-h for help')
+
+ help_msg = ('SCuBA automated conformance check for '
+ 'Google Workspace (GWS) products')
+ gws_parser = subparsers.add_parser('gws',
+ description = help_msg,
+ help = help_msg)
+ get_gws_args(gws_parser, user_config)
+
+ help_msg = 'Download OPA executable'
+ getopa_parser = subparsers.add_parser('getopa',
+ description = help_msg,
+ help = help_msg)
+ get_opa_args(getopa_parser, user_config)
+
+ help_msg = 'Purge old ScubaGoggles reports'
+ purge_parser = subparsers.add_parser('purge',
+ description = help_msg,
+ help = help_msg)
+ get_purge_args(purge_parser, user_config)
+
+ help_msg = 'ScubaGoggles user setup'
+ setup_parser = subparsers.add_parser('setup',
+ description = help_msg,
+ help = help_msg)
+ get_setup_args(setup_parser, user_config)
+
+ help_msg = 'ScubaGoggles version'
+ setup_parser = subparsers.add_parser('version',
+ description = help_msg,
+ help = help_msg)
+ get_version_args(setup_parser)
- gws_parser_help = "Run the SCuBA automated conformance " \
- "check against one or more Google Workspace products"
- gws_parser = subparsers.add_parser('gws', help=gws_parser_help)
- get_gws_args(gws_parser)
scuba_parser = ScubaArgumentParser(parser)
args = scuba_parser.parse_args_with_config()
- if args.scuba_cmd == 'gws':
- Orchestrator(args).start_automation()
- else:
- raise Exception("Invalid subparser. Run scubagoggles -h to see a list of valid subparsers")
+ logging.basicConfig(format = '(%(levelname)s): %(message)s')
+ level = log_level(args.log)
+ log = logging.root
+ log.setLevel(level)
+
+ # When trapping exceptions to suppress tracebacks (which users don't need
+ # to see for obvious failures not related to the code), make sure the
+ # process exits with an error code.
+
+ error = False
+
+ try:
+ args.dispatch(args)
+ except NotADirectoryError as nad:
+ print(f'\n{nad}')
+ error = True
+ except FileNotFoundError as fnf:
+ print(f'\n{fnf}')
+ error = True
+ except MarkdownParserError as mpe:
+ print(f'\n{mpe}')
+ error = True
+ except UserRuntimeError as ure:
+ print(f'\n{ure}')
+ error = True
+ except KeyboardInterrupt:
+ print('\nUser interrupt')
+
+ if error:
+ sys.exit(EXIT_FAILURE)
+
+
+if __name__ == '__main__':
+ dive()
diff --git a/scubagoggles/orchestrator.py b/scubagoggles/orchestrator.py
index b5b68931..f0e6fd80 100644
--- a/scubagoggles/orchestrator.py
+++ b/scubagoggles/orchestrator.py
@@ -2,23 +2,34 @@
orchestrator.py is the main module that starts and handles the output of the
provider, rego, and report modules of the SCuBA tool
"""
+
import argparse
-import shutil
-import os
import json
+import logging
+import os
+import platform
+import shutil
import webbrowser
+
+from datetime import datetime, timezone
from pathlib import Path
-from datetime import datetime
from tqdm import tqdm
-from googleapiclient.discovery import build
-from scubagoggles.auth import gws_auth
from scubagoggles.provider import Provider
-from scubagoggles.run_rego import opa_eval
-from scubagoggles.reporter import md_parser
+from scubagoggles.reporter.md_parser import MarkdownParser
from scubagoggles.reporter.reporter import Reporter
+from scubagoggles.run_rego import opa_eval, find_opa
from scubagoggles.utils import rel_abs_path
+from scubagoggles.version import Version
+log = logging.getLogger(__name__)
+
+
+class UserRuntimeError(RuntimeError):
+ """This exception class is for runtime errors (possibly caused by the
+ user) for which a traceback might not be appropriate (error has nothing
+ to do with the code).
+ """
class Orchestrator:
@@ -29,32 +40,33 @@ class Orchestrator:
# Dictionary of the SCuBA GWS baselines short names plus full names.
_gws_baselines = [
- "gmail",
- "calendar",
- "groups",
- "chat",
- "drive",
- "meet",
- "sites",
- "commoncontrols",
- "rules",
- "classroom"
+ 'gmail',
+ 'calendar',
+ 'groups',
+ 'chat',
+ 'drive',
+ 'meet',
+ 'sites',
+ 'commoncontrols',
+ 'rules',
+ 'classroom'
]
_prod_to_fullname = {
- "gmail": "Gmail",
- "calendar": "Google Calendar",
- "groups": "Groups for Business",
- "chat": "Google Chat",
- "drive": "Google Drive and Docs",
- "meet": "Google Meet",
- "sites": "Google Sites",
- "commoncontrols": "Common Controls",
- "rules": "Rules",
- "classroom": "Google Classroom"
+ 'gmail': 'Gmail',
+ 'calendar': 'Google Calendar',
+ 'groups': 'Groups for Business',
+ 'chat': 'Google Chat',
+ 'drive': 'Google Drive and Docs',
+ 'meet': 'Google Meet',
+ 'sites': 'Google Sites',
+ 'commoncontrols': 'Common Controls',
+ 'rules': 'Rules',
+ 'classroom': 'Google Classroom'
}
+
_gws = {
- "gws_baselines": _gws_baselines,
- "prod_to_fullname": _prod_to_fullname
+ 'gws_baselines': _gws_baselines,
+ 'prod_to_fullname': _prod_to_fullname
}
def __init__(self, args: argparse.Namespace):
@@ -75,26 +87,26 @@ def gws_products(cls) -> dict:
"""
return cls._gws
- def _run_gws_providers(self, services: dict):
+ def _run_gws_providers(self):
"""
Runs the provider scripts and outputs a json to path
-
- :param services: a dictionary of Google API service objects
"""
args = self._args
products = args.baselines
- out_folder = args.outputpath
- provider = Provider(services, args.customerid)
- provider_dict = provider.call_gws_providers(products, args.quiet)
- provider_dict['successful_calls'] = list(provider.successful_calls)
- provider_dict['unsuccessful_calls'] = list(provider.unsuccessful_calls)
+ with Provider(args.customerid,
+ args.credentials,
+ args.subjectemail) as provider:
+ provider_dict = provider.call_gws_providers(products, args.quiet)
+ provider_dict['baseline_suffix'] = Version.suffix
+ provider_dict['successful_calls'] = list(provider.successful_calls)
+ provider_dict['unsuccessful_calls'] = list(provider.unsuccessful_calls)
- settings_json = json.dumps(provider_dict, indent = 4)
- out_path = out_folder + f'/{args.outputproviderfilename}.json'
- with open(out_path, mode="w", encoding='UTF-8') as outfile:
- outfile.write(settings_json)
+ out_jsonfile = args.outputpath / args.outputproviderfilename
+ out_jsonfile = out_jsonfile.with_suffix('.json')
+ with out_jsonfile.open('w', encoding = 'utf-8') as out_stream:
+ json.dump(provider_dict, out_stream, indent = 4)
def _rego_eval(self):
"""
@@ -105,32 +117,28 @@ def _rego_eval(self):
args = self._args
products = args.baselines
products_bar = tqdm(products, leave=False, disable=args.quiet)
- out_folder = args.outputpath
results = []
for product in products_bar:
product_name = product
- input_file = f'{out_folder}/{args.outputproviderfilename}.json'
+ input_file = args.outputpath / f'{args.outputproviderfilename}.json'
opa_path = args.opapath
rego_path = args.regopath
- products_bar.set_description(f"Running Rego verification for {product}...")
- product_tests = opa_eval(
- product_name=product_name,
- input_file=input_file,
- opa_path=opa_path,
- rego_path=rego_path,
- omit_sudo=args.omitsudo,
- debug=args.debug
- )
+ products_bar.set_description(f'Running Rego verification for {product}...')
