PyPanther Detections

Configure detections fully in Python

Overview

PyPanther Detections are in closed beta starting with Panther version 1.108. Please share any bug reports and feature requests with your Panther support team.

PyPanther Detections are Panther’s evolved approach to detections-as-code. In this framework, detections are defined fully in Python, enabling component reusability and simple rule overrides. The foundation of PyPanther Detections is the Panther-managed pypanther Python library.

Key features

An entirely Python-native experience for importing, writing, modifying, testing, and uploading rules—eliminating the need to manage a fork or clone of panther-analysis.
```
# Import the Panther-managed BoxNewLogin rule
from pypanther.rules.box import BoxNewLogin
```

The ability to apply custom configurations to Panther-managed rules through overrides, filters, and inheritance.

from pypanther import Severity

# Set multiple attribute overrides
BoxNewLogin.override(
    default_severity=Severity.MEDIUM,
    tags=['Initial Access'],
    default_runbook="Ask user in Slack if this login was actually from them.",
)

# Add a simple filter to exclude all logins from Alice
BoxNewLogin.extend(
    exclude_filters=[lambda e: e.deep_get('created_by', 'name') != 'Alice'],
)

The ability to selectively choose the set of rules you want to include in your Panther deployment package.
```
from pypanther import register

# Register a single rule to test and upload
register(BoxNewLogin)
```

Benefits

PyPanther Detections have the following benefits:

No upstream merge conflicts: In the v1 model, merge conflicts can arise when syncing your customized fork of panther-analysis with the upstream repository. In this PyPanther model, Panther-managed rules exist separately from your rule configurations, eliminating the possibility of merge conflicts.
Full flexibility and composability: This feature offers complete flexibility in rule creation, enabling full modularity, composability, the ability to override any rule attribute, and full Python inheritance—all providing a customizable and user-centric experience.
First-class developer experience: Backed by a portable, open-source Python library called pypanther, this framework provides a superior local development experience by hooking into native applications and developer workflows. This library can also be loaded into any Python environment, such as Jupyter Notebooks.

PyPanther Detections vs. v1 detections

This documentation uses the term "v1 detections," which refers to rules created in the format described in Writing Python Detections. PyPanther Detections are sometimes referred to as "v2 detections."

Panther has developed a tool that translates detections from v1 to PyPanther format—see the convert command on Using the pypanther Command Line Tool.

PyPanther Detections differ from v1 detections in the following areas:

File structure: A rule in the v1 framework requires two files: a Python file to define rule logic and dynamic alerting functions and a YAML file to set metadata. A PyPanther rule is written entirely in Python.
- This singular rule definition in a Python class—which contains all functions, properties, and helpers—enables overrides and composability.
Process for retrieving Panther-managed detections: In v1 detections, you must periodically sync your copy of panther-analysis with upstream changes. With PyPanther Detections, however, no Git syncing is required—the latest Panther-managed content is always available in the pypanther Python library.
Packs: Panther-managed v1 detections are bundled in Detection Packs. With PyPanther Detections, you can choose which detections you want to include in your Panther instance using get_panther_rules() (or direct imports) with register().

The same detection, Box.New.Login is defined below in both versions:

v1 Box New Login rule

PyPanther Box New Login rule

Limitations of PyPanther Detections

PyPanther Detections are currently designed for real-time rules developed in the CLI workflow.

While PyPanther Detections are evolving rapidly, they currently have the following limitations:

(Planned) It’s not possible to define new custom Lookup Tables.
- It is possible to reference data from existing custom Lookup Tables, as well as Panther-managed Enrichment Providers.
(Planned) No support for Policies, Scheduled Rules, Simple Rules, Correlation Rules.
- Only rules (or “real-time rules”) are supported in the PyPanther framework.
(Planned) It’s not possible to use Data Replay in the CLI or Console workflows.
(Planned) It’s not possible to define your own data models.
- It is possible to reference Panther-managed data models in the pypanther library, using event.udm().
Library version pinning and declaring custom dependencies from the repository are not supported.
It’s not possible to edit PyPanther Detections in the Panther Console.
The CLI tool used with PyPanther Detections, pypanther, does not have all of the commands panther_analysis_tool does.
- See a list of available pypanther commands on Using the pypanther CLI Tool.
There are limitations on the functionality of the upload command. See the upload limitations section.

Getting started using PyPanther Detections

Panther has provided this pypanther-starter-kit repository, containing PyPanther Detection examples, which you can clone to quickly get up and running.

Get started by following the setup instructions in the repository's README.

Creating PyPanther Detections

Before writing PyPanther Detections, you’ll need to set up your environment. See Getting started using PyPanther Detections, above.

When working with PyPanther Detections:

A main.py file controls your entire detection configuration, outlining which rules to register, override configurations, and custom rule definitions. You can either:
- (Recommended) Define your detections in various other files/folders, then import them into main.py
- Define your detections in main.py
A PyPanther rule is defined in a single Python file. Within it, you can import Panther-managed (or your own custom) PyPanther rules and specify overrides. A single Python file can define multiple detections.
All PyPanther rules subclass the pypanther Rule class or a parent class of type Rule.
Rules must be registered to be tested and uploaded to your Panther instance.
All event object functions currently available in v1 detections are available in PyPanther Detections. These include: get(), deep_get(), deep_walk(), and udm().
All alert functions available in Python (v1) detections are available in PyPanther Detections, such as title() and severity(). See Rule auxiliary/alerting function reference.
Use the pypanther type-ahead hints in your IDE, like searching for available rules or viewing properties of classes.

Writing a custom PyPanther Detection

A "custom" PyPanther rule is one that you write completely from scratch—i.e., one that isn't built from a Panther-managed rule. Custom PyPanther rules are defined in a Python class that subclasses the pypanther Rule class. In this class, you must:

Define a rule() function
- (Optional) Define any of the other alert functions, like title() or destinations()
Define certain attributes, such as log_types
- (Optional) Define additional attributes, such as threshold or dedup_period_minutes

The id attribute is only required for a rule if you plan to register it.

See the Rule property reference section for a full list of required and optional fields.

from pypanther import Rule, Severity, LogType

# Custom rule for a Panther-supported log type
class MyCloudTrailRule(Rule):
    id = "MyCloudTrailRule"
    tests = True
    log_types = [LogType.AWS_CLOUDTRAIL]
    default_severity = Severity.MEDIUM
    threshold = 50
    dedup_period_minutes = 1

    def rule(self, event) -> bool:
        return (
	    event.get("eventType") == "AssumeRole" and 
	        400 <= int(event.get("errorCode", 0)) <= 413
	)

Importing Panther-managed rules

Panther-managed rules can be imported directly or using the get_panther_rules() function.

Panther-managed rules currently all have a -prototype suffix (e.g., AWS.Root.Activity-prototype). This is temporary, and will be removed in the future.

You may want to import Panther-managed rules (into main.py or another file) to either register them individually as-is, set overrides on them, or subclass them. You can import Panther-managed rules directly (from the pypanther.rules module) or by using the get_panther_rules() function.

To import a Panther-managed rule directly using the rules module, you would use a statement like:

from pypanther.rules.github import GitHubAdvancedSecurityChange

The get_panther_rules() function can filter on any Rule class attribute, such as default_severity, log_types, or tag. When filtering, keys use AND logic, and values use OR logic.

Get all Panther-managed rules using get_panther_rules():

from pypanther import get_panther_rules

all_rules = get_panther_rules()

Get Panther-managed rules with certain severities using get_panther_rules():

from pypanther import get_panther_rules, Severity

important_rules = get_panther_rules(
    default_severity=[
        Severity.HIGH,
        Severity.CRITICAL,
    ]
)

Get Panther-managed rules for certain log types using get_panther_rules():

from pypanther import get_panther_rules, LogType

cloudtrail_okta_rules = get_panther_rules(
    log_types=[
        LogType.AWS_CLOUDTRAIL,
        LogType.OKTA_SYSTEM_LOG
    ]
)

Get Panther-managed rules that meet multiple criteria using get_panther_rules():

from pypanther import get_panther_rules, Severity

rules_i_care_about = get_panther_rules(
    enabled=True,
    default_severity=[Severity.CRITICAL, Severity.HIGH],
    tags=["Configuration Required"],
)

See Using list comprehension for an example of how to use get_panther_rules() with advanced Python.

Once you’ve imported a Panther-managed rule, you can modify it using overrides or inheritance.

Applying overrides on existing rules

If your objective is to modify a rule's logic, it's recommended to use include/exclude filters instead of overriding the rule() function itself. Learn more in Use filters instead of overriding rule().

When making overrides on Panther-managed detections, it's recommended to:

Outside of main.py, store all of your overrides in apply_overrides() functions.
In main.py, call pypanther's apply_overrides() to apply each of your apply_overrides() functions.

