new and improved Notion rules for demo

rules/notion_rules/notion_page_shared_to_web.py

@@ -16,12 +16,12 @@ def rule(event):
 
 def title(event):
     user = event.deep_get("event", "actor", "person", "email", default="<NO_USER_FOUND>")
-    page_id = event.deep_get("event", "details", "target", "page_id", default="<NO_PAGE_ID_FOUND>")
-    return f"Notion User [{user}] changed the status of page [{page_id}] to public."
+    page_name = event.deep_get("event", "details", "page_name", default="<NO_PAGE_NAME_FOUND>")
+    return f"Notion User [{user}] changed the status of page [{page_name}] to public."
 
 
 def alert_context(event):
     context = notion_alert_context(event)
-    page_id = event.deep_get("event", "details", "target", "page_id", default="<NO_PAGE_ID_FOUND>")
-    context["page_id"] = page_id
+    page_name = event.deep_get("event", "details", "page_name", default="<NO_PAGE_NAME_FOUND>")
+    context["page_name"] = page_name
     return context

rules/notion_rules/notion_scim_token_generated.py

@@ -12,11 +12,7 @@ def rule(event):
 def title(event):
     user = event.deep_get("event", "actor", "person", "email", default="<NO_USER_FOUND>")
     workspace_id = event.deep_get("event", "workspace_id", default="<NO_WORKSPACE_ID_FOUND>")
-    token_id = event.deep_get("event", "workspace", "scim_token_generated", default="{}")
-    return (
-        f"Notion User [{user}] generated a SCIM token "
-        f"[{token_id}] for workspace id [{workspace_id}]."
-    )
+    return f"Notion User [{user}] generated a SCIM token for workspace id [{workspace_id}]."
 
 
 def alert_context(event):

rules/notion_rules/notion_sharing_settings_updated.py

@@ -0,0 +1,32 @@
+from panther_notion_helpers import notion_alert_context
+
+EVENTS = (
+    "teamspace.settings.allow_public_page_sharing_setting_updated",
+    "teamspace.settings.allow_guests_setting_updated",
+    "teamspace.settings.allow_content_export_setting_updated",
+    "workspace.settings.allow_public_page_sharing_setting_updated",
+    "workspace.settings.allow_guests_setting_updated",
+    "workspace.settings.allow_content_export_setting_updated",
+)
+
+
+def rule(event):
+    return all(
+        [
+            event.deep_get("event", "type", default="") in EVENTS,
+            event.deep_get("event", "details", "state", default="") == "enabled",
+        ]
+    )
+
+
+def title(event):
+    actor = event.deep_get("event", "actor", "person", "email", default="NO_ACTOR_FOUND")
+    action = event.deep_get("event", "type", default="NO.EVENT.FOUND").split(".")[2]
+    teamspace = event.deep_get("event", "details", "target", "name", default=None)
+    if teamspace:
+        return f"[{actor}] enabled [{action}] for [{teamspace}] Teamspace"
+    return f"[{actor}] enabled [{action}] for Workspace"
+
+
+def alert_context(event):
+    return notion_alert_context(event)

rules/notion_rules/notion_sharing_settings_updated.yml

@@ -0,0 +1,69 @@
+AnalysisType: rule
+Filename: notion_sharing_settings_updated.py
+RuleID: "Notion.SharingSettingsUpdated"
+DisplayName: "Notion Sharing Settings Updated"
+Enabled: true
+LogTypes:
+    - Notion.AuditLogs
+Tags:
+  - Notion
+  - Data Exfiltration
+Description: A Notion User enabled sharing for a Workspace or Teamspace.
+Severity: Medium
+DedupPeriodMinutes: 60
+Threshold: 1
+Runbook: Possible Data Exfiltration. Follow up with the Notion User to determine if this was done for a valid business reason.
+Tests:
+    - ExpectedResult: true
+      Log:
+          {
+            "event": {
+              "actor": {
+                "id": "c16137bb-5078-4eac-b026-5cbd2f9a027a",
+                "object": "user",
+                "person": {
+                  "email": "[email protected]"
+                },
+                "type": "person"
+              },
+              "details": {
+                "state": "enabled",
+              },
+              "id": "91b29a4b-4978-40e1-ab56-40221f801ce5",
+              "ip_address": "11.22.33.44",
+              "platform": "web",
+              "timestamp": "2023-12-13 16:39:06.860000000",
+              "type": "workspace.settings.allow_guests_setting_updated",
+              "workspace_id": "ea65b016-6abc-4dcf-808b-e119617b55d1"
+            },
+          }
+      Name: Sharing Enabled
+    - ExpectedResult: false
+      Log:
+          {
+            "event": {
+              "actor": {
+                "id": "c16137bb-5078-4eac-b026-5cbd2f9a027a",
+                "object": "user",
+                "person": {
+                  "email": "[email protected]"
+                },
+                "type": "person"
+              },
+              "details": {
+                "state": "disabled",
+                "target": {
+                  "id": "a70a4074-5cac-4fc5-8e59-109df81e5a93",
+                  "name": "R&D",
+                  "object": "teamspace"
+                }
+              },
+              "id": "91b29a4b-4978-40e1-ab56-40221f801ce5",
+              "ip_address": "11.22.33.44",
+              "platform": "web",
+              "timestamp": "2023-12-13 16:39:06.860000000",
+              "type": "teamspace.settings.allow_guests_setting_updated",
+              "workspace_id": "ea65b016-6abc-4dcf-808b-e119617b55d1"
+            },
+          }
+      Name: Sharing Disabled