+ product_tests = opa_eval(product_name,
+ input_file,
+ opa_path,
+ rego_path,
+ args.debug)
try:
results.extend(product_tests[0])
except Exception as exc:
- raise Exception("run_rego error") from exc
+ raise Exception('run_rego error') from exc
- settings_json = json.dumps(results,sort_keys=True ,indent = 4)
- out_path = out_folder + f'/{args.outputregofilename}.json'
- with open(out_path, mode="w", encoding='UTF-8') as outfile:
- outfile.write(settings_json)
+ out_jsonfile = args.outputpath / args.outputregofilename
+ out_jsonfile = out_jsonfile.with_suffix('.json')
+ with out_jsonfile.open('w', encoding = 'utf-8') as out_stream:
+ json.dump(results, out_stream, indent = 4)
@staticmethod
def _pluralize(singular: str, plural: str, count: int) -> str:
@@ -141,24 +149,23 @@ def _pluralize(singular: str, plural: str, count: int) -> str:
:param plural: string value in plural tense
:param count: how many of string value
"""
- if count == 1:
- return singular
- return plural
+
+ return singular if count == 1 else plural
@classmethod
def _generate_summary(cls, stats: dict) -> str:
"""
Craft the html-formatted summary from the stats dictionary.
"""
- n_success = stats["Passes"]
- n_warn = stats["Warnings"]
- n_fail = stats["Failures"]
- n_manual = stats["Manual"]
- n_error = stats["Errors"]
+ n_success = stats['Passes']
+ n_warn = stats['Warnings']
+ n_fail = stats['Failures']
+ n_manual = stats['Manual']
+ n_error = stats['Errors']
n_omit = stats['Omit']
pass_summary = (f"{n_success}"
- f" {cls._pluralize('pass', 'passes', n_success)}
")
+ f" {cls._pluralize('pass', 'passes', n_success)}")
# The warnings, failures, and manuals are only shown if they are
# greater than zero. Reserve the space for them here. They will
@@ -171,22 +178,26 @@ def _generate_summary(cls, stats: dict) -> str:
if n_warn > 0:
warning_summary = (f"{n_warn}"
- f" {cls._pluralize('warning', 'warnings', n_warn)}
")
+ f" {cls._pluralize('warning', 'warnings', n_warn)}"
+ '')
if n_fail > 0:
failure_summary = (f"{n_fail}"
- f" {cls._pluralize('failure', 'failures', n_fail)}
")
+ f" {cls._pluralize('failure', 'failures', n_fail)}"
+ '')
if n_manual > 0:
manual_summary = (f"{n_manual} manual"
- f" {cls._pluralize('check', 'checks', n_manual)}
")
+ f" {cls._pluralize('check', 'checks', n_manual)}"
+ '')
if n_error > 0:
error_summary = (f"{n_error}"
- f" {cls._pluralize('error', 'errors', n_error)}
")
+ f" {cls._pluralize('error', 'errors', n_error)}"
+ '')
if n_omit > 0:
omit_summary = (f"{n_omit}"
- " omitted
")
+ ' omitted')
- return f"{pass_summary}{warning_summary}{failure_summary}" \
- f"{manual_summary}{omit_summary}{error_summary}"
+ return (f'{pass_summary}{warning_summary}{failure_summary}'
+ f'{manual_summary}{omit_summary}{error_summary}')
def _run_reporter(self):
"""
@@ -196,10 +207,9 @@ def _run_reporter(self):
# Make the report output folders
args = self._args
out_folder = args.outputpath
- individual_reports_path = out_folder + "/IndividualReports"
- reports_images_path = individual_reports_path + "/images"
- Path(individual_reports_path).mkdir(parents=True, exist_ok=True)
- Path(reports_images_path).mkdir(parents=True, exist_ok=True)
+ individual_reports_path = out_folder / 'IndividualReports'
+ reports_images_path = individual_reports_path / 'images'
+ reports_images_path.mkdir(parents=True, exist_ok=True)
# Copy the CISA logo to the repo folder so that it can be accessed
# from there
@@ -212,44 +222,37 @@ def _run_reporter(self):
# we should load the test results json here
products = args.baselines
prod_to_fullname = args.fullnamesdict
- test_results_json = out_folder + f'/{args.outputregofilename}.json'
- with open(test_results_json, mode='r', encoding='UTF-8') as file:
+ test_results_json = out_folder / f'{args.outputregofilename}.json'
+ with test_results_json.open(encoding='UTF-8') as file:
test_results_data = json.load(file)
# Get the successful/unsuccessful commands
- settings_name = f'{out_folder}/{args.outputproviderfilename}.json'
- with open(settings_name, mode='r', encoding='UTF-8') as file:
+ settings_name = out_folder / f'{args.outputproviderfilename}.json'
+ with settings_name.open(encoding='UTF-8') as file:
settings_data = json.load(file)
+ tenant_info = settings_data['tenant_info']
+ tenant_domain = tenant_info['domain']
successful_calls = set(settings_data['successful_calls'])
unsuccessful_calls = set(settings_data['unsuccessful_calls'])
- # baseline_path
- subset_prod_to_fullname = {
- key: prod_to_fullname[key]
- for key in args.baselines
- if key in prod_to_fullname
- }
+ md_products = set(args.baselines) - {'rules'}
+
+ md_parser = MarkdownParser(args.documentpath)
- baseline_policies = md_parser.read_baseline_docs(args.documentpath,
- subset_prod_to_fullname)
+ baseline_policies = md_parser.parse_baselines(md_products)
- if "rules" in args.baselines:
+ if 'rules' in args.baselines:
# There's no baseline specific to rules, so this case
# needs to be handled separately
- baseline_policies["rules"] = []
+ baseline_policies['rules'] = []
for group in baseline_policies['commoncontrols']:
if group['GroupName'] == 'System-defined Rules':
- baseline_policies["rules"].append(group)
+ baseline_policies['rules'].append(group)
break
else:
- raise RuntimeError("Unable to process 'rules' as no policy group named "
- "'System-defined Rules' found in the Common Controls baseline.")
-
- # Load Org metadata from provider
- with open(f'{out_folder}/{args.outputproviderfilename}.json',
- mode='r',encoding='UTF-8') as file:
- tenant_info = json.load(file)['tenant_info']
- tenant_domain = tenant_info['domain']
+ raise RuntimeError("Unable to process 'rules' as no policy "
+ "group named 'System-defined Rules' found "
+ 'in the Common Controls baseline.')
# Determine if any controls were omitted in the config file
omissions = {}
@@ -268,27 +271,28 @@ def _run_reporter(self):
product_abbreviation_mapping = {fullname: shortname for shortname,
fullname in prod_to_fullname.items()}
- timestamp_utc = datetime.utcnow()
+ timestamp_utc = datetime.now(timezone.utc)
timestamp_zulu = timestamp_utc.strftime('%Y-%m-%dT%H:%M:%S.%f')[:-3] + 'Z'
report_metadata = {
- "TenantId": None,
- "DisplayName": None,
- "DomainName": tenant_domain,
- "ProductSuite": "GWS",
- "ProductsAssessed": products_assessed,
- "ProductAbbreviationMapping": product_abbreviation_mapping,
- "Tool": "ScubaGoggles",
- "ToolVersion": "0.3.0",
- "TimeStampZulu": timestamp_zulu
+ 'TenantId': None,
+ 'DisplayName': None,
+ 'DomainName': tenant_domain,
+ 'ProductSuite': 'GWS',
+ 'ProductsAssessed': products_assessed,
+ 'ProductAbbreviationMapping': product_abbreviation_mapping,
+ 'Tool': 'ScubaGoggles',
+ 'ToolVersion': Version.number,
+ 'TimeStampZulu': timestamp_zulu
}
- total_output.update({"MetaData": report_metadata})
+ total_output.update({'MetaData': report_metadata})
main_report_name = args.outputreportfilename
products_bar = tqdm(products, leave=False, disable=args.quiet)
for product in products_bar:
- products_bar.set_description(f"Creating the HTML and JSON Report for {product}...")