Learn more about apply_overrides() in PyPanther Detections Style Guide.

Overriding single attributes

You can override a single rule attribute in a one-line statement using the override() function:

from pypanther import Severity
from pypanther.rules.aws_cloudtrail import AWSCloudTrailCreated

# Set rule severity to High
AWSCloudTrailCreated.override(default_severity=Severity.HIGH)

Overriding multiple attributes with the override function

It’s also possible to make multi-attribute overrides with the override() function:

from pypanther import Severity
from pypanther.rules.box import BoxContentWorkflowPolicyViolation

BoxContentWorkflowPolicyViolation.override(
    default_severity=Severity.HIGH,
    default_runbook="Check if other internal users hit this same violation"
)

Applying overrides on multiple PyPanther rules

To apply overrides on multiple rules at once, iterate over the collection using a for loop.

This could be useful, for example, when updating a certain attribute for all rules associated to a certain LogType.

from pypanther import get_panther_rules, Severity, LogType

rules = get_panther_rules(
    enabled=True,
    default_severity=[Severity.CRITICAL, Severity.HIGH],
    tags=["Configuration Required"],
)

# Define the destination [override](<https://docs.panther.com/detections/rules/python#destinations>)
def aws_cloudtrail_destinations(self, event):
    if event.get('recipientAccountId') == 112233445566:
        # Name or UUID of a configured Slack Destination
        return ['AWS Notifications']
    # Suppress the alert, doesn't deliver
    return ['SKIP']

# Appending to the Panther-managed rules' destinations and tags using extend()
for rule in rules:
    rule.extend(
        default_destinations="Slack #security",
        tags="Production",
    )
		
    # Updating the destinations method for CloudTrail rules
    if LogType.AWS_CLOUDTRAIL in rule.log_types:
        rule.destinations = aws_cloudtrail_destinations

Extending list attributes on existing rules

When making modifications to an existing rule, you might want to add items to a list-type rule attribute (like tags, tests, include_filters, or exclude_filters) while preserving the existing list.

Instead of overriding the attribute (using one of the methods in Applying overrides on existing rules), which would replace the existing list value, use the pypanther extend() function to append new values to the list attribute.

from pypanther import Severity
from pypanther.rules.box_rules.box_policy_violation import BoxContentWorkflowPolicyViolation

BoxContentWorkflowPolicyViolation.extend(
    tags="Production",
    include_filters=lambda event: event.get("env") == "prod"
)

# Because BoxContentWorkflowPolicyViolation already has a "Box" tag, it will now 
# have two tags: "Production" and "Box"

# Because BoxContentWorkflowPolicyViolation does not already define include_filters, 
# it will now have the single filter above

Creating include or exclude filters

PyPanther Detection filters let you exclude certain events from being evaluated by a rule. Filters are designed to be applied on top of existing rule logic (likely for Panther-managed PyPanther Detections you are importing).

Each filter defines logic that is run before the rule() function, and the outcome of the filter determines whether or not the event should go on to be evaluated by the rule.

Common use cases for filters include:

To target only certain environments, like prod
To exclude events that are known false positives, due to a misconfiguration or other non-malicious scenario

There are two types of filters:

include_filters: If the filter returns True for an event, the event is evaluated by rule()
exclude_filters: If the filter returns True for an event, the event is dismissed (i.e., not evaluated by rule())

The Rule base class has include_filters and exclude_filters attributes, which each contain a list of functions that will be evaluated against the log event.

Examples as standalone functions:

from pypanther.rules.github import GitHubAdvancedSecurityChange

# Include only repos that are production
prod_repos = ["prod_repo1", "prod_repo2"]
GitHubAdvancedSecurityChange.extend(
    include_filters=lambda e: e.get("repo") in prod_repos
)

from pypanther.rules.box import BoxContentWorkflowPolicyViolation

# Exclude accounts that are for development
dev_repos = ["dev_repo1", "dev_repo2"]
GitHubAdvancedSecurityChange.extend(
    exclude_filters=lambda e: e.get("repo") in dev_repos
)

Example as part of an inherited rule definition:

from pypanther.wrap import include, exclude
from pypanther.rules.github import GitHubAdvancedSecurityChange

class GitHubAdvancedSecurityChangeOverride(GitHubAdvancedSecurityChange):
    id = "GitHubAdvancedSecurityChangeOverride"
    # In a real-world scenario, likely only one of the below would be necessary
    # Extend parent rule's include_filters
    include_filters = super().include_filters.append(lambda e: e.get("repo") in prod_repos)
    # Override parent rule's exclude_filters
    exclude_filters = [lambda e: e.get("repo") in dev_repos]
    ...

Filters can also be reused with a for loop to be applied to multiple rules:

from pypanther.wrap import include

rules = [
    # Panther-managed and custom rules
    ...
]

def prod_filter(event):
    return event.get("repo") in prod_repos
		
for rule in rules:
    rule.extend(include_filters=prod_filter)

Ensuring necessary fields are set on configuration-required rules

Panther-managed rules that require some customer configuration before they are uploaded into a Panther environment may include a validate_config() function, which defines one or more conditions that must be met for the rule to pass the test command (and function properly).

Most commonly, validate_config() verifies that some class variable, such as an allowlist or denylist, has been assigned a value. If the requirements included in validate_config() are not met, an exception will be raised when the pypanther test command is run (if the rule is registered).

Example:

class ValidateMyRule(Rule):
    id = "Validate.MyRule"
    log_types = [LogType.PANTHER_AUDIT]
    default_severity = Severity.HIGH

    allowed_domains: list[str] = []

    def rule(self, event):
        return event.get("domain") not in self.allowed_domains

    @classmethod 
    def validate_config(cls):
        assert (
            len(cls.allowed_domains) > 0
        ), "The allowed_domains field on your rule must be populated"

In this example, if allowed_domains is not assigned a non-empty list, an assertion error will be thrown during pypanther test.

To set this value, you can use a statement like:

ValidateMyRule.allowed_domains = ["example.com"]

Creating PyPanther rules with inheritance

You can use inheritance to create rules that are subclasses of other rules (that are Panther-managed or custom).

It’s recommended to use inheritance when you’re creating a collection of rules that all share a number of characteristics—for example, rule() function logic, property values, class variables, or helper functions. In this case, it’s useful to create a base rule that all related rules inherit from.

For example, it may be useful to create a base rule for each LogType, from which all rules for that LogType are extended.

Inheritance is commonly used with filters—i.e., subclassed rules can define additional criteria an event must meet in order to be processed by the rule.

If you don’t plan to register a base rule, it’s not required to provide it an id property.

Example:

# Custom rule for a custom log type — the parent rule
class HostIDSBaseRule(Rule):
    # id not necessary since we're not uploading this parent rule
    log_types = ['Custom.HostIDS']
    default_severity = Severity.HIGH
    threshold = 1
    dedup_period_minutes = 6 * 60 # 6 hours

    def rule(self, event) -> bool:
        return event.get('event_name') == 'confirmed_compromise'
    
    def host_user_lookup(self, hostname):
	return 'groot'
		
    def title(self, event): -> str:
	return f"Confirmed compromise from hostname {event.get('hostname')}"
		
    def alert_context(self, event):
	user = self.host_user_lookup(event.get('hostName') 
	return {
	    'hostname': event['hostName'],
	    'time': event['p_event_time'],
	    'user': user,
	}

# Inherited rule #1

# Filter on event_type (in addition to base rule function)
@include(lambda e: e.get('event_type') == 'c2')
class IDSCommandAndControl(HostIDSBaseRule):
    id = 'IDSCommandAndControl'
    threshold = 19
    
    def title(self, event):
	return f"Confirmed c2 on host {event.get('hostname')}"
	
    # From parent rule, inherits rule(), alert_context(), log_types, severity, and dedup_period_minutes
    # From PantherRule, inherits other fields (like Enabled)

# Inherited rule #2

# Filter on event_type (in addition to base rule function)
@include(lambda e: e.get('event_type') == 'malware')
class IDSCommandAndControl(HostIDSBaseRule):
    id = 'HostIDSMalware'
    threshold = 2
    default_severity = Severity.CRITICAL

    def title(self, event):
	return f"Confirmed malware on host {event.get('hostname')}"
    
    # From parent rule, inherits rule(), alert_context(), log_types, and dedup_period_minutes
    # From PantherRule, inherits other fields (like enabled)

Using advanced Python

Because PyPanther rules are fully defined in Python, you can use its full expressiveness when customizing your detections.

Calling `super()`

For more advanced use cases, you can supplement the logic in functions defined by the parent rule.

