Panther medium experimental python

OneLogin Multiple Accounts Deleted

Possible Denial of Service detected. Threshold for user account deletions exceeded.

View Source

Detection Logic

def rule(event):
    # filter events; event type 17 is a user deleted
    return str(event.get("event_type_id")) == "17"


def title(event):
    return (
        f"User [{event.get('actor_user_name', '<UNKNOWN_USER>')}] "
        f"has exceeded the user account deletion threshold"
    )

Field Validations

Loading…

Comments (0)

Loading comments...