+ products_bar.set_description('Creating the HTML and JSON Report '
+ f'for {product}...')
reporter = Reporter(product,
tenant_domain,
main_report_name,
@@ -301,55 +305,64 @@ def _run_reporter(self):
stats_and_data[product] = \
reporter.rego_json_to_ind_reports(test_results_data,
out_folder)
- baseline_product_summary = {product:stats_and_data[product][0]}
- baseline_product_results_json = {product:stats_and_data[product][1]}
+ baseline_product_summary = {product: stats_and_data[product][0]}
+ baseline_product_results_json = {product: stats_and_data[product][1]}
summary.update(baseline_product_summary)
results.update(baseline_product_results_json)
- total_output.update({"Summary": summary})
- total_output.update({"Results": results})
+ total_output.update({'Summary': summary})
+ total_output.update({'Results': results})
# Create the ScubaResults files
- with open(f'{out_folder}/{args.outputproviderfilename}.json', encoding='UTF-8') as file:
+ scuba_results_file = out_folder / f'{args.outputproviderfilename}.json'
+ with scuba_results_file.open(encoding='UTF-8') as file:
raw_data = json.load(file)
- total_output.update({"Raw": raw_data})
- report = json.dumps(total_output, indent = 4)
- with open(f"{out_folder}/{out_jsonfile}.json", mode='w', encoding='UTF-8') as results_file:
- results_file.write(report)
+ total_output.update({'Raw': raw_data})
+
+ report_file = out_folder / f'{out_jsonfile}.json'
+ with report_file.open('w', encoding = 'utf-8') as results_file:
+ json.dump(total_output, results_file, indent = 4)
- # Delete the ProviderOutput file as it's now encapsulated in the ScubaResults file
- os.remove(f"{out_folder}/{args.outputproviderfilename}.json")
+ # Delete the ProviderOutput file as it's now encapsulated in the
+ # ScubaResults file
+ scuba_results_file.unlink()
# Make the report front page
- report_path = out_folder + "/" + f'{args.outputreportfilename}.html'
- abs_report_path = os.path.abspath(report_path)
+ report_path = out_folder / f'{args.outputreportfilename}.html'
fragments = []
table_data = []
for product, stats in stats_and_data.items():
- ## Build the "Baseline Conformance Reports" column
+ # Build the "Baseline Conformance Reports" column
product_capitalize = product.capitalize()
full_name = prod_to_fullname[product]
- link_path = "./IndividualReports/" f"{product_capitalize}Report.html"
- link = f"{full_name}"
- table_data.append({
- "Baseline Conformance Reports": link,
- "Details": self._generate_summary(stats[0])
- })
+ link_path = f'./IndividualReports/{product_capitalize}Report.html'
+ link = f'{full_name}'
+ table_data.append({'Baseline Conformance Reports': link,
+ 'Details': self._generate_summary(stats[0])})
fragments.append(Reporter.create_html_table(table_data))
- with open(f"{report_path}", mode='w', encoding='UTF-8') as file:
- file.write(Reporter.build_front_page_html(fragments, tenant_info))
+ front_page_html = Reporter.build_front_page_html(fragments, tenant_info)
+ report_path.write_text(front_page_html, encoding = 'utf-8')
# suppress opening the report in the browser
if args.quiet:
return
# Open the report in the client's default web browser
- # pylint: disable=E1101
- if os.name == 'nt':
- os.startfile(abs_report_path)
+ if platform.system().lower() == 'windows':
+ # Keep pylint from complaining when run on linux/macOS
+ # pylint: disable-next=no-member
+ os.startfile(report_path)
else:
- report_path = "file:///" + abs_report_path
- webbrowser.get().open(report_path, new=2)
+ report_url = f'file:///{report_path}'
+ try:
+ webbrowser.get().open(report_url, new=2)
+ except webbrowser.Error:
+ # You get here when a user runs on a linux system,
+ # "ssh'd" to a terminal, in which case the user most likely
+ # expects there'll be no browser popping up (so there's no
+ # need to have the exception abort the run).
+ log.warning('No web browser available, report: %s',
+ str(report_path))
def _run_cached(self):
"""
@@ -357,29 +370,26 @@ def _run_cached(self):
"""
args = self._args
- args.outputpath = str(rel_abs_path(__file__,args.outputpath))
+ args.outputpath = str(rel_abs_path(__file__, args.outputpath))
Path(args.outputpath).mkdir(parents=True, exist_ok=True)
args.outputpath = os.path.abspath(args.outputpath)
if not args.skipexport:
- creds = gws_auth(args.credentials)
- services = {}
- services['reports'] = build('admin', 'reports_v1', credentials=creds)
- services['directory'] = build('admin', 'directory_v1', credentials=creds)
- services['groups'] = build('groupssettings', 'v1', credentials=creds)
- self._run_gws_providers(services)
+ self._run_gws_providers()
if not os.path.exists(f'{args.outputpath}/{args.outputproviderfilename}.json'):
- # When running run_cached, the provider output might not exist as a stand-alone
- # file depending what version of ScubaGoggles created the output. If the provider
- # output doesn't exist as a standalone file, create it from the scuba results
- # file so the other functions can execute as normal.
+ # When running run_cached, the provider output might not exist as
+ # a standalone file depending on what version of ScubaGoggles
+ # created the output. If the provider output doesn't exist as a
+ # standalone file, create it from the scuba results file so the
+ # other functions can execute as normal.
with open(f'{args.outputpath}/{args.outjsonfilename}.json', 'r',
- encoding='UTF-8') as scuba_results:
+ encoding='UTF-8') as scuba_results:
provider_output = json.load(scuba_results)['Raw']
- with open(f'{args.outputpath}/{args.outputproviderfilename}.json', 'w',
- encoding='UTF-8') as provider_file:
+ with open(f'{args.outputpath}/{args.outputproviderfilename}.json',
+ 'w', encoding='UTF-8') as provider_file:
json.dump(provider_output, provider_file)
+
self._rego_eval()
self._run_reporter()
@@ -389,46 +399,57 @@ def start_automation(self):
"""
args = self._args
- if "commoncontrols" in args.baselines and "rules" not in args.baselines:
- args.baselines.append("rules")
- if "rules" in args.baselines and "commoncontrols" not in args.baselines:
- args.baselines.append("commoncontrols")
+ args.baselines = list(args.baselines)
+ if 'commoncontrols' in args.baselines and 'rules' not in args.baselines:
+ args.baselines.append('rules')
+ if 'rules' in args.baselines and 'commoncontrols' not in args.baselines:
+ args.baselines.append('commoncontrols')
args.baselines.sort()
# get the absolute paths relative to this directory
- args.outputpath = (Path.cwd() / args.outputpath).resolve()
- args.credentials = (Path.cwd() / args.credentials).resolve()
- args.opapath = Path(args.opapath).resolve()
- args.regopath = Path(args.regopath).resolve()
- args.documentpath = Path(args.documentpath).resolve()
+ if not isinstance(args.outputpath, Path):
+ args.outputpath = Path(args.outputpath)
+ args.outputpath = args.outputpath.resolve()
+ args.credentials = args.credentials.resolve()
+ args.opapath = args.opapath.resolve()
+ args.regopath = args.regopath.resolve()
+ args.documentpath = args.documentpath.resolve()
+
+ see_docs = 'see ScubaGoggles setup documentation'
+
+ try:
+ find_opa(args.opapath)
+ except FileNotFoundError as fnf:
+ raise UserRuntimeError(f'? "{args.opapath}" - OPA executable '
+ f'missing - {see_docs}') from fnf
+
+ if not args.credentials.exists():
+ raise UserRuntimeError(f'? "{args.credentials}" - Google '
+ f'credentials file missing - {see_docs}')
# add any additional variables to args
gws_params = self.gws_products()
additional_args = vars(args)
- additional_args['fullnamesdict'] = gws_params["prod_to_fullname"]
+ additional_args['fullnamesdict'] = gws_params['prod_to_fullname']
if args.skipexport and not args.runcached:
- exc = 'Used --skipexport without --runcached' \
- 'please rerun scubagoggles with --runcached as well'
- raise Exception(exc)
+ message = ('Used --skipexport without --runcached please rerun '
+ 'scubagoggles with --runcached as well')
+ raise UserRuntimeError(message)
if not args.runcached:
# create a timestamped output folder
now = datetime.now()
- folder_time = now.strftime("%Y_%m_%d_%H_%M_%S")
+ folder_time = now.strftime('%Y_%m_%d_%H_%M_%S')
timestamped_folder = f'{args.outputfoldername}_{folder_time}'
+ if not args.outputpath.exists():
+ log.warning('%s - parent directory for output subdirectories '
+ 'will be created',
+ args.outputpath)
args.outputpath = (args.outputpath / timestamped_folder).resolve()
- Path(args.outputpath).mkdir(parents=True, exist_ok=True)
- args.outputpath = os.path.abspath(args.outputpath)
-
- # authenticate
- creds = gws_auth(args.credentials, args.subjectemail)
- services = {}
- services['reports'] = build('admin', 'reports_v1', credentials=creds)
- services['directory'] = build('admin', 'directory_v1', credentials=creds)
- services['groups'] = build('groupssettings', 'v1', credentials=creds)
+ args.outputpath.mkdir(parents=True, exist_ok=True)
- self._run_gws_providers(services)
+ self._run_gws_providers()
self._rego_eval()
self._run_reporter()
else:
diff --git a/scubagoggles/policy_api.py b/scubagoggles/policy_api.py
new file mode 100644
index 00000000..0494ffd6
--- /dev/null
+++ b/scubagoggles/policy_api.py
@@ -0,0 +1,817 @@
+"""Google Policy API class implementation
+"""
+
+import io
+import json
+import logging
+import os
+import re
+import sys
+import time
+
+from collections import defaultdict
+from collections.abc import Iterable
+from pathlib import Path
+from random import random
+from time import sleep
+
+from google.auth.transport.requests import AuthorizedSession
+
+from scubagoggles.auth import GwsAuth
+
+log = logging.getLogger(__name__)
+
+# Not all lambdas are bad, you know (see below)...