# Creating an inherited rule
class MyRule(AnExistingRule):
    def alert_context(self, event):
	# Preserve the parent rule's alert context and extend with a new field
	context = super().alert_context(event)
	context["new field"] = "new_value"
	return context
				
    def severity(self, event):
	# Conditionally increment the parent rule's severity
	if event.get("env") == "prod":
	    return Severity.CRITICAL
	return super().severity(event)

Using list comprehension

You can use Python’s list comprehension functionality to create a new list based on an existing list with condensed syntax. This may be particularly useful when you want to filter a list of detections fetched using get_panther_rules().

# Collection of rules that have more than one LogType
rules = [rule for rule in get_panther_rules() if len(rule.log_types) > 1]
					
# Collection of rules that do not require configuration
rules = [rule for rule in get_panther_rules() if "Configuration Required" not in rule.tags]

Registering PyPanther Detections

Registering a PyPanther rule means including it in your Panther deployment package.

To register a rule, pass it in to register() in your main.py file. When you run the pypanther upload or test commands, only rules passed in to register() will be uploaded to your Panther instance or tested.

If a previously uploaded rule is not passed in to register() on a subsequent invocation of upload, it will be deleted in your Panther instance.

Registering a single rule more than once (perhaps because it’s included in multiple collections, which are all passed into register()) will not result in an error.

It’s not required to register rules used as base rules with inheritance so long as you do not want the base rules themselves uploaded into your Panther instance.

# Sample main.py file

from pypanther import register, get_panther_rules

# Register a single rule (that was defined as a class called "BoxNewLogin")
register(BoxNewLogin)

# Register all Panther-managed rules
register(get_panther_rules())

Viewing registered rules

To see all rules that are registered given your currently configured repository, run the pypanther list rules CLI command.
- Learn about other commands in the pypanther CLI command reference.

Importing instances of `Rule`

You can use the get_rules() function to easily fetch rules you might want to register in main.py. get_rules() takes in an imported package (folder) or module (file) name, and returns all rules from that package or module that inherit the pypanther Rule class.

Each folder containing rules imported with get_rules() must contain an __init__.py file. Learn more about recommended repository structure in the PyPanther Detections Style Guide.

Example using get_rules():

# main.py
import custom_rules

all_my_rules = get_rules(custom_rules)

register(all_my_rules)

Registering vs. enabling a rule

All rules have an enabled property, which is different from being registered. See the table below for all possible outcomes:

enabled = True

enabled = False

Testing PyPanther Detections

Defining tests

Tests for PyPanther Detections are defined by creating instances of the pypanther RuleTest class.

Each instance of RuleTest must set a name, expected_result, and log. Each test can also optionally define:

Additional fields (prepended with expected_) that verify the output of alert functions. For example, expected_severity and expected_title.
A mocks field, which takes a list of RuleMocks.

See a full list of available fields in the RuleTest property reference.

my_rule_tests: List[RuleTest] = [
    RuleTest(
	name="RuleShouldReturnTrue"
	expected_result=True,
	log={
	    "name":"value"
	}
    ),
    RuleTest(
	name="RuleShouldReturnFalse"
	expected_result=False,
	log={
	    "name":"value"
	}
    )
]

Tests are associated with rules by assigning them to a rule’s tests field. Tests can be defined directly within a rule, or separately set to a variable (that is either local or imported).

Example

Note that this rule's tests (defined above the rule class) use mocks, expected_title, expected_dedup, and expected_alert_context.

Example: Rule with tests

from pypanther import LogType, Rule, RuleMock, RuleTest, Severity, panther_managed
from pypanther.helpers.base import deep_get
from pypanther.helpers.default import lookup_aws_account_name
from pypanther.helpers.oss import geoinfo_from_ip_formatted

aws_console_root_login_tests: list[RuleTest] = [
    RuleTest(
        name="Successful Root Login",
        expected_result=True,
        expected_title="AWS root login detected from [111.111.111.111] (111.111.111.111 in SF, California in USA) in account [sample-account]",
        expected_dedup="123456789012-ConsoleLogin-2019-01-01T00:00:00Z",
        expected_alert_context={
            "sourceIPAddress": "111.111.111.111",
            "userIdentityAccountId": "123456789012",
            "userIdentityArn": "arn:aws:iam::123456789012:root",
            "eventTime": "2019-01-01T00:00:00Z",
            "mfaUsed": "No",
        },
        mocks=[
            RuleMock(object_name="geoinfo_from_ip_formatted", return_value="111.111.111.111 in SF, California in USA")
        ],
        log={
            "eventVersion": "1.05",
            "userIdentity": {
                "type": "Root",
                "principalId": "1111",
                "arn": "arn:aws:iam::123456789012:root",
                "accountId": "123456789012",
                "userName": "root",
            },
            "eventTime": "2019-01-01T00:00:00Z",
            "eventSource": "signin.amazonaws.com",
            "eventName": "ConsoleLogin",
            "awsRegion": "us-east-1",
            "sourceIPAddress": "111.111.111.111",
            "userAgent": "Mozilla",
            "requestParameters": None,
            "responseElements": {"ConsoleLogin": "Success"},
            "additionalEventData": {
                "LoginTo": "https://console.aws.amazon.com/console/",
                "MobileVersion": "No",
                "MFAUsed": "No",
            },
            "eventID": "1",
            "eventType": "AwsConsoleSignIn",
            "recipientAccountId": "123456789012",
        },
    ),
    RuleTest(
        name="Non-Login Event",
        expected_result=False,
        expected_dedup="123456789012-DescribeTable-2019-01-01T00:00:00Z",
        expected_alert_context={
            "sourceIPAddress": "111.111.111.111",
            "userIdentityAccountId": "123456789012",
            "userIdentityArn": "arn:aws:sts::123456789012:user/tester",
            "eventTime": "2019-01-01T00:00:00Z",
            "mfaUsed": None,
        },
        mocks=[
            RuleMock(object_name="geoinfo_from_ip_formatted", return_value="111.111.111.111 in SF, California in USA")
        ],
        log={
            "eventVersion": "1.06",
            "userIdentity": {
                "type": "AssumedRole",
                "principalId": "1111:tester",
                "arn": "arn:aws:sts::123456789012:user/tester",
                "accountId": "123456789012",
                "accessKeyId": "1",
                "sessionContext": {
                    "sessionIssuer": {
                        "type": "Role",
                        "principalId": "1111",
                        "arn": "arn:aws:iam::123456789012:user/tester",
                        "accountId": "123456789012",
                        "userName": "tester",
                    },
                    "attributes": {"creationDate": "2019-01-01T00:00:00Z", "mfaAuthenticated": "true"},
                },
            },
            "eventTime": "2019-01-01T00:00:00Z",
            "eventSource": "dynamodb.amazonaws.com",
            "eventName": "DescribeTable",
            "awsRegion": "us-west-2",
            "sourceIPAddress": "111.111.111.111",
            "userAgent": "console.amazonaws.com",
            "requestParameters": {"tableName": "table"},
            "responseElements": None,
            "requestID": "1",
            "eventID": "1",
            "readOnly": True,
            "resources": [{"accountId": "123456789012", "type": "AWS::DynamoDB::Table", "ARN": "arn::::table/table"}],
            "eventType": "AwsApiCall",
            "apiVersion": "2012-08-10",
            "managementEvent": True,
            "recipientAccountId": "123456789012",
        },
    ),
]


@panther_managed
class AWSConsoleRootLogin(Rule):
    id = "AWS.Console.RootLogin-prototype"
    display_name = "Root Console Login"
    dedup_period_minutes = 15
    log_types = [LogType.AWS_CLOUDTRAIL]
    tags = [
        "AWS",
        "Identity & Access Management",
        "Authentication",
        "DemoThreatHunting",
        "Privilege Escalation:Valid Accounts",
    ]
    reports = {"CIS": ["3.6"], "MITRE ATT&CK": ["TA0004:T1078"]}
    default_severity = Severity.HIGH
    default_description = "The root account has been logged into."
    default_runbook = "Investigate the usage of the root account. If this root activity was not authorized, immediately change the root credentials and investigate what actions the root account took.\n"
    default_reference = "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html"
    summary_attributes = ["userAgent", "sourceIpAddress", "recipientAccountId", "p_any_aws_arns"]
    tests = aws_console_root_login_tests

    def rule(self, event):
        return (
            event.get("eventName") == "ConsoleLogin"
            and deep_get(event, "userIdentity", "type") == "Root"
            and (deep_get(event, "responseElements", "ConsoleLogin") == "Success")
        )

    def title(self, event):
        ip_address = event.get("sourceIPAddress")
        return f"AWS root login detected from [{ip_address}] ({geoinfo_from_ip_formatted(ip_address)}) in account [{lookup_aws_account_name(event.get('recipientAccountId'))}]"

    def dedup(self, event):
        # Each Root login should generate a unique alert
        return "-".join([event.get("recipientAccountId"), event.get("eventName"), event.get("eventTime")])

    def alert_context(self, event):
        return {
            "sourceIPAddress": event.get("sourceIPAddress"),
            "userIdentityAccountId": deep_get(event, "userIdentity", "accountId"),
            "userIdentityArn": deep_get(event, "userIdentity", "arn"),
            "eventTime": event.get("eventTime"),
            "mfaUsed": deep_get(event, "additionalEventData", "MFAUsed"),
        }

Running tests

To run all tests defined for your PyPanther Detections, run:

$ pypanther test

To run only a subset of tests, filter the detections for which tests are run by using a filter flag with test, such as --id or --log-types. See a full list of filter flags by running pypanther test --help.

