Axonius Webhook Created

AnalysisType: rule
Filename: axonius_webhook_created.py
RuleID: Axonius.WebhookCreated
DisplayName: Axonius Webhook Created
Enabled: true
LogTypes:
  - Axonius.Activity
Tags:
  - Axonius
Severity: Low
Description: Detects when an Axonius Webhook is Created
Runbook: Review if the webhook is approved and appropriate
Tests:
  - Name: Webhook Created
    ExpectedResult: True
    Log:
      {
        "event": {
          "action": "AuditAction.Put",
          "category": "AuditCategory.WebhookManagement",
          "params": {
            "config_id": "66db3fc88a93f66a4da0f084",
            "vendor_name": "Okta"
          },
          "type": "user",
          "user": "admin@axonius.com"
        },
        "source": "axonius",
        "time": 1745944321.285849
      }

# ------ paired body: axonius_webhook_created.py ------

def rule(event):
    action = event.deep_get("event", "action", default="")
    category = event.deep_get("event", "category", default="")
    if action == "AuditAction.Put" and category == "AuditCategory.WebhookManagement":
        return True
    return False


def title(event):
    username = event.deep_get("event", "user", default="")
    return f"[Axonius] API Key Reset for {username} Detected"


def alert_context(event):
    username = event.deep_get("event", "user", default="")
    config_id = event.deep_get("event", "params", "config_id", default="")
    vendor_name = event.deep_get("event", "params", "vendor_name", default="")
    event_type = event.deep_get("event", "type", default="")

    context = {
        "username": username,
        "config_id": config_id,
        "vendor_name": vendor_name,
        "type": event_type,
    }
    return context