Can I modify a Panther-managed Data Model?

QUESTION

Is there a way to change the logic for a standard rule, like the "Admin Role Assigned" rule, for a specific log type?

ANSWER

You can copy, edit, then replace the associated data model for that log type by disabling the old one and then enabling the new one.

Standard rules look at Data Model values for each log type to determine if the logic applies. In the "Admin Role Assigned" rule, we can see that we check event_type, which is a UDM field defined on a per-log-type basis. Data Models for log types that are included in the standard rules can be found in the data_models folder in the panther-analysis repo.

import panther_event_type_helpers as event_type

def rule(event):
  # filter events on unified data model field
  return event.udm("event_type") == event_type.ADMIN_ROLE_ASSIGNED