OneLogin Authentication Factor Removed

AnalysisType: rule
Filename: onelogin_remove_authentication_factor.py
RuleID: "OneLogin.AuthFactorRemoved"
DisplayName: "OneLogin Authentication Factor Removed"
Enabled: true
LogTypes:
  - OneLogin.Events
Tags:
  - OneLogin
  - Identity & Access Management
  - Defense Evasion:Modify Authentication Process
Reports:
  MITRE ATT&CK:
    - TA0005:T1556
Severity: Low
Description: >
  A user removed an authentication factor or otp device.
Reference: https://onelogin.service-now.com/kb_view_customer.do?sysparm_article=KB0010426
Runbook: >
  Investigate whether this was an intentional action and if other multifactor devices exist.
SummaryAttributes:
  - account_id
  - event_type_id
  - user_name
  - user_id
  - authentication_factor_description
  - otp_device_name
Tests:
  - Name: User removed an auth factor
    LogType: OneLogin.Events
    ExpectedResult: true
    Log:
      {
        "event_type_id": "172",
        "actor_user_id": 123456,
        "actor_user_name": "Bob Cat",
        "user_id": 123456,
        "user_name": "Bob Cat",
        "authentication_factor_description": "2FA Name",
      }
  - Name: User deactivated an otp deice
    LogType: OneLogin.Events
    ExpectedResult: true
    Log:
      {
        "event_type_id": "24",
        "actor_user_id": 123456,
        "actor_user_name": "Bob Cat",
        "user_id": 123456,
        "user_name": "Bob Cat",
        "otp_device_name": "2FA Name",
      }


# ------ paired body: onelogin_remove_authentication_factor.py ------

def rule(event):
    # verify this is a auth factor being removed
    # event id 24 is otp device deregistration
    # event id 172 is a user deleted an authentication factor
    return str(event.get("event_type_id")) == "24" or str(event.get("event_type_id")) == "172"


def dedup(event):
    return event.get("user_name", "<UNKNOWN_USER>")


def title(event):
    if str(event.get("event_type_id")) == "172":
        return (
            f"A user [{event.get('user_name', '<UNKNOWN_USER>')}] removed an authentication "
            f"factor [{event.get('authentication_factor_description', '<UNKNOWN_AUTH_FACTOR>')}]"
        )
    return (
        f"A user [{event.get('user_name', '<UNKNOWN_USER>')}] deactivated an otp device "
        f"[{event.get('otp_device_name', '<UNKNOWN_OTP_DEVICE>'),}]"
    )