GSuite User Suspended

AnalysisType: rule
Filename: gsuite_user_suspended.py
RuleID: "GSuite.UserSuspended"
DisplayName: "GSuite User Suspended"
Enabled: true
LogTypes:
  - GSuite.ActivityEvent
Tags:
  - GSuite
Severity: High
Description: >
  A GSuite user was suspended, the account may have been compromised by a spam network.
Reference: https://support.google.com/drive/answer/40695?hl=en&sjid=864417124752637253-EU
Runbook: >
  Investigate the behavior that got the account suspended. Verify with the user that this intended behavior. If not, the account may have been compromised.
SummaryAttributes:
  - actor:email
Tests:
  - Name: Normal Login Event
    ExpectedResult: false
    Log:
      {
        "id": { "applicationName": "login" },
        "kind": "admin#reports#activity",
        "type": "account_warning",
        "name": "login_success",
        "parameters": { "affected_email_address": "bobert@ext.runpanther.io" },
      }
  - Name: Account Warning Not For User Suspended
    ExpectedResult: false
    Log:
      {
        "id": { "applicationName": "login" },
        "kind": "admin#reports#activity",
        "type": "account_warning",
        "name": "suspicious_login ",
        "parameters": { "affected_email_address": "bobert@ext.runpanther.io" },
      }
  - Name: Account Warning For Suspended User
    ExpectedResult: true
    Log:
      {
        "id": { "applicationName": "login" },
        "kind": "admin#reports#activity",
        "type": "account_warning",
        "name": "account_disabled_spamming",
        "parameters": { "affected_email_address": "bobert@ext.runpanther.io" },
      }


# ------ paired body: gsuite_user_suspended.py ------

from panther_gsuite_helpers import gsuite_activityevent_alert_context

USER_SUSPENDED_EVENTS = {
    "account_disabled_generic",
    "account_disabled_spamming_through_relay",
    "account_disabled_spamming",
    "account_disabled_hijacked",
}


def rule(event):
    if event.deep_get("id", "applicationName") != "login":
        return False

    return bool(event.get("name") in USER_SUSPENDED_EVENTS)


def title(event):
    user = event.deep_get("parameters", "affected_email_address")
    if not user:
        user = "<UNKNOWN_USER>"
    return f"User [{user}]'s account was disabled"


def alert_context(event):
    return gsuite_activityevent_alert_context(event)