OneLogin Password Access

AnalysisType: rule
Filename: onelogin_password_accessed.py
RuleID: "OneLogin.PasswordAccess"
DisplayName: "OneLogin Password Access"
Enabled: true
LogTypes:
  - OneLogin.Events
Tags:
  - OneLogin
  - Credential Access:Unsecured Credentials
Reports:
  MITRE ATT&CK:
    - TA0006:T1552
Severity: Medium
Description: >
  User accessed another user's application password
Reference: https://onelogin.service-now.com/kb_view_customer.do?sysparm_article=KB0010598
Runbook: >
  Investigate whether this was authorized access.
SummaryAttributes:
  - account_id
  - user_name
  - user_id
Tests:
  - Name: User accessed their own password
    ExpectedResult: false
    Log:
      {
        "event_type_id": "240",
        "actor_user_id": 123456,
        "actor_user_name": "Bob Cat",
        "user_id": 123456,
        "user_name": "Bob Cat",
      }
  - Name: User accessed another user's password
    ExpectedResult: true
    Log:
      {
        "event_type_id": "240",
        "actor_user_id": 654321,
        "actor_user_name": "Mountain Lion",
        "user_id": 123456,
        "user_name": "Bob Cat",
      }


# ------ paired body: onelogin_password_accessed.py ------

def rule(event):
    # Filter events; event type 240 is actor_user revealed user's app password
    if (
        str(event.get("event_type_id")) != "240"
        or not event.get("actor_user_id")
        or not event.get("user_id")
    ):
        return False

    # Determine if actor_user accessed another user's password
    return event.get("actor_user_id") != event.get("user_id")


def dedup(event):
    return event.get("actor_user_name") + ":" + event.get("app_name", "<UNKNOWN_APP>")


def title(event):
    return (
        f"A user [{event.get('actor_user_name', '<UNKNOWN_USER>')}] accessed another user's "
        f"[{event.get('user_name', '<UNKNOWN_USER>')}] "
        f"[{event.get('app_name', '<UNKNOWN_APP>')}] password"
    )