Zendesk Account Owner Changed

AnalysisType: rule
Filename: zendesk_new_owner.py
RuleID: "Zendesk.AccountOwnerChanged"
DedupPeriodMinutes: 60
DisplayName: "Zendesk Account Owner Changed"
Enabled: true
LogTypes:
  - Zendesk.Audit
Severity: High
Tags:
  - Zendesk
  - Privilege Escalation:Valid Accounts
Reports:
  MITRE ATT&CK:
    - TA0004:T1078
Description: Only one admin user can be the account owner. Ensure the change in ownership is expected.
Reference: https://support.zendesk.com/hc/en-us/articles/4408822084634-Changing-the-account-owner
SummaryAttributes:
  - p_any_ip_addresses
Tests:
  - Name: Zendesk - Owner Changed
    ExpectedResult: true
    Log:
      {
        "url": "https://myzendek.zendesk.com/api/v2/audit_logs/111222333444.json",
        "id": 123456789123,
        "action_label": "Updated",
        "actor_id": 123,
        "actor_name": "John Doe",
        "source_id": 123,
        "source_type": "account",
        "source_label": "Account: Account",
        "action": "update",
        "change_description": "Owner changed from Bob Cat to Mountain Lion",
        "ip_address": "127.0.0.1",
        "created_at": "2021-05-28T18:39:50Z",
        "p_log_type": "Zendesk.Audit",
      }
  - Name: Zendesk - Admin Role Assigned
    ExpectedResult: false
    Log:
      {
        "url": "https://myzendek.zendesk.com/api/v2/audit_logs/111222333444.json",
        "id": 123456789123,
        "action_label": "Updated",
        "actor_id": 123,
        "actor_name": "John Doe",
        "source_id": 123,
        "source_type": "user",
        "source_label": "Account: Account",
        "action": "update",
        "change_description": "Role changed from End User to Administrator",
        "ip_address": "127.0.0.1",
        "created_at": "2021-05-28T18:39:50Z",
        "p_log_type": "Zendesk.Audit",
      }


# ------ paired body: zendesk_new_owner.py ------

import re

from panther_zendesk_helpers import ZENDESK_CHANGE_DESCRIPTION

ZENDESK_OWNER_CHANGED = re.compile(
    r"Owner changed from (?P<old_owner>.+) to (?P<new_owner>[^$]+)", re.IGNORECASE
)


def rule(event):
    if event.get("action", "") == "update" and event.get("source_type", "") == "account":
        return event.get(ZENDESK_CHANGE_DESCRIPTION, "").lower().startswith("owner changed from ")
    return False


def title(event):
    old_owner = "<UNKNOWN_USER>"
    new_owner = "<UNKNOWN_USER>"
    matches = ZENDESK_OWNER_CHANGED.match(event.get(ZENDESK_CHANGE_DESCRIPTION, ""))
    if matches:
        old_owner = matches.group("old_owner")
        new_owner = matches.group("new_owner")
    return f"zendesk administrative owner changed from {old_owner} to {new_owner}"