Netskope Many Unauthorized API Calls

AnalysisType: rule
RuleID: "Netskope.UnauthorizedAPICalls"
DisplayName: "Netskope Many Unauthorized API Calls"
Enabled: true
Filename: netskope_unauthorized_api_calls.py
LogTypes:
  - Netskope.Audit
Tags:
  - Netskope
  - Configuration Required # configure threshold for your environment
  - Brute Force
Reports:
  MITRE ATT&CK:
    - TA0006:T1110
Severity: High
Description: Many unauthorized API calls were observed for a user in a short period of time.
DedupPeriodMinutes: 60
Threshold: 10
Runbook: An account is making many unauthorized API calls.  This could indicate brute force activity, or expired service account credentials.
Reference: https://docs.netskope.com/en/netskope-help/data-security/netskope-private-access/private-access-rest-apis/
Tests:
  - Name: True positive
    ExpectedResult: true
    Log:
      {
        "_id": "1e589befa3da30132362f32a",
        "_insertion_epoch_timestamp": 1702318213,
        "audit_log_event": "Rest API V2 Call",
        "count": 1,
        "is_netskope_personnel": false,
        "organization_unit": "",
        "severity_level": 2,
        "supporting_data":
          {
            "data_type": "incidents",
            "data_values":
              [
                403,
                "POST",
                "/api/v2/incidents/uba/getuci",
                "trid=ccb898fgrhvdd0v0lebg",
              ],
          },
        "timestamp": "2023-12-11 18:10:13.000000000",
        "type": "admin_audit_logs",
        "ur_normalized": "service-account",
        "user": "service-account",
      }
  - Name: True negative
    ExpectedResult: false
    Log:
      {
        "_id": "1e589befa3da30132362f32a",
        "_insertion_epoch_timestamp": 1702318213,
        "audit_log_event": "Rest API V2 Call",
        "count": 1,
        "is_netskope_personnel": false,
        "organization_unit": "",
        "severity_level": 2,
        "supporting_data":
          {
            "data_type": "incidents",
            "data_values":
              [
                200,
                "POST",
                "/api/v2/incidents/uba/getuci",
                "trid=ccb898fgrhvdd0v0lebg",
              ],
          },
        "timestamp": "2023-12-11 18:10:13.000000000",
        "type": "admin_audit_logs",
        "ur_normalized": "service-account",
        "user": "service-account",
      }


# ------ paired body: netskope_unauthorized_api_calls.py ------

def rule(event):
    data_values = event.deep_walk("supporting_data", "data_values")
    if data_values and data_values[0] == 403:
        return True
    return False


def title(event):
    user = event.get("user", "<USER_NOT_FOUND>")
    return f"Many unauthorized API calls from user [{user}]"