Okta API Key Created

AnalysisType: rule
Filename: okta_api_key_created.py
RuleID: "Okta.APIKeyCreated"
DisplayName: "Okta API Key Created"
Enabled: true
LogTypes:
  - Okta.SystemLog
Tags:
  - Identity & Access Management
  - Okta
  - Credential Access:Steal Application Access Token
Reports:
  MITRE ATT&CK:
    - TA0006:T1528
Severity: Info
Description: A user created an API Key in Okta
Reference: https://help.okta.com/en/prod/Content/Topics/Security/API.htm
Runbook: Reach out to the user if needed to validate the activity.
SummaryAttributes:
  - eventType
  - severity
  - displayMessage
  - p_any_ip_addresses
Tests:
  - Name: API Key Created
    ExpectedResult: true
    Log:
      {
        "uuid": "2a992f80-d1ad-4f62-900e-8c68bb72a21b",
        "published": "2021-01-08 21:28:34.875",
        "eventType": "system.api_token.create",
        "version": "0",
        "severity": "INFO",
        "legacyEventType": "api.token.create",
        "displayMessage": "Create API token",
        "actor":
          {
            "alternateId": "user@example.com",
            "displayName": "Test User",
            "id": "00u3q14ei6KUOm4Xi2p4",
            "type": "User",
          },
        "outcome": { "result": "SUCCESS" },
        "request": {},
        "debugContext": {},
        "target":
          [
            {
              "id": "00Tpki36zlWjhjQ1u2p4",
              "type": "Token",
              "alternateId": "unknown",
              "displayName": "test_key",
              "details": null,
            },
          ],
      }


# ------ paired body: okta_api_key_created.py ------

from panther_okta_helpers import okta_alert_context


def rule(event):
    return (
        event.get("eventType", None) == "system.api_token.create"
        and event.deep_get("outcome", "result") == "SUCCESS"
    )


def title(event):
    target = event.get("target", [{}])
    key_name = target[0].get("displayName", "MISSING DISPLAY NAME") if target else "MISSING TARGET"

    return (
        f"{event.deep_get('actor', 'displayName')} <{event.deep_get('actor', 'alternateId')}>"
        f"created a new API key - <{key_name}>"
    )


def alert_context(event):
    return okta_alert_context(event)