Zendesk User Role Changed

AnalysisType: rule
Filename: zendesk_user_role.py
RuleID: "Zendesk.UserRoleChanged"
DedupPeriodMinutes: 60
DisplayName: "Zendesk User Role Changed"
Enabled: true
LogTypes:
  - Zendesk.Audit
Severity: Info
Description: A user's Zendesk role was changed
Reference: https://support.zendesk.com/hc/en-us/articles/4408824375450-Setting-roles-and-access-in-Zendesk-Admin-Center
SummaryAttributes:
  - p_any_ip_addresses
Tests:
  - Name: Zendesk - Role Changed
    ExpectedResult: true
    Log:
      {
        "url": "https://myzendek.zendesk.com/api/v2/audit_logs/111222333444.json",
        "id": 123456789123,
        "action_label": "Updated",
        "actor_id": 123,
        "actor_name": "John Doe",
        "source_id": 123,
        "source_type": "user",
        "source_label": "Bob Cat",
        "action": "update",
        "change_description": "Role changed from Administrator to End User",
        "ip_address": "127.0.0.1",
        "created_at": "2021-05-28T18:39:50Z",
        "p_log_type": "Zendesk.Audit",
      }
  - Name: Zendesk - Admin Role Assigned
    ExpectedResult: false
    Log:
      {
        "url": "https://myzendek.zendesk.com/api/v2/audit_logs/111222333444.json",
        "id": 123456789123,
        "action_label": "Updated",
        "actor_id": 123,
        "actor_name": "John Doe",
        "source_id": 123,
        "source_type": "user",
        "source_label": "Bob Cat",
        "action": "update",
        "change_description": "Role changed from End User to Administrator",
        "ip_address": "127.0.0.1",
        "created_at": "2021-05-28T18:39:50Z",
        "p_log_type": "Zendesk.Audit",
      }
  - Name: Zendesk - No changing roles
    ExpectedResult: false
    Log:
      {
        "url": "https://myzendek.zendesk.com/api/v2/audit_logs/111222333444.json",
        "id": 123456789123,
        "action_label": "Updated",
        "actor_id": 123,
        "actor_name": "John Doe",
        "source_id": 123,
        "source_type": "user",
        "source_label": "Bob Cat",
        "action": "update",
        "change_description": "Organization: AAAA is asigned",
        "ip_address": "127.0.0.1",
        "created_at": "2021-05-28T18:39:50Z",
        "p_log_type": "Zendesk.Audit",
      }


# ------ paired body: zendesk_user_role.py ------

import panther_event_type_helpers as event_type
from panther_zendesk_helpers import zendesk_get_roles


def rule(event):
    if event.get("source_type") == "user" and event.get("action") == "update":
        # admin roles have their own handling
        if (
            event.udm("event_type") != event_type.ADMIN_ROLE_ASSIGNED
            and "role changed" in event.get("change_description", "").lower()
        ):
            _, new_role = zendesk_get_roles(event)
            return bool(new_role)
    return False


def title(event):
    old_role, new_role = zendesk_get_roles(event)
    return (
        f"Actor user [{event.udm('actor_user')}] changed [{event.udm('user')}] role from "
        f"{old_role} to {new_role}"
    )