GSuite Passthrough Rule Triggered

AnalysisType: rule
Filename: gsuite_passthrough_rule.py
RuleID: "GSuite.Rule"
DisplayName: "GSuite Passthrough Rule Triggered"
Enabled: true
LogTypes:
  - GSuite.ActivityEvent
Tags:
  - GSuite
Severity: Info
Description: >
  A GSuite rule was triggered.
Reference: https://support.google.com/a/answer/9420866
Runbook: >
  Investigate what triggered the rule.
SummaryAttributes:
  - actor:email
Tests:
  - Name: Non Triggered Rule
    ExpectedResult: false
    Log:
      {
        "id": { "applicationName": "rules" },
        "actor": { "email": "some.user@somedomain.com" },
        "parameters": { "severity": "HIGH", "triggered_actions": null },
      }
  - Name: High Severity Rule
    ExpectedResult: true
    Log:
      {
        "id": { "applicationName": "rules" },
        "actor": { "email": "some.user@somedomain.com" },
        "parameters":
          {
            "data_source": "DRIVE",
            "severity": "HIGH",
            "triggered_actions": [{ "action_type": "DRIVE_UNFLAG_DOCUMENT" }],
          },
      }
  - Name: Medium Severity Rule
    ExpectedResult: true
    Log:
      {
        "id": { "applicationName": "rules" },
        "actor": { "email": "some.user@somedomain.com" },
        "parameters":
          {
            "data_source": "DRIVE",
            "severity": "MEDIUM",
            "triggered_actions": [{ "action_type": "DRIVE_UNFLAG_DOCUMENT" }],
          },
      }
  - Name: Low Severity Rule
    ExpectedResult: true
    Log:
      {
        "id": { "applicationName": "rules" },
        "actor": { "email": "some.user@somedomain.com" },
        "parameters":
          {
            "severity": "LOW",
            "triggered_actions": [{ "action_type": "DRIVE_UNFLAG_DOCUMENT" }],
          },
      }
  - Name: High Severity Rule with Rule Name
    ExpectedResult: true
    Log:
      {
        "id": { "applicationName": "rules" },
        "actor": { "email": "some.user@somedomain.com" },
        "parameters":
          {
            "severity": "HIGH",
            "rule_name": "CEO Impersonation",
            "triggered_actions": [{ "action_type": "MAIL_MARK_AS_PHISHING" }],
          },
      }


# ------ paired body: gsuite_passthrough_rule.py ------

def rule(event):
    if event.deep_get("id", "applicationName") != "rules":
        return False

    if not event.deep_get("parameters", "triggered_actions"):
        return False
    return True


def title(event):
    rule_severity = event.deep_get("parameters", "severity")
    if event.deep_get("parameters", "rule_name"):
        return (
            "GSuite "
            + rule_severity
            + " Severity Rule Triggered: "
            + event.deep_get("parameters", "rule_name")
        )
    return "GSuite " + rule_severity + " Severity Rule Triggered"


def severity(event):
    return event.deep_get("parameters", "severity", default="INFO")