Box Shield Detected Anomalous Download Activity

AnalysisType: rule
Filename: box_anomalous_download.py
RuleID: "Box.Shield.Anomalous.Download"
DisplayName: "Box Shield Detected Anomalous Download Activity"
Enabled: true
LogTypes:
  - Box.Event
Tags:
  - Box
  - Exfiltration:Exfiltration Over Web Service
Reports:
  MITRE ATT&CK:
    - TA0010:T1567
Severity: High
Description: >
  A user's download activity has altered significantly.
Reference: https://developer.box.com/guides/events/shield-alert-events/
Runbook: >
  Investigate whether this was triggered by expected user download activity.
SummaryAttributes:
  - event_type
  - ip_address
Tests:
  - Name: Regular Event
    ExpectedResult: false
    Log:
      {
        "type": "event",
        "additional_details": { '"key": "value"' },
        "created_by":
          {
            "id": "12345678",
            "type": "user",
            "login": "cat@example",
            "name": "Bob Cat",
          },
        "event_type": "DELETE",
      }
  - Name: Anomalous Download Event
    ExpectedResult: true
    Log:
      {
        "type": "event",
        "additional_details": '{"shield_alert":{"rule_category":"Anomalous Download","risk_score":77,"alert_summary":{"description":"Significant increase in download content week over week, 9999% (50.00 MB) more than last week."}}}',
        "created_by":
          {
            "id": "12345678",
            "type": "user",
            "login": "bob@example",
            "name": "Bob Cat",
          },
        "event_type": "SHIELD_ALERT",
        "source":
          {
            "id": "12345678",
            "type": "user",
            "login": "bob@example",
            "name": "Bob Cat",
          },
      }


# ------ paired body: box_anomalous_download.py ------

from panther_base_helpers import deep_get
from panther_box_helpers import box_parse_additional_details


def rule(event):
    if event.get("event_type") != "SHIELD_ALERT":
        return False
    alert_details = box_parse_additional_details(event).get("shield_alert", {})
    if alert_details.get("rule_category", "") == "Anomalous Download":
        if alert_details.get("risk_score", 0) > 50:
            return True
    return False


def title(event):
    details = box_parse_additional_details(event)
    description = deep_get(details, "shield_alert", "alert_summary", "description")

    if description:
        return description
    return (
        f"Anomalous download activity triggered by user "
        f"[{event.deep_get('created_by', 'name', default='<UNKNOWN_USER>')}]."
    )