Slack Detections - EKM (#463)

* Initial commit - Slack EKM

* Anonymized IPs

* Fixed wording for descritpion on Slack.AuditLogs.EKMSlackbotUnenrolled

slack_rules/slack_ekm_config_changed.py

@@ -0,0 +1,11 @@
+from panther_base_helpers import slack_alert_context
+
+
+def rule(event):
+ # Only alert on the `ekm_logging_config_set` action
+ return event.get("action") == "ekm_logging_config_set"
+
+
+def alert_context(event):
+ # TODO: Add details to the context
+ return slack_alert_context(event)

slack_rules/slack_ekm_config_changed.yml

@@ -0,0 +1,81 @@
+AnalysisType: rule
+Filename: slack_ekm_config_changed.py
+RuleID: Slack.AuditLogs.EKMConfigChanged
+DisplayName: Slack EKM Config Changed
+Enabled: true
+LogTypes:
+ - Slack.AuditLogs
+Tags:
+ - Slack
+Severity: High
+Description: Detects when the logging settings for a workspace's EKM configuration has changed
+Reference: https://api.slack.com/admins/audit-logs
+DedupPeriodMinutes: 60
+Threshold: 1
+SummaryAttributes:
+ - p_any_ip_addresses
+ - p_any_emails
+Tests:
+ -
+ Name: EKM Config Changed
+ ExpectedResult: true
+ Log:
+ {
+ "action": "ekm_logging_config_set",
+ "actor": {
+ "type": "user",
+ "user": {
+ "email": "[email protected]",
+ "id": "A012B3CDEFG",
+ "name": "username",
+ "team": "T01234N56GB"
+ }
+ },
+ "context": {
+ "ip_address": "1.2.3.4",
+ "location": {
+ "domain": "test-workspace",
+ "id": "T01234N56GB",
+ "name": "test-workspace",
+ "type": "workspace"
+ },
+ "ua": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36"
+ }
+ }
+ -
+ Name: User Logout
+ ExpectedResult: false
+ Log:
+ {
+ "action": "user_logout",
+ "actor": {
+ "type": "user",
+ "user": {
+ "email": "[email protected]",
+ "id": "W012J3FEWAU",
+ "name": "primary-owner",
+ "team": "T01234N56GB"
+ }
+ },
+ "context": {
+ "ip_address": "1.2.3.4",
+ "location": {
+ "domain": "test-workspace-1",
+ "id": "T01234N56GB",
+ "name": "test-workspace-1",
+ "type": "workspace"
+ },
+ "ua": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36"
+ },
+ "date_create": "2022-07-28 15:22:32",
+ "entity": {
+ "type": "user",
+ "user": {
+ "email": "[email protected]",
+ "id": "W012J3FEWAU",
+ "name": "primary-owner",
+ "team": "T01234N56GB"
+ }
+ },
+ "id": "72cac009-9eb3-4dde-bac6-ee49a32a1789"
+ }

slack_rules/slack_ekm_slackbot_unenrolled.py

@@ -0,0 +1,10 @@
+from panther_base_helpers import slack_alert_context
+
+
+def rule(event):
+ # Only alert on the `ekm_slackbot_unenroll_notification_sent` action
+ return event.get("action") == "ekm_slackbot_unenroll_notification_sent"
+
+
+def alert_context(event):
+ return slack_alert_context(event)

