Add references to rules (zoom_rules) (#1035)

* Add references to rules (zoom_rules) * Add references to rules (zoom_rules) --------- Co-authored-by: Evan Gibler <[email protected]>
panther-labs · Dec 12, 2023 · 28189dc · 28189dc
1 parent 6d95214
commit 28189dc
Show file tree

Hide file tree

Showing 6 changed files with 6 additions and 0 deletions.
diff --git a/rules/zoom_operation_rules/zoom_all_meetings_secured_with_one_option_disabled.yml b/rules/zoom_operation_rules/zoom_all_meetings_secured_with_one_option_disabled.yml
@@ -4,6 +4,7 @@ DisplayName: "Zoom All Meetings Secured With One Option Disabled"
 Enabled: true
 Filename: zoom_all_meetings_secured_with_one_option_disabled.py
 Runbook: Confirm this user acted with valid business intent and determine whether this activity was authorized.
+Reference: https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0059862
 Severity: Medium
 Tests:
     - ExpectedResult: true

diff --git a/rules/zoom_operation_rules/zoom_new_meeting_passcode_required_disabled.yml b/rules/zoom_operation_rules/zoom_new_meeting_passcode_required_disabled.yml
@@ -4,6 +4,7 @@ DisplayName: "Zoom New Meeting Passcode Required Disabled"
 Enabled: true
 Filename: zoom_new_meeting_passcode_required_disabled.py
 Runbook: Confirm this user acted with valid business intent and determine whether this activity was authorized.
+Reference: https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0063160#:~:text=Since%20September%202022%2C%20Zoom%20requires,enforced%20for%20all%20free%20accounts
 Severity: Medium
 Tests:
     - ExpectedResult: true

diff --git a/rules/zoom_operation_rules/zoom_sign_in_method_modified.yml b/rules/zoom_operation_rules/zoom_sign_in_method_modified.yml
@@ -4,6 +4,7 @@ DisplayName: "Zoom Sign In Method Modified"
 Enabled: true
 Filename: zoom_sign_in_method_modified.py
 Runbook: Confirm this user acted with valid business intent and determine whether this activity was authorized.
+Reference: https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0067602#:~:text=Go%20to%20the%20Zoom%20site,click%20Link%20and%20Sign%20In
 Severity: Medium
 Tests:
     - ExpectedResult: true

diff --git a/rules/zoom_operation_rules/zoom_sign_in_requirements_changed.yml b/rules/zoom_operation_rules/zoom_sign_in_requirements_changed.yml
@@ -4,6 +4,7 @@ DisplayName: "Zoom Sign In Requirements Changed"
 Enabled: true
 Filename: zoom_sign_in_requirements_changed.py
 Runbook: Confirm this user acted with valid business intent and determine whether this activity was authorized.
+Reference: https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0061263
 Severity: Medium
 Tests:
     - ExpectedResult: true

diff --git a/rules/zoom_operation_rules/zoom_two_factor_authentication_disabled.yml b/rules/zoom_operation_rules/zoom_two_factor_authentication_disabled.yml
@@ -4,6 +4,7 @@ DisplayName: "Zoom Two Factor Authentication Disabled"
 Enabled: true
 Filename: zoom_two_factor_authentication_disabled.py
 Runbook: Confirm this user acted with valid business intent and determine whether this activity was authorized.
+Reference: https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0066054
 Severity: Medium
 Tests:
     - ExpectedResult: true

diff --git a/rules/zoom_operation_rules/zoom_user_promoted_to_privileged_role.yml b/rules/zoom_operation_rules/zoom_user_promoted_to_privileged_role.yml
@@ -3,6 +3,7 @@ Description: A Zoom user was promoted to a privileged role.
 DisplayName: "Zoom User Promoted to Privileged Role"
 Enabled: true
 Filename: zoom_user_promoted_to_privileged_role.py
+Reference: https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0064983
 Severity: Medium
 Tests:
     - ExpectedResult: true