Notion SCIM Token Generated

AnalysisType: rule
Filename: notion_scim_token_generated.py
RuleID: "Notion.Workspace.SCIM.Token.Generated"
DisplayName: "Notion SCIM Token Generated"
Enabled: true
LogTypes:
  - Notion.AuditLogs
Tags:
  - Notion
  - Application Security
  - Supply Chain Attack
Description: A Notion User generated a SCIM token.
Severity: Medium
DedupPeriodMinutes: 60
Threshold: 1
Runbook: Possible Initial Access. Follow up with the Notion User to determine if this was done for a valid business reason.
Reference: https://www.notion.so/help/provision-users-and-groups-with-scim
Tests:
  - ExpectedResult: false
    Log:
      {
        "event":
          {
            "id": "...",
            "timestamp": "2023-06-02T20:16:41.217Z",
            "workspace_id": "123",
            "actor":
              {
                "id": "..",
                "object": "user",
                "type": "person",
                "person": { "email": "homer.simpson@yourcompany.io" },
              },
            "ip_address": "...",
            "platform": "mac-desktop",
            "type": "workspace.content_exported",
            "workspace.content_exported": {},
          },
      }
    Name: other event
  - ExpectedResult: true
    Log:
      {
        "event":
          {
            "id": "...",
            "timestamp": "2023-06-02T20:21:01.873Z",
            "workspace_id": "123",
            "actor":
              {
                "id": "..",
                "object": "user",
                "type": "person",
                "person": { "email": "homer.simpson@yourcompany.com" },
              },
            "ip_address": "...",
            "platform": "mac-desktop",
            "type": "workspace.scim_token_generated",
            "workspace.scim_token_generated": {},
          },
      }
    Name: Token Generated


# ------ paired body: notion_scim_token_generated.py ------

from panther_notion_helpers import notion_alert_context


def rule(event):

    event_type = event.deep_get("event", "type", default="<NO_EVENT_TYPE_FOUND>")
    return event_type == "workspace.scim_token_generated"


def title(event):
    user = event.deep_get("event", "actor", "person", "email", default="<NO_USER_FOUND>")
    workspace_id = event.deep_get("event", "workspace_id", default="<NO_WORKSPACE_ID_FOUND>")
    return f"Notion User [{user}] generated a SCIM token for workspace id [{workspace_id}]."


def alert_context(event):
    return notion_alert_context(event)