zendesk_new_api_token.py

API_TOKEN_ACTIONS = {
    "create",
    "destroy",
}


def rule(event):
    return event.get("source_type") == "api_token" and event.get("action", "") in API_TOKEN_ACTIONS


def title(event):
    action = event.get("action", "<UNKNOWN_ACTION>")
    return f"[{event.get('p_log_type')}]: User [{event.udm('actor_user')}] {action} an api token"


def severity(event):
    if event.get("action", "") == "destroy":
        return "INFO"
    return "HIGH"