Notion Workspace public page added

AnalysisType: rule
Filename: notion_workspace_settings_public_homepage_added.py
RuleID: "Notion.Workspace.Public.Page.Added"
DisplayName: "Notion Workspace public page added"
Enabled: true
LogTypes:
  - Notion.AuditLogs
Tags:
  - Notion
  - Data Security
  - Information Disclosure
Severity: Info
Description: A Notion page was set to public in your worksace.
DedupPeriodMinutes: 60
Threshold: 1
Runbook: A Notion page was made public. Check with the author to determine why this page was made public.
Reference: https://www.notion.so/help/public-pages-and-web-publishing
Tests:
  - Name: Public page added
    ExpectedResult: true
    Log:
      {
        "event":
          {
            "id": "eeeeeeee-dddd-4444-bbbb-4444444444444",
            "timestamp": "2023-05-15T19:14:21.031Z",
            "workspace_id": "vvvvvvvv-dddd-4444-bbbb-666666666666",
            "actor":
              {
                "object": "user",
                "id": "44444444-cccc-7777-aaaa-666666666666",
                "type": "person",
                "person": { "email": "example@personemail.com" },
              },
            "ip_address": "00.000.00.000",
            "platform": "web",
            "type": "workspace.settings.public_homepage_added",
            "workspace.settings.public_homepage_added":
              {
                "new_public_page":
                  {
                    "type": "database_id",
                    "database_id": "4b801dc7-d724-4fbb-afd0-9885cbc12405",
                  },
              },
          },
      }
  - Name: Workspace Exported
    ExpectedResult: false
    Log:
      {
        "event":
          {
            "actor":
              {
                "id": "bd37477c-869d-418b-abdb-0fc727b38b5e",
                "object": "user",
                "person": { "email": "homer.simpson@yourcompany.io" },
                "type": "person",
              },
            "details":
              {
                "parent":
                  {
                    "type": "workspace_id",
                    "workspace_id": "ab99as87-6abc-4dcf-808b-111999882299",
                  },
                "target":
                  {
                    "page_id": "3cd2c560-d1b9-474e-b46e-gh8899002763",
                    "type": "page_id",
                  },
              },
            "id": "d4b9963f-12a8-4b01-b597-233a140abf5e",
            "ip_address": "12.12.12.12",
            "platform": "web",
            "timestamp": "2023-06-01 18:57:07.486000000",
            "type": "page.exported",
            "workspace_id": "ea65b016-6abc-4dcf-808b-e119617b55d1",
          },
      }


# ------ paired body: notion_workspace_settings_public_homepage_added.py ------

from panther_notion_helpers import notion_alert_context


def rule(event):

    event_type = event.deep_get("event", "type", default="<NO_EVENT_TYPE_FOUND>")
    return event_type == "workspace.settings.public_homepage_added"


def title(event):
    actor = event.deep_get("event", "actor", "person", "email", default="<NO_EMAIL_FOUND>")
    wkspc_id = event.deep_get("event", "workspace_id", default="<NO_WORKSPACE_ID_FOUND>")
    db_id = event.deep_get(
        "event",
        "workspace.settings.public_homepage_added",
        "new_public_page",
        "database_id",
        default="<NO_DATABASE_ID_FOUND>",
    )
    return f"Notion User [{actor}] added a new public homepage [{db_id}] in workspace [{wkspc_id}]"


def alert_context(event):
    context = notion_alert_context(event)
    workspace_id = event.deep_get("event", "workspace_id", default="<NO_WORKSPACE_ID_FOUND>")
    db_id = event.deep_get(
        "event",
        "workspace.settings.public_homepage_added",
        "new_public_page",
        "database_id",
        default="<NO_DATABASE_ID_FOUND>",
    )
    context["workspace_id"] = workspace_id
    context["page_id"] = db_id
    return context