Snyk System SSO Settings Changed

AnalysisType: rule
Filename: snyk_system_sso.py
RuleID: "Snyk.System.SSO"
DisplayName: "Snyk System SSO Settings Changed"
Enabled: true
LogTypes:
  - Snyk.GroupAudit
Tags:
  - Snyk
Severity: High
Description: >
  Detects Snyk SSO Settings have been changed.
  The reference URL from Snyk indicates that these events are likely to
  originate exclusively from Snyk Support.
Reference: https://docs.snyk.io/user-and-group-management/setting-up-sso-for-authentication/set-up-snyk-single-sign-on-sso
DedupPeriodMinutes: 60
Threshold: 1
SummaryAttributes:
  - event
  - p_any_ip_addresses
  - p_any_emails
Tests:
  - Name: Snyk System SSO Setting event happened
    ExpectedResult: true
    Log:
      {
        "userId": "05555555-3333-4ddd-8ccc-755555555555",
        "event": "group.sso.edit",
        "groupId": "8fffffff-1555-4444-b000-b55555555555",
        "orgId": "21111111-a222-4eee-8ddd-a99999999999",
        "content": { "unknown": "contents" },
      }
  - Name: Snyk Group SSO Membership sync
    ExpectedResult: false
    Log:
      {
        "content":
          {
            "addAsOrgAdmin": [],
            "addAsOrgCollaborator": ["group.name"],
            "addAsOrgCustomRole": [],
            "addAsOrgRestrictedCollaborator": [],
            "removedOrgMemberships": [],
            "userPublicId": "05555555-3333-4ddd-8ccc-755555555555",
          },
        "created": "2023-03-15 13:13:13.133",
        "event": "group.sso.membership.sync",
        "groupId": "8fffffff-1555-4444-b000-b55555555555",
      }


# ------ paired body: snyk_system_sso.py ------

from panther_snyk_helpers import snyk_alert_context

ACTIONS = [
    "group.sso.auth0_connection.create",
    "group.sso.auth0_connection.edit",
    "group.sso.create",
    "group.sso.edit",
]


def rule(event):

    action = event.get("event", "<NO_EVENT>")
    return action in ACTIONS


def title(event):
    return (
        "Snyk: System SSO Setting event "
        f"[{event.deep_get('event', default='<NO_EVENT>')}] "
        f"performed by [{event.deep_get('userId', default='<NO_USERID>')}]"
    )


def alert_context(event):
    return snyk_alert_context(event)