",
          "params": { },
          "type": "user",
          "user": "boss@axonius.com"
        },
        "source": "axonius",
        "time": 1752699243.486779
      }

# ------ paired body: axonius_resetapikey.py ------

def rule(event):
    action = event.deep_get("event", "action", default="")
    if action == "AuditAction.ResetApiKey":
        return True
    return False


def title(event):
    username = event.deep_get("event", "user", default="")
    return f"[Axonius] API Key Reset for {username} Detected"