New Rule: Standard Sign-In from Rogue State #1332
Draft
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Added a new helper (panther_country_helpers) to contain code relating to getting contextual information from country codes. Moved the existing functions out out panther_base_helpers and expanded on them. Also refactored the rogue state sign-in rule to use the new helper.
OneLogin data model was checking the event type as an integer, but our schema actually casts the event type as a string, so the data model never mapped correctly. I've fixed this. Since I'm unsure if there's any likelihood of the event type being an integer instead of a string, I've opted to manually cast it to a string when comparing
|
😱 [INFO][root]: ignoring file dependabot.yml |
|
@arielkr256 there were 2 log sources associated with this rule that I was unable to write tests for: Atlassian and Zendesk. I couldn't find test login events to use. Should I remove those log types from the rule if we can't test them? |
|
Let's use an existing python module like pycountry instead of implementing our own. |
|
I've added pycountry to the pipenv file and adjusted the detection to use it. We're blocked until I can get pycountry added to the backend python runtime, so I'm gonna convert this to a draft for now to prevent it getting merged accidentally. |
arielkr256
added
rules
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Background
Some customers have requested the option to detect when a sign-in is detected from a list of "rogue nations". The list should be configurable according to each customer's needs. To ensure the detection is most effective, we use the Panther UDM to apply the logic to multiple log sources.
Changes
Standard.SignInFromRogueStatepanther_country_helperswhich allows users to get contextual information on different countriesStandard.OneLogin.EventsdatamodelTesting
make lint,make test