detection.wiki

Detection rules › Panther

Google Drive High Download Count

Status
Deprecated
Severity
medium
Tags
Deprecated
Reference
https://support.google.com/drive/answer/2423534?hl=en&co=GENIE.Platform%3DDesktop
Source
github.com/panther-labs/panther-analysis

Scheduled rule for the High Google Drive Download Count query which looks for incidents of more than 10 (tunable) downloads by a user in the past day.

Rule body yaml

AnalysisType: scheduled_rule
Description: Scheduled rule for the High Google Drive Download Count query which looks for incidents of more than 10 (tunable) downloads by a user in the past day.
DisplayName: "Google Drive High Download Count"
Status: Deprecated
Enabled: false
Filename: gsuite_drive_many_docs_downloaded.py
Reference: https://support.google.com/drive/answer/2423534?hl=en&co=GENIE.Platform%3DDesktop
Severity: Medium
Tags:
  - Deprecated
Tests:
  - ExpectedResult: true
    Log:
      download_count: 23
      downloaded_files:
        - all_hands01.mov
        - all_hands02.mov
        - all_hands03.mov
        - all_hands23.mov
      user: homer.simpson@simpsons.com
    Name: Result Row
DedupPeriodMinutes: 60
RuleID: "Google.Drive.High.Download.Count"
Threshold: 1
ScheduledQueries:
  - GSuite Many Docs Downloaded Query

Detection logic

Filter

def rule(_):
    return True


def title(event):
    return (
        f"GSuite: [{event.get('user', '<user_not_found>')}] "
        f"downloaded [{event.get('download_count', '<count_not_found>')}] "
        "files from Google Drive."
    )


def alert_context(event):
    return event.to_dict()

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

Field
user
download_count