Push Security Open Security Finding

Query · python

def rule(event):
    if event.get("object") != "FINDING":
        return False

    event_type = event.get("type")

    if event_type == "CREATE":
        return True

    if event_type == "UPDATE" and event.deep_get("new", "state") == "OPEN":
        return True

    return False


def title(event):
    new_type = event.deep_get("new", "type")
    app_type = event.deep_get("new", "appType")
    return f"Open finding {new_type} for app {app_type}"
Raw source Push Security Open Security Finding · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Filename: push_security_open_security_finding.py
RuleID: "Push.Security.Open.Security.Finding"
DisplayName: "Push Security Open Security Finding"
Enabled: true
LogTypes:
  - PushSecurity.Entities
Severity: Info
DedupPeriodMinutes: 60
Threshold: 1
Tests:
  - Name: Resolved Finding
    ExpectedResult: false
    Log:
      id: c478966c-f927-411c-b919-179832d3d50c
      new:
        accountId: null
        appId: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0
        appType: PUSH_SECURITY
        creationTimestamp: 1.698064423e+09
        employeeId: 379ac7ea-ff2a-42ef-af37-06d2020dc46a
        id: d6a32ba5-0532-4a66-8137-48cdf409c972
        passwordId: c4a045a1-5331-4714-af83-6a361e98960d
        state: RESOLVED
        type: WEAK_PASSWORD
      object: FINDING
      old:
        accountId: null
        appId: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0
        appType: PUSH_SECURITY
        creationTimestamp: 1.698064423e+09
        employeeId: 379ac7ea-ff2a-42ef-af37-06d2020dc46a
        id: d6a32ba5-0532-4a66-8137-48cdf409c972
        passwordId: c4a045a1-5331-4714-af83-6a361e98960d
        state: OPEN
        type: WEAK_PASSWORD
      timestamp: 1.698604061e+09
      type: UPDATE
      version: "1"
  - Name: New Finding
    ExpectedResult: true
    Log:
      id: c478966c-f927-411c-b919-179832d3d50c
      new:
        accountId: null
        appId: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0
        appType: PUSH_SECURITY
        creationTimestamp: 1.698064423e+09
        employeeId: 379ac7ea-ff2a-42ef-af37-06d2020dc46a
        id: d6a32ba5-0532-4a66-8137-48cdf409c972
        passwordId: c4a045a1-5331-4714-af83-6a361e98960d
        state: OPEN
        type: WEAK_PASSWORD
      object: FINDING
      old: null
      timestamp: 1.698604061e+09
      type: CREATE
      version: "1"
  - Name: Reopened Finding
    ExpectedResult: true
    Log:
      id: c478966c-f927-411c-b919-179832d3d50c
      new:
        accountId: null
        appId: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0
        appType: PUSH_SECURITY
        creationTimestamp: 1.698064423e+09
        employeeId: 379ac7ea-ff2a-42ef-af37-06d2020dc46a
        id: d6a32ba5-0532-4a66-8137-48cdf409c972
        passwordId: c4a045a1-5331-4714-af83-6a361e98960d
        state: OPEN
        type: WEAK_PASSWORD
      object: FINDING
      old:
        accountId: null
        appId: 2a2197de-ad2c-47e4-8dcb-fb0f04cf83e0
        appType: PUSH_SECURITY
        creationTimestamp: 1.698064423e+09
        employeeId: 379ac7ea-ff2a-42ef-af37-06d2020dc46a
        id: d6a32ba5-0532-4a66-8137-48cdf409c972
        passwordId: c4a045a1-5331-4714-af83-6a361e98960d
        state: RESOLVED
        type: WEAK_PASSWORD
      timestamp: 1.698604061e+09
      type: UPDATE
      version: "1"


# ------ paired body: push_security_open_security_finding.py ------

def rule(event):
    if event.get("object") != "FINDING":
        return False

    event_type = event.get("type")

    if event_type == "CREATE":
        return True

    if event_type == "UPDATE" and event.deep_get("new", "state") == "OPEN":
        return True

    return False


def title(event):
    new_type = event.deep_get("new", "type")
    app_type = event.deep_get("new", "appType")
    return f"Open finding {new_type} for app {app_type}"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.