Zoom Two Factor Authentication Disabled

AnalysisType: rule
Description: A Zoom User disabled your organization's setting to sign in with Two-Factor Authentication.
DisplayName: "Zoom Two Factor Authentication Disabled"
Enabled: true
Filename: zoom_two_factor_authentication_disabled.py
Runbook: Confirm this user acted with valid business intent and determine whether this activity was authorized.
Reference: https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0066054
Severity: Medium
Tests:
  - ExpectedResult: true
    Log:
      action: Update
      category_type: Account
      operation_detail: "Security  - Sign in with Two-Factor Authentication: from On to Off"
      operator: example@example.io
      time: "2022-12-16 18:20:35"
    Name: 2FA Disabled
  - ExpectedResult: false
    Log:
      action: Update
      category_type: Account
      operation_detail: "Security  - Sign in with Two-Factor Authentication: from Off to On"
      operator: example@example.io
      time: "2022-12-16 18:20:35"
    Name: 2FA Enabled
  - ExpectedResult: false
    Log:
      action: Update
      category_type: Account
      operation_detail: "Sign-in Methods  - Allow users to sign in with Apple ID: from Off to On"
      operator: example@example.io
      time: "2022-12-16 18:19:57"
    Name: "Sign In Apple ID "
DedupPeriodMinutes: 60
LogTypes:
  - Zoom.Operation
RuleID: "Zoom.Two.Factor.Authentication.Disabled"
Threshold: 1


# ------ paired body: zoom_two_factor_authentication_disabled.py ------

def rule(event):
    operation_detail = event.get("operation_detail", "<NO_OPS_DETAIL>")
    operation_flag = "Security  - Sign in with Two-Factor Authentication: from On to Off"
    return all(
        [
            event.get("action", "<NO_ACTION>") == "Update",
            event.get("category_type", "<NO_CATEGORY_TYPE>") == "Account",
            operation_detail == operation_flag,
        ]
    )


def title(event):
    return (
        f"Zoom User [{event.get('operator', '<NO_OPERATOR>')}] disabled your organization's "
        f"setting to sign in with Two-Factor Authentication."
    )