Rules: Tines Actions Disabled Change (#781)

* Rules: Adding Tines rule for Actions Disabled Changes.

- Detects if the operation_name is ActonsDisabledChange.

---------

Co-authored-by: calkim-panther <113376708+calkim-panther@users.noreply.github.com>
Co-authored-by: Ed⁦ <ed.anderson@panther.io>

rules/tines_rules/tines_actions_disabled_changes.py

@@ -0,0 +1,19 @@
+from panther_base_helpers import deep_get
+from panther_tines_helpers import tines_alert_context
+
+ACTIONS = ["ActionsDisabledChange"]
+
+
+def rule(event):
+    action = deep_get(event, "operation_name", default="<NO_OPERATION_NAME>")
+    return action in ACTIONS
+
+
+def title(event):
+    action = deep_get(event, "operation_name", default="<NO_OPERATION_NAME>")
+    actor = deep_get(event, "user_email", default="<NO_USERNAME>")
+    return f"Tines: {action} " f"by {actor}"
+
+
+def alert_context(event):
+    return tines_alert_context(event)

rules/tines_rules/tines_actions_disabled_changes.yml

@@ -0,0 +1,45 @@
+AnalysisType: rule
+Filename: tines_actions_disabled_changes.py
+RuleID: Tines.Actions.DisabledChanges
+DisplayName: Tines Actions Disabled Change
+Enabled: true
+LogTypes:
+  - Tines.Audit
+Tags:
+  - Tines
+Severity: Medium
+Description: >
+  Detections when Tines Actions are set to Disabled Change
+DedupPeriodMinutes: 60
+Threshold:  1
+SummaryAttributes:
+  - event
+Tests:
+  - Name: Tines Actions Disabled Change
+    ExpectedResult: true
+    Log:
+      {
+        "created_at": "2023-05-23 23:16:41",
+        "id": 7111111,
+        "operation_name": "ActionsDisabledChange",
+        "request_ip": "12.12.12.12",
+        "request_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36",
+        "tenant_id": "8888",
+        "user_email": "user@company.com",
+        "user_id": "17171",
+        "user_name": "user at company dot com"
+      }
+  - Name: Tines Login
+    ExpectedResult: false
+    Log:
+      {
+        "created_at": "2023-05-17 14:45:19",
+        "id": 7888888,
+        "operation_name": "Login",
+        "request_ip": "12.12.12.12",
+        "request_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36",
+        "tenant_id": "8888",
+        "user_email": "user@company.com",
+        "user_id": "17171",
+        "user_name": "user at company dot com"
+      }