The test command:

Only tests those detections passed into register()
Skips tests for Panther-managed rules

If any rules fail a test, the error will print next to the rule name that was tested:

MyRuleNameI:
   FAIL: my test name
     - Expected rule() to return 'True', but got 'False'

Testing custom helper functions and data fixtures

The pypanther test command tests all PyPanther Detection classes that have a tests attribute set. In addition to testing rule() and alert function output in this way, if you have created custom helper functions for use in rules, you may want to write targeted tests for these helper functions. To do this, it's recommended to use a common Python testing framework, such as pytest or unittest.

Currently, pypanther will not run these tests during pypanther test, but they can be run locally or as part of your CI/CD workflow.

Example: using pytest to test a custom function

Say you'd like to write a reusable function that reads a list of AWS account IDs from a file and filters it to include only the production ones. (This function could then be used in an include or exclude filter.) This function might look like the following:

import pandas as pd

# A sample list of account data you may use with your detections
_account_data = [
        {"account_id": "012345678901", "account_age_days": 1543, "environment": "prod"},
        {"account_id": "112345678901", "account_age_days": 1753, "environment": "staging"},
        ...
        {"account_id": "756239201432", "account_age_days": 32, "environment": "development"}
        ]

# Load account data into a pandas dataframe for easy access
AWS_ACCOUNTS = pd.DataFrame.from_dict(_account_data) 

def is_prod_aws_account(account_id: str) -> bool:
    """
    Checks the AWS_ACCOUNTS dataframe to see if an account_id is in production
    """
    return AWS_ACCOUNTS.loc[AWS_ACCOUNTS['account_id'] == account_id, "environment"] == "prod"

Given this function, there are a few ways in which you may want to test both the data fixture (AWS_ACCOUNTS) itself, as well as the function is_prod_aws_account(). For instance:

To verify that the AWS_ACCOUNTS data fixture:
- Has a certain number of rows
- Has a certain required field
To verify that certain account IDs are included in the prod list (and others are not)

To test these characteristics using pytest, you would add the following functions (all with the test_ prefix):

def test_accounts_metadata_is_correct_size():
    """
    Ensure that the account list has 100 rows.
    """
    assert AWS_ACCOUNTS.shape[0] == 100

def test_critical_list_is_marked_prod():
    """
    Ensure that specific accounts are marked as production while other ones are not
    """
    expected_prod_list = ["012345678901", "012345678902", "012345678903"]
    for account_id in expected_prod_list:
        assert is_prod_aws_account(account_id)
    
    expected_non_prod_list = ["012345678905", "012345678906", "012345678907"]
    for account_id in expected_non_prod_list:
        assert not is_prod_aws_account(account_id)

def test_accounts_metadata_has_account_age_field():
    """
    Ensure the metadata data fixture has a field we may require for another helper function
    """
    assert "account_age_days" in AWS_ACCOUNTS.columns

After you define these tests, you can invoke them by running pytest from your command line.

Uploading PyPanther Detections to Panther

In order to use the pypanther upload functionality, it must first be enabled for you. If you would like to upload detections, please reach out to your Panther Support team.

To upload all PyPanther Detections that are registered, run:

$ pypanther upload

You must authenticate when using upload—see Authenticating CLI commands.

You can see all upload options by running pypanther upload -h, but may find the following options particularly useful:

--verbose: Generates verbose output, which includes a list of tests by detection (and their pass/fail statuses), a list of registered detections, and a list of included files
--dry-run: Do not upload, but show a summary of the changes that will be applied in the next upload
--output {text, json}: Prints output in the provided format
- text is the default value, but json can be useful if you plan to port the output into another workflow

