MongoDB access allowed from anywhere

AnalysisType: rule
Description: Atlas only allows client connections to the database deployment from entries in the project's IP access list. This rule detects when 0.0.0.0/0 is added to that list, which allows access from anywhere.
DisplayName: "MongoDB access allowed from anywhere"
Enabled: true
LogTypes:
  - MongoDB.ProjectEvent
RuleID: "MongoDB.Access.Allowed.From.Anywhere"
Filename: mongodb_access_allowed_from_anywhere.py
Severity: High
Tags:
  - MongoDB
  - Persistence
  - Remote Services
  - Modify Authentication Process - Conditional Access Policies
Reports:
  MITRE ATT&CK:
    - TA0003:T1556.009 # Modify Authentication Process - Conditional Access Policies
    - TA0008:T1021.007 # Remote Services
Reference: https://www.mongodb.com/docs/atlas/security/ip-access-list/
Runbook: Check if this activity was legitimate. If not, delete 0.0.0.0/0 from the list of allowed ips.
Tests:
  - Name: Allowed access from anywhere
    ExpectedResult: true
    Log:
      {
        "created": "2024-04-03 11:13:04.000000000",
        "currentValue": {},
        "eventTypeName": "NETWORK_PERMISSION_ENTRY_ADDED",
        "groupId": "some_group_id",
        "id": "123abc",
        "isGlobalAdmin": false,
        "remoteAddress": "1.2.3.4",
        "userId": "123abc",
        "username": "some_user@company.com",
        "whitelistEntry": "0.0.0.0/0",
      }
  - Name: Allowed access from specific ip
    ExpectedResult: false
    Log:
      {
        "created": "2024-04-03 11:13:04.000000000",
        "currentValue": {},
        "eventTypeName": "NETWORK_PERMISSION_ENTRY_ADDED",
        "groupId": "some_group_id",
        "id": "123abc",
        "isGlobalAdmin": false,
        "remoteAddress": "1.2.3.4",
        "userId": "123abc",
        "username": "some_user@company.com",
        "whitelistEntry": "1.2.3.4/32",
      }
DedupPeriodMinutes: 60
Threshold: 1


# ------ paired body: mongodb_access_allowed_from_anywhere.py ------

from panther_mongodb_helpers import mongodb_alert_context


def rule(event):
    if (
        event.get("eventTypeName", "") == "NETWORK_PERMISSION_ENTRY_ADDED"
        and event.get("whitelistEntry", "") == "0.0.0.0/0"
    ):
        return True
    return False


def title(event):
    user = event.get("username", "<USER_NOT_FOUND>")
    group_id = event.get("groupId", "<GROUP_NOT_FOUND>")
    return f"MongoDB: [{user}] has allowed access to group [{group_id}] from anywhere"


def alert_context(event):
    context = mongodb_alert_context(event)
    context["groupId"] = event.get("groupId", "<GROUP_NOT_FOUND>")
    return context