+# pylint: disable=unnecessary-lambda-assignment
+
+
+class PolicyAPI:
+
+ """Implementation for accessing Google Policy API. It should be used as
+ a context manager (see 'with' statement) so the Google API resource is
+ closed when it's no longer needed.
+ """
+
+ # LAMBDAS! They're VOODOO to some, just like the "goto". The following
+ # are short functions that evaluate whether the Google API setting value
+ # is exactly or roughly what's expected. Using lambdas encapsulates the
+ # functionality within the class without the bother of making them
+ # static. They're simple and do the job, and they can be placed close
+ # to the policy settings where they're referenced.
+
+ isBool = lambda x: isinstance(x, bool)
+
+ # Google's "enum" type is essentially the string name for the enumeration
+ # member. It must be all alphanumeric characters with possible underscores.
+
+ isEnum = lambda x: isinstance(x, str) and re.match(r'^[A-Z0-9_]+$', x)
+
+ isInt = lambda x: isinstance(x, int)
+
+ isListStrings = lambda x: (isinstance(x, list)
+ and all(isinstance(e, str) for e in x))
+
+ isState = lambda x: x.lower() in ('disabled', 'enabled')
+
+ isString = lambda x: isinstance(x, str)
+
+ isDuration = lambda x: isinstance(x, str) and re.match(r'(?i)^\d+[hms]$', x)
+
+ # There may be duplicate policies returned for an orgunit/group and
+ # section. The policies must be "reduced" to single settings using
+ # a method. The default "reducer" method is to select the policy with the
+ # highest "sort order", and this is applied if a reducer is not specified
+ # in the expected policy settings below.
+
+ _merge_reducer = '_merge'
+
+ # This is the list of policy settings returned by Google that are relevant
+ # to the secure baselines. Settings that are not relevant are ignored
+ # (i.e., they are NOT included in this data structure - these are settings
+ # that are not referenced in any of our policy code). The key is the section
+ # (what Google calls "setting type") (NOTE that while Google returns a
+ # setting type with a period (.) delimiting the type (e.g.,
+ # "sites.service_status"), we convert the periods into underscores because
+ # Rego uses the period to delimit hierarchy). The setting is a dictionary
+ # containing the name of each setting and a function that will validate that
+ # the setting value is correct. Optionally, a reducer may be given if it
+ # differs from the default ("maximum sort order") - this is set using the
+ # "reducer" key.
+ #
+ # The entries are ordered alphabetically (not that they have to, but it
+ # does make finding them in this data structure easier). If you need to
+ # add a new entry, it may be easiest to copy a similar entry and update
+ # it with the correct section/setting names and verifier, and finally
+ # whether a reducer is needed.
+
+ _expectedPolicySettings = {
+ 'analytics_service_status': {'settings': {'serviceState': isState}},
+ 'applied_digital_skills_service_status': {'settings': {
+ 'serviceState': isState}},
+ 'appsheet_service_status': {'settings': {'serviceState': isState}},
+ 'blogger_service_status': {'settings': {'serviceState': isState}},
+ 'blogger_user_takeout': {'settings': {'takeoutStatus': isEnum}},
+ 'books_user_takeout': {'settings': {'takeoutStatus': isEnum}},
+ 'calendar_appointment_schedules': {'settings': {
+ 'enablePayments': isBool}},
+ 'calendar_external_invitations': {'settings': {'warnOnInvite': isBool}},
+ 'calendar_interoperability': {'settings': {
+ 'enableExchangeRoomBooking': isBool,
+ 'enableFullEventDetails': isBool,
+ 'enableInteroperability': isBool}},
+ 'calendar_primary_calendar_max_allowed_external_sharing': {'settings': {
+ 'maxAllowedExternalSharing': isEnum}},
+ 'calendar_secondary_calendar_max_allowed_external_sharing': {
+ 'settings': {'maxAllowedExternalSharing': isEnum}},
+ 'calendar_service_status': {'settings': {'serviceState': isState}},
+ 'chat_chat_file_sharing': {'settings': {
+ 'externalFileSharing': isEnum,
+ 'internalFileSharing': isEnum}},
+ 'chat_chat_history': {'reducer': _merge_reducer,
+ 'settings': {
+ 'allowUserModification': isBool,
+ 'historyOnByDefault': isBool}},
+ 'chat_external_chat_restriction': {'reducer': _merge_reducer,
+ 'settings': {
+ 'allowExternalChat': isBool,
+ 'externalChatRestriction': isEnum}},
+ 'chat_service_status': {'settings': {'serviceState': isState}},
+ 'chat_space_history': {'settings': {'historyState': isEnum}},
+ 'chrome_canvas_service_status': {'settings': {'serviceState': isState}},
+ 'classroom_api_data_access': {'settings': {'enableApiAccess': isBool}},
+ 'classroom_class_membership': {'settings': {
+ 'whoCanJoinClasses': isEnum,
+ 'whichClassesCanUsersJoin': isEnum}},
+ 'classroom_guardian_access': {'settings': {
+ 'allowAccess': isBool,
+ 'whoCanManageGuardianAccess': isEnum}},
+ 'classroom_roster_import': {'settings': {'rosterImportOption': isEnum}},
+ 'classroom_student_unenrollment': {'settings': {
+ 'whoCanUnenrollStudents': isEnum}},
+ 'classroom_teacher_permissions': {'settings': {
+ 'whoCanCreateClasses': isEnum}},
+ 'cloud_search_service_status': {'settings': {'serviceState': isState}},
+ 'drive_and_docs_drive_for_desktop': {'settings': {
+ 'allowDriveForDesktop': isBool,
+ 'restrictToAuthorizedDevices': isBool}},
+ 'drive_and_docs_drive_sdk': {'reducer': _merge_reducer,
+ 'settings': {
+ 'enableDriveSdkApiAccess': isBool}},
+ 'drive_and_docs_external_sharing': {'settings': {
+ 'accessCheckerSuggestions': isEnum,
+ 'allowNonGoogleInvites': isBool,
+ 'allowNonGoogleInvitesInAllowlistedDomains': isBool,
+ 'allowPublishingFiles': isBool,
+ 'allowReceivingExternalFiles': isBool,
+ 'allowReceivingFilesOutsideAllowlistedDomains': isBool,
+ 'allowedPartiesForDistributingContent': isEnum,
+ 'externalSharingMode': isEnum,
+ 'warnForExternalSharing': isBool,
+ 'warnForSharingOutsideAllowlistedDomains': isBool}},
+ 'drive_and_docs_general_access_default': {'settings': {
+ 'defaultFileAccess': isEnum}},
+ 'drive_and_docs_service_status': {'settings': {
+ 'serviceState': isState}},
+ 'drive_and_docs_shared_drive_creation': {'settings': {
+ 'allowContentManagersToShareFolders': isBool,
+ 'allowExternalUserAccess': isBool,
+ 'allowManagersToOverrideSettings': isBool,
+ 'allowNonMemberAccess': isBool,
+ 'allowSharedDriveCreation': isBool,
+ 'allowedPartiesForDownloadPrintCopy': isEnum,
+ 'orgUnitForNewSharedDrives': isEnum}},
+ 'drive_and_docs_file_security_update': {'settings': {
+ 'allowUsersToManageUpdate': isBool,
+ 'securityUpdate': isEnum}},
+ 'enterprise_service_restrictions_service_status': {'settings': {
+ 'serviceState': isState}},
+ 'gmail_auto_forwarding': {'settings': {'enableAutoForwarding': isBool}},
+ 'gmail_email_attachment_safety': {'settings': {
+ 'anomalousAttachmentProtectionConsequence': isEnum,
+ 'applyFutureRecommendedSettingsAutomatically': isBool,
