Panther medium experimental python

Duo Admin App Integration Secret Key Viewed

An administrator viewed a Secret Key for an Application Integration

View Source

Detection Logic

def rule(event):
    # Return True to match the log event and trigger an alert.
    return event.get("action", "") == "integration_skey_view"


def title(event):
    # If no 'dedup' function is defined, the return value of
    # this method will act as deduplication string.
    return (
        f"'Duo: [{event.get('username', '<NO_USER_FOUND>')}] viewed "
        f"the Secret Key for Application [{event.get('object', '<NO_OBJECT_FOUND>')}]"
    )

Field Validations

Loading…

Comments (0)

Loading comments...