Panther informational experimental python

GSuite Passthrough Rule Triggered

A GSuite rule was triggered.

View Source

Detection Logic

def rule(event):
    if event.deep_get("id", "applicationName") != "rules":
        return False

    if not event.deep_get("parameters", "triggered_actions"):
        return False
    return True


def title(event):
    rule_severity = event.deep_get("parameters", "severity")
    if event.deep_get("parameters", "rule_name"):
        return (
            "GSuite "
            + rule_severity
            + " Severity Rule Triggered: "
            + event.deep_get("parameters", "rule_name")
        )
    return "GSuite " + rule_severity + " Severity Rule Triggered"


def severity(event):
    return event.deep_get("parameters", "severity", default="INFO")

Field Validations

Loading…

Comments (0)

Loading comments...