Panther medium experimental python

GSuite User Device Compromised

GSuite reported a user's device has been compromised.

View Source

Detection Logic

def rule(event):
    if event.deep_get("id", "applicationName") != "mobile":
        return False

    if event.get("name") == "DEVICE_COMPROMISED_EVENT":
        return bool(event.deep_get("parameters", "DEVICE_COMPROMISED_STATE") == "COMPROMISED")

    return False


def title(event):
    return (
        f"User [{event.deep_get('parameters', 'USER_EMAIL', default='<UNKNOWN_USER>')}]'s "
        f"device was compromised"
    )

Field Validations

Loading…

Comments (0)

Loading comments...