-
Notifications
You must be signed in to change notification settings - Fork 165
/
aws_console_root_login.py
38 lines (30 loc) · 1.19 KB
/
aws_console_root_login.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
from panther import lookup_aws_account_name
from panther_base_helpers import deep_get
from panther_oss_helpers import geoinfo_from_ip_formatted
def rule(event):
return (
event.get("eventName") == "ConsoleLogin"
and deep_get(event, "userIdentity", "type") == "Root"
and deep_get(event, "responseElements", "ConsoleLogin") == "Success"
)
def title(event):
ip_address = event.get("sourceIPAddress")
return (
f"AWS root login detected from [{ip_address}] "
f"({geoinfo_from_ip_formatted(ip_address)}) "
f"in account "
f"[{lookup_aws_account_name(event.get('recipientAccountId'))}]"
)
def dedup(event):
# Each Root login should generate a unique alert
return "-".join(
[event.get("recipientAccountId"), event.get("eventName"), event.get("eventTime")]
)
def alert_context(event):
return {
"sourceIPAddress": event.get("sourceIPAddress"),
"userIdentityAccountId": deep_get(event, "userIdentity", "accountId"),
"userIdentityArn": deep_get(event, "userIdentity", "arn"),
"eventTime": event.get("eventTime"),
"mfaUsed": deep_get(event, "additionalEventData", "MFAUsed"),
}