rules/notion_rules/notion_teamspace_owner_added.py

@@ -0,0 +1,26 @@
+from panther_notion_helpers import notion_alert_context
+
+
+def rule(event):
+    added = (
+        event.deep_get("event", "type", default="") == "teamspace.permissions.member_added"
+        and event.deep_get("event", "details", "role", default="") == "owner"
+    )
+    updated = (
+        event.deep_get("event", "type", default="") == "teamspace.permissions.member_role_updated"
+        and event.deep_get("event", "details", "new_role", default="") == "owner"
+    )
+    return added or updated
+
+
+def title(event):
+    actor = event.deep_get("event", "actor", "person", "email", default="NO_ACTOR_FOUND")
+    member = event.deep_get(
+        "event", "details", "member", "person", "email", default="NO_MEMBER_FOUND"
+    )
+    teamspace = event.deep_get("event", "details", "target", "name", default="NO_TEAMSPACE_FOUND")
+    return f"[{actor}] added [{member}] as owner of [{teamspace}] Teamspace"
+
+
+def alert_context(event):
+    return notion_alert_context(event)

rules/notion_rules/notion_teamspace_owner_added.yml

@@ -0,0 +1,90 @@
+AnalysisType: rule
+Filename: notion_teamspace_owner_added.py
+RuleID: "Notion.TeamspaceOwnerAdded"
+DisplayName: "Notion Teamspace Owner Added"
+Enabled: true
+LogTypes:
+    - Notion.AuditLogs
+Tags:
+  - Notion
+  - Privilege Escalation
+Description: A Notion User was added as a Teamspace owner.
+Severity: Medium
+DedupPeriodMinutes: 60
+Threshold: 1
+Runbook: Possible Privilege Escalation. Follow up with the Notion User to determine if this was done for a valid business reason.
+Tests:
+    - ExpectedResult: false
+      Log:
+          {
+            "event": {
+              "actor": {
+                "id": "c16137bb-5078-4eac-b026-5cbd2f9a027a",
+                "object": "user",
+                "person": {
+                  "email": "[email protected]"
+                },
+                "type": "person"
+              },
+              "details": {
+                "member": {
+                  "id": "c16137bb-5078-4eac-b026-5cbd2f9a027a",
+                  "object": "user",
+                  "person": {
+                    "email": "[email protected]"
+                  },
+                  "type": "person"
+                },
+                "role": "member",
+                "target": {
+                  "id": "b8db234d-71eb-49e2-a5ed-7935ca764920",
+                  "name": "General",
+                  "object": "teamspace"
+                }
+              },
+              "id": "eed75a56-ca1b-453b-afd8-73789bc19398",
+              "ip_address": "11.22.33.44",
+              "platform": "web",
+              "timestamp": "2023-12-13 16:20:14.966000000",
+              "type": "teamspace.permissions.member_added",
+              "workspace_id": "ea65b016-6abc-4dcf-808b-e119617b55d1"
+            }
+          }
+      Name: Member Added
+    - ExpectedResult: true
+      Log:
+          {
+            "event": {
+              "actor": {
+                "id": "c16137bb-5078-4eac-b026-5cbd2f9a027a",
+                "object": "user",
+                "person": {
+                  "email": "[email protected]"
+                },
+                "type": "person"
+              },
+              "details": {
+                "member": {
+                  "id": "c16137bb-5078-4eac-b026-5cbd2f9a027a",
+                  "object": "user",
+                  "person": {
+                    "email": "[email protected]"
+                  },
+                  "type": "person"
+                },
+                "new_role": "owner",
+                "target": {
+                  "id": "b8db234d-71eb-49e2-a5ed-7935ca764920",
+                  "name": "General",
+                  "object": "teamspace"
+                }
+              },
+              "id": "6019b995-0158-4430-8263-89ad7905bd1d",
+              "ip_address": "11.22.33.44",
+              "platform": "web",
+              "timestamp": "2023-12-13 16:38:04.264000000",
+              "type": "teamspace.permissions.member_role_updated",
+              "workspace_id": "ea65b016-6abc-4dcf-808b-e119617b55d1"
+            }
+          }
+      Name: Owner Added

rules/notion_rules/notion_workspace_audit_log_exported.py

@@ -1,5 +1,4 @@
 from global_filter_notion import filter_include_event
-from panther_base_helpers import deep_get
 from panther_notion_helpers import notion_alert_context
 
 
@@ -13,10 +12,9 @@ def rule(event):
 def title(event):
     user = event.deep_get("event", "actor", "person", "email", default="<NO_USER_FOUND>")
     workspace_id = event.deep_get("event", "workspace_id", default="<NO_WORKSPACE_ID_FOUND>")
-    duration_in_days = deep_get(
-        event,
+    duration_in_days = event.deep_get(
         "event",
-        "workspace.audit_log_exported",
+        "details",
         "duration_in_days",
         default="<NO_DURATION_IN_DAYS_FOUND>",
     )

rules/notion_rules/notion_workspace_audit_log_exported.yml

@@ -57,7 +57,7 @@ Tests:
               "ip_address": "...",
               "platform": "web",
               "type": "workspace.audit_log_exported",
-              "workspace.audit_log_exported": {
+              "details": {
                 "duration_in_days": 30
               }
             }