OneLogin User Locked

AnalysisType: rule
Filename: onelogin_user_account_locked.py
RuleID: "OneLogin.UserAccountLocked"
DisplayName: "OneLogin User Locked"
Enabled: true
LogTypes:
  - OneLogin.Events
Tags:
  - OneLogin
  - Credential Access:Brute Force
Reports:
  MITRE ATT&CK:
    - TA0006:T1110
Severity: Low
Description: >
  User locked or suspended from their account.
Reference: https://onelogin.service-now.com/kb_view_customer.do?sysparm_article=KB0010420
Runbook: >
  Investigate whether this was caused by expected action.
SummaryAttributes:
  - account_id
  - event_type_id
  - user_name
  - user_id
Tests:
  - Name: User account locked via api - first method.
    ExpectedResult: true
    Log:
      {
        "event_type_id": "531",
        "actor_user_id": 123456,
        "actor_user_name": "Bob Cat",
        "user_id": 123456,
        "user_name": "Bob Cat",
      }
  - Name: User account locked via api - second method.
    ExpectedResult: true
    Log:
      {
        "event_type_id": "553",
        "actor_user_id": 654321,
        "actor_user_name": "Mountain Lion",
        "user_id": 123456,
        "user_name": "Bob Cat",
      }
  - Name: User account suspended via api.
    ExpectedResult: true
    Log:
      {
        "event_type_id": "551",
        "actor_user_id": 654321,
        "actor_user_name": "Mountain Lion",
        "user_id": 123456,
        "user_name": "Bob Cat",
      }
  - Name: Normal User Activated Event
    ExpectedResult: false
    Log:
      {
        "event_type_id": "11",
        "actor_user_id": 654321,
        "actor_user_name": "Mountain Lion",
        "user_id": 123456,
        "user_name": "Bob Cat",
      }


# ------ paired body: onelogin_user_account_locked.py ------

def rule(event):
    # check for a user locked event
    # event 531 and 553 are user lock events via api
    # event 551 is user suspended via api
    return str(event.get("event_type_id")) in ["531", "553", "551"]


def title(event):
    return (
        f"A user [{event.get('user_name', '<UNKNOWN_USER>')}] was locked or suspended via api call"
    )