Sample output for pypanther upload --verbose --output json

{
    "result": "UPLOAD_SUCCEEDED",
    "upload_statistics": {
      "rules": {
        "new": 0,
        "total": 569,
        "modified": 569,
        "deleted": 0
      }
    },
    "tests": {
      "test_results": {
        // Only a subset of rule tests are shown below, for conciseness
        "AWS.ECR.EVENTS": [
          {
            "test_name": "Authorized account, unauthorized region",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          },
          {
            "test_name": "Unauthorized account",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          },
          {
            "test_name": "Authorized account",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          }
        ],
        "Osquery.Mac.OSXAttacksKeyboardEvents": [
          {
            "test_name": "App running on Desktop that is watching keyboard events",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          },
          {
            "test_name": "App is running from approved path",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          },
          {
            "test_name": "Unrelated query does not alert",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          }
        ],
        "Dropbox.User.Disabled.2FA": [
          {
            "test_name": "2FA Disabled",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          },
          {
            "test_name": "Other",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          }
        ],
        "Push.Security.Authorized.IdP.Login": [
          {
            "test_name": "Google Workspace Password Login",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          },
          {
            "test_name": "Microsoft 365 OIDC Login",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          },
          {
            "test_name": "Okta Login",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          },
          {
            "test_name": "Password Login",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          }
        ],
        "GSuite.GroupBannedUser": [
          {
            "test_name": "User Added",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          },
          {
            "test_name": "User Banned from Group",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          }
        ],
        "AWS.S3.ServerAccess.Error": [
          {
            "test_name": "Amazon Access Error",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          },
          {
            "test_name": "Access Error",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          },
          {
            "test_name": "403 on HEAD.BUCKET",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          },
          {
            "test_name": "Internal Server Error",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          }
        ],
        "OneLogin.PasswordAccess": [
          {
            "test_name": "User accessed their own password",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          },
          {
            "test_name": "User accessed another user's password",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          }
        ],
        "Push.Security.New.App.Detected": [
          {
            "test_name": "New App",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          },
          {
            "test_name": "App Updated",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          }
        ],
        "GCP.VPC.Flow.Logs.Disabled": [
          {
            "test_name": "Disable Flow Logs Event",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          },
          {
            "test_name": "Enable Flow Logs Event",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          }
        ],
        "Duo.Admin.Bypass.Code.Viewed": [
          {
            "test_name": "Bypass View",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          },
          {
            "test_name": "Bypass Create",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          }
        ],
        "Netskope.ManyDeletes": [
          {
            "test_name": "True positive",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          },
          {
            "test_name": "True negative",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          }
        ],
        "Slack.AuditLogs.UserPrivilegeEscalation": [
          {
            "test_name": "Owner Transferred",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          },
          {
            "test_name": "Permissions Assigned",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          },
          {
            "test_name": "Role Changed to Admin",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          },
          {
            "test_name": "Role Changed to Owner",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          },
          {
            "test_name": "User Logout",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          }
        ],
        "Dropbox.External.Share": [
          {
            "test_name": "Domain in Allowlist",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          },
          {
            "test_name": "external share",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          }
        ],
        "Slack.AuditLogs.AppAccessExpanded": [
          {
            "test_name": "App Scopes Expanded",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          },
          {
            "test_name": "App Resources Added",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          },
          {
            "test_name": "App Resources Granted",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          },
          {
            "test_name": "Bot Token Upgraded",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          },
          {
            "test_name": "User Logout",
            "passed": true,
            "exceptions": [],
            "failed_results": []
          }
        ]
      },
      "failed_tests_summary": [],
      "test_summary": {
        "skipped_rules": 96,
        "passed_rules": 464,
        "failed_rules": 0,
        "total_rules": 560,
        "passed_tests": 1373,
        "failed_tests": 0,
        "total_tests": 1373
      }
    },
    "registered_rules": [
      "AWS.ECR.EVENTS",
      "Osquery.Mac.OSXAttacksKeyboardEvents",
      "Dropbox.User.Disabled.2FA",
      "Push.Security.Authorized.IdP.Login",
      "GSuite.GroupBannedUser",
      "GCP.IAM.serviceAccounts.signBlob",
      "Okta.App.Unauthorized.Access.Attempt",
      "GCP.K8S.Service.Type.NodePort.Deployed",
      "Snyk.Project.Settings",
      "Notion.SharingSettingsUpdated",
      "GCP.UnusedRegions",
      "AWS.User.Login.Profile.Modified",
      "aws_cloudtrail_security_group_change_ingress_egress",
      "Notion.LoginFromBlockedIP",
      "github_push_protection_bypass_detected",
      "Azure.Audit.ManyFailedSignIns",
      "AWS.EC2.ManualSecurityGroupChange",
      "OneLogin.HighRiskFailedLogin",
      "GCP.Destructive.Queries",
      "Atlassian.User.LoggedInAsUser",
      "AWS.EC2.VPCModified",
      "Zoom.New.Meeting.Passcode.Required.Disabled",
      "Slack.AuditLogs.OrgCreated",
      "Tines.Story.Jobs.Clearance",
      "DUO.User.BypassCode.Used",
      "GCP.IAM.CustomRoleChanges",
      "GSuite.Workspace.GmailDefaultRoutingRuleModified",
      "Box.Access.Granted",
      "CarbonBlack.Audit.Admin.Grant",
      "Github.Repo.Created",
      "gcp_breakglass_container_workload_deployed",
      "AWS.RDS.PublicRestore",
      "AWS.RDS.ManualSnapshotCreated",
      "Crowdstrike.DNS.Request",
      "Crowdstrike.Unusual.Parent.Child.Processes",
      "AWS.GuardDuty.MediumSeverityFinding",
      "Tailscale.HTTPS.Disabled",
      "okta_fastpass_phishing_detection",
      "Teleport.AuthErrors",
      "Teleport.SuspiciousCommands",
      "Okta.Identity.Provider.SignIn",
      "Decoy.Secret.Accessed",
      "AWS.Root.Activity",
      "aws_rds_public_db_restore",
      "okta_user_account_locked_out",
      "gcp_service_account_disabled_or_deleted",
      "aws_efs_fileshare_mount_modified_or_deleted",
      "Asana.Team.Privacy.Public",
      "GSuite.LeakedPassword",
      "GCP.IAM.serviceAccounts.signJwt.Privilege.Escalation",
      "AWS.ECR.CRUD",
      "Standard.MaliciousSSODNSLookup",
      "AWS.Console.LoginWithoutSAML",
      "Notion.TeamspaceOwnerAdded",
      "GCP.Workload.Identity.Pool.Created.or.Updated",
      "Retrieve.SSO.access.token",
      "Snyk.Role.Change",
      "Okta.Refresh.Access.Token.Reuse",
      "github_push_protection_disabled",
      "Azure.Audit.LegacyAuth",
      "AWS.CloudTrail.Created",
      "OneLogin.HighRiskLogin",
      "Push.Security.MFA.Method.Changed",
      "Duo.Admin.Bypass.Code.Created",
      "MongoDB.External.UserInvited.NoConfig",
      "Osquery.Mac.UnwantedChromeExtensions",
      "GitHub.Branch.PolicyOverride",
      "Slack.AuditLogs.OrgDeleted",
