Zoom New Meeting Passcode Required Disabled

Description

A Zoom User turned off your organization's setting to require passcodes for new meetings.

Query · python

def rule(event):
    operation_detail = event.get("operation_detail", "<NO_OPS_DETAIL>")
    operation_flag = "Security  - Require a passcode when scheduling new meetings: from On to Off"
    return all(
        [
            event.get("action", "<NO_ACTION>") == "Update",
            event.get("category_type", "<NO_CATEGORY_TYPE>") == "Account",
            operation_flag == operation_detail,
        ]
    )


def title(event):
    return (
        f"Zoom User [{event.get('operator', '<NO_OPERATOR>')}] turned off your organization's "
        f"setting to require passcodes for new meetings."
    )

Analyst notes

Confirm this user acted with valid business intent and determine whether this activity was authorized.

Raw source Zoom New Meeting Passcode Required Disabled · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Description: A Zoom User turned off your organization's setting to require passcodes for new meetings.
DisplayName: "Zoom New Meeting Passcode Required Disabled"
Enabled: true
Filename: zoom_new_meeting_passcode_required_disabled.py
Runbook: Confirm this user acted with valid business intent and determine whether this activity was authorized.
Reference: https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0063160#:~:text=Since%20September%202022%2C%20Zoom%20requires,enforced%20for%20all%20free%20accounts
Severity: Medium
Tests:
  - ExpectedResult: true
    Log:
      action: Update
      category_type: Account
      operation_detail: "Security  - Require a passcode when scheduling new meetings: from On to Off"
      operator: example@example.io
      time: "2022-12-16 18:22:17"
    Name: Setting Turn Off
  - ExpectedResult: false
    Log:
      action: Update
      category_type: Account
      operation_detail: "Security  - Require a passcode when scheduling new meetings: from Off to On"
      operator: example@example.io
      time: "2022-12-16 18:22:17"
    Name: Setting Turn On
  - ExpectedResult: false
    Log:
      action: Update
      category_type: Account
      operation_detail: "Security  - Automatically sign users out after a specified time: from On to Off"
      operator: example@example.io
      time: "2022-12-16 18:20:42"
    Name: "Automatic Sign Out Setting Disabled "
DedupPeriodMinutes: 60
LogTypes:
  - Zoom.Operation
RuleID: "Zoom.New.Meeting.Passcode.Required.Disabled"
Threshold: 1


# ------ paired body: zoom_new_meeting_passcode_required_disabled.py ------

def rule(event):
    operation_detail = event.get("operation_detail", "<NO_OPS_DETAIL>")
    operation_flag = "Security  - Require a passcode when scheduling new meetings: from On to Off"
    return all(
        [
            event.get("action", "<NO_ACTION>") == "Update",
            event.get("category_type", "<NO_CATEGORY_TYPE>") == "Account",
            operation_flag == operation_detail,
        ]
    )


def title(event):
    return (
        f"Zoom User [{event.get('operator', '<NO_OPERATOR>')}] turned off your organization's "
        f"setting to require passcodes for new meetings."
    )

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.