Snyk Org or Group Settings Change

AnalysisType: rule
Filename: snyk_ou_change.py
RuleID: "Snyk.OU.Change"
DisplayName: "Snyk Org or Group Settings Change"
Enabled: true
LogTypes:
  - Snyk.GroupAudit
  - Snyk.OrgAudit
Tags:
  - Snyk
Severity: High
Description: >
  Detects when Snyk Group or Organization Settings are changed.
Runbook: |
  These actions in the Snyk Audit logs indicate that a Organization or
  Group setting has changed, including Group and Org creation/deletion.
  Deletion events are marked with HIGH severity
  Creation events are marked with INFO severity
  Edit events are marked with MEDIUM Severity

Reference: https://docs.snyk.io/snyk-admin/introduction-to-snyk-administration
DedupPeriodMinutes: 60
Threshold: 1
SummaryAttributes:
  - event
Tests:
  - Name: Snyk Org Deletion ( HIGH )
    ExpectedResult: true
    Log:
      {
        "groupId": "8fffffff-1555-4444-b000-b55555555555",
        "orgId": "21111111-a222-4eee-8ddd-a99999999999",
        "event": "org.delete",
        "content": { "orgName": "expendable-org" },
        "created": "2023-04-09T23:32:14.649Z",
        "userId": "05555555-3333-4ddd-8ccc-755555555555",
      }
  - Name: Snyk Group Org Remove ( HIGH )
    ExpectedResult: true
    Log:
      {
        "groupId": "8fffffff-1555-4444-b000-b55555555555",
        "orgId": "21111111-a222-4eee-8ddd-a99999999999",
        "event": "group.org.remove",
        "content": { "orgName": "expendable-org" },
        "created": "2023-04-09T23:32:14.649Z",
        "userId": "05555555-3333-4ddd-8ccc-755555555555",
      }
  - Name: Snyk Group Edit ( MEDIUM )
    ExpectedResult: true
    Log:
      {
        "groupId": "8fffffff-1555-4444-b000-b55555555555",
        "event": "group.edit",
        "content":
          { "updatedValues": { "projectTestFrequencySetting": "daily" } },
        "created": "2023-04-11T23:22:57.667Z",
      }
  - Name: Snyk Org Create ( INFO )
    ExpectedResult: true
    Log:
      {
        "groupId": "8fffffff-1555-4444-b000-b55555555555",
        "event": "org.create",
        "content": { "newOrgPublicId": "21111111-a222-4eee-8ddd-a99999999999" },
        "created": "2023-04-11T23:12:33.206Z",
        "userId": "05555555-3333-4ddd-8ccc-755555555555",
      }
  - Name: Snyk Group SSO Membership sync
    ExpectedResult: false
    Log:
      {
        "content": {},
        "created": "2023-03-15 13:13:13.133",
        "event": "group.sso.membership.sync",
        "groupId": "8fffffff-1555-4444-b000-b55555555555",
      }


# ------ paired body: snyk_ou_change.py ------

from panther_snyk_helpers import snyk_alert_context

ACTIONS = [
    "group.create",
    "group.delete",
    "group.edit",
    "group.feature_flags.edit",
    "group.org.add",
    "group.org.remove",
    "group.settings.edit",
    "group.settings.feature_flag.edit",
    "org.create",
    "org.delete",
    "org.edit",
    "org.settings.feature_flag.edit",
]


def rule(event):

    action = event.get("event", "<NO_EVENT>")
    return action in ACTIONS


def title(event):
    group_or_org = "<GROUP_OR_ORG>"
    action = event.get("event", "<NO_EVENT>")
    if "." in action:
        group_or_org = action.split(".")[0].title()
    return (
        f"Snyk: [{group_or_org}] Organizational Unit settings have been modified "
        f"via [{action}] "
        f"performed by [{event.deep_get('userId', default='<NO_USERID>')}]"
    )


def alert_context(event):
    return snyk_alert_context(event)


def dedup(event):
    return (
        f"{event.deep_get('userId', default='<NO_USERID>')}"
        f"{event.deep_get('orgId', default='<NO_ORGID>')}"
        f"{event.deep_get('groupId', default='<NO_GROUPID>')}"
        f"{event.deep_get('event', default='<NO_EVENT>')}"
    )


def severity(event):
    action = event.get("event", "<NO_EVENT>")
    if action.endswith((".remove", ".delete")):
        return "HIGH"
    if action.endswith((".edit")):
        return "MEDIUM"
    return "INFO"