AnalysisType: rule
Description: Your organization's Google Workspace Advanced Protection Program settings were modified.
DisplayName: "Google Workspace Advanced Protection Program"
Enabled: true
Filename: google_workspace_advanced_protection_program.py
Runbook: Confirm the changes made were authorized for your organization.
Reference: https://support.google.com/a/answer/9378686?hl=en
Severity: Medium
Tests:
- ExpectedResult: false
Name: parameters json key set to null value
Log:
{
"actor":
{
"callerType": "USER",
"email": "user@example.io",
"profileId": "111111111111111111111",
},
"id":
{
"applicationName": "user_accounts",
"customerId": "C00000000",
"time": "2022-12-29 22:42:44.467000000",
"uniqueQualifier": "517500000000000000",
},
"parameters": null,
"ipAddress": "2600:2600:2600:2600:2600:2600:2600:2600",
"kind": "admin#reports#activity",
"name": "recovery_email_edit",
"type": "recovery_info_change",
}
- ExpectedResult: true
Log:
actor:
callerType: USER
email: example@example.io
profileId: "12345"
id:
applicationName: admin
customerId: D12345
time: "2022-12-11 01:35:29.906000000"
uniqueQualifier: "-12345"
ipAddress: 12.12.12.12
kind: admin#reports#activity
name: CREATE_APPLICATION_SETTING
parameters:
APPLICATION_EDITION: standard
APPLICATION_NAME: Security
NEW_VALUE: ALLOWED_WITH_REMOTE_ACCESS
ORG_UNIT_NAME: Example IO
SETTING_NAME: Advanced Protection Program Settings - Allow security codes
type: APPLICATION_SETTINGS
Name: Allow Security Codes
- ExpectedResult: true
Log:
actor:
callerType: USER
email: example@example.io
profileId: "12345"
id:
applicationName: admin
customerId: D12345
time: "2022-12-11 01:35:29.906000000"
uniqueQualifier: "-12345"
ipAddress: 12.12.12.12
kind: admin#reports#activity
name: CREATE_APPLICATION_SETTING
parameters:
APPLICATION_EDITION: standard
APPLICATION_NAME: Security
NEW_VALUE: "true"
ORG_UNIT_NAME: Example IO
SETTING_NAME: Advanced Protection Program Settings - Enable user enrollment
type: APPLICATION_SETTINGS
Name: Enable User Enrollment
- ExpectedResult: false
Log:
actor:
callerType: USER
email: example@example.io
profileId: "123456"
id:
applicationName: admin
customerId: D12345
time: "2022-12-11 02:57:48.693000000"
uniqueQualifier: "-12456"
ipAddress: 12.12.12.12
kind: admin#reports#activity
name: CREATE_ROLE
parameters:
ROLE_ID: "567890"
ROLE_NAME: CustomAdminRoleName
type: DELEGATED_ADMIN_SETTINGS
Name: New Custom Role Created
- Name: ListObject Type
ExpectedResult: false
Log:
{
"actor":
{ "email": "user@example.io", "profileId": "118111111111111111111" },
"id":
{
"applicationName": "drive",
"customerId": "D12345",
"time": "2022-12-20 17:27:47.080000000",
"uniqueQualifier": "-7312729053723258069",
},
"ipAddress": "12.12.12.12",
"kind": "admin#reports#activity",
"name": "rename",
"parameters":
{
"actor_is_collaborator_account": null,
"billable": true,
"doc_id": "1GGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG",
"doc_title": "Document Title- Found Here",
"doc_type": "presentation",
"is_encrypted": null,
"new_value": ["Document Title- Found Here"],
"old_value": ["Document Title- Old"],
"owner": "user@example.io",
"owner_is_shared_drive": null,
"owner_is_team_drive": null,
"primary_event": true,
"visibility": "private",
},
"type": "access",
}
DedupPeriodMinutes: 60
LogTypes:
- GSuite.ActivityEvent
RuleID: "Google.Workspace.Advanced.Protection.Program"
Threshold: 1
# ------ paired body: google_workspace_advanced_protection_program.py ------
def rule(event):
# Return True to match the log event and trigger an alert.
setting_name = (
event.deep_get("parameters", "SETTING_NAME", default="NO_SETTING_NAME")
.split("-")[0]
.strip()
)
setting_alert_flag = "Advanced Protection Program Settings"
return event.get("name") == "CREATE_APPLICATION_SETTING" and setting_name == setting_alert_flag
def title(event):
# If no 'dedup' function is defined, the return value of this
# method will act as deduplication string.
setting = event.deep_get("parameters", "SETTING_NAME", default="NO_SETTING_NAME")
setting_name = setting.split("-")[-1].strip()
return (
f"Google Workspace Advanced Protection Program settings have been updated to "
f"[{setting_name}] by Google Workspace User "
f"[{event.deep_get('actor', 'email', default='<NO_EMAIL_FOUND>')}]."
)