+ 'attachmentWithScriptsProtectionConsequence': isEnum,
+ 'enableAnomalousAttachmentProtection': isBool,
+ 'enableAttachmentWithScriptsProtection': isBool,
+ 'enableEncryptedAttachmentProtection': isBool,
+ 'encryptedAttachmentProtectionConsequence': isEnum}},
+ 'gmail_email_spam_filter_ip_allowlist': {'settings': {
+ 'allowedIpAddresses': isListStrings}},
+ 'gmail_enhanced_pre_delivery_message_scanning': {'settings': {
+ 'enableImprovedSuspiciousContentDetection': isBool}},
+ 'gmail_links_and_external_images': {'settings': {
+ 'applyFutureSettingsAutomatically': isBool,
+ 'enableAggressiveWarningsOnUntrustedLinks': isBool,
+ 'enableExternalImageScanning': isBool,
+ 'enableShortenerScanning': isBool}},
+ 'gmail_service_status': {'settings': {'serviceState': isState}},
+ 'gmail_spoofing_and_authentication': {'settings': {
+ 'applyFutureSettingsAutomatically': isBool,
+ 'detectDomainNameSpoofing': isBool,
+ 'detectDomainSpoofingFromUnauthenticatedSenders': isBool,
+ 'detectEmployeeNameSpoofing': isBool,
+ 'detectGroupsSpoofing': isBool,
+ 'detectUnauthenticatedEmails': isBool,
+ 'domainNameSpoofingConsequence': isEnum,
+ 'domainSpoofingConsequence': isEnum,
+ 'employeeNameSpoofingConsequence': isEnum,
+ 'groupsSpoofingConsequence': isEnum,
+ 'unauthenticatedEmailConsequence': isEnum}},
+ 'groups_for_business_groups_sharing': {'reducer': _merge_reducer,
+ 'settings': {
+ 'collaborationCapability': isEnum,
+ 'createGroupsAccessLevel': isEnum,
+ 'newGroupsAreHidden': isBool,
+ 'ownersCanAllowExternalMembers': isBool,
+ 'ownersCanAllowIncomingMailFromPublic': isBool,
+ 'ownersCanHideGroups': isBool,
+ 'viewTopicsDefaultAccessLevel': isEnum}},
+ 'groups_for_business_service_status': {'settings': {
+ 'serviceState': isState}},
+ 'jamboard_service_status': {'settings': {'serviceState': isState}},
+ 'keep_service_status': {'settings': {'serviceState': isState}},
+ 'location_history_user_takeout': {'settings': {
+ 'takeoutStatus': isEnum}},
+ 'maps_user_takeout': {'settings': {'takeoutStatus': isEnum}},
+ 'meet_safety_access': {'settings': {'meetingsAllowedToJoin': isEnum}},
+ 'meet_safety_domain': {'settings': {'usersAllowedToJoin': isEnum}},
+ 'meet_safety_external_participants': {'settings': {
+ 'enableExternalLabel': isBool}},
+ 'meet_safety_host_management': {'settings': {
+ 'enableHostManagement': isBool}},
+ 'meet_service_status': {'settings': {'serviceState': isState}},
+ 'meet_video_recording': {'settings': {'enableRecording': isBool}},
+ 'migrate_service_status': {'settings': {'serviceState': isState}},
+ 'pay_user_takeout': {'settings': {'takeoutStatus': isEnum}},
+ 'photos_user_takeout': {'settings': {'takeoutStatus': isEnum}},
+ 'play_console_user_takeout': {'settings': {'takeoutStatus': isEnum}},
+ 'play_user_takeout': {'settings': {'takeoutStatus': isEnum}},
+ 'security_advanced_protection_program': {'settings': {
+ 'enableAdvancedProtectionSelfEnrollment': isBool,
+ 'securityCodeOption': isEnum}},
+ 'security_less_secure_apps': {'reducer': _merge_reducer,
+ 'settings': {
+ 'allowLessSecureApps': isBool}},
+ 'security_login_challenges': {'settings': {
+ 'enableEmployeeIdChallenge': isBool}},
+ 'security_password': {'settings': {
+ 'allowedStrength': isEnum,
+ 'allowReuse': isBool,
+ 'enforceRequirementsAtLogin': isBool,
+ 'expirationDuration': isDuration,
+ 'maximumLength': isInt,
+ 'minimumLength': isInt}},
+ 'security_session_controls': {'settings': {
+ 'webSessionDuration': isDuration}},
+ 'security_super_admin_account_recovery': {'reducer': _merge_reducer,
+ 'settings': {
+ 'enableAccountRecovery': isBool}},
+ 'security_user_account_recovery': {'reducer': _merge_reducer,
+ 'settings': {
+ 'enableAccountRecovery': isBool}},
+ 'sites_service_status': {'settings': {'serviceState': isState}},
+ 'sites_sites_creation_and_modification': {'settings': {
+ 'allowSitesCreation': isBool,
+ 'allowSitesModification': isBool}},
+ 'takeout_service_status': {'settings': {'serviceState': isState}},
+ 'tasks_service_status': {'settings': {'serviceState': isState}},
+ 'vault_service_status': {'settings': {'serviceState': isState}},
+ 'workspace_marketplace_apps_access_options': {'settings': {
+ 'accessLevel': isEnum,
+ 'allowAllInternalApps': isBool}},
+ 'youtube_user_takeout': {'settings': {'takeoutStatus': isEnum}}}
+
+ # In this section of Google's Policy API documentation:
+ # https://cloud.google.com/identity/docs/concepts/policy-api-concepts
+ # #default_field_values
+ # there are a number of settings which may not be present in the top-level
+ # orgunit, and for these cases defaults must be applied. The following
+ # default values are taken directly from the documentation. Google claims
+ # that it would take an act of god to change these defaults, but since
+ # these are copied from an external source, there is a risk that one or
+ # more defaults may be changed. There is also no assurance that Google's
+ # documentation reflects the current default values (i.e., the
+ # documented defaults must be kept current with the implementation).
+
+ _defaults = {
+ 'chat_chat_history': {'allowUserModification': True,
+ 'historyOnByDefault': False},
+ 'chat_external_chat_restriction': {
+ 'allowExternalChat': False,
+ 'externalChatRestriction': 'NO_RESTRICTION'},
+ 'drive_and_docs_drive_sdk': {'enableDriveSdkApiAccess': True},
+ 'drive_and_docs_external_sharing': {
+ 'accessCheckerSuggestions': 'RECIPIENTS_OR_AUDIENCE_OR_PUBLIC',
+ 'allowNonGoogleInvites': True,
+ 'allowNonGoogleInvitesInAllowlistedDomains': False,
+ 'allowPublishingFiles': True,
+ 'allowReceivingExternalFiles': True,
+ 'allowReceivingFilesOutsideAllowlistedDomains': True,
+ 'allowedPartiesForDistributingContent': 'ALL_ELIGIBLE_USERS',
+ 'externalSharingMode': 'ALLOWED',
+ 'warnForExternalSharing': True,
+ 'warnForSharingOutsideAllowlistedDomains': True},
+ 'drive_and_docs_general_access_default': {
+ 'defaultFileAccess': 'LINK_SHARING_PRIVATE'},
+ 'gmail_workspace_sync_for_outlook': {
+ 'enableGoogleWorkspaceSyncForMicrosoftOutlook': True},
+ 'gmail_email_spam_filter_ip_allowlist': {
+ 'allowedIpAddresses': []},
+ 'groups_for_business_groups_sharing': {
+ 'collaborationCapability': 'DOMAIN_USERS_ONLY',
+ 'createGroupsAccessLevel': 'USERS_IN_DOMAIN',
+ 'newGroupsAreHidden': False,
+ 'ownersCanAllowExternalMembers': False,
+ 'ownersCanAllowIncomingMailFromPublic': True,
+ 'ownersCanHideGroups': False,
+ 'viewTopicsDefaultAccessLevel': 'DOMAIN_USERS'},
+ 'security_less_secure_apps': {'allowLessSecureApps': False},
+ 'security_super_admin_account_recovery': {
+ 'enableAccountRecovery': False},
+ 'security_user_account_recovery': {'enableAccountRecovery': False},
+ 'workspace_marketplace_apps_access_options': {
+ 'accessLevel': 'ALLOW_ALL',
+ 'allowAllInternalApps': False},
+ }
+
+ # This is the URL to the Policies API.
