Detection content has been deleted from Panther

AnalysisType: rule
Filename: panther_detection_deleted.py
RuleID: "Panther.Detection.Deleted"
DisplayName: "Detection content has been deleted from Panther"
Enabled: true
LogTypes:
  - Panther.Audit
Severity: Info
Tags:
  - DataModel
  - Defense Evasion:Impair Defenses
Reports:
  MITRE ATT&CK:
    - TA0005:T1562
Description: Detection content has been removed from Panther.
Runbook: Ensure this change was approved and appropriate.
Reference: https://docs.panther.com/system-configuration/panther-audit-logs/querying-and-writing-detections-for-panther-audit-logs
SummaryAttributes:
  - p_any_ip_addresses
Tests:
  - Name: Delete 1 Detection
    ExpectedResult: true
    Log:
      {
        "actionName": "DELETE_DETECTION",
        "actionParams":
          {
            "dynamic":
              { "input": { "detections": [{ "id": "GitHub.Team.Modified" }] } },
          },
        "actionResult": "SUCCEEDED",
        "actor":
          {
            "attributes":
              {
                "email": "homer@springfield.gov",
                "emailVerified": true,
                "roleId": "11111111",
              },
            "id": "1111111",
            "name": "Homer Simpson",
            "type": "USER",
          },
        "errors": null,
        "p_log_type": "Panther.Audit",
        "sourceIP": "1.2.3.4",
        "timestamp": "2022-04-28 15:30:22.42",
      }
  - Name: Delete Many Detections
    ExpectedResult: true
    Log:
      {
        "actionName": "DELETE_DETECTION",
        "actionParams":
          {
            "dynamic":
              {
                "input":
                  {
                    "detections":
                      [
                        { "id": "Github.Repo.Created" },
                        { "id": "Okta.Global.MFA.Disabled" },
                        { "id": "Okta.AdminRoleAssigned" },
                        { "id": "Okta.BruteForceLogins" },
                      ],
                  },
              },
          },
        "actionResult": "SUCCEEDED",
        "actor":
          {
            "attributes":
              {
                "email": "homer@springfield.gov",
                "emailVerified": true,
                "roleId": "111111",
              },
            "id": "1111111",
            "name": "Homer Simpson",
            "type": "USER",
          },
        "errors": null,
        "p_log_type": "Panther.Audit",
        "sourceIP": "1.2.3.4.",
        "timestamp": "2022-04-28 15:34:43.067",
      }
  - Name: Non-Delete event
    ExpectedResult: false
    Log:
      {
        "actionName": "GET_GENERAL_SETTINGS",
        "actionParams": {},
        "actionResult": "SUCCEEDED",
        "actor":
          {
            "attributes":
              {
                "email": "homer@springfield.gov",
                "emailVerified": true,
                "roleId": "111111",
              },
            "id": "111111",
            "name": "Homer Simpson",
            "type": "USER",
          },
        "errors": null,
        "p_log_type": "Panther.Audit",
      }


# ------ paired body: panther_detection_deleted.py ------

PANTHER_DETECTION_DELETE_ACTIONS = [
    "DELETE_DATA_MODEL",
    "DELETE_DETECTION",
    "DELETE_DETECTION_PACK_SOURCE",
    "DELETE_GLOBAL_HELPER",
    "DELETE_LOOKUP_TABLE",
    "DELETE_SAVED_DATA_LAKE_QUERY",
]


def rule(event):
    return (
        event.get("actionName") in PANTHER_DETECTION_DELETE_ACTIONS
        and event.get("actionResult") == "SUCCEEDED"
    )


def title(event):
    return f"Detection Content has been deleted by {event.udm('actor_user')}"


def alert_context(event):
    detections_list = event.deep_get("actionParams", "dynamic", "input", "detections")
    if detections_list is None:
        detections_list = event.deep_get("actionParams", "input", "detections", default=[])
    return {
        "deleted_detections_list": [x.get("id") for x in detections_list],
        "user": event.udm("actor_user"),
        "ip": event.udm("source_ip"),
    }