Panther medium experimental python

Slack Information Barrier Modified

Detects when a Slack information barrier is deleted/updated

View Source

Detection Logic

from panther_slack_helpers import slack_alert_context

INFORMATION_BARRIER_ACTIONS = {
    "barrier_deleted": "Slack Information Barrier Deleted",
    "barrier_updated": "Slack Information Barrier Updated",
}


def rule(event):
    return event.get("action") in INFORMATION_BARRIER_ACTIONS


def title(event):
    if event.get("action") in INFORMATION_BARRIER_ACTIONS:
        return INFORMATION_BARRIER_ACTIONS.get(event.get("action"))
    return "Slack Information Barrier Modified"


def alert_context(event):
    return slack_alert_context(event)

Field Validations

Loading…

Comments (0)

Loading comments...