Panther rules: google

def rule(event):
    # Return True to match the log event and trigger an alert.
    # Create Alert if there is a custom role created under delegated admin settings
    return (
        event.get("type", "") == "DELEGATED_ADMIN_SETTINGS"
        and event.get("name", "") == "CREATE_ROLE"
    )


def title(event):
    # (Optional) Return a string which will be shown as the alert title.
    # If no 'dedup' function is defined, the return value of this method
    # will act as deduplication string.
    return (
        f"Google Workspace Administrator "
        f"[{event.get('actor',{}).get('email','NO_EMAIL_FOUND')}] "
        f"created a new admin role "
        f"[{event.get('parameters',{}).get('ROLE_NAME','NO_ROLE_NAME_FOUND')}]."
    )

AnalysisType: rule
Description: A Google Workspace administrator created a new custom administrator role.
DisplayName: "Google Workspace Admin Custom Role"
Enabled: true
Filename: google_workspace_admin_custom_role.py
Runbook: Please review this activity with the administrator and ensure this behavior was authorized.
Reference: https://support.google.com/a/answer/2406043?hl=en#:~:text=under%20the%20limit.-,Create%20a%20custom%20role,-Before%20you%20begin
Severity: Medium
Tags:
  - admin
  - administrator
  - google workspace
  - role
DedupPeriodMinutes: 60
LogTypes:
  - GSuite.ActivityEvent
RuleID: "Google.Workspace.Admin.Custom.Role"
SummaryAttributes:
  - name
  - type
Threshold: 1

def rule(event):
    # Return True to match the log event and trigger an alert.
    setting_name = (
        event.deep_get("parameters", "SETTING_NAME", default="NO_SETTING_NAME")
        .split("-")[0]
        .strip()
    )
    setting_alert_flag = "Advanced Protection Program Settings"
    return event.get("name") == "CREATE_APPLICATION_SETTING" and setting_name == setting_alert_flag


def title(event):
    # If no 'dedup' function is defined, the return value of this
    # method will act as deduplication string.
    setting = event.deep_get("parameters", "SETTING_NAME", default="NO_SETTING_NAME")
    setting_name = setting.split("-")[-1].strip()
    return (
        f"Google Workspace Advanced Protection Program settings have been updated to "
        f"[{setting_name}] by Google Workspace User "
        f"[{event.deep_get('actor', 'email', default='<NO_EMAIL_FOUND>')}]."
    )

AnalysisType: rule
Description: Your organization's Google Workspace Advanced Protection Program settings were modified.
DisplayName: "Google Workspace Advanced Protection Program"
Enabled: true
Filename: google_workspace_advanced_protection_program.py
Runbook: Confirm the changes made were authorized for your organization.
Reference: https://support.google.com/a/answer/9378686?hl=en
Severity: Medium
DedupPeriodMinutes: 60
LogTypes:
  - GSuite.ActivityEvent
RuleID: "Google.Workspace.Advanced.Protection.Program"
Threshold: 1

def rule(event):
    # Return True to match the log event and trigger an alert.
    setting_name = event.deep_get("parameters", "SETTING_NAME", default="<NO_SETTING_NAME>")
    old_val = event.deep_get("parameters", "OLD_VALUE", default="<NO_OLD_VALUE_FOUND>")
    new_val = event.deep_get("parameters", "NEW_VALUE", default="<NO_NEW_VALUE_FOUND>")
    return setting_name == "ENABLE_G_SUITE_MARKETPLACE" and old_val != new_val


def title(event):
    # (Optional) Return a string which will be shown as the alert title.
    # If no 'dedup' function is defined, the return value of this
    # method will act as deduplication string.
    value_dict = {
        "DEFAULT": "DEFAULT",
        "1": "Don't allow users to install and run apps from the Marketplace",
        "2": "Allow users to install and run any app from the Marketplace",
        "3": "Allow users to install and run only selected apps from the Marketplace",
    }
    old_val = event.deep_get("parameters", "OLD_VALUE", default="<NO_OLD_VALUE_FOUND>")
    new_val = event.deep_get("parameters", "NEW_VALUE", default="<NO_NEW_VALUE_FOUND>")
    actor = event.deep_get("actor", "email", default="<NO_EMAIL_FOUND>")
    return (
        f"Google Workspace User [{actor}] "
        f"made an application allowlist setting change from [{value_dict.get(str(old_val))}] "
        f"to [{value_dict.get(str(new_val))}]"
    )

