Panther SAML configuration has been modified

AnalysisType: rule
Filename: panther_saml_modified.py
RuleID: "Panther.SAML.Modified"
DisplayName: "Panther SAML configuration has been modified"
Enabled: true
LogTypes:
  - Panther.Audit
Severity: High
Tags:
  - DataModel
  - Defense Evasion:Impair Defenses
Reports:
  MITRE ATT&CK:
    - TA0005:T1562
Description: An Admin has modified Panther's SAML configuration.
Runbook: Ensure this change was approved and appropriate.
Reference: https://docs.panther.com/system-configuration/saml
SummaryAttributes:
  - p_any_ip_addresses
  - p_any_usernames
Tests:
  - Name: SAML config modified
    ExpectedResult: True
    Log:
      {
        "actionName": "UPDATE_SAML_SETTINGS",
        "actionParams": {},
        "actionResult": "SUCCEEDED",
        "actor":
          {
            "attributes":
              {
                "email": "homer@springfield.gov",
                "emailVerified": true,
                "roleId": "111111",
              },
            "id": "111111",
            "name": "Homer Simpson",
            "type": "USER",
          },
        "errors": null,
        "p_log_type": "Panther.Audit",
      }
  - Name: SAML config viewed
    ExpectedResult: false
    Log:
      {
        "actionName": "GET_SAML_SETTINGS",
        "actionParams": {},
        "actionResult": "SUCCEEDED",
        "actor":
          {
            "attributes":
              {
                "email": "homer@springfield.gov",
                "emailVerified": true,
                "roleId": "111111",
              },
            "id": "111111",
            "name": "Homer Simpson",
            "type": "USER",
          },
        "errors": null,
        "p_log_type": "Panther.Audit",
      }


# ------ paired body: panther_saml_modified.py ------

def rule(event):
    return (
        event.get("actionName") == "UPDATE_SAML_SETTINGS"
        and event.get("actionResult") == "SUCCEEDED"
    )


def title(event):
    return f"Panther SAML config has been modified by {event.udm('actor_user')}"


def alert_context(event):
    return {
        "user": event.udm("actor_user"),
        "ip": event.udm("source_ip"),
    }