Zoom Sign In Method Modified

AnalysisType: rule
Description: A Zoom User modified your organizations sign in method.
DisplayName: "Zoom Sign In Method Modified"
Enabled: true
Filename: zoom_sign_in_method_modified.py
Runbook: Confirm this user acted with valid business intent and determine whether this activity was authorized.
Reference: https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0067602#:~:text=Go%20to%20the%20Zoom%20site,click%20Link%20and%20Sign%20In
Severity: Medium
Tests:
  - ExpectedResult: true
    Log:
      action: Update
      category_type: Account
      operation_detail: "Sign-in Methods  - Allow users to sign in with Google: from Off to On"
      operator: example@example.io
      time: "2022-12-16 18:20:07"
    Name: Google
  - ExpectedResult: true
    Log:
      action: Update
      category_type: Account
      operation_detail: "Sign-in Methods  - Allow users to sign in with Apple ID: from Off to On"
      operator: example@example.io
      time: "2022-12-16 18:19:57"
    Name: Apple ID
  - ExpectedResult: false
    Log:
      action: Update
      category_type: Account
      operation_detail: "Security  - Automatically sign users out after a specified time: from On to Off"
      operator: example@example.io
      time: "2022-12-16 18:20:42"
    Name: Automatic Sign Out Disabled
DedupPeriodMinutes: 60
LogTypes:
  - Zoom.Operation
RuleID: "Zoom.Sign.In.Method.Modified"
Threshold: 1


# ------ paired body: zoom_sign_in_method_modified.py ------

def rule(event):
    operation_detail = event.get("operation_detail", "<NO_OPS_DETAIL>")
    operation_flag = "Sign-in Methods  - Allow users to sign in with "
    setting_flag = "from Off to On"
    return all(
        [
            event.get("action", "<NO_ACTION>") == "Update",
            event.get("category_type", "<NO_CATEGORY_TYPE>") == "Account",
            operation_detail.startswith(operation_flag),
            operation_detail.endswith(setting_flag),
        ]
    )


def title(event):
    # string manipulation to grab service that allows sign-in from the operation detail
    # and clean it up a bit
    service_detail = ""
    operation_detail = event.get("operation_detail", "<NO_OPS_DETAIL>")
    operation_flag = "Sign-in Methods  - Allow users to sign in with "
    setting_flag = "from Off to On"
    if operation_detail.startswith(operation_flag) and operation_detail.endswith(setting_flag):
        service_detail = (
            event.get("operation_detail", "<NO_OPS_DETAIL>").split("with")[1].split(":")[0].strip()
        )
    return (
        f"Zoom User [{event.get('operator', '<NO_OPERATOR>')}] modified your organization's "
        f"sign in methods to allow users to sign in with [{service_detail}]."
    )