      "Teleport.CompanyDomainLoginWithoutSAML",
      "aws_cloudtrail_security_group_change_loadbalancer",
      "Tines.Team.Destruction",
      "Box.Shield.Anomalous.Download",
      "CarbonBlack.Audit.API.Key.Created.Retrieved",
      "GitHub.Repo.HookModified",
      "GSuite.Workspace.GmailPredeliveryScanningDisabled",
      "gcp_bucket_enumeration",
      "GCP.Workforce.Pool.Created.or.Updated",
      "Microsoft365.Brute.Force.Login.by.User",
      "GCP.User.Added.to.IAP.Protected.Service",
      "Okta.PotentiallyStolenSession",
      "AppOmni.Alert.Passthrough",
      "AWS.S3.ServerAccess.IPWhitelist",
      "Auth0.CIC.Credential.Stuffing",
      "AWS.CloudTrail.RootAccessKeyCreated",
      "okta_identity_provider_created",
      "AWS.CloudTrail.SecurityConfigurationChange",
      "aws_root_account_usage",
      "AWS.IPSet.Modified",
      "aws_eks_cluster_created_or_deleted",
      "AWS.CloudTrail.Account.Discovery",
      "Crowdstrike.RealTimeResponse.Session",
      "Crowdstrike.Macos.Plutil.Usage",
      "Osquery.OSSECRootkitDetected",
      "GCP.Log.Bucket.Or.Sink.Deleted",
      "Google.Workspace.Admin.Custom.Role",
      "Notion.Audit.Log.Exported",
      "AWS.RDS.SnapshotShared",
      "Okta.Group.Admin.Role.Assigned",
      "Slack.AuditLogs.AppRemoved",
      "AWS.S3.ServerAccess.Error",
      "AWS.WAF.Disassociation",
      "github_repo_or_org_transferred",
      "OneLogin.PasswordAccess",
      "Push.Security.New.App.Detected",
      "GCP.VPC.Flow.Logs.Disabled",
      "Duo.Admin.Bypass.Code.Viewed",
      "MongoDB.Identity.Provider.Activity",
      "Asana.Service.Account.Created",
      "GCP.Firewall.Rule.Created",
      "DUO.User.Endpoint.Failure",
      "Standard.MFADisabled",
      "Slack.AuditLogs.PassthroughAnomaly",
      "Teleport.LocalUserLoginWithoutMFA",
      "aws_cloudtrail_security_group_change_rds",
      "GCP.Inbound.SSO.Profile.Created",
      "Decoy.Systems.Manager.Parameter.Accessed",
      "Tines.Tenant.AuthToken",
      "Box.Event.Triggered.Externally",
      "Snyk.System.ExternalAccess",
      "CarbonBlack.Audit.Data.Forwarder.Stopped",
      "AWS.EC2.Monitoring",
      "GSuite.Workspace.GmailSecuritySandboxDisabled",
      "GSuite.LoginType",
      "Okta.Rate.Limits",
      "AWS.S3.BucketDeleted",
      "gcp_service_account_modified",
      "Auth0.Integration.Installed",
      "okta_mfa_reset_or_deactivated",
      "gcp_bucket_modified_or_deleted",
      "Github.Repo.VisibilityChange",
      "GCP.GKE.Kubernetes.Cron.Job.Created.Or.Modified",
      "Slack.AuditLogs.ApplicationDoS",
      "aws_elasticache_security_group_created",
      "AWS.IAM.AccessKeyCompromised",
      "Push.Security.New.SaaS.Account.Created",
      "Teleport.CreateUserAccounts",
      "AWS.CloudTrail.IAMAnythingChanged",
      "Snyk.ServiceAccount.Change",
      "Auth0.Custom.Role.Created",
      "aws_route_53_domain_transferred_lock_disabled",
      "Notion.Workspace.Exported",
      "Zoom.PasscodeDisabled",
      "github_secret_scanning_feature_disabled",
      "Role.Assumed.by.AWS.Service",
      "OneLogin.PasswordChanged",
      "Duo.Admin.Create.Admin",
      "Osquery.OutdatedAgent",
      "MongoDB.Logging.Toggled",
      "GitHub.Repo.InitialAccess",
      "GitHub.Action.Failed",
      "Okta.SSO.to.AWS",
      "GCP.Access.Attempts.Violating.VPC.Service.Controls",
      "Crowdstrike.FDR.LOLBAS",
      "Slack.AuditLogs.PotentiallyMaliciousFileShared",
      "Google.Workspace.Advanced.Protection.Program",
      "aws_cloudtrail_ssm_malicious_usage",
      "CarbonBlack.Audit.Flagged",
      "Okta.Identity.Provider.Created.Modified",
      "Zoom.Sign.In.Method.Modified",
      "okta_user_created",
      "GSuite.DeviceCompromise",
      "GSuite.Workspace.PasswordEnforceStrongDisabled",
      "AWS.CloudTrail.UserAccessKeyAuth",
      "okta_network_zone_deactivated_or_deleted",
      "gcp_dlp_re_identifies_sensitive_information",
      "Wiz.Alert.Passthrough",
      "Crowdstrike.Base64EncodedArgs",
      "gcp_sql_database_modified_or_deleted",
      "Slack.AuditLogs.DLPModified",
      "gcp_access_policy_deleted",
      "Asana.Workspace.Default.Session.Duration.Never",
      "Push.Security.Open.Security.Finding",
      "AWS.S3.BucketPolicyModified",
      "Microsoft365.External.Document.Sharing",
      "AWS.DNS.Crypto.Domain",
      "AWS.S3.ServerAccess.Unauthenticated",
      "Crowdstrike.WMI.Query.Detection",
      "Role.Assumed.by.User",
      "OneLogin.AuthFactorRemoved",
      "AWS.KMS.CustomerManagedKeyLoss",
      "Duo.Admin.Lockout",
      "MongoDB.org.Membership.Restriction.Disabled",
      "aws_route_53_domain_transferred_to_another_account",
      "OneLogin.ActiveLoginActivity",
      "GCP.BigQuery.Large.Scan",
      "Slack.AuditLogs.PrivateChannelMadePublic",
      "Google.Workspace.Apps.Marketplace.Allowlist",
      "aws_config_disable_recording",
      "GCP.Logging.Settings.Modified",
      "Notion.SAML.SSO.Configuration.Changed",
      "AWS.EC2.NetworkACLModified",
      "CarbonBlack.Audit.User.Added.Outside.Org",
      "github_self_hosted_runner_changes_detected",
      "AWS.CloudTrail.LoginProfileCreatedOrModified",
      "Zoom.Sign.In.Requirements.Changed",
      "GCP.GCS.IAMChanges",
      "Teleport.LockCreated",
      "GSuite.DeviceUnlockFailure",
      "okta_user_session_start_via_anonymised_proxy",
      "Standard.DNSBase64",
      "GitHub.Advanced.Security.Change",
      "Osquery.UnsupportedMacOS",
      "Snyk.System.PolicySetting",
      "okta_new_behaviours_admin_console",
      "aws_elasticache_security_group_modified_or_deleted",
      "gcp_dns_zone_modified_or_deleted",
      "Zendesk.MobileAppAccessUpdated",
      "Slack.AuditLogs.EKMConfigChanged",
      "AWS.CloudTrail.Password.Policy.Discovery",
      "Asana.Workspace.Email.Domain.Added",
      "GSuite.Workspace.PasswordReuseEnabled",
      "Push.Security.Phishable.MFA.Method",
      "GCP.Firewall.Rule.Modified",
      "AWS.Suspicious.SAML.Activity",
      "GCP.K8s.ExecIntoPod",
      "AWS.VPC.HealthyLogStatus",
      "AWS.S3.ServerAccess.Insecure",
      "gcp_vpn_tunnel_modified_or_deleted",
      "Github.Repository.Transfer",
      "Crowdstrike.API.Key.Created",
      "OneLogin.ThresholdAccountsDeleted",
      "DUO.Admin.Action.MarkedFraudulent",
      "MongoDB.User.Created.Or.Deleted",
      "Okta.Support.Reset",
      "aws_s3_data_management_tampering",
      "Snyk.System.SSO",
      "Auth0.MFA.Factor.Setting.Enabled",
      "GCP.Cloud.Run.Service.Created",
      "Slack.AuditLogs.UserPrivilegeChangedToUser",
      "Google.Workspace.Apps.Marketplace.New.Domain.Application",
      "GCP.Logging.Sink.Modified",
      "Notion.Workspace.Public.Page.Added",
      "AWS.EC2.RouteTableModified",
      "Zendesk.NewAPIToken",
      "CarbonBlack.AlertV2.Passthrough",
      "github_ssh_certificate_config_changed",
      "AWS.LAMBDA.CRUD",
      "Crowdstrike.Remote.Access.Tool.Execution",
      "Zoom.Two.Factor.Authentication.Disabled",
      "GSuite.DeviceSuspiciousActivity",
      "Box.Item.Shared.Externally",
      "GitHub.Branch.ProtectionDisabled",
      "Osquery.SSHListener",
      "okta_password_in_alternateid_field",
      "Notion.LoginFromNewLocation",
      "aws_console_getsignintoken",
      "Auth0.MFA.Policy.Disabled",
      "GCP.K8s.IOC.Activity",
      "AWS.VPC.InboundPortWhitelist",
      "aws_enum_buckets",
      "Okta.Login.Without.Push.Marker",
      "Slack.AuditLogs.EKMSlackbotUnenrolled",
      "AWS.Console.LoginWithoutMFA",
      "Connection.to.Embargoed.Country",
      "Asana.Workspace.Form.Link.Auth.Requirement.Disabled",
      "Standard.NewAWSAccountCreated",
      "Push.Security.Phishing.Attack",
      "Tailscale.Machine.Approval.Requirements.Disabled",
      "gcp_firewall_rule_modified_or_deleted",
      "github_delete_action_invoked",
      "Microsoft365.MFA.Disabled",
      "Teleport.LongLivedCerts",
      "OneLogin.ThresholdAccountsModified",
      "AWS.CloudTrail.Stopped",
      "Duo.Admin.MFA.Restrictions.Updated",
      "AWS.Unsuccessful.MFA.attempt",
      "Okta.Login.Success",
      "Sign-in.with.AWS.CLI.prompt",
      "AWS.SecurityHub.Finding.Evasion",
      "Box.Malicious.Content",
      "Osquery.SuspiciousCron",
      "aws_securityhub_finding_evasion",
      "GCP.GCS.Public",
      "Slack.AuditLogs.ServiceOwnerTransferred",
      "Google.Workspace.Apps.New.Mobile.App.Installed",
      "GSuite.Workspace.TrustedDomainsAllowlist",
      "Okta.Support.Access",
      "Zendesk.AccountOwnerChanged",
      "AWS.Console.RootLogin",
      "GCP.Permissions.Granted.to.Create.or.Manage.Service.Account.Key",
      "CiscoUmbrella.DNS.Blocked",
      "Tailscale.Magic.DNS.Disabled",
      "Crowdstrike.API.Key.Deleted",
      "GSuite.Rule",
      "MongoDB.User.Roles.Changed",
      "Okta.ThreatInsight.Security.Threat.Detected",
      "GitHub.Org.AuthChange",
      "GCP.Cloud.Run.Set.IAM.Policy",
      "aws_delete_identity",
      "Auth0.MFA.Policy.Enabled",
      "GCP.K8s.New.Daemonset.Deployed",
      "AWS.VPC.InboundPortBlacklist",
      "GitHub.Secret.Scanning.Alert.Created",
      "Osquery.Linux.AWSCommandExecuted",
      "aws_guardduty_disruption",
