Thinkst Canary DCRC

Description

A Canary has disconnected/reconnected.

Query · python

def rule(event):
    return any(keyword in event.get("Intro", "") for keyword in ["disconnected", "reconnected"])


def title(event):
    return event.get("Intro", "Canary Disconnected/Reconnected")


def severity(event):
    if "reconnected" in event.get("Intro", ""):
        return "Low"
    return "Default"
Raw source Thinkst Canary DCRC · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Filename: thinkst_canary_dcrc.py
DisplayName: Thinkst Canary DCRC
RuleID: Thinkst.CanaryDCRC
Description: "A Canary has disconnected/reconnected."
Enabled: true
Severity: High
LogTypes:
  - ThinkstCanary.Alert
DedupPeriodMinutes: 60
Threshold: 1
Tests:
  - ExpectedResult: true
    Name: Canary Disconnected
    Log:
      {
        "CanaryID": "00029666d14d454f",
        "CanaryIP": "192.168.20.101",
        "CanaryName": "FS01",
        "Description": "Canary Disconnected",
        "IncidentKey": "incident:devicedied:3b04b62c54dcbb64d17131be::1718794923",
        "Intro": "One of your Canaries (FS01) previously at 192.168.20.101 has disconnected.",
        "MatchedAnnotations": {},
        "Timestamp": "2024-06-19 11:02:03 (UTC)",
      }


# ------ paired body: thinkst_canary_dcrc.py ------

def rule(event):
    return any(keyword in event.get("Intro", "") for keyword in ["disconnected", "reconnected"])


def title(event):
    return event.get("Intro", "Canary Disconnected/Reconnected")


def severity(event):
    if "reconnected" in event.get("Intro", ""):
        return "Low"
    return "Default"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.