+ _baseURL = 'https://cloudidentity.googleapis.com/v1beta1/policies'
+ _too_many_requests = 429
+
+ def __init__(self, gws_auth: GwsAuth, top_orgunit: str):
+
+ """PolicyAPI class instance initialization.
+
+ :param GwsAuth gws_auth: GWS credentials instance.
+ :param str top_orgunit: name of the top-level orgunit.
+ """
+
+ # Google's AuthorizedSession is currently being used because this
+ # API is not available in the Google API Client interface.
+ self._session = AuthorizedSession(gws_auth.credentials)
+
+ self._top_orgunit = top_orgunit
+
+ # This is a mapping of Google's org unit ids to names.
+ self._orgunit_id_map = self._get_ou()
+
+ self._group_id_map = self._get_groups()
+
+ # This is a dictionary that is used in reducing the policies returned
+ # by Google.
+ self._reduction_map = None
+
+ def __enter__(self):
+
+ # This class is implemented as a context manager - meaning that it's
+ # intended to be instantiated via the "with" statement. This ensures
+ # that the Google resource will be properly closed.
+
+ return self
+
+ def __exit__(self, exc_type, exc_val, exc_tb):
+
+ self.close()
+
+ def close(self):
+
+ """Closes Google's resource. This should be called when the instance
+ is no longer needed.
+ """
+
+ self._session.close()
+
+ def get_policies(self) -> dict:
+
+ """Query Google's Policy API and return the policy settings grouped
+ by org unit.
+
+ :return: dictionary of settings, with keys being the org unit names
+ and the values are dictionaries with name/value pairs for the
+ settings.
+ :rtype: dict
+ """
+
+ # Google returns the policy settings in a dictionary. Each setting
+ # contains one or more values and is associated with an org unit.
+ policies = self._get_policies_list()
+
+ # If the following environment variable is defined, the policy data
+ # returned by Google, as well as the orgunit and group maps, will be
+ # written to the file name defined in the variable. If the value
+ # contains only whitespace, the data will be written to the standard
+ # output stream. This is intended for debugging.
+ dump_envname = 'SCUBAGOGGLES_DUMP_FILE'
+ if dump_envname in os.environ:
+ self._dump(policies, os.environ[dump_envname].strip())
+
+ self._reduce(policies)
+
+ result = defaultdict(dict)
+
+ for key, policy in self._reduction_map.items():
+ orgunit_name, section = key
+ result[orgunit_name][section] = self._settings(policy)
+
+ self._apply_defaults(result)
+
+ return result
+
+ def _get_ou(self) -> dict:
+
+ """Calls Google's Directory API to get all org units, and returns a
+ mapping of org unit id to name.
+
+ :return: dictionary with the Google org unit identifier as the key,
+ and the corresponding name as the value.
+ :rtype: dict
+ """
+
+ # See comment above regarding the Policy API not currently included
+ # in Google's Client API. While the directory API is included in the
+ # Client API, it's easiest here to use the same mechanism as is used
+ # for the Policy API.
+ url = ('https://admin.googleapis.com/admin/directory/'
+ 'v1/customer/my_customer/orgunits')
+
+ params = {'orgUnitPath': '/',
+ 'type': 'all_including_parent'}
+
+ response = self._get(url, params)
+
+ # Based on the Client API, there should be no possibility of a next
+ # page when getting the org units, but this check is here just in
+ # case.
+ if 'nextPageToken' in response:
+ raise RuntimeError(f'{url} - unhandled next page token')
+
+ orgunit_id_map = {}
+
+ for orgunit_data in response['organizationUnits']:
+ orgunit_id = orgunit_data['orgUnitId'].removeprefix('id:')
+ orgunit_id_map[orgunit_id] = {'name': orgunit_data['name'],
+ 'path': orgunit_data['orgUnitPath']}
+
+ return orgunit_id_map
+
+ def _get_groups(self) -> dict:
+
+ """Calls Google's Directory API to get all groups in the root org unit,
+ and returns a mapping of group id to name.
+
+ :return: dictionary with the Google group identifier as the key,
+ and the corresponding name as the value.
+ :rtype: dict
+ """
+
+ # See comment above regarding the Policy API not currently included
+ # in Google's Client API. While the directory API is included in the
+ # Client API, it's easiest here to use the same mechanism as is used
+ # for the Policy API.
+ url = 'https://admin.googleapis.com/admin/directory/v1/groups'
+
+ group_id_map = {}
+
+ params = {'customer': 'my_customer'}
+
+ while True:
+
+ response = self._get(url, params)
+
+ for group_data in response['groups']:
+ group_id = group_data['id']
+ group_id_map[group_id] = group_data['name']
+
+ if 'nextPageToken' not in response:
+ break
+
+ params['pageToken'] = response['nextPageToken']
+
+ return group_id_map
+
+ def _get_policies_list(self) -> list:
+
+ """Calls the Google Policy API and returns the results.
+
+ :return: list of dictionaries containing policy settings.
+ :rtype: list
+ """
+
+ policies = []
+
+ # The parameters will only be used if Google returns the policies in
+ # multiple pages. The following loop will iterate multiple times only
+ # if there's more than one page.
+ params = None
+
+ while True:
+
+ policies_result = self._get(self._baseURL, params)
+
+ # So far, only one page of actual content is being returned
+ # (with 2 blank pages, which is another issue). Merge each page's
+ # policies in with the result list.
+ if 'policies' in policies_result:
+ policies += policies_result['policies']
+
+ if 'nextPageToken' not in policies_result:
+ break
+
+ params = {'pageToken': policies_result['nextPageToken']}
+
+ return policies
+
+ def _get(self, url: str, params: dict = None) -> dict:
+
+ """Invokes a GET request using the given URL, returning the result.
+
+ :param str url: URL
+ :param dict params: [optional] parameters to be used in the request.
+
+ :return: dictionary result returned by the Google request.
+ :rtype: dict
+ """
+
+ response = None
+
+ start_time = time.time()
+
+ # Google will return the "too many requests" error if the requests come
+ # in without any delay between them. The total iterations is limited to
+ # 8 because the delay is exponential and after several iterations the
+ # delay becomes impractical if the error continues to be returned.
+ # In practice, with the API calls it sometimes takes seconds to get a
+ # response, and for those cases a subsequent request is made after a
+ # sufficient delay due to the time it took for the previous response.
+
+ for iter_count in range(1, 9):
+
+ response = self._session.get(url, params = params)
+ if response.status_code != self._too_many_requests:
+ break
+
+ # Back off the requests exponentially (adding up to a 10% random
+ # delay).
+
+ delay = (2 ** iter_count) / 10
+ delay += (delay * random())
+
+ log.debug('attempt %i - too many requests response: '
+ 'delay %.2f seconds', iter_count, delay)
+
+ sleep(delay)
+
+ end_time = time.time() - start_time
+
+ response_json = response.json()
+
+ if not response.ok:
+ raise RuntimeError(f'? {url} - {response_json["error"]["message"]}')
+
+ log.debug('URL: %s', url)
+ if params:
+ log.debug(' params: %s', params)
+ log.debug('Result length: %d', len(response.text))
+ log.debug('Elapsed time: %.2f seconds', end_time)
+
+ return response_json
+
+ def _reduce(self, policies: Iterable):
+
+ """Reduces the policies returned by Google to those that apply for
+ each orgunit and group.
+
+ This method populates the instance's "_reduction_map". It is a
+ dictionary where the key is a tuple containing the orgunit/group name
+ and section name. The value is a policy (dictionary). After the
+ reduction, there will be only one policy for each section in an
+ orgunit/group.
+
+ See https://cloud.google.com/identity/docs/concepts/policy-api-concepts
+ #reducers_for_settings
+ for Google's discussion of the "reduction process".
+
+ :param list policies: list of policies (dictionaries).
+ """
+
+ self._reduction_map = {}
+
+ # Sorting the policies by largest sort order first is KEY to getting
+ # the correct policies. This accomplishes the "max" reduction
+ # referred to by Google, and it also necessary for the "merge"
+ # reduction.
+ policies.sort(key = self._sort_order, reverse = True)
+
+ for policy in policies:
+
+ # For the current policy setting, use the returned org unit id
+ # to get the org unit name, which is used as the key for the
+ # result dictionary.
+ orgunit_id = policy['policyQuery']['orgUnit']
+ orgunit_id = orgunit_id.removeprefix('orgUnits/')
+ orgunit_name = self._orgunit_id_map[orgunit_id]['name']
+
+ if 'group' in policy['policyQuery']:
+ group_id = policy['policyQuery']['group']
+ group_id = group_id.removeprefix('groups/')
+ group_name = self._group_id_map[group_id]
+ orgunit_name += f' (group "{group_name}")'
+
+ # The setting has two layers in the policies dictionary. Depending
+ # on the setting, there may be one or multiple values - so the
+ # setting itself has a "type" (i.e., "name), and the value is a
+ # dictionary with one or more name/value pairs. The setting type
+ # is something like "settings/appsheet.service_status". We remove
+ # the "settings/" prefix and convert the dot to an underscore.
+ # This results in "appsheet_service_status", which is a format that
+ # can easily be used in Rego code.
+ policy_setting = policy['setting']
+ section = policy_setting['type'].removeprefix('settings/')
+ section = section.replace('.', '_')
+
+ key = (orgunit_name, section)
+
+ # This is where the dictionary is populated, with policies
+ # having the highest sort order for each orgunit/group and
+ # section. This is possible because of the initial sorting
+ # above.
+ if key not in self._reduction_map:
+ self._reduction_map[key] = policy
+ continue
+
+ expected_settings = self._expectedPolicySettings.get(section)
+
+ if not expected_settings:
+ # The section is not in the expected settings, which means
+ # it is not associated with a secure baseline.
+ continue
+
+ # If there is a reducer associated with this policy, it will
+ # be invoked.
+ reduce_name = expected_settings.get('reduce_method')
+
+ if reduce_name:
+ reduce_method = getattr(self, reduce_name)
+ reduce_method(key, policy)
+
+ @staticmethod
+ def _settings(policy: dict) -> dict:
+
+ """Given a policy (dictionary) from Google's response, returns the
+ name/value pairs, which are the setting values for a section.
+
+ :param policy: "raw" policy data dictionary returned by Google.
+ """
+
+ return policy['setting']['value']
+
+ @staticmethod
+ def _sort_order(policy: dict) -> float:
+
+ """Given a policy (dictionary) from Google's response, returns the
+ sort order value for the policy.
+
+ :param policy: "raw" policy data dictionary returned by Google.
+ """
+
+ return policy['policyQuery']['sortOrder']
+
+ def _merge(self, key: tuple, policy: dict):
+
+ """Peforms a merge reduction of the given policy with the current
+ policy (having the greatest sort order).
+
+ :param key: tuple containing the orgunit name and section name, used
+ for locating the corresponding policy in the reduction map.
+ :param policy: "raw" policy having a sort order below the policy
+ stored in the reduction map.
+ """
+
+ # Get the policy from the reduction map. The policies have already
+ # been sorted by largest sort order first, so this one is the
+ # in-effect policy for the given key.
+
+ current_policy = self._reduction_map[key]
+
+ current_settings = self._settings(current_policy)
+
+ # If any setting present in the given lower sort order policy is
+ # not present in the in-effect policy, add the setting to the
+ # current policy.
+
+ for setting, value in self._settings(policy).items():
+ if setting not in current_settings:
+ current_settings[setting] = value
+
+ def _apply_defaults(self, policies: dict):
+
+ """Applies Google's default setting values to the top orgunit policies.
+ See the discussion above where the default setting values are defined.
+
+ :param policies: the complete set of policies, formatted from the raw
+ data returned by Google.
+ """
+
+ if not self._top_orgunit:
+ log.debug('No top orgunit specified in PolicyAPI - '
+ 'skipping defaults')
+ return
+
+ # The defaults apply only to the top-level orgunit. The top orgunit
+ # must contain all settings, and the subordinate orgunits and groups
+ # only contain settings that have changed from the top orgunit's
+ # values. We'll keep track of the default settings actually applied
+ # so they can be reported in the log.
+
+ top_ou_policies = policies[self._top_orgunit]
+
+ applied = defaultdict(dict)
+
+ for section, settings in self._defaults.items():
+ if section not in top_ou_policies:
+ # Copy the section dictionary into the top OU policies as a
+ # precaution because the defaults are read-only.
+ top_ou_policies[section] = settings.copy()
+ applied[section] = settings
+ continue
+
+ for setting, value in settings.items():
+ if setting not in top_ou_policies[section]:
+ top_ou_policies[section][setting] = value
+ applied[section][setting] = value
+
+ if applied:
+ log.debug('Default value(s) applied to %s:', self._top_orgunit)
+ for section, settings in applied.items():
+ log.debug(' %s:', section)
+ for setting, value in settings.items():
+ log.debug(' %s: %s', setting, str(value))
+
+ def _dump(self, policies: Iterable, file_or_stream = sys.stdout):
+
+ """Writes the orgunit and group maps, and the given policies from
+ Google to the given I/O stream or file.
+
+ :param policies: sequence of policy data (dictionaries) returned by
+ Google's Policy API.
+ :param file_or_stream: [optional] file specification for the file
+ to be written, or an existing I/O stream. If not given or if
+ an empty string is provided, the standard output stream (stdout)
+ is used.
+ """
+
+ out_data = {'orgunits': self._orgunit_id_map,
+ 'groups': self._group_id_map,
+ 'policies': policies}
+
+ is_stream = not file_or_stream or isinstance(file_or_stream, io.IOBase)
+
+ # pylint: disable=consider-using-with
+ out_stream = (sys.stdout if not file_or_stream
+ else file_or_stream if is_stream
+ else Path(file_or_stream).open('wt', encoding = 'utf-8'))
+
+ try:
+ json.dump(out_data, out_stream, indent = 2)
+ finally:
+ if not is_stream:
+ out_stream.close()
+
+ def verify(self, policies: dict) -> bool:
+
+ """Verify that all expected policy settings (see above) are present
+ for the top-level orgunit, and that the values of each setting are the
+ correct type and/or format.
+
+ We do this verification because while Rego is good at checking for
+ policy requirements, it may yield incorrect results when expected
+ settings are missing or values are incorrect. This verification only
+ issues warnings. so we're not aborting if something is found to be
+ missing or incorrect. However, if warnings are issued, checks should be
+ done to determine what's wrong with the data returned by Google.
+
+ :param dict policies: policy settings returned by get_policies().
+ :return: True if all expected policy settings are found and the setting
+ values are correct types and format.
+ """
+
+ orgunit = self._top_orgunit
+ policies_ok = True
+
+ expected_policy_settings = self._expectedPolicySettings
+ orgunit_policies = policies.get(orgunit)
+
+ if not orgunit_policies:
+ log.warning('No policy settings found for orgunit: %s', orgunit)
+ return False
+
+ missing_settings = {n for n in expected_policy_settings
+ if n not in orgunit_policies}
+
+ if missing_settings:
+ log.warning('Setting(s) missing from %s orgunit: %s',
+ orgunit,
+ str(sorted(missing_settings)))
+ policies_ok = False
+
+ for section, section_data in expected_policy_settings.items():
+
+ expected_settings = section_data['settings']
+ settings = orgunit_policies.get(section)
+ if not settings:
+ continue
+
+ invalid_settings = []
+
+ for setting_name, verifier in expected_settings.items():
+ policy_value = settings.get(setting_name)
+ if policy_value is None or not verifier(policy_value):
+ invalid_settings.append(setting_name)
+
+ if invalid_settings:
+ log.warning('Settings missing or values invalid for '
+ 'orgunit %s, resource %s: %s',
+ orgunit,
+ section,
+ sorted(invalid_settings))
+
+ return policies_ok
diff --git a/scubagoggles/provider.py b/scubagoggles/provider.py
index 3d63e6d1..7d0c4c54 100644
--- a/scubagoggles/provider.py
+++ b/scubagoggles/provider.py
@@ -1,14 +1,22 @@
"""
provider.py is where the GWS api calls are made.