      "GSuite.AdvancedProtection",
      "okta_admin_activity_from_proxy_query",
      "AWS.EC2.SecurityGroupModified",
      "Slack.AuditLogs.EKMUnenrolled",
      "Snyk.User.Management",
      "Asana.Workspace.Guest.Invite.Permissions.Anyone",
      "AWS.ConfigService.Created",
      "Zoom.User.Promoted.to.Privileged.Role",
      "Notion.Many.Pages.Deleted",
      "GCP.IAM.CorporateEmail",
      "github_disable_high_risk_configuration",
      "Teleport.NetworkScanning",
      "GCP.Privilege.Escalation.By.Deployments.Create",
      "Microsoft365.Exchange.External.Forwarding",
      "okta_policy_modified_or_deleted",
      "OneLogin.UnauthorizedAccess",
      "Duo.Admin.New.Admin.API.App.Integration",
      "Box.New.Login",
      "Panther.Detection.Deleted",
      "aws_snapshot_backup_exfiltration",
      "GCP.Cloud.Storage.Buckets.Modified.Or.Deleted",
      "Push.Security.Unauthorized.IdP.Login",
      "Slack.AuditLogs.SSOSettingsChanged",
      "AWS.S3.ServerAccess.UnknownRequester",
      "Okta.Global.MFA.Disabled",
      "Zendesk.SensitiveDataRedactionOff",
      "GSuite.Drive.ExternalFileShare",
      "Crowdstrike.Macos.Add.Trusted.Cert",
      "gcp_full_network_traffic_packet_capture",
      "CiscoUmbrella.DNS.FuzzyMatching",
      "AWS.Macie.Evasion",
      "Teleport.RoleCreated",
      "Tines.Actions.DisabledChanges",
      "Standard.AdminRoleAssigned",
      "GSuite.SuspiciousLogins",
      "Netskope.AdminLoggedOutLoginFailures",
      "Okta.New.Behavior.Accessing.Admin.Console",
      "GitHub.Org.IpAllowlist",
      "aws_disable_bucket_versioning",
      "Auth0.MFA.Risk.Assessment.Enabled",
      "GCP.K8s.Pod.Attached.To.Node.Host.Network",
      "AWS.VPC.UnapprovedOutboundDNS",
      "Osquery.Linux.LoginFromNonOffice",
      "aws_iam_backdoor_users_keys",
      "AWS.EC2.Startup.Script.Change",
      "okta_admin_role_assigned_to_user_or_group",
      "Microsoft.Graph.Passthrough",
      "Crowdstrike.Credential.Dumping.Tool",
      "Asana.Workspace.New.Admin",
      "Dropbox.Admin.sign.in.as.Session",
      "Okta.User.Account.Locked",
      "Notion.Many.Pages.Exported",
      "AWS.ConfigService.DisabledDeleted",
      "aws_attached_malicious_lambda_layer",
      "GCP.CloudBuild.Potential.Privilege.Escalation",
      "github_disabled_outdated_dependency_or_vulnerability",
      "GSuite.CalendarMadePublic",
      "Slack.AuditLogs.IDPConfigurationChanged",
      "GSuite.DriveOverlyVisible",
      "okta_policy_rule_modified_or_deleted",
      "AWS.CloudTrail.UnauthorizedAPICall",
      "GCP.Service.Account.Access.Denied",
      "OneLogin.UserAccountLocked",
      "Duo.Admin.Policy.Updated",
      "Netskope.AdminUserChange",
      "Amazon.EKS.Audit.Multiple403",
      "Box.Content.Workflow.Policy.Violation",
      "Panther.SAML.Modified",
      "aws_sso_idp_change",
      "Auth0.MFA.Risk.Assessment.Disabled",
      "Snyk.Misc.Settings",
      "Crowdstrike.Reverse.Shell.Tool.Executed",
      "AWS.EC2.Vulnerable.XZ.Image.Launched",
      "GitHub.Team.Modified",
      "Zendesk.UserAssumption",
      "Tines.Custom.CertificateAuthority",
      "GSuite.TwoStepVerification",
      "GitHub.Org.Moderators.Add",
      "AWS.Console.Login",
      "Auth0.User.Invitation.Created",
      "GCP.IAM.OrgFolderIAMChanges",
      "aws_iam_s3browser_loginprofile_creation",
      "Osquery.Linux.Mac.VulnerableXZliblzma",
      "Okta.Anonymizing.VPN.Login",
      "Decoy.DynamoDB.Accessed",
      "gcp_kubernetes_admission_controller",
      "okta_admin_role_assignment_created",
      "CiscoUmbrella.DNS.Suspicious",
      "Okta.User.MFA.Factor.Suspend",
      "Notion.PagePerms.APIPermsChanged",
      "Okta.Org2org.Creation.Modification",
      "Salesforce.Admin.Login.As.User",
      "aws_cloudtrail_disable_logging",
      "AWS.Software.Discovery",
      "aws_ec2_disable_encryption",
      "AWS.CloudTrail.CodebuildProjectMadePublic",
      "AWS.CloudTrail.SnapshotMadePublic",
      "github_fork_private_repos_enabled_or_cleared",
      "AWS.Console.RootLoginFailed",
      "Asana.Workspace.Org.Export",
      "GSuite.DocOwnershipTransfer",
      "Slack.AuditLogs.InformationBarrierModified",
      "Okta.AdminRoleAssigned",
      "okta_security_threat_detected",
      "GCP.SQL.ConfigChanges",
      "OneLogin.UserAssumption",
      "Duo.Admin.SSO.SAML.Requirement.Disabled",
      "GCP.Cloudfunctions.Functions.Create",
      "Netskope.ManyDeletes",
      "GCP.K8S.Pot.Create.Or.Modify.Host.Path.Volume.Mount",
      "Standard.BruteForceByIP",
      "Box.Shield.Suspicious.Alert",
      "Teleport.RootLogin",
      "Slack.AuditLogs.UserPrivilegeEscalation",
      "AWS.CloudTrail.IAMCompromisedKeyQuarantine",
      "Dropbox.External.Share",
      "GCP.iam.roles.update.Privilege.Escalation",
      "AWS.IAMUser.ReconAccessDenied",
      "Auth0.Post.Login.Action.Flow",
      "GitHub.User.AccessKeyCreated",
      "Zendesk.UserRoleChanged",
      "MongoDB.2FA.Disabled",
      "AWS.EC2.StopInstances",
      "aws_sts_assumerole_misuse",
      "Tines.Enqueued.Retrying.Job.Destruction",
      "GSuite.UserSuspended",
      "GCP.Service.Account.or.Keys.Created",
      "GitHub.Org.Modified",
      "Push.Security.App.Banner.Acknowledged",
      "Okta.User.MFA.Reset.Single",
      "Osquery.Mac.ApplicationFirewallSettings",
      "okta_api_token_created",
      "GSuite.DriveVisibilityChanged",
      "AWS.Console.Sign-In",
      "aws_iam_s3browser_templated_s3_bucket_policy_creation",
      "aws_cloudtrail_imds_malicious_usage",
      "aws_ec2_startup_script_change",
      "Okta.PasswordAccess",
      "AWS.Modify.Cloud.Compute.Infrastructure",
      "gcp_kubernetes_cronjob",
      "github_new_org_member",
      "GCP.iam.serviceAccountKeys.create",
      "Slack.AuditLogs.IntuneMDMDisabled",
      "MongoDB.Access.Allowed.From.Anywhere",
      "okta_suspicious_activity_enduser_report",
      "Crowdstrike.Cryptomining.Tools",
      "OnePassword.Lut.Sensitive.Item",
      "Notion.PagePerms.GuestPermsChanged",
      "Duo.Admin.User.MFA.Bypass.Enabled",
      "AWS.CloudTrail.IAMEntityCreatedWithoutCloudFormation",
      "GCP.Cloudfunctions.Functions.Update",
      "GCP.K8s.Pod.Using.Host.PID.Namespace",
      "Netskope.NetskopePersonnelActivity",
      "SentinelOne.Threats",
      "Box.Untrusted.Device",
      "Panther.Sensitive.Role",
      "Teleport.SAMLCreated",
      "AWS.IAM.PolicyModified",
      "Decoy.IAM.Assumed",
      "GSuite.ExternalMailForwarding",
      "Dropbox.Linked.Team.Application.Added",
      "Asana.Workspace.Password.Requirements.Simple",
      "GitHub.User.RoleUpdated",
      "Zendesk.UserSuspension",
      "Amazon.EKS.Audit.SystemNamespaceFromPublicIP",
      "Tines.Global.Resource.Destruction",
      "GCP.serviceusage.apiKeys.create.Privilege.Escalation",
      "Github.Organization.App.Integration.Installed",
      "AWS.CloudTrail.IAMAssumeRoleBlacklistIgnored",
      "AWS.EC2.EBS.Encryption.Disabled",
      "Osquery.Mac.AutoUpdateEnabled",
      "aws_sts_getsessiontoken_misuse",
      "okta_api_token_revoked",
      "Cloudflare.Firewall.L7DDoS",
      "Okta.APIKeyCreated",
      "MongoDB.Alerting.Disabled.Or.Deleted",
      "OnePassword.Sensitive.Item",
      "Snyk.Org.Settings",
      "aws_iam_s3browser_user_or_accesskey_creation",
      "SentinelOne.Alert.Passthrough",
      "aws_cloudtrail_new_acl_entries",
      "aws_ec2_vm_export_failure",
      "github_new_secret_created",
      "GSuite.GoogleAccess",
      "Auth0.User.Joined.Tenant",
      "Crowdstrike.Systemlog.Tampering",
      "okta_unauthorized_access_to_app",
      "Crowdstrike.Detection.passthrough",
      "Notion.PageSharedToWeb",
      "DUO.User.Action.Fraudulent",
      "AWS.UnusedRegion",
      "GCP.compute.instances.create.Privilege.Escalation",
      "Netskope.UnauthorizedAPICalls",
      "Box.Large.Number.Downloads",
      "GCP.Access.Attempts.Violating.IAP.Access.Controls",
      "Teleport.SAMLLoginWithoutCompanyDomain",
      "Okta.User.MFA.Reset.All",
      "AWS.RDS.MasterPasswordUpdated",
      "Okta.Password.Extraction.via.SCIM",
      "Dropbox.Ownership.Transfer",
      "Asana.Workspace.Require.App.Approvals.Disabled",
      "AWS.CloudTrail.ResourceMadePublic",
      "GitLab.Audit.Password.Reset.Multiple.Emails",
      "Zoom.All.Meetings.Secured.With.One.Option.Disabled",
      "Slack.AuditLogs.LegalHoldPolicyModified",
      "Tines.SSO.Settings",
      "Crowdstrike.Macos.Osascript.Administrator",
      "Github.Public.Repository.Created",
      "AWS.IAM.Group.Read.Only.Events",
      "Osquery.Mac.OSXAttacks",
      "AWS.EC2.Traffic.Mirroring",
      "okta_application_modified_or_deleted",
      "Okta.APIKeyRevoked",
      "Snyk.OU.Change",
      "GSuite.Workspace.CalendarExternalSharingSetting",
      "MongoDB.External.UserInvited",
      "GCP.Storage.Hmac.Keys.Create",
      "OnePassword.Unusual.Client",
      "aws_passed_role_to_glue_development_endpoint",
      "GCP.DNS.Zone.Modified.or.Deleted",
      "gcp_kubernetes_rolebinding",
      "aws_cloudtrail_new_route_added",
      "aws_ecs_task_definition_cred_endpoint_query",
      "aws_susp_saml_activity",
