OneLogin Active Login Activity

AnalysisType: rule
Filename: onelogin_active_login_activity.py
RuleID: "OneLogin.ActiveLoginActivity"
DisplayName: "OneLogin Active Login Activity"
Enabled: true
LogTypes:
  - OneLogin.Events
Tags:
  - OneLogin
  - Lateral Movement:Use Alternate Authentication Material
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0008:T1550
Threshold: 3
DedupPeriodMinutes: 720
Description: Multiple user accounts logged in from the same ip address.
Reference: https://support.onelogin.com/kb/4271392/user-policies
Runbook: Investigate whether multiple user's logging in from the same ip address is expected. Determine if this ip address should be added to the SHARED_IP_SPACE array.
SummaryAttributes:
  - account_id
  - user_name
  - user_id
Tests:
  - Name: Login Event - Counts Toward Threshold
    ExpectedResult: true
    Log:
      {
        "event_type_id": "5",
        "actor_user_id": 123456,
        "actor_user_name": "Bob Cat",
        "user_id": 123456,
        "user_name": "Bob Cat",
        "ipaddr": "203.0.113.55",
      }
  - Name: Non-Login Event Type - No Match
    ExpectedResult: false
    Log:
      {
        "event_type_id": "6",
        "actor_user_id": 123456,
        "actor_user_name": "Bob Cat",
        "user_id": 123456,
        "user_name": "Bob Cat",
      }
  - Name: Shared IP Login Event - No Match
    ExpectedResult: false
    Log:
      {
        "event_type_id": "5",
        "actor_user_id": 123456,
        "actor_user_name": "Bob Cat",
        "user_id": 123456,
        "user_name": "Bob Cat",
        "ipaddr": "192.168.1.1",
      }


# ------ paired body: onelogin_active_login_activity.py ------

from panther_base_helpers import is_ip_in_network

# Safelist for IP Subnets to ignore in this ruleset
# Each entry in the list should be in CIDR notation
# This should include any source ip addresses
# that are shared among users such as:
# proxy servers, the public corporate ip space,
# scanner ips etc
SHARED_IP_SPACE = [
    "192.168.0.0/16",
]


def rule(event):
    # Pre-filter: event_type_id = 5 is login events.
    if (
        str(event.get("event_type_id")) != "5"
        or not event.get("ipaddr")
        or not event.get("user_id")
    ):
        return False
    # We expect to see multiple user logins from these shared, common ip addresses
    if is_ip_in_network(event.get("ipaddr"), SHARED_IP_SPACE):
        return False
    return True


def unique(event):
    return str(event.get("user_id", ""))


def dedup(event):
    return event.get("ipaddr", "<UNKNOWN_IP>")


def title(event):
    return (
        f"Unusual logins in OneLogin for multiple users from ip "
        f"[{event.get('ipaddr', '<UNKNOWN_IP>')}]"
    )