A User from the company domain(s) Logged in without SAML

AnalysisType: rule
Filename: teleport_company_domain_login_without_saml.py
RuleID: Teleport.CompanyDomainLoginWithoutSAML
DisplayName: "A User from the company domain(s) Logged in without SAML"
Enabled: true
LogTypes:
  - Gravitational.TeleportAudit
Tags:
  - Teleport
Severity: Medium
Description: "A User from the company domain(s) Logged in without SAML"
DedupPeriodMinutes: 60
Reports:
  MITRE ATT&CK:
    - TA0005:T1562
Reference: https://goteleport.com/docs/management/admin/
Runbook: >
  A User from the company domain(s) Logged in without SAML
SummaryAttributes:
  - event
  - code
  - user
  - method
  - mfa_device
Tests:
  - Name: A User from the company domain(s) logged in with SAML
    ExpectedResult: false
    Log:
      {
        "attributes": { "firstName": [""], "groups": ["employees"] },
        "cluster_name": "teleport.example.com",
        "code": "T1001I",
        "ei": 0,
        "event": "user.login",
        "method": "saml",
        "success": true,
        "time": "2023-09-18 00:00:00",
        "uid": "88888888-4444-4444-4444-222222222222",
        "user": "jane.doe@example.com",
      }
  - Name: A User from the company domain(s) logged in without SAML
    ExpectedResult: true
    Log:
      {
        "cluster_name": "teleport.example.com",
        "code": "T1001I",
        "ei": 0,
        "event": "user.login",
        "method": "local",
        "success": true,
        "time": "2023-09-18 00:00:00",
        "uid": "88888888-4444-4444-4444-222222222222",
        "user": "jane.doe@example.com",
      }


# ------ paired body: teleport_company_domain_login_without_saml.py ------

def rule(event):
    user_domain = event.get("user", "@").split("@")[-1]
    cluster = event.get("cluster_name", "")
    return bool(
        event.get("event") == "user.login"
        and event.get("success") is True
        and cluster.endswith(user_domain)
        and event.get("method") != "saml"
    )


def title(event):
    return (
        f"User [{event.get('user', '<UNKNOWN_USER>')}] logged into "
        f"[{event.get('cluster_name', '<UNNAMED_CLUSTER>')}] without using SAML"
    )