      "AWS.EC2.GatewayModified",
      "AWS.CloudTrail.NetworkACLPermissiveEntry",
      "Okta.User.Reported.Suspicious.Activity",
      "Panther.User.Modified",
      "GCP.IAM.serviceAccounts.getAccessToken.Privilege.Escalation",
      "AWS.GuardDuty.HighSeverityFinding",
      "GSuite.GovernmentBackedAttack",
      "AWS.CloudTrail.AMIModifiedForPublicAccess",
      "Decoy.S3.Accessed",
      "Notion.Workspace.SCIM.Token.Generated",
      "DUO.User.Denied.AnomalousPush",
      "Box.Large.Number.Permission.Updates",
      "Slack.AuditLogs.AppAdded",
      "github_outside_collaborator_detected",
      "Teleport.ScheduledJobs",
      "Standard.NewUserAccountCreated",
      "Okta.Phishing.Attempt.Blocked.FastPass",
      "GCP.K8S.Privileged.Pod.Created",
      "Asana.Workspace.SAML.Optional",
      "MongoDB.Atlas.ApiKeyCreated",
      "GitLab.Production.Password.Reset.Multiple.Emails",
      "Standard.ImpossibleTravel.Login",
      "Duo.Admin.App.Integration.Secret.Key.Viewed",
      "Zoom.Automatic.Sign.Out.Disabled",
      "Slack.AuditLogs.MFASettingsChanged",
      "GSuite.Workspace.DataExportCreated",
      "Tines.Story.Items.Destruction",
      "AWS.IAM.CredentialsUpdated",
      "Azure.Audit.RiskLevelPassthrough",
      "Notion.AccountChangedAfterLogin",
      "Github.Repo.CollaboratorChange",
      "AWS.IAM.Backdoor.User.Keys",
      "AWS.CloudTrail.RootPasswordChanged",
      "AWS.GuardDuty.LowSeverityFinding",
      "okta_application_sign_on_policy_modified_or_deleted",
      "Cloudflare.HttpRequest.BotHighVolume",
      "aws_rds_change_master_password",
      "GCP.Firewall.Rule.Deleted",
      "gcp_kubernetes_secrets_modified_or_deleted",
      "Slack.AuditLogs.AppAccessExpanded",
      "aws_efs_fileshare_modified_or_deleted"
    ],
    "included_files": [
      "mitre.py",
      "main.py",
      "rules/__init__.py",
      "rules/sigma/__init__.py",
      "rules/sigma/cloud/__init__.py",
      "rules/sigma/cloud/gcp/gcp_dns_zone_modified_or_deleted.py",
      "rules/sigma/cloud/gcp/gcp_kubernetes_rolebinding.py",
      "rules/sigma/cloud/gcp/gcp_full_network_traffic_packet_capture.py",
      "rules/sigma/cloud/gcp/gcp_sql_database_modified_or_deleted.py",
      "rules/sigma/cloud/gcp/gcp_kubernetes_secrets_modified_or_deleted.py",
      "rules/sigma/cloud/gcp/gcp_kubernetes_admission_controller.py",
      "rules/sigma/cloud/gcp/gcp_dlp_re_identifies_sensitive_information.py",
      "rules/sigma/cloud/gcp/gcp_firewall_rule_modified_or_deleted.py",
      "rules/sigma/cloud/gcp/__init__.py",
      "rules/sigma/cloud/gcp/gcp_bucket_modified_or_deleted.py",
      "rules/sigma/cloud/gcp/gcp_access_policy_deleted.py",
      "rules/sigma/cloud/gcp/gcp_service_account_disabled_or_deleted.py",
      "rules/sigma/cloud/gcp/gcp_service_account_modified.py",
      "rules/sigma/cloud/gcp/gcp_vpn_tunnel_modified_or_deleted.py",
      "rules/sigma/cloud/gcp/gcp_kubernetes_cronjob.py",
      "rules/sigma/cloud/gcp/gcp_breakglass_container_workload_deployed.py",
      "rules/sigma/cloud/gcp/gcp_bucket_enumeration.py",
      "rules/sigma/cloud/github/github_new_secret_created.py",
      "rules/sigma/cloud/github/github_delete_action_invoked.py",
      "rules/sigma/cloud/github/github_self_hosted_runner_changes_detected.py",
      "rules/sigma/cloud/github/__init__.py",
      "rules/sigma/cloud/github/github_outside_collaborator_detected.py",
      "rules/sigma/cloud/github/github_repo_or_org_transferred.py",
      "rules/sigma/cloud/github/github_push_protection_disabled.py",
      "rules/sigma/cloud/github/github_secret_scanning_feature_disabled.py",
      "rules/sigma/cloud/github/github_disabled_outdated_dependency_or_vulnerability.py",
      "rules/sigma/cloud/github/github_push_protection_bypass_detected.py",
      "rules/sigma/cloud/github/github_new_org_member.py",
      "rules/sigma/cloud/github/github_disable_high_risk_configuration.py",
      "rules/sigma/cloud/github/github_fork_private_repos_enabled_or_cleared.py",
      "rules/sigma/cloud/github/github_ssh_certificate_config_changed.py",
      "rules/sigma/cloud/okta/okta_admin_role_assigned_to_user_or_group.py",
      "rules/sigma/cloud/okta/okta_network_zone_deactivated_or_deleted.py",
      "rules/sigma/cloud/okta/okta_application_modified_or_deleted.py",
      "rules/sigma/cloud/okta/okta_policy_modified_or_deleted.py",
      "rules/sigma/cloud/okta/okta_mfa_reset_or_deactivated.py",
      "rules/sigma/cloud/okta/okta_security_threat_detected.py",
      "rules/sigma/cloud/okta/okta_policy_rule_modified_or_deleted.py",
      "rules/sigma/cloud/okta/okta_application_sign_on_policy_modified_or_deleted.py",
      "rules/sigma/cloud/okta/__init__.py",
      "rules/sigma/cloud/okta/okta_suspicious_activity_enduser_report.py",
      "rules/sigma/cloud/okta/okta_api_token_revoked.py",
      "rules/sigma/cloud/okta/okta_user_session_start_via_anonymised_proxy.py",
      "rules/sigma/cloud/okta/okta_user_account_locked_out.py",
      "rules/sigma/cloud/okta/okta_unauthorized_access_to_app.py",
      "rules/sigma/cloud/okta/okta_fastpass_phishing_detection.py",
      "rules/sigma/cloud/okta/okta_api_token_created.py",
      "rules/sigma/cloud/okta/okta_user_created.py",
      "rules/sigma/cloud/okta/okta_admin_role_assignment_created.py",
      "rules/sigma/cloud/okta/okta_identity_provider_created.py",
      "rules/sigma/cloud/okta/okta_password_in_alternateid_field.py",
      "rules/sigma/cloud/okta/okta_admin_activity_from_proxy_query.py",
      "rules/sigma/cloud/okta/okta_new_behaviours_admin_console.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_iam_s3browser_templated_s3_bucket_policy_creation.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_elasticache_security_group_created.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_route_53_domain_transferred_to_another_account.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_root_account_usage.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_ec2_startup_script_change.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_config_disable_recording.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_passed_role_to_glue_development_endpoint.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_elasticache_security_group_modified_or_deleted.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_efs_fileshare_mount_modified_or_deleted.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_route_53_domain_transferred_lock_disabled.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_cloudtrail_security_group_change_ingress_egress.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_sso_idp_change.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_cloudtrail_disable_logging.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_disable_bucket_versioning.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_sts_assumerole_misuse.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_cloudtrail_security_group_change_rds.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_iam_backdoor_users_keys.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_cloudtrail_new_acl_entries.py",
      "rules/sigma/cloud/aws_cloudtrail/__init__.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_sts_getsessiontoken_misuse.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_snapshot_backup_exfiltration.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_delete_identity.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_enum_buckets.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_iam_s3browser_loginprofile_creation.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_iam_s3browser_user_or_accesskey_creation.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_attached_malicious_lambda_layer.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_s3_data_management_tampering.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_eks_cluster_created_or_deleted.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_ec2_disable_encryption.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_cloudtrail_security_group_change_loadbalancer.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_console_getsignintoken.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_ec2_vm_export_failure.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_efs_fileshare_modified_or_deleted.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_susp_saml_activity.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_ecs_task_definition_cred_endpoint_query.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_rds_change_master_password.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_cloudtrail_imds_malicious_usage.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_securityhub_finding_evasion.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_rds_public_db_restore.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_cloudtrail_ssm_malicious_usage.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_cloudtrail_new_route_added.py",
      "rules/sigma/cloud/aws_cloudtrail/aws_guardduty_disruption.py",
      "helpers/__init__.py"
    ]
  }