Snyk Miscellaneous Settings

AnalysisType: rule
Filename: snyk_misc_settings.py
RuleID: "Snyk.Misc.Settings"
DisplayName: "Snyk Miscellaneous Settings"
Enabled: true
LogTypes:
  - Snyk.GroupAudit
  - Snyk.OrgAudit
Tags:
  - Snyk
Reference: https://docs.snyk.io/snyk-admin/manage-settings
Severity: Low
Description: >
  Detects when Snyk settings that lack a clear security impact are changed
DedupPeriodMinutes: 60
Threshold: 1
SummaryAttributes:
  - event
Tests:
  - Name: Snyk Feature Flags changed
    ExpectedResult: true
    Log:
      {
        "created": "2023-04-11 23:32:14.173",
        "event": "group.feature_flags.edit",
        "groupId": "8fffffff-1555-4444-b000-b55555555555",
        "orgId": "21111111-a222-4eee-8ddd-a99999999999",
        "userId": "05555555-3333-4ddd-8ccc-755555555555",
      }
  - Name: Snyk User Invite Revoke
    ExpectedResult: false
    Log:
      {
        "content": {},
        "created": "2023-04-11 23:32:13.248",
        "event": "org.user.invite.revoke",
        "groupId": "8fffffff-1555-4444-b000-b55555555555",
        "orgId": "21111111-a222-4eee-8ddd-a99999999999",
        "userId": "05555555-3333-4ddd-8ccc-755555555555",
      }


# ------ paired body: snyk_misc_settings.py ------

from panther_snyk_helpers import snyk_alert_context

ACTIONS = [
    "group.cloud_config.settings.edit",
    "group.feature_flags.edit",
]


def rule(event):

    action = event.get("event", "<NO_EVENT>")
    return action in ACTIONS


def title(event):
    group_or_org = "<GROUP_OR_ORG>"
    operation = "<NO_OPERATION>"
    action = event.get("event", "<NO_EVENT>")
    if "." in action:
        group_or_org = action.split(".")[0].title()
        operation = ".".join(action.split(".")[1:]).title()
    return (
        f"Snyk: [{group_or_org}] Setting "
        f"[{operation}] "
        f"performed by [{event.deep_get('userId', default='<NO_USERID>')}]"
    )


def alert_context(event):
    return snyk_alert_context(event)


def dedup(event):
    return (
        f"{event.deep_get('userId', default='<NO_USERID>')}"
        f"{event.deep_get('orgId', default='<NO_ORGID>')}"
        f"{event.deep_get('groupId', default='<NO_GROUPID>')}"
        f"{event.deep_get('event', default='<NO_EVENT>')}"
    )