Tines Custom CertificateAuthority setting changed

AnalysisType: rule
Filename: tines_custom_ca.py
RuleID: Tines.Custom.CertificateAuthority
DisplayName: Tines Custom CertificateAuthority setting changed
Enabled: true
LogTypes:
  - Tines.Audit
Tags:
  - Tines
  - IAM - Credential Security
Reference: https://www.tines.com/docs/admin/custom-certificate-authority
Severity: High
Description: >
  Detects when Tines Custom CertificateAuthority settings are changed
DedupPeriodMinutes: 60
Threshold: 1
SummaryAttributes:
  - user_id
  - operation_name
  - tenant_id
  - request_ip
Tests:
  - Name: Tines Login
    ExpectedResult: false
    Log:
      {
        "created_at": "2023-05-17 14:45:19",
        "id": 7888888,
        "operation_name": "Login",
        "request_ip": "12.12.12.12",
        "request_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36",
        "tenant_id": "8888",
        "user_email": "user@company.com",
        "user_id": "17171",
        "user_name": "user at company dot com",
      }
  - Name: Tines Custom CA set
    ExpectedResult: true
    Log:
      {
        "created_at": "2023-05-18 22:54:11",
        "id": 7111111,
        "inputs": {},
        "operation_name": "CustomCertificateAuthoritySet",
        "request_ip": "12.12.12.12",
        "request_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36",
        "tenant_id": "8888",
        "user_email": "user@company.com",
        "user_id": "17171",
        "user_name": "user at company dot com",
      }


# ------ paired body: tines_custom_ca.py ------

from panther_tines_helpers import tines_alert_context

ACTIONS = [
    "CustomCertificateAuthoritySet",
]


def rule(event):

    action = event.get("operation_name", "<NO_OPERATION_NAME>")
    return action in ACTIONS


def title(event):
    action = event.get("operation_name", "<NO_OPERATION_NAME>")
    return f"Tines: [{action}] " f"by [{event.deep_get('user_email', default='<NO_USEREMAIL>')}]"


def alert_context(event):
    return tines_alert_context(event)


def dedup(event):
    return (
        f"{event.deep_get('user_id', default='<NO_USERID>')}"
        "_"
        f"{event.deep_get('operation_name', default='<NO_OPERATION>')}"
    )