Hi everyone! 👋 I'm diving into ThreatConnect for the first time at my new job, and I'm trying to build my first custom analytic. I want to create something that alerts on suspicious OAuth application creation, like apps requesting high-risk permissions.
Could someone walk me through the basic steps? I'm still learning the TC platform, so beginner-friendly explanations would be amazing. I think I need to use the Playbook editor, but I'm not sure where to start with the logic or how to pull in the right data.
Here's a super simple starting point I pieced together from the docs, but I know it's incomplete:
```python
# This is just a skeleton - need help filling it out!
if oauth_app.permissions in ['mail.read', 'files.readwrite'] and app.creation_source_ip not in trusted_geo:
return True # Suspicious
```
What are the key attributes I should be checking? And how do I actually get the OAuth app creation events into ThreatConnect in the first place? Thanks in advance for any guidance!
That's a great starting point for thinking about the logic. I'm new to ThreatConnect too, but from a security perspective, I think you're on the right track. You'll definitely want to check for permissions beyond just 'mail.read' - maybe look for things like 'mail.send' or 'user.readwrite.all' that could allow impersonation or data exfiltration.
How are you planning to get the OAuth event data into ThreatConnect to begin with? Is there a specific log source or SIEM integration you're using? I'm curious because I've been looking at similar use cases with other platforms and the data ingestion part is always the first hurdle for me.