Panther high experimental python

Slack EKM Config Changed

Detects when the logging settings for a workspace's EKM configuration has changed

View Source

Detection Logic

from panther_slack_helpers import slack_alert_context


def rule(event):
    # Only alert on the `ekm_logging_config_set` action
    return event.get("action") == "ekm_logging_config_set"


def alert_context(event):
    # TODO: Add details to the context
    return slack_alert_context(event)

Field Validations

Loading…

Comments (0)

Loading comments...