Allow 'applicationName=login for GSuite.ExternalMailForwarding` (#1395

)
panther-labs · Oct 22, 2024 · 09d2d70 · 09d2d70
1 parent 3c0205f
commit 09d2d70
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 2 deletions.
diff --git a/rules/gsuite_activityevent_rules/gsuite_external_forwarding.py b/rules/gsuite_activityevent_rules/gsuite_external_forwarding.py
@@ -2,7 +2,7 @@
 
 
 def rule(event):
-    if event.deep_get("id", "applicationName") != "user_accounts":
+    if event.deep_get("id", "applicationName") not in ("user_accounts", "login"):
         return False
 
     if event.get("name") == "email_forwarding_out_of_domain":

diff --git a/rules/gsuite_activityevent_rules/gsuite_external_forwarding.yml b/rules/gsuite_activityevent_rules/gsuite_external_forwarding.yml
@@ -21,7 +21,7 @@ Runbook: >
 SummaryAttributes:
   - p_any_emails
 Tests:
-  - Name: Forwarding to External Address
+  - Name: Forwarding to External Address - applicationName = user_accounts
     ExpectedResult: true
     Log:
       {
@@ -33,6 +33,17 @@ Tests:
           { "email_forwarding_destination_address": "[email protected]" },
       }
 
+  - Name: Forwarding to External Address - applicationName = login
+    ExpectedResult: true
+    Log:
+      {
+        "id": { "applicationName": "login", "customerId": "D12345" },
+        "actor": { "email": "[email protected]" },
+        "type": "email_forwarding_change",
+        "name": "email_forwarding_out_of_domain",
+        "parameters": { "email_forwarding_destination_address": "[email protected]" }
+      }
+
   - Name: Forwarding to External Address - Allowed Domain
     ExpectedResult: false
     Log: