MongoDB security alerts disabled or deleted

AnalysisType: rule
Description:
  MongoDB provides security alerting policies for notifying admins when certain conditions are met.
  This rule detects when these policies are disabled or deleted.
DisplayName: "MongoDB security alerts disabled or deleted"
Enabled: true
LogTypes:
  - MongoDB.OrganizationEvent
RuleID: "MongoDB.Alerting.Disabled.Or.Deleted"
Filename: mongodb_alerting_disabled.py
Severity: High
Reports:
  MITRE ATT&CK:
    - TA0005:T1562.001 # Impair Defenses: Disable or Modify Tools
Reference: https://www.mongodb.com/docs/atlas/configure-alerts/
Runbook: Re-enable security alerts
Tests:
  - Name: Alert added
    ExpectedResult: false
    Log:
      {
        "alertConfigId": "alert_id",
        "created": "2024-04-01 11:57:54.000000000",
        "currentValue": {},
        "eventTypeName": "ALERT_CONFIG_ADDED_AUDIT",
        "id": "alert_id",
        "isGlobalAdmin": false,
        "links": [],
        "orgId": "some_org_id",
        "remoteAddress": "1.2.3.4",
        "userId": "user_id",
        "username": "some_user@company.com",
      }
  - Name: Alert deleted
    ExpectedResult: true
    Log:
      {
        "alertConfigId": "alert_id",
        "created": "2024-04-01 11:58:52.000000000",
        "currentValue": {},
        "eventTypeName": "ALERT_CONFIG_DELETED_AUDIT",
        "id": "alert_id",
        "isGlobalAdmin": false,
        "links": [],
        "orgId": "some_org_id",
        "remoteAddress": "1.2.3.4",
        "userId": "user_id",
        "username": "some_user@company.com",
      }
DedupPeriodMinutes: 60
Threshold: 1


# ------ paired body: mongodb_alerting_disabled.py ------

from panther_mongodb_helpers import mongodb_alert_context


def rule(event):
    return event.get("eventTypeName", "") in [
        "ALERT_CONFIG_DISABLED_AUDIT",
        "ALERT_CONFIG_DELETED_AUDIT",
    ]


def title(event):
    user = event.get("username", "<USER_NOT_FOUND>")
    alert_id = event.get("alertConfigId", "<ALERT_NOT_FOUND>")
    return f"MongoDB: [{user}] has disabled or deleted security alert [{alert_id}]"


def alert_context(event):
    context = mongodb_alert_context(event)
    context["alertConfigId"] = event.get("alertConfigId", "<ALERT_NOT_FOUND>")
    return context