Suspicious GSuite Login

AnalysisType: rule
Filename: gsuite_suspicious_logins.py
RuleID: "GSuite.SuspiciousLogins"
DisplayName: "Suspicious GSuite Login"
Enabled: true
LogTypes:
  - GSuite.ActivityEvent
Tags:
  - GSuite
Severity: Medium
Description: >
  GSuite reported a suspicious login for this user.
Reference: https://support.google.com/a/answer/7102416?hl=en
Runbook: >
  Checkout the details of the login and verify this behavior with the user to ensure the account wasn't compromised.
SummaryAttributes:
  - actor:email
Tests:
  - Name: Normal Login Event
    ExpectedResult: false
    Log:
      {
        "id": { "applicationName": "login" },
        "kind": "admin#reports#activity",
        "type": "account_warning",
        "name": "login_success",
        "parameters": { "affected_email_address": "bobert@ext.runpanther.io" },
      }
  - Name: Account Warning Not For Suspicious Login
    ExpectedResult: false
    Log:
      {
        "id": { "applicationName": "login" },
        "kind": "admin#reports#activity",
        "type": "account_warning",
        "name": "account_disabled_spamming",
        "parameters": { "affected_email_address": "bobert@ext.runpanther.io" },
      }
  - Name: Account Warning For Suspicious Login
    ExpectedResult: true
    Log:
      {
        "id": { "applicationName": "login" },
        "kind": "admin#reports#activity",
        "type": "account_warning",
        "name": "suspicious_login",
        "parameters": { "affected_email_address": "bobert@ext.runpanther.io" },
      }

# ------ paired body: gsuite_suspicious_logins.py ------

SUSPICIOUS_LOGIN_TYPES = {
    "suspicious_login",
    "suspicious_login_less_secure_app",
    "suspicious_programmatic_login",
}


def rule(event):
    if event.deep_get("id", "applicationName") != "login":
        return False

    if event.get("name") in SUSPICIOUS_LOGIN_TYPES:
        return True

    return False


def title(event):
    user = event.deep_get("actor", "email") or event.deep_get(
        "parameters", "affected_email_address", default="<UNKNOWN_USER>"
    )
    return f"A suspicious login was reported for user [{user}]"