Panther medium deprecated python

Google Drive High Download Count

Scheduled rule for the High Google Drive Download Count query which looks for incidents of more than 10 (tunable) downloads by a user in the past day.

View Source

Detection Logic

def rule(_):
    return True


def title(event):
    return (
        f"GSuite: [{event.get('user', '<user_not_found>')}] "
        f"downloaded [{event.get('download_count', '<count_not_found>')}] "
        "files from Google Drive."
    )


def alert_context(event):
    return event.to_dict()

Field Validations

Loading…

Comments (0)

Loading comments...