Duo Admin Bypass Code Created

AnalysisType: rule
Description: A Duo administrator created an MFA bypass code for an application.
DisplayName: "Duo Admin Bypass Code Created"
Enabled: true
Filename: duo_admin_bypass_code_created.py
Runbook: Confirm this was authorized and necessary behavior.
Reference: https://duo.com/docs/administration-users#generating-a-bypass-code
Severity: Medium
Tests:
  - ExpectedResult: true
    Log:
      action: bypass_create
      description: '{"bypass": "", "count": 1, "valid_secs": 3600, "auto_generated": true, "remaining_uses": 1, "user_id": "D12345", "bypass_code_ids": ["A12345"]}'
      isotimestamp: "2022-12-14 21:17:39"
      object: target@example.io
      timestamp: "2022-12-14 21:17:39"
      username: Homer Simpson
    Name: Bypass Create
  - ExpectedResult: false
    Log:
      action: bypass_detele
      description: '{"bypass": "", "count": 1, "valid_secs": 3600, "auto_generated": true, "remaining_uses": 1, "user_id": "D12345", "bypass_code_ids": ["A12345"]}'
      isotimestamp: "2022-12-14 21:17:39"
      object: target@example.io
      timestamp: "2022-12-14 21:17:39"
      username: Homer Simpson
    Name: Bypass Delete
DedupPeriodMinutes: 60
LogTypes:
  - Duo.Administrator
RuleID: "Duo.Admin.Bypass.Code.Created"
Threshold: 1


# ------ paired body: duo_admin_bypass_code_created.py ------

def rule(event):
    # Return True to match the log event and trigger an alert.
    return event.get("action", "") == "bypass_create"


def title(event):
    # If no 'dedup' function is defined, the return value of
    # this method will act as deduplication string.
    return (
        f"Duo: [{event.get('username', '<NO_USER_FOUND>')}] created "
        f"a MFA bypass code for [{event.get('object', '<NO_OBJECT_FOUND>')}]"
    )