Duo Admin App Integration Secret Key Viewed

AnalysisType: rule
Description: An administrator viewed a Secret Key for an Application Integration
DisplayName: "Duo Admin App Integration Secret Key Viewed"
Enabled: true
Filename: duo_admin_app_integration_secret_key_viewed.py
Reference: https://duo.com/docs/adminapi
Runbook: The security of your Duo application is tied to the security of your secret key (skey). Secure it as you would any sensitive credential. Don't share it with unauthorized individuals or email it to anyone under any circumstances!
Severity: Medium
Tests:
  - ExpectedResult: true
    Log:
      action: integration_skey_view
      isotimestamp: "2022-12-14 20:09:57"
      object: Example Integration Name
      timestamp: "2022-12-14 20:09:57"
      username: Homer Simpson
    Name: Generic Skey View
  - ExpectedResult: false
    Log:
      action: application_install
      isotimestamp: "2022-12-14 20:09:57"
      object: Example Integration Name
      timestamp: "2022-12-14 20:09:57"
      username: Homer Simpson
    Name: "Duo app install "
DedupPeriodMinutes: 60
LogTypes:
  - Duo.Administrator
RuleID: "Duo.Admin.App.Integration.Secret.Key.Viewed"
Threshold: 1


# ------ paired body: duo_admin_app_integration_secret_key_viewed.py ------

def rule(event):
    # Return True to match the log event and trigger an alert.
    return event.get("action", "") == "integration_skey_view"


def title(event):
    # If no 'dedup' function is defined, the return value of
    # this method will act as deduplication string.
    return (
        f"'Duo: [{event.get('username', '<NO_USER_FOUND>')}] viewed "
        f"the Secret Key for Application [{event.get('object', '<NO_OBJECT_FOUND>')}]"
    )