AnalysisType: rule
Filename: push_security_app_banner_acknowledged.py
RuleID: "Push.Security.App.Banner.Acknowledged"
DisplayName: "Push Security App Banner Acknowledged"
Enabled: true
LogTypes:
- PushSecurity.Activity
Severity: Low
DedupPeriodMinutes: 60
Threshold: 1
Tests:
- Name: App Banner Acknowledged
ExpectedResult: true
Log:
id: c478966c-f927-411c-b919-179832d3d50c
new:
action: ACKNOWLEDGED
appBanner:
buttonText: Proceed anyway
mode: ACKNOWLEDGE
subtext: This app is not approved, please use Google Drive instead.
title: This app is not approved for use
appType: DROPBOX
browser: CHROME
employee:
chatopsEnabled: true
creationTimestamp: 1.698669223e+09
department: Security Engineering
email: john.hill@example.com
firstName: John
id: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0
lastName: Hill
licensed: true
location: New York
os: WINDOWS
sourceIpAddress: 8.158.25.38
userAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299
object: APP_BANNER
timestamp: 1.698604061e+09
version: "1"
- Name: App Banner Displayed
ExpectedResult: false
Log:
id: c478966c-f927-411c-b919-179832d3d50c
new:
action: DISPLAYED
appBanner:
buttonText: Proceed anyway
mode: ACKNOWLEDGE
subtext: This app is not approved, please use Google Drive instead.
title: This app is not approved for use
appType: DROPBOX
browser: CHROME
employee:
chatopsEnabled: true
creationTimestamp: 1.698669223e+09
department: Security Engineering
email: john.hill@example.com
firstName: John
id: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0
lastName: Hill
licensed: true
location: New York
os: WINDOWS
sourceIpAddress: 8.158.25.38
userAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299
object: APP_BANNER
timestamp: 1.698604061e+09
version: "1"
- Name: App Banner Inform Mode
ExpectedResult: false
Log:
id: c478966c-f927-411c-b919-179832d3d50c
new:
action: DISPLAYED
appBanner:
buttonText: null
mode: INFORM
subtext: This app is not approved, please use Google Drive instead.
title: This app is not approved for use
appType: DROPBOX
browser: CHROME
employee:
chatopsEnabled: true
creationTimestamp: 1.698669223e+09
department: Security Engineering
email: john.hill@example.com
firstName: John
id: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0
lastName: Hill
licensed: true
location: New York
os: WINDOWS
sourceIpAddress: 8.158.25.38
userAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Edge/16.16299
object: APP_BANNER
timestamp: 1.698604061e+09
version: "1"
# ------ paired body: push_security_app_banner_acknowledged.py ------
def rule(event):
if event.get("object") != "APP_BANNER":
return False
if event.deep_get("new", "action") == "ACKNOWLEDGED":
return True
return False
def title(event):
app_type = event.deep_get("new", "appType")
employee_email = event.deep_get("new", "employee", "email")
return f"{app_type} accessed by {employee_email}"
def alert_context(event):
return {
"Push Security app banner": event.deep_get("new", "appBanner", "mode"),
"Title": event.deep_get("new", "appBanner", "title"),
"Subtext": event.deep_get("new", "appBanner", "subtext"),
"Button": event.deep_get("new", "appBanner", "buttonText"),
}