slack_rules/slack_ekm_slackbot_unenrolled.yml

@@ -0,0 +1,81 @@
+AnalysisType: rule
+Filename: slack_ekm_slackbot_unenrolled.py
+RuleID: Slack.AuditLogs.EKMSlackbotUnenrolled
+DisplayName: Slack EKM Slackbot Unenrolled
+Enabled: true
+LogTypes:
+ - Slack.AuditLogs
+Tags:
+ - Slack
+Severity: High
+Description: Detects when a workspace is longer enrolled in EKM
+Reference: https://api.slack.com/admins/audit-logs
+DedupPeriodMinutes: 60
+Threshold: 1
+SummaryAttributes:
+ - p_any_ip_addresses
+ - p_any_emails
+Tests:
+ -
+ Name: EKM Slackbot Unenrolled
+ ExpectedResult: true
+ Log:
+ {
+ "action": "ekm_slackbot_unenroll_notification_sent",
+ "actor": {
+ "type": "user",
+ "user": {
+ "email": "[email protected]",
+ "id": "A012B3CDEFG",
+ "name": "username",
+ "team": "T01234N56GB"
+ }
+ },
+ "context": {
+ "ip_address": "1.2.3.4",
+ "location": {
+ "domain": "test-workspace",
+ "id": "T01234N56GB",
+ "name": "test-workspace",
+ "type": "workspace"
+ },
+ "ua": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36"
+ }
+ }
+ -
+ Name: User Logout
+ ExpectedResult: false
+ Log:
+ {
+ "action": "user_logout",
+ "actor": {
+ "type": "user",
+ "user": {
+ "email": "[email protected]",
+ "id": "W012J3FEWAU",
+ "name": "primary-owner",
+ "team": "T01234N56GB"
+ }
+ },
+ "context": {
+ "ip_address": "1.2.3.4",
+ "location": {
+ "domain": "test-workspace-1",
+ "id": "T01234N56GB",
+ "name": "test-workspace-1",
+ "type": "workspace"
+ },
+ "ua": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36"
+ },
+ "date_create": "2022-07-28 15:22:32",
+ "entity": {
+ "type": "user",
+ "user": {
+ "email": "[email protected]",
+ "id": "W012J3FEWAU",
+ "name": "primary-owner",
+ "team": "T01234N56GB"
+ }
+ },
+ "id": "72cac009-9eb3-4dde-bac6-ee49a32a1789"
+ }

slack_rules/slack_ekm_unenrolled.py

@@ -0,0 +1,10 @@
+from panther_base_helpers import slack_alert_context
+
+
+def rule(event):
+ # Only alert on the `ekm_unenrolled` action
+ return event.get("action") == "ekm_unenrolled"
+
+
+def alert_context(event):
+ return slack_alert_context(event)

slack_rules/slack_ekm_unenrolled.yml

@@ -0,0 +1,81 @@
+AnalysisType: rule
+Filename: slack_ekm_unenrolled.py
+RuleID: Slack.AuditLogs.EKMUnenrolled
+DisplayName: Slack App Access Expanded
+Enabled: true
+LogTypes:
+ - Slack.AuditLogs
+Tags:
+ - Slack
+Severity: Critical
+Description: Detects when a workspace is no longer enrolled or managed by EKM
+Reference: https://api.slack.com/admins/audit-logs
+DedupPeriodMinutes: 60
+Threshold: 1
+SummaryAttributes:
+ - p_any_ip_addresses
+ - p_any_emails
+Tests:
+ -
+ Name: EKM Unenrolled
+ ExpectedResult: true
+ Log:
+ {
+ "action": "ekm_unenrolled",
+ "actor": {
+ "type": "user",
+ "user": {
+ "email": "[email protected]",
+ "id": "A012B3CDEFG",
+ "name": "username",
+ "team": "T01234N56GB"
+ }
+ },
+ "context": {
+ "ip_address": "1.2.3.4",
+ "location": {
+ "domain": "test-workspace",
+ "id": "T01234N56GB",
+ "name": "test-workspace",
+ "type": "workspace"
+ },
+ "ua": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36"
+ }
+ }
+ -
+ Name: User Logout
+ ExpectedResult: false
+ Log:
+ {
+ "action": "user_logout",
+ "actor": {
+ "type": "user",
+ "user": {
+ "email": "[email protected]",
+ "id": "W012J3FEWAU",
+ "name": "primary-owner",
+ "team": "T01234N56GB"
+ }
+ },
+ "context": {
+ "ip_address": "1.2.3.4",
+ "location": {
+ "domain": "test-workspace-1",
+ "id": "T01234N56GB",
+ "name": "test-workspace-1",
+ "type": "workspace"
+ },
+ "ua": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36"
+ },
+ "date_create": "2022-07-28 15:22:32",
+ "entity": {
+ "type": "user",
+ "user": {
+ "email": "[email protected]",
+ "id": "W012J3FEWAU",
+ "name": "primary-owner",
+ "team": "T01234N56GB"
+ }
+ },
+ "id": "72cac009-9eb3-4dde-bac6-ee49a32a1789"
+ }