Tines SSO Settings

AnalysisType: rule
Filename: tines_sso_settings.py
RuleID: Tines.SSO.Settings
DisplayName: Tines SSO Settings
Enabled: true
LogTypes:
  - Tines.Audit
Tags:
  - Tines
  - IAM - Credential Security
Severity: High
Description: >
  Detects when Tines SSO settings are changed
Reference: https://www.tines.com/docs/admin/single-sign-on
DedupPeriodMinutes: 60
Threshold: 1
SummaryAttributes:
  - user_id
  - operation_name
  - tenant_id
  - request_ip
Tests:
  - Name: Tines SsoConfigurationSamlSet
    ExpectedResult: true
    Log:
      {
        "created_at": "2023-05-16 23:26:46",
        "id": 1111111,
        "inputs":
          {
            "domainId": "REDACTED",
            "fingerprint": "REDACTED",
            "idpCertificate": "REDACTED",
            "targetUrl": "REDACTED",
          },
        "operation_name": "SsoConfigurationSamlSet",
        "request_ip": "12.12.12.12",
        "request_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36",
        "tenant_id": "8888",
        "user_email": "user@company.com",
        "user_id": "17171",
        "user_name": "user at company dot com",
      }
  - Name: Tines Login
    ExpectedResult: false
    Log:
      {
        "created_at": "2023-05-17 14:45:19",
        "id": 7888888,
        "operation_name": "Login",
        "request_ip": "12.12.12.12",
        "request_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36",
        "tenant_id": "8888",
        "user_email": "user@company.com",
        "user_id": "17171",
        "user_name": "user at company dot com",
      }


# ------ paired body: tines_sso_settings.py ------

from panther_tines_helpers import tines_alert_context

ACTIONS = [
    "SsoConfigurationDefaultSet",
    "SsoConfigurationOidcSet",
    "SsoConfigurationSamlSet",
]


def rule(event):

    action = event.get("operation_name", "<NO_OPERATION_NAME>")
    return action in ACTIONS


def title(event):
    action = event.get("operation_name", "<NO_OPERATION_NAME>")
    return (
        f"Tines: [{action}] Setting "
        f"changed by [{event.deep_get('user_email', default='<NO_USEREMAIL>')}]"
    )


def alert_context(event):
    return tines_alert_context(event)


def dedup(event):
    return (
        f"{event.deep_get('user_id', default='<NO_USERID>')}"
        "_"
        f"{event.deep_get('operation_name', default='<NO_OPERATION>')}"
    )