Tines Story Items Destruction

AnalysisType: rule
Filename: tines_story_items_destruction.py
RuleID: Tines.Story.Items.Destruction
DisplayName: "Tines Story Items Destruction"
Enabled: true
LogTypes:
  - Tines.Audit
Tags:
  - Tines
Severity: Info
Description: "A user has destroyed a story item"
Runbook: "Possible data destruction. Please reach out to the user and confirm this was done for valid business reasons."
Reference: https://www.tines.com/docs/stories
DedupPeriodMinutes: 60
Threshold: 1
Tests:
  - Name: Detection Trigger
    ExpectedResult: true
    Log:
      {
        "created_at": "2023-06-13 15:14:46",
        "id": 1234,
        "operation_name": "StoryItemsDestruction",
        "p_source_label": "tines-log-source-name",
        "request_ip": "98.224.225.84",
        "request_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (  KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36",
        "tenant_id": "1337",
        "user_email": "user@email.com",
        "user_id": "7331",
        "user_name": "Tines User Person",
      }
  - Name: Tines Login
    ExpectedResult: false
    Log:
      {
        "created_at": "2023-05-17 14:45:19",
        "id": 7888888,
        "operation_name": "Login",
        "p_source_label": "tines-log-source-name",
        "request_ip": "12.12.12.12",
        "request_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36",
        "tenant_id": "8888",
        "user_email": "user@company.com",
        "user_id": "17171",
        "user_name": "user at company dot com",
      }


# ------ paired body: tines_story_items_destruction.py ------

from panther_tines_helpers import tines_alert_context


def rule(event):

    return event.get("operation_name", "<NO_OPERATION_NAME>") == "StoryItemsDestruction"


def title(event):
    operation = event.get("operation_name", "<NO_OPERATION_NAME>")
    user = event.get("user_email", "<NO_USER_EMAIL>")
    tines_instance = event.get("p_source_label", "<NO_SOURCE_LABEL>")

    return f"Tines [{operation}] performed by [{user}] on [{tines_instance}]."


def alert_context(event):
    return tines_alert_context(event)