Tines Tenant API Keys Added

AnalysisType: rule
Filename: tines_tenant_authtoken.py
RuleID: Tines.Tenant.AuthToken
DisplayName: Tines Tenant API Keys Added
Enabled: true
LogTypes:
  - Tines.Audit
Tags:
  - Tines
  - IAM - Credential Security
Severity: Medium
Description: >
  Detects when Tines Tenant API Keys are added
Reference: https://www.tines.com/api/authentication
DedupPeriodMinutes: 60
Threshold: 1
SummaryAttributes:
  - user_id
  - operation_name
  - tenant_id
  - request_ip
Tests:
  - Name: Tines Login
    ExpectedResult: false
    Log:
      {
        "created_at": "2023-05-17 14:45:19",
        "id": 7888888,
        "operation_name": "Login",
        "request_ip": "12.12.12.12",
        "request_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36",
        "tenant_id": "8888",
        "user_email": "user@company.com",
        "user_id": "17171",
        "user_name": "user at company dot com",
      }
  - Name: Tines Personal API Token Created
    ExpectedResult: false
    Log:
      {
        "created_at": "2023-05-18 22:54:11",
        "id": 7111111,
        "inputs":
          { "inputs": { "isServiceToken": false, "name": "personal-api-key" } },
        "operation_name": "AuthenticationTokenCreation",
        "request_ip": "12.12.12.12",
        "request_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36",
        "tenant_id": "8888",
        "user_email": "user@company.com",
        "user_id": "17171",
        "user_name": "user at company dot com",
      }
  - Name: Tines Tenant API Token Created
    ExpectedResult: true
    Log:
      {
        "created_at": "2023-05-18 22:54:01",
        "id": 7222222,
        "inputs":
          { "inputs": { "isServiceToken": true, "name": "tenant-api-key" } },
        "operation_name": "AuthenticationTokenCreation",
        "request_ip": "12.12.12.12",
        "request_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36",
        "tenant_id": "8888",
        "user_email": "user@company.com",
        "user_id": "17171",
        "user_name": "user at company dot com",
      }


# ------ paired body: tines_tenant_authtoken.py ------

from panther_tines_helpers import tines_alert_context

ACTIONS = [
    "AuthenticationTokenCreation",
    # AuthenticationTokenDeletion does not include
    #  the scope of the deleted token.
    # Leaving deletion un-implemented for now
    # "AuthenticationTokenDeletion",
]


def rule(event):

    action = event.get("operation_name", "<NO_OPERATION_NAME>")
    is_tenant_token = event.deep_get("inputs", "inputs", "isServiceToken", default=False)
    return all([action in ACTIONS, is_tenant_token])


def title(event):
    action = event.get("operation_name", "<NO_OPERATION_NAME>")
    return (
        f"Tines: Tenant [{action}] "
        f"by [{event.deep_get('user_email', default='<NO_USEREMAIL>')}]"
    )


def alert_context(event):
    a_c = tines_alert_context(event)
    a_c["token_name"] = event.deep_get("inputs", "inputs", "name", default="<NO_TOKENNAME>")
    return a_c


def dedup(event):
    return (
        f"{event.deep_get('user_id', default='<NO_USERID>')}"
        "_"
        f"{event.deep_get('operation_name', default='<NO_OPERATION>')}"
        "_"
        f"{event.deep_get('inputs', 'inputs', 'name', default='<NO_TOKENNAME>')}"
    )