Duo Admin SSO SAML Requirement Disabled

Description

Detects when SAML Authentication for Administrators is marked as Disabled or Optional.

Query · python

from panther_duo_helpers import deserialize_administrator_log_event_description, duo_alert_context


def rule(event):
    if event.get("action") == "admin_single_sign_on_update":
        description = deserialize_administrator_log_event_description(event)
        enforcement_status = description.get("enforcement_status", "required")
        return enforcement_status != "required"
    return False


def title(event):
    description = deserialize_administrator_log_event_description(event)
    return (
        f"Duo: [{event.get('username', '<username_not_found>')}] "
        "changed SAML authentication requirements for Administrators "
        f"to [{description.get('enforcement_status', '<enforcement_status_not_found>')}]"
    )


def alert_context(event):
    return duo_alert_context(event)
Raw source Duo Admin SSO SAML Requirement Disabled · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Description: Detects when SAML Authentication for Administrators is marked as Disabled or Optional.
DisplayName: "Duo Admin SSO SAML Requirement Disabled"
Enabled: true
Filename: duo_admin_sso_saml_requirement_disabled.py
Reference: https://duo.com/docs/sso#saml:~:text=Modify%20Authentication%20Sources
Severity: Medium
Tests:
  - ExpectedResult: true
    Log:
      action: admin_single_sign_on_update
      description: '{"enforcement_status": "disabled"}'
      isotimestamp: "2021-10-12 21:29:22"
      timestamp: "2021-10-12 21:29:22"
      username: Homer Simpson
    Name: Enforcement Disabled
  - ExpectedResult: true
    Log:
      action: admin_single_sign_on_update
      description: '{"enforcement_status": "optional"}'
      isotimestamp: "2021-10-12 21:29:22"
      timestamp: "2021-10-12 21:29:22"
      username: Homer Simpson
    Name: Enforcement Optional
  - ExpectedResult: false
    Log:
      action: admin_single_sign_on_update
      description: '{"enforcement_status": "required"}'
      isotimestamp: "2021-10-12 21:29:22"
      timestamp: "2021-10-12 21:29:22"
      username: Homer Simpson
    Name: Enforcement Required
  - ExpectedResult: false
    Log:
      action: admin_single_sign_on_update
      description: '{"sso_url": "https://duff.okta.com/app/duoadminpanel/abcdefghijklm/sso/saml", "slo_url": null, "idp_type": "okta", "cert": "C=US/CN=duff/L=Springfield/O=Okta/OU=SSOProvider/ST=California/emailAddress=info@okta.com - 2031-08-10 13:39:00+00:00", "require_signed_response": true, "entity_id": "http://www.okta.com/abcdefghijk"}'
      isotimestamp: "2021-10-12 21:33:40"
      timestamp: "2021-10-12 21:33:40"
      username: Homer Simpson
    Name: SSO Update
DedupPeriodMinutes: 60
LogTypes:
  - Duo.Administrator
RuleID: "Duo.Admin.SSO.SAML.Requirement.Disabled"
Threshold: 1


# ------ paired body: duo_admin_sso_saml_requirement_disabled.py ------

from panther_duo_helpers import deserialize_administrator_log_event_description, duo_alert_context


def rule(event):
    if event.get("action") == "admin_single_sign_on_update":
        description = deserialize_administrator_log_event_description(event)
        enforcement_status = description.get("enforcement_status", "required")
        return enforcement_status != "required"
    return False


def title(event):
    description = deserialize_administrator_log_event_description(event)
    return (
        f"Duo: [{event.get('username', '<username_not_found>')}] "
        "changed SAML authentication requirements for Administrators "
        f"to [{description.get('enforcement_status', '<enforcement_status_not_found>')}]"
    )


def alert_context(event):
    return duo_alert_context(event)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.