slack_information_barrier_modified.yml

AnalysisType: rule
Filename: slack_information_barrier_modified.py
RuleID: Slack.AuditLogs.InformationBarrierModified
DisplayName: Slack Information Barrier Modified
Enabled: true
LogTypes:
  - Slack.AuditLogs
Tags:
  - Slack
Severity: Medium
Description: Detects when a Slack information barrier is deleted/updated
Reference: https://api.slack.com/admins/audit-logs
DedupPeriodMinutes: 60
Threshold:  1
SummaryAttributes:
  - action
  - p_any_ip_addresses
  - p_any_emails
Tests:
  -
    Name: Information Barrier Deleted
    ExpectedResult: true
    Log:
      {
        "action": "barrier_deleted",
        "actor": {
          "type": "user",
          "user": {
            "email": "user@example.com",
            "id": "A012B3CDEFG",
            "name": "username",
            "team": "T01234N56GB"
          }
        },
        "context": {
          "ip_address": "1.2.3.4",
          "location": {
            "domain": "test-workspace",
            "id": "T01234N56GB",
            "name": "test-workspace",
            "type": "workspace"
          },
          "ua": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36"
        }
      }
  -
    Name: Information Barrier Updated
    ExpectedResult: true
    Log:
      {
        "action": "barrier_updated",
        "actor": {
          "type": "user",
          "user": {
            "email": "user@example.com",
            "id": "A012B3CDEFG",
            "name": "username",
            "team": "T01234N56GB"
          }
        },
        "context": {
          "ip_address": "1.2.3.4",
          "location": {
            "domain": "test-workspace",
            "id": "T01234N56GB",
            "name": "test-workspace",
            "type": "workspace"
          },
          "ua": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36"
        }
      }
  -
    Name: User Logout
    ExpectedResult: false
    Log:
      {
        "action": "user_logout",
        "actor": {
          "type": "user",
          "user": {
            "email": "user@example.com",
            "id": "W012J3FEWAU",
            "name": "primary-owner",
            "team": "T01234N56GB"
          }
        },
        "context": {
          "ip_address": "1.2.3.4",
          "location": {
            "domain": "test-workspace-1",
            "id": "T01234N56GB",
            "name": "test-workspace-1",
            "type": "workspace"
          },
          "ua": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36"
        },
        "date_create": "2022-07-28 15:22:32",
        "entity": {
          "type": "user",
          "user": {
            "email": "user@example.com",
            "id": "W012J3FEWAU",
            "name": "primary-owner",
            "team": "T01234N56GB"
          }
        },
        "id": "72cac009-9eb3-4dde-bac6-ee49a32a1789"
      }