Notion Audit Log Exported

from panther_notion_helpers import notion_alert_context


def rule(event):

    event_type = event.deep_get("event", "type", default="<NO_EVENT_TYPE_FOUND>")
    return event_type == "workspace.audit_log_exported"


def title(event):
    user = event.deep_get("event", "actor", "person", "email", default="<NO_USER_FOUND>")
    workspace_id = event.deep_get("event", "workspace_id", default="<NO_WORKSPACE_ID_FOUND>")
    duration_in_days = event.deep_get(
        "event",
        "details",
        "duration_in_days",
        default="<NO_DURATION_IN_DAYS_FOUND>",
    )
    return (
        f"Notion User [{user}] exported audit logs for the last "
        f"{duration_in_days} days for workspace id {workspace_id}"
    )


def alert_context(event):
    return notion_alert_context(event)