Notion Page Guest Permissions Changed

AnalysisType: rule
Filename: notion_page_accessible_to_guests.py
RuleID: "Notion.PagePerms.GuestPermsChanged"
DisplayName: "Notion Page Guest Permissions Changed"
Enabled: true
LogTypes:
  - Notion.AuditLogs
Tags:
  - Notion
  - Data Security
  - Information Disclosure
Severity: Low
Description: The external guest permissions for a Notion page have been altered.
DedupPeriodMinutes: 60
Threshold: 1
Runbook: Potential information exposure - review the shared page and rectify if needed.
Reference: https://www.notion.so/help/sharing-and-permissions
Tests:
  - Name: Guest Role Added
    ExpectedResult: true
    Log:
      {
        "event":
          {
            "actor":
              {
                "id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
                "object": "user",
                "person": { "email": "aragorn.elessar@lotr.com" },
                "type": "person",
              },
            "details":
              {
                "entity":
                  {
                    "id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
                    "object": "user",
                    "person": { "email": "frodo.baggins@lotr.com" },
                    "type": "person",
                  },
                "new_permission": "full_access",
                "old_permission": "none",
                "page_audience": "shared_internally",
                "target":
                  {
                    "page_id": "441356b5-557b-4053-8d2f-7932d2607d66",
                    "type": "page_id",
                  },
              },
            "id": "e18690f8-e24b-4b03-ba6f-123eb7ec0f08",
            "timestamp": "2023-08-11 23:02:53.113000000",
            "type": "page.permissions.guest_role_added",
            "workspace_id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
          },
      }

  - Name: Guest Role Changed
    ExpectedResult: true
    Log:
      {
        "event":
          {
            "actor":
              {
                "id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
                "object": "user",
                "person": { "email": "aragorn.elessar@lotr.com" },
                "type": "person",
              },
            "details":
              {
                "entity":
                  {
                    "id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
                    "object": "user",
                    "person": { "email": "frodo.baggins@lotr.com" },
                    "type": "person",
                  },
                "new_permission": "full_access",
                "old_permission": "read_only",
                "page_audience": "shared_internally",
                "target":
                  {
                    "page_id": "441356b5-557b-4053-8d2f-7932d2607d66",
                    "type": "page_id",
                  },
              },
            "id": "e18690f8-e24b-4b03-ba6f-123eb7ec0f08",
            "timestamp": "2023-08-11 23:02:53.113000000",
            "type": "page.permissions.guest_role_updated",
            "workspace_id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
          },
      }


# ------ paired body: notion_page_accessible_to_guests.py ------

from panther_base_helpers import deep_get
from panther_notion_helpers import notion_alert_context

# These event types correspond to users adding or editing the default role on a public page
event_types = ("page.permissions.guest_role_added", "page.permissions.guest_role_updated")


def rule(event):

    return event.deep_get("event", "type", default="<NO_EVENT_TYPE_FOUND>") in event_types


def title(event):
    user = event.deep_get("event", "actor", "person", "email", default="<NO_USER_FOUND>")
    guest = event.deep_get(
        "event", "details", "entity", "person", "email", default="<NO_USER_FOUND>"
    )
    page_id = event.deep_get("event", "details", "target", "page_id", default="<NO_PAGE_ID_FOUND>")
    event_type = event.deep_get("event", "type", default="<NO_EVENT_TYPE_FOUND>")
    action = {
        "page.permissions.guest_role_added": "added a guest",
        "page.permissions.guest_role_updated": "changed the guest permissions of",
    }.get(event_type, "changed the guest permissions of")
    return f"Notion User [{user}] {action} [{guest}] on page [{page_id}]."


def alert_context(event):
    context = notion_alert_context(event)
    page_id = event.deep_get("event", "details", "target", "page_id", default="<NO_PAGE_ID_FOUND>")
    context["page_id"] = page_id
    details = event.deep_get("event", "details", default={})
    context["guest"] = deep_get(details, "entity", "person", "email", default="<NO_USER_FOUND>")
    context["new_permission"] = deep_get(details, "new_permission", default="<UNKNOWN PERMISSION>")
    context["old_permission"] = deep_get(details, "old_permission", default="<UNKNOWN PERMISSION>")
    return context