GSuite User Banned from Group

AnalysisType: rule
Filename: gsuite_group_banned_user.py
RuleID: "GSuite.GroupBannedUser"
DisplayName: "GSuite User Banned from Group"
Enabled: true
LogTypes:
  - GSuite.ActivityEvent
Tags:
  - GSuite
Severity: Low
Description: >
  A GSuite user was banned from an enterprise group by moderator action.
Reference: https://support.google.com/a/users/answer/9303224?hl=en&sjid=864417124752637253-EU
Runbook: >
  Investigate the banned user to see if further disciplinary action needs to be taken.
SummaryAttributes:
  - actor:email
Tests:
  - Name: User Added
    ExpectedResult: false
    Log:
      {
        "id": { "applicationName": "groups_enterprise" },
        "actor": { "email": "homer.simpson@example.com" },
        "type": "moderator_action",
        "name": "add_member",
      }
  - Name: User Banned from Group
    ExpectedResult: true
    Log:
      {
        "id": { "applicationName": "groups_enterprise" },
        "actor": { "email": "homer.simpson@example.com" },
        "type": "moderator_action",
        "name": "ban_user_with_moderation",
      }


# ------ paired body: gsuite_group_banned_user.py ------

def rule(event):
    if event.deep_get("id", "applicationName") != "groups_enterprise":
        return False

    if event.get("type") == "moderator_action":
        return bool(event.get("name") == "ban_user_with_moderation")

    return False


def title(event):
    return (
        f"User [{event.deep_get('actor', 'email', default='<UNKNOWN_EMAIL>')}] "
        f"banned another user from a group."
    )