Duo Admin MFA Restrictions Updated

AnalysisType: rule
Description: Detects changes to allowed MFA factors administrators can use to log into the admin panel.
DisplayName: "Duo Admin MFA Restrictions Updated"
Enabled: true
Filename: duo_admin_mfa_restrictions_updated.py
Reference: https://duo.com/docs/essentials-overview
Severity: Medium
Tests:
  - ExpectedResult: true
    Log:
      action: update_admin_factor_restrictions
      description: '{"allowed_factors": "Duo mobile passcodes, Hardware tokens, Duo push, Yubikey aes"}'
      isotimestamp: "2022-02-21 21:48:06"
      timestamp: "2022-02-21 21:48:06"
      username: Homer Simpson
    Name: Admin MFA Update Event
  - ExpectedResult: false
    Log:
      action: admin_login
      description: '{"ip_address": "1.2.3.4", "device": "123-456-789", "factor": "sms", "saml_idp": "OneLogin", "primary_auth_method": "Single Sign-On"}'
      isotimestamp: "2021-06-30 19:45:37"
      timestamp: "2021-06-30 19:45:37"
      username: Homer Simpson
    Name: Login Event
DedupPeriodMinutes: 60
LogTypes:
  - Duo.Administrator
RuleID: "Duo.Admin.MFA.Restrictions.Updated"
Threshold: 1


# ------ paired body: duo_admin_mfa_restrictions_updated.py ------

from panther_duo_helpers import duo_alert_context


def rule(event):
    return event.get("action") == "update_admin_factor_restrictions"


def title(event):
    return "Duo Admin MFA Restrictions Updated " f"by [{event.get('username','<user_not_found>')}]"


def alert_context(event):
    return duo_alert_context(event)