Zendesk Mobile App Access Modified

AnalysisType: rule
Filename: zendesk_mobile_app_access.py
RuleID: "Zendesk.MobileAppAccessUpdated"
DedupPeriodMinutes: 60
DisplayName: "Zendesk Mobile App Access Modified"
Enabled: true
LogTypes:
  - Zendesk.Audit
Tags:
  - Zendesk
  - Persistence:Valid Accounts
Reports:
  MITRE ATT&CK:
    - TA0003:T1078
Severity: Medium
Description: A user updated account setting that enabled or disabled mobile app access.
Reference: https://support.zendesk.com/hc/en-us/articles/4408846407066-About-the-Zendesk-Support-mobile-app#:~:text=More%20settings.-,Configuring%20the%20mobile%20app,-Activate%20the%20new
SummaryAttributes:
  - p_any_ip_addresses
Tests:
  - Name: Zendesk - Mobile App Access Off
    ExpectedResult: true
    Log:
      {
        "url": "https://myzendek.zendesk.com/api/v2/audit_logs/111222333444.json",
        "id": 123456789123,
        "action_label": "Updated",
        "actor_id": 123,
        "actor_name": "John Doe",
        "source_id": 123,
        "source_type": "account_setting",
        "source_label": "Zendesk Support Mobile App Access",
        "action": "create",
        "change_description": "Disabled",
        "ip_address": "127.0.0.1",
        "created_at": "2021-05-28T18:39:50Z",
        "p_log_type": "Zendesk.Audit",
      }
  - Name: Zendesk - Mobile App Access On
    ExpectedResult: true
    Log:
      {
        "url": "https://myzendek.zendesk.com/api/v2/audit_logs/111222333444.json",
        "id": 123456789123,
        "action_label": "Updated",
        "actor_id": 123,
        "actor_name": "John Doe",
        "source_id": 123,
        "source_type": "account_setting",
        "source_label": "Zendesk Support Mobile App Access",
        "action": "create",
        "change_description": "Enabled",
        "ip_address": "127.0.0.1",
        "created_at": "2021-05-28T18:39:50Z",
        "p_log_type": "Zendesk.Audit",
      }
  - Name: Zendesk - Credit Card Redaction
    ExpectedResult: false
    Log:
      {
        "url": "https://myzendek.zendesk.com/api/v2/audit_logs/111222333444.json",
        "id": 123456789123,
        "action_label": "Updated",
        "actor_id": 123,
        "actor_name": "John Doe",
        "source_id": 123,
        "source_type": "account_setting",
        "source_label": "Credit Card Redaction",
        "action": "create",
        "change_description": "Enabled",
        "ip_address": "127.0.0.1",
        "created_at": "2021-05-28T18:39:50Z",
        "p_log_type": "Zendesk.Audit",
      }


# ------ paired body: zendesk_mobile_app_access.py ------

from panther_zendesk_helpers import ZENDESK_CHANGE_DESCRIPTION

MOBILE_APP_ACTIONS = {"create", "update"}


def rule(event):
    return (
        event.get("source_type") == "account_setting"
        and event.get("action", "") in MOBILE_APP_ACTIONS
        and event.get("source_label", "") == "Zendesk Support Mobile App Access"
    )


def title(event):
    action = event.get(ZENDESK_CHANGE_DESCRIPTION, "<UNKNOWN_ACTION>")
    return f"User [{event.udm('actor_user')}] {action} mobile app access"


def severity(event):
    if event.get(ZENDESK_CHANGE_DESCRIPTION, "").lower() == "disabled":
        return "INFO"
    return "MEDIUM"