panther-siem/packs/gsuite_reports.yml at develop · TachTech-Engineering/panther-siem · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
AnalysisType: pack
PackID: PantherManaged.GSuite.Reports
Description: Panther GSuite Detections
PackDefinition:
  IDs:
    - Google.Workspace.Admin.Custom.Role
    - Google.Workspace.Advanced.Protection.Program
    - Google.Workspace.Apps.Marketplace.Allowlist
    - Google.Workspace.Apps.Marketplace.New.Domain.Application
    - Google.Workspace.Apps.New.Mobile.App.Installed
    - Google.Workspace.ManyDocsDownloaded
    - GSuite.AdvancedProtection
    - GSuite.CalendarMadePublic
    - GSuite.Drive.Many.Documents.Deleted
    - Google.Drive.High.Download.Count
    - GSuite.GoogleAccess
    - GSuite.GovernmentBackedAttack
    - GSuite.GroupBannedUser
    - GSuite.LeakedPassword
    - GSuite.DeviceCompromise
    - GSuite.DeviceUnlockFailure
    - GSuite.DeviceSuspiciousActivity
    - GSuite.Rule
    - GSuite.SuspiciousLogins
    - GSuite.TwoStepVerification
    - GSuite.UserSuspended
    - GSuite.Workspace.CalendarExternalSharingSetting
    - GSuite.Workspace.DataExportCreated
    - GSuite.Workspace.GmailDefaultRoutingRuleModified
    - GSuite.Workspace.GmailPredeliveryScanningDisabled
    - GSuite.Workspace.GmailSecuritySandboxDisabled
    - GSuite.Workspace.PasswordEnforceStrongDisabled
    - GSuite.Workspace.PasswordReuseEnabled
    - GSuite.Workspace.TrustedDomainsAllowlist
    - GSuite.DriveOverlyVisible
    # Data Models used in these detections
    - Standard.GSuite.Reports
    # Globals used in these detections
    - panther_base_helpers
    - panther_gsuite_helpers
    - panther_event_type_helpers
    - panther_lookuptable_helpers
    # Queries
    - GSuite Many Docs Deleted Query
    - GSuite Many Docs Downloaded Query
DisplayName: "Panther GSuite Pack"