GSuite User Advanced Protection Change

AnalysisType: rule
Filename: gsuite_advanced_protection.py
RuleID: "GSuite.AdvancedProtection"
DisplayName: "GSuite User Advanced Protection Change"
Enabled: true
LogTypes:
  - GSuite.ActivityEvent
Tags:
  - GSuite
  - Defense Evasion:Impair Defenses
Reports:
  MITRE ATT&CK:
    - TA0005:T1562
Severity: Low
Description: >
  A user disabled advanced protection for themselves.
Reference: https://support.google.com/a/answer/9378686?hl=en&sjid=864417124752637253-EU
Runbook: >
  Have the user re-enable Google Advanced Protection
SummaryAttributes:
  - actor:email
Tests:
  - Name: Advanced Protection Enabled
    ExpectedResult: false
    Log:
      {
        "id": { "applicationName": "user_accounts" },
        "actor": { "callerType": "USER", "email": "homer.simpson@example.com" },
        "type": "titanium_change",
        "name": "titanium_enroll",
      }
  - Name: Advanced Protection Disabled
    ExpectedResult: true
    Log:
      {
        "id": { "applicationName": "user_accounts" },
        "actor": { "callerType": "USER", "email": "homer.simpson@example.com" },
        "type": "titanium_change",
        "name": "titanium_unenroll",
      }


# ------ paired body: gsuite_advanced_protection.py ------

def rule(event):
    if event.deep_get("id", "applicationName") != "user_accounts":
        return False

    return bool(event.get("name") == "titanium_unenroll")


def title(event):
    return (
        f"Advanced protection was disabled for user "
        f"[{event.deep_get('actor', 'email', default='<UNKNOWN_EMAIL>')}]"
    )