Google Workspace - New Login IP detection #550
Conversation
rules/gsuite_activityevent_rules/google_workspace_new_login_ip.py
Outdated
Show resolved
Hide resolved
rules/gsuite_activityevent_rules/google_workspace_new_login_ip.py
Outdated
Show resolved
Hide resolved
|
Also should note that this detection will alert on EVERY login once this is enabled. We may want to add logic to allow the first login to not alert and only alert when ip_history > 1 |
|
Also new IPs can lead to a lot of false positives. Thoughts on utilizing the new IPInfo LUT and alerting based on new ASNs? |
I thought about this but wasn't sure how to best solve it. I had an idea for cache priming that involved running a sql query, and putting the results in an array (Along with the query ran date) that would prime the cache and enable the 30 day expiration too, but it introduces a decent amount of complexity. Your solution of just waiting for 1 entry is a solid compromise! cc @natezpanther |
|
Marking as a draft (not honestly sure what that does) because I am going to implement some suggestions. |
Curious - how would I go about mocking the LUT in a unit test? |
…ght break the overload capability?
|
Deer lord, I have finally fixed the linter issues (which were actually disguising failed tests interestingly enough). Fixed those too. |
|
You can also see it on Papaya Oarfish: https://papaya-junior.runpanther.net/build/detections/rules/Google.Workspace.New.Login.IP/edit/?section=functions |
|
Just needs the check to test that this isn't the first login to alert to prevent an alert storm |
Background
Google Workspace (Gsuite) detection to alert when a new IP has successfully logged into an account.
NOTE: The rest of the rules are prefixed (and named) Gsuite. Should I conform to that naming convention, even though its technically outdated?
Changes
Testing