OneLogin User Password Changed

AnalysisType: rule
Filename: onelogin_password_changed.py
RuleID: "OneLogin.PasswordChanged"
DisplayName: "OneLogin User Password Changed"
Enabled: true
LogTypes:
  - OneLogin.Events
Tags:
  - OneLogin
  - Identity & Access Management
Severity: Info
Description: >
  A user password was updated.
Reference: https://onelogin.service-now.com/kb_view_customer.do?sysparm_article=KB0010510
Runbook: >
  Investigate whether this was an authorized action.
SummaryAttributes:
  - account_id
  - user_name
  - user_id
Tests:
  - Name: User changed their password
    ExpectedResult: true
    Log:
      {
        "event_type_id": "11",
        "actor_user_id": 123456,
        "actor_user_name": "Bob Cat",
        "user_id": 123456,
        "user_name": "Bob Cat",
      }
  - Name: User changed another's password
    ExpectedResult: true
    Log:
      {
        "event_type_id": "11",
        "actor_user_id": 654321,
        "actor_user_name": "Mountain Lion",
        "user_id": 123456,
        "user_name": "Bob Cat",
      }
  - Name: Admin user changed another's password
    ExpectedResult: false
    Log:
      {
        "event_type_id": "211",
        "actor_user_id": 654321,
        "actor_user_name": "Mountain Lion",
        "user_id": 123456,
        "user_name": "Bob Cat",
      }


# ------ paired body: onelogin_password_changed.py ------

def rule(event):
    # check that this is a password change event;
    # event id 11 is actor_user changed password for user
    # Normally, admin's may change a user's password (event id 211)
    return str(event.get("event_type_id")) == "11"


def title(event):
    return (
        f"A user [{event.get('user_name', '<UNKNOWN_USER>')}] password changed by user "
        f"[{event.get('actor_user_name', '<UNKNOWN_USER>')}]"
    )