OneLogin Unauthorized Access

AnalysisType: rule
Filename: onelogin_unauthorized_access.py
RuleID: "OneLogin.UnauthorizedAccess"
DisplayName: "OneLogin Unauthorized Access"
Enabled: true
LogTypes:
  - OneLogin.Events
Tags:
  - OneLogin
  - Lateral Movement:Use Alternate Authentication Material
Reports:
  MITRE ATT&CK:
    - TA0008:T1550
Severity: Medium
Description: A OneLogin user was denied access to an app more times than the configured threshold.
Threshold: 10
DedupPeriodMinutes: 10
Reference: https://onelogin.service-now.com/kb_view_customer.do?sysparm_article=KB0010420
Runbook: Analyze the user activity and actions.
SummaryAttributes:
  - account_id
  - user_name
  - user_id
  - app_name
Tests:
  - Name: Normal Event
    ExpectedResult: false
    Log:
      {
        "event_type_id": "8",
        "user_id": 123456,
        "user_name": "Bob Cat",
        "app_name": "confluence",
      }
  - Name: User Unauthorized Access Event
    ExpectedResult: true
    Log:
      {
        "event_type_id": "90",
        "user_id": 123456,
        "user_name": "Bob Cat",
        "app_name": "confluence",
      }


# ------ paired body: onelogin_unauthorized_access.py ------

def rule(event):
    # filter events; event type 90 is an unauthorized application access event id
    return str(event.get("event_type_id")) == "90"


def title(event):
    return (
        f"User [{event.get('user_name', '<UNKNOWN_USER>')}] has exceeded the unauthorized "
        f"application access attempt threshold"
    )