AnalysisType: rule
Description: Google Workspace Marketplace application allowlist settings were modified.
DisplayName: "Google Workspace Apps Marketplace Allowlist"
Enabled: true
Filename: google_workspace_apps_marketplace_allowlist.py
Runbook: Confirm with the acting user that this change was authorized.
Reference: https://support.google.com/a/answer/6089179?hl=en
Severity: Medium
DedupPeriodMinutes: 60
LogTypes:
  - GSuite.ActivityEvent
RuleID: "Google.Workspace.Apps.Marketplace.Allowlist"
Threshold: 1

def rule(event):
    # Return True to match the log event and trigger an alert.
    return (
        event.get("name") == "ADD_APPLICATION"
        and event.get("parameters", {}).get("APPLICATION_ENABLED", "<NO_APPLICATION_FOUND>")
        == "true"
    )


def title(event):
    # (Optional) Return a string which will be shown as the alert title.
    # If no 'dedup' function is defined, the return value of this method
    # will act as deduplication string.
    return (
        f"Google Workspace User [{event.get('actor',{}).get('email','<NO_EMAIL_PROVIDED>')}] "
        f"enabled a new Google Workspace Marketplace application "
        f"[{event.get('parameters',{}).get('APPLICATION_NAME','<NO_APPLICATION_NAME_FOUND>')}]"
    )

AnalysisType: rule
Description: A Google Workspace User configured a new domain application from the Google Workspace Apps Marketplace.
DisplayName: "Google Workspace Apps Marketplace New Domain Application"
Enabled: true
Filename: google_workspace_apps_marketplace_new_domain_application.py
Runbook: Confirm this was the intended behavior.
Reference: https://developers.google.com/workspace/marketplace/overview
Severity: Medium
DedupPeriodMinutes: 60
LogTypes:
  - GSuite.ActivityEvent
RuleID: "Google.Workspace.Apps.Marketplace.New.Domain.Application"
Threshold: 1

def rule(event):
    # Return True to match the log event and trigger an alert.
    return event.get("name", "") == "ADD_MOBILE_APPLICATION_TO_WHITELIST"


def title(event):
    # If no 'dedup' function is defined, the return value of
    # this method will act as deduplication string.
    mobile_app_pkg_id = event.get("parameters", {}).get(
        "MOBILE_APP_PACKAGE_ID", "<NO_MOBILE_APP_PACKAGE_ID_FOUND>"
    )
    return (
        f"Google Workspace User [{event.get('actor',{}).get('email','<NO_EMAIL_FOUND>')}] "
        f"added application "
        f"[{mobile_app_pkg_id}] "
        f"to your org's mobile application allowlist for "
        f"[{event.get('parameters',{}).get('DEVICE_TYPE','<NO_DEVICE_TYPE_FOUND>')}]."
    )

AnalysisType: rule
Description: A new mobile application was added to your organization's mobile apps whitelist in Google Workspace Apps.
DisplayName: "Google Workspace Apps New Mobile App Installed"
Enabled: true
Filename: google_workspace_apps_new_mobile_app_installed.py
Runbook: https://admin.google.com/ac/apps/unified
Reference: https://support.google.com/a/answer/6089179?hl=en
Severity: Medium

DedupPeriodMinutes: 60
LogTypes:
  - GSuite.ActivityEvent
RuleID: "Google.Workspace.Apps.New.Mobile.App.Installed"
Threshold: 1

from panther_core import PantherEvent


def rule(event: PantherEvent) -> bool:
    if event.deep_get("id", "applicationName") != "drive":
        return False
    return event.get("name") == "download"


def alert_context(event: PantherEvent) -> dict:
    return {
        "actor": event.deep_get("actor", "email", default="<UNKNOWN ACTOR>"),
        "document_name": event.deep_get("parameters", "doc_title", default="<UNKNOWN DOCUMENT>"),
    }

AnalysisType: rule
Filename: google_workspace_many_docs_downloaded.py
RuleID: "Google.Workspace.ManyDocsDownloaded"
DisplayName: Google Workspace Many Docs Downloaded
Enabled: true
LogTypes:
  - GSuite.ActivityEvent
Severity: Info
CreateAlert: false
Reports:
  MITRE ATT&CK:
    - TA0010:T1567
Description: >
  Checks whether a user has downloaded a large number of documents from Google Drive
  within a 5-minute period.
DedupPeriodMinutes: 5
Threshold: 20
Reference: >
  https://support.google.com/drive/answer/2423534?hl=en&co=GENIE.Platform%3DDesktop
SummaryAttributes:
  - p_any_usernames
  - parameters:doc_title
Tags:
  - GSuite ActivityEvent
Status: Experimental