Snyk System External Access Settings Changed

AnalysisType: rule
Filename: snyk_system_externalaccess.py
RuleID: "Snyk.System.ExternalAccess"
DisplayName: "Snyk System External Access Settings Changed"
Enabled: true
LogTypes:
  - Snyk.GroupAudit
  - Snyk.OrgAudit
Tags:
  - Snyk
Severity: High
Description: >
  Detects when Snyk Settings that control access for external parties have been changed.
Runbook: |
  This action in the Snyk Audit logs indicate that the setting for allowing external
  parties to request access to your Snyk installation have changed.
Reference: https://docs.snyk.io/snyk-admin/manage-users-and-permissions/organization-access-requests
DedupPeriodMinutes: 60
Threshold: 1
SummaryAttributes:
  - event
Tests:
  - Name: Snyk External Access Allowed By External Parties - Enabled
    ExpectedResult: true
    Log:
      {
        "groupId": "8fffffff-1555-4444-b000-b55555555555",
        "event": "group.request_access_settings.edit",
        "content": { "after": { "isEnabled": true }, "before": {} },
        "created": "2023-03-03T19:52:01.628Z",
        "userId": "05555555-3333-4ddd-8ccc-755555555555",
      }
  - Name: Snyk External Access Allowed By External Parties - Disabled
    ExpectedResult: true
    Log:
      {
        "groupId": "8fffffff-1555-4444-b000-b55555555555",
        "event": "group.request_access_settings.edit",
        "content": { "after": {}, "before": { "isEnabled": true } },
        "created": "2023-03-03T20:52:01.628Z",
        "userId": "05555555-3333-4ddd-8ccc-755555555555",
      }
  - Name: Snyk Group SSO Membership sync
    ExpectedResult: false
    Log:
      {
        "content":
          {
            "addAsOrgAdmin": [],
            "addAsOrgCollaborator": ["group.name"],
            "addAsOrgCustomRole": [],
            "addAsOrgRestrictedCollaborator": [],
            "removedOrgMemberships": [],
            "userPublicId": "05555555-3333-4ddd-8ccc-755555555555",
          },
        "created": "2023-03-15 13:13:13.133",
        "event": "group.sso.membership.sync",
        "groupId": "8fffffff-1555-4444-b000-b55555555555",
      }


# ------ paired body: snyk_system_externalaccess.py ------

from panther_snyk_helpers import snyk_alert_context

ACTIONS = [
    "group.request_access_settings.edit",
    "org.request_access_settings.edit",
]


def rule(event):

    action = event.get("event", "<NO_EVENT>")
    return action in ACTIONS


def title(event):
    current_setting = event.deep_get("content", "after", "isEnabled", default=False)
    action = event.get("event", "<NO_EVENT>")
    if "." in action:
        action = action.split(".")[0].title()
    return (
        f"Snyk: [{action}] External Access settings have been modified "
        f"to PermitExternalUsers:[{current_setting}] "
        f"performed by [{event.deep_get('userId', default='<NO_USERID>')}]"
    )


def alert_context(event):
    a_c = snyk_alert_context(event)
    current_setting = event.deep_get("content", "after", "isEnabled", default=False)
    a_c["current_setting"] = current_setting
    return a_c


def dedup(event):
    return (
        f"{event.deep_get('userId', default='<NO_USERID>')}"
        f"{event.deep_get('orgId', default='<NO_ORGID>')}"
        f"{event.deep_get('groupId', default='<NO_GROUPID>')}"
    )


def severity(event):
    current_setting = event.deep_get("content", "after", "isEnabled", default=False)
    if current_setting:
        return "HIGH"
    return "INFO"