OneLogin Multiple Accounts Modified

AnalysisType: rule
Filename: onelogin_threshold_accounts_modified.py
RuleID: "OneLogin.ThresholdAccountsModified"
DisplayName: "OneLogin Multiple Accounts Modified"
Enabled: true
LogTypes:
  - OneLogin.Events
Tags:
  - OneLogin
  - Impact:Account Access Removal
Severity: Medium
Reports:
  MITRE ATT&CK:
    - TA0040:T1531
Description: >
  Possible Denial of Service detected. Threshold for user account password changes exceeded.
Threshold: 10
DedupPeriodMinutes: 10
Reference: https://en.wikipedia.org/wiki/Denial-of-service_attack
Runbook: Determine if this is normal user-cleanup activity.
SummaryAttributes:
  - account_id
  - user_name
  - user_id
Tests:
  - Name: Normal User Activated Event
    ExpectedResult: false
    Log:
      {
        "event_type_id": "16",
        "actor_user_id": 654321,
        "actor_user_name": "Mountain Lion",
        "user_id": 123456,
        "user_name": "Bob Cat",
      }
  - Name: User Password Changed Event
    ExpectedResult: true
    Log:
      {
        "event_type_id": "11",
        "actor_user_id": 654321,
        "actor_user_name": "Mountain Lion",
        "user_id": 123456,
        "user_name": "Bob Cat",
      }


# ------ paired body: onelogin_threshold_accounts_modified.py ------

def rule(event):
    # filter events; event type 11 is an actor_user changed user password
    return str(event.get("event_type_id")) == "11"


def title(event):
    return (
        f"User [{event.get('actor_user_name', '<UNKNOWN_USER>')}] has exceeded the user"
        f" account password change threshold"
    )