Zoom User Promoted to Privileged Role

AnalysisType: rule
Description: A Zoom user was promoted to a privileged role.
DisplayName: "Zoom User Promoted to Privileged Role"
Enabled: true
Filename: zoom_user_promoted_to_privileged_role.py
Reference: https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0064983
Severity: Medium
Tests:
  - ExpectedResult: true
    Log:
      action: Batch Update
      category_type: User
      operation_detail: "Change Role  - homer.simpson@duff.io: from User to Co-Owner"
      operator: admin-test%1223+123@duff.dev.co
      time: "2022-07-05 20:28:48"
    Name: Admin Promotion Event
  - ExpectedResult: false
    Log:
      action: Batch Update
      category_type: User
      operation_detail: "Change Role  - homer.simpson@duff.io: from Admin to Co-Owner"
      operator: admin@duff.io
      time: "2022-07-05 20:28:48"
    Name: Admin to Admin
  - ExpectedResult: false
    Log:
      action: Batch Update
      category_type: User
      operation_detail: "Change Role  - homer.simpson@duff.io: from Admin to Billing Admin"
      operator: admin@duff.io
      time: "2022-07-05 20:28:48"
    Name: Admin to Billing Admin
  - ExpectedResult: true
    Log:
      action: Batch Update
      category_type: User
      operation_detail: "Change Role  - homer.simpson@duff.io: from Member to Billing Admin"
      operator: admin@duff.io
      time: "2022-07-05 20:28:48"
    Name: Member to Billing Admin Event
  - ExpectedResult: false
    Log:
      action: Batch Update
      category_type: User
      operation_detail: "Change Role  - homer.simpson@duff.io: from Co-Owner to User"
      operator: admin@duff.io
      time: "2022-07-05 20:28:48"
    Name: Admin to User
  - ExpectedResult: false
    Log:
      action: Batch Update
      category_type: User
      operation_detail: "Change Role  - homer.simpson@duff.io: from Co-Owner to Admin"
      operator: admin@duff.io
      time: "2022-07-05 20:28:48"
    Name: CoOwner to Admin
  - ExpectedResult: false
    Log:
      action: SCIM API - Update
      category_type: User
      operation_detail: "Edit User homer.simpson@duff.co  - Change Type: from Basic to Licensed"
      operator: admin-test%1223+123@duff.dev.co
      time: "2022-07-01 22:05:22"
    Name: Other Event
DedupPeriodMinutes: 60
LogTypes:
  - Zoom.Operation
RuleID: "Zoom.User.Promoted.to.Privileged.Role"
Threshold: 1


# ------ paired body: zoom_user_promoted_to_privileged_role.py ------

import re

from panther_base_helpers import EMAIL_REGEX

PRIVILEGED_ROLES = ("Admin", "Co-Owner", "Owner", "Billing Admin")


def extract_values(event):
    operator = event.get("operator", "<operator-not-found>")
    operation_detail = event.get("operation_detail", "")
    email = re.search(EMAIL_REGEX, operation_detail)[0] or "<email-not-found>"
    fromto = re.findall(r"from ([-\s\w]+) to ([-\s\w]+)", operation_detail) or [
        ("<from-role-not-found>", "<to-role-not-found>")
    ]
    from_role, to_role = fromto[0] or ("<role-not-found>", "<role-not-found>")
    return operator, email, from_role, to_role


def rule(event):
    if (
        "Update" in event.get("action", "")
        and event.get("category_type") == "User"
        and event.get("operation_detail", "").startswith("Change Role")
    ):
        _, _, from_role, to_role = extract_values(event)
        return to_role in PRIVILEGED_ROLES and from_role not in PRIVILEGED_ROLES
    return False


def title(event):
    operator, email, from_role, to_role = extract_values(event)
    return (
        f"Zoom: [{email}]'s role was changed from [{from_role}] " f"to [{to_role}] by [{operator}]."
    )