Notion Page API Permissions Changed

AnalysisType: rule
Filename: notion_page_accessible_to_api.py
DisplayName: "Notion Page API Permissions Changed"
RuleID: "Notion.PagePerms.APIPermsChanged"
Enabled: true
LogTypes:
  - Notion.AuditLogs
Tags:
  - Notion
  - Data Security
  - Unapproved 3rd Party Apps
Severity: Low
Description: "A new API integration was added to a Notion page, or it's permissions were changed."
DedupPeriodMinutes: 60
Threshold: 1
Runbook: Potential information exposure - review the shared page and rectify if needed.
Reference: https://www.notion.so/help/sharing-and-permissions


# ------ paired body: notion_page_accessible_to_api.py ------

from panther_notion_helpers import notion_alert_context

# These event types correspond to users adding or editing the default role on a public page
event_types = (
    "page.permissions.integration_role_added",
    "page.permissions.integration_role_updated",
)


def rule(event):

    return event.deep_get("event", "type", default="<NO_EVENT_TYPE_FOUND>") in event_types


def title(event):
    user = event.deep_get("event", "actor", "person", "email", default="<NO_USER_FOUND>")
    page_id = event.deep_get("event", "details", "target", "page_id", default="<NO_PAGE_ID_FOUND>")
    return f"Notion User [{user}] added an integration to page [{page_id}]."


def alert_context(event):
    context = notion_alert_context(event)
    page_id = event.deep_get("event", "details", "target", "page_id", default="<NO_PAGE_ID_FOUND>")
    context["page_id"] = page_id
    return context