Push Security New SaaS Account Created

Query · python

def rule(event):
    if event.get("object") != "ACCOUNT":
        return False

    if event.get("type") == "CREATE":
        return True

    return False


def title(event):
    app_type = event.deep_get("new", "appType")
    new_email = event.deep_get("new", "email")
    return f"New account on {app_type} created by {new_email}"
Raw source Push Security New SaaS Account Created · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Filename: push_security_new_saas_account_created.py
RuleID: "Push.Security.New.SaaS.Account.Created"
DisplayName: "Push Security New SaaS Account Created"
Enabled: true
LogTypes:
  - PushSecurity.Entities
Severity: Info
DedupPeriodMinutes: 60
Threshold: 1
Tests:
  - Name: Account Update
    ExpectedResult: false
    Log:
      id: c478966c-f927-411c-b919-179832d3d50c
      new:
        appId: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0
        appType: ATLASSIAN
        creationTimestamp: 1.698064423e+09
        email: john.hill@example.com
        employeeId: 72d0347a-2663-4ef5-b1c5-df39163f1603
        id: d6a32ba5-0532-4a66-8137-48cdf409c972
        lastUsedTimestamp: 1.698669168e+09
        loginMethods:
          oidcLogin: GOOGLE_WORKSPACE
          oktaSwaLogin: true
          passwordLogin: true
          samlLogin: OKTA
          vendorSsoLogin: GOOGLE_WORKSPACE
        mfaMethods:
          - APP_TOTP
          - PUSH_NOTIFICATION
          - EMAIL_OTP
          - U2F
          - HARDWARE_TOTP
          - PHONE_CALL
          - SMS_OTP
          - APP_PASSWORD
          - GRID_CARD
          - EXTERNAL_PROVIDER
          - BACKUP_CODES
          - WEBAUTHN
        mfaRegistered: true
        passwordId: 4c13674f-e88a-4411-bfa2-53a70468a898
      object: ACCOUNT
      old:
        appId: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0
        appType: ATLASSIAN
        creationTimestamp: 1.698064423e+09
        email: john.hill@example.com
        employeeId: 72d0347a-2663-4ef5-b1c5-df39163f1603
        id: d6a32ba5-0532-4a66-8137-48cdf409c972
        lastUsedTimestamp: 1.698669168e+09
        loginMethods:
          oidcLogin: GOOGLE_WORKSPACE
          oktaSwaLogin: true
          passwordLogin: true
          samlLogin: OKTA
          vendorSsoLogin: GOOGLE_WORKSPACE
        mfaMethods:
          - APP_TOTP
          - PUSH_NOTIFICATION
          - EMAIL_OTP
          - U2F
          - HARDWARE_TOTP
          - PHONE_CALL
          - SMS_OTP
          - APP_PASSWORD
          - GRID_CARD
          - EXTERNAL_PROVIDER
          - BACKUP_CODES
          - WEBAUTHN
        mfaRegistered: true
        passwordId: 4c13674f-e88a-4411-bfa2-53a70468a898
      timestamp: 1.698604061e+09
      type: UPDATE
      version: "1"
  - Name: New Account
    ExpectedResult: true
    Log:
      id: c478966c-f927-411c-b919-179832d3d50c
      new:
        appId: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0
        appType: ATLASSIAN
        creationTimestamp: 1.698064423e+09
        email: john.hill@example.com
        employeeId: 72d0347a-2663-4ef5-b1c5-df39163f1603
        id: d6a32ba5-0532-4a66-8137-48cdf409c972
        lastUsedTimestamp: 1.698669168e+09
        loginMethods:
          oidcLogin: GOOGLE_WORKSPACE
          oktaSwaLogin: true
          passwordLogin: true
          samlLogin: OKTA
          vendorSsoLogin: GOOGLE_WORKSPACE
        mfaMethods:
          - APP_TOTP
          - PUSH_NOTIFICATION
          - EMAIL_OTP
          - U2F
          - HARDWARE_TOTP
          - PHONE_CALL
          - SMS_OTP
          - APP_PASSWORD
          - GRID_CARD
          - EXTERNAL_PROVIDER
          - BACKUP_CODES
          - WEBAUTHN
        mfaRegistered: true
        passwordId: 4c13674f-e88a-4411-bfa2-53a70468a898
      object: ACCOUNT
      old: null
      timestamp: 1.698604061e+09
      type: CREATE
      version: "1"


# ------ paired body: push_security_new_saas_account_created.py ------

def rule(event):
    if event.get("object") != "ACCOUNT":
        return False

    if event.get("type") == "CREATE":
        return True

    return False


def title(event):
    app_type = event.deep_get("new", "appType")
    new_email = event.deep_get("new", "email")
    return f"New account on {app_type} created by {new_email}"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.