OneLogin Multiple Accounts Deleted

AnalysisType: rule
Filename: onelogin_threshold_accounts_deleted.py
RuleID: "OneLogin.ThresholdAccountsDeleted"
DisplayName: "OneLogin Multiple Accounts Deleted"
Enabled: true
LogTypes:
  - OneLogin.Events
Tags:
  - OneLogin
  - Impact:Account Access Removal
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0040:T1531
Description: >
  Possible Denial of Service detected. Threshold for user account deletions exceeded.
Threshold: 10
DedupPeriodMinutes: 10
Reference: https://en.wikipedia.org/wiki/Denial-of-service_attack
Runbook: Determine if this is normal user-cleanup activity.
SummaryAttributes:
  - account_id
  - user_name
  - user_id
Tests:
  - Name: Normal User Activated Event
    ExpectedResult: false
    Log:
      {
        "event_type_id": "16",
        "actor_user_id": 654321,
        "actor_user_name": " Lion",
        "user_id": 123456,
        "user_name": "Bob Cat",
      }
  - Name: User Account Delete Event
    ExpectedResult: true
    Log:
      {
        "event_type_id": "17",
        "actor_user_id": 654321,
        "actor_user_name": " Lion",
        "user_id": 123456,
        "user_name": "Bob Cat",
      }


# ------ paired body: onelogin_threshold_accounts_deleted.py ------

def rule(event):
    # filter events; event type 17 is a user deleted
    return str(event.get("event_type_id")) == "17"


def title(event):
    return (
        f"User [{event.get('actor_user_name', '<UNKNOWN_USER>')}] "
        f"has exceeded the user account deletion threshold"
    )