-
"""
+
import warnings
+from pathlib import Path
from tqdm import tqdm
-from scubagoggles.utils import create_subset_inverted_dict, create_key_to_list, merge_dicts
+from googleapiclient.discovery import build
+
+from scubagoggles.auth import GwsAuth
+from scubagoggles.policy_api import PolicyAPI
+from scubagoggles.utils import create_subset_inverted_dict, \
+ create_key_to_list, merge_dicts
from scubagoggles.scuba_constants import ApiReference
from scubagoggles.robust_dns import RobustDNSClient
+# pylint: disable=too-many-instance-attributes
+
EVENTS = {
'calendar': [
'CHANGE_CALENDAR_SETTING',
@@ -75,7 +83,7 @@
}
-SELECTORS = ["google", "selector1", "selector2"]
+SELECTORS = ['google', 'selector1', 'selector2']
# For DKIM.
# Unfortunately, hard-coded. Ideally, we'd be able to use an API to get
# the selectors used programmatically, but it doesn't seem like there is
@@ -93,57 +101,114 @@
# beginning of the domain name up to the first period
#
+
class Provider:
- '''
+ """
Class for making the GWS api calls and tracking the results.
- '''
+ """
+
+ def __init__(self,
+ customer_id: str,
+ credentials_file: Path,
+ svc_account_email: str = None):
- def __init__(self, services : dict, customer_id : str):
- '''
- Initialize the Provider.
+ """Initialize the Provider.
- :param services: a dict of service objects.
:param customer_id: the ID of the customer to run against.
- '''
- self.services = services
- self.customer_id = customer_id
- self.successful_calls = set()
- self.unsuccessful_calls = set()
- self.dns_client = RobustDNSClient()
- self.domains = None
+ :param credentials_file: file specification of Google JSON-format
+ credentials.
+ :param svc_account_email: (optional) email address for the service
+ account.
+ """
+
+ self._gws_auth = GwsAuth(credentials_file, svc_account_email)
+ self._credentials = self._gws_auth.credentials
+ self._services = {}
+ self._customer_id = customer_id
+ self._successful_calls = set()
+ self._unsuccessful_calls = set()
+ self._dns_client = RobustDNSClient()
+ self._domains = None
+
+ self._initialize_services()
+ self._top_ou = self.get_toplevel_ou()
+
+ def __enter__(self):
+ return self
+
+ def __exit__(self, exc_type, exc_val, exc_tb):
+
+ for resource in self._services.values():
+ resource.close()
+
+ @property
+ def successful_calls(self):
+
+ """Returns names of methods successfully called.
+
+ :rtype: set
+ """
+
+ return self._successful_calls
+
+ @property
+ def unsuccessful_calls(self):
+
+ """Returns names of methods unsuccessfully called.
+
+ :rtype: set
+ """
+
+ return self._unsuccessful_calls
+
+ def _initialize_services(self):
+
+ service_list = (('reports', 'admin', 'reports_v1'),
+ ('directory', 'admin', 'directory_v1'),
+ ('groups', 'groupssettings', 'v1'))
+
+ for service_data in service_list:
+
+ name, service_name, version = service_data
+
+ self._services[name] = build(service_name,
+ version,
+ cache_discovery = False,
+ credentials = self._credentials)
def list_domains(self) -> list:
- '''
+ """
Return the customer's domains. Ensures that the domains API is called only once and that
the domains used throughout the provider are consistent.
- '''
- if self.domains is None:
+ """
+ if self._domains is None:
try:
- self.domains = self.services['directory'].domains().list(customer=self.customer_id)\
- .execute()['domains']
- self.successful_calls.add(ApiReference.LIST_DOMAINS.value)
+ with self._services['directory'].domains() as domains:
+ self._domains = (domains.list(customer = self._customer_id)
+ .execute()['domains'])
+ self._successful_calls.add(ApiReference.LIST_DOMAINS.value)
except Exception as exc:
- self.domains = []
- warnings.warn(f"An exception was thrown by list_domains: {exc}", RuntimeWarning)
- self.unsuccessful_calls.add(ApiReference.LIST_DOMAINS.value)
- return self.domains
+ self._domains = []
+ warnings.warn(f'An exception was thrown by list_domains: {exc}', RuntimeWarning)
+ self._unsuccessful_calls.add(ApiReference.LIST_DOMAINS.value)
+ return self._domains
- def get_spf_records(self, domains: list) -> list:
- '''
+ def get_spf_records(self, domains: set) -> list:
+ """
Gets the SPF records for each domain in domains.
:param domains: The list of domain names (strings).
- '''
+ """
results = []
n_low_confidence = 0
for domain in domains:
- result = self.dns_client.query(domain)
+ result = self._dns_client.query(domain)
if not result['HighConfidence']:
n_low_confidence += 1
results.append({
- "domain": domain,
- "rdata": result["Answers"],
- "log": result["LogEntries"]
+ 'domain': domain,
+ 'rdata': result['Answers'],
+ 'log': result['LogEntries']
})
if n_low_confidence > 0:
warnings.warn(f"get_spf_records: for {n_low_confidence} domain(s), \
@@ -153,19 +218,19 @@ def get_spf_records(self, domains: list) -> list:
See ProviderSettingsExport.json under 'spf_records' for more details.", RuntimeWarning)
return results
- def get_dkim_records(self, domains : list) -> list:
- '''
+ def get_dkim_records(self, domains: set) -> list:
+ """
Gets the DKIM records for each domain in domains.
:param domains: The list of domain names (strings).
- '''
+ """
results = []
n_low_confidence = 0
for domain in domains:
- qnames = [f"{selector}._domainkey.{domain}" for selector in SELECTORS]
+ qnames = [f'{selector}._domainkey.{domain}' for selector in SELECTORS]
log_entries = []
for qname in qnames:
- result = self.dns_client.query(qname)
+ result = self._dns_client.query(qname)
log_entries.extend(result['LogEntries'])
if len(result['Answers']) == 0:
# The DKIM record does not exist with this selector, we need to try again with
@@ -177,9 +242,9 @@ def get_dkim_records(self, domains : list) -> list:
if not result['HighConfidence']:
n_low_confidence += 1
results.append({
- "domain": domain,
- "rdata": result["Answers"],
- "log": log_entries
+ 'domain': domain,
+ 'rdata': result['Answers'],
+ 'log': log_entries
})
if n_low_confidence > 0:
@@ -190,32 +255,32 @@ def get_dkim_records(self, domains : list) -> list:
See ProviderSettingsExport.json under 'dkim_records' for more details.", RuntimeWarning)
return results
- def get_dmarc_records(self, domains : list) -> list:
- '''
+ def get_dmarc_records(self, domains: set) -> list:
+ """
Gets the DMARC records for each domain in domains.
:param domains: The list of domain names (strings).
- '''
+ """
results = []
n_low_confidence = 0
for domain in domains:
log_entries = []
- qname = f"_dmarc.{domain}"
- result = self.dns_client.query(qname)
+ qname = f'_dmarc.{domain}'
+ result = self._dns_client.query(qname)
log_entries.extend(result['LogEntries'])
- if len(result["Answers"]) == 0:
+ if len(result['Answers']) == 0:
# The domain does not exist. If the record is not available at the full domain
# level, we need to check at the organizational domain level.
- labels = domain.split(".")
- org_domain = f"{labels[-2]}.{labels[-1]}"
- result = self.dns_client.query(f"_dmarc.{org_domain}")
+ labels = domain.split('.')
+ org_domain = f'{labels[-2]}.{labels[-1]}'
+ result = self._dns_client.query(f'_dmarc.{org_domain}')
log_entries.extend(result['LogEntries'])
if not result['HighConfidence']:
n_low_confidence += 1
results.append({
- "domain": domain,
- "rdata": result["Answers"],
- "log": log_entries
+ 'domain': domain,
+ 'rdata': result['Answers'],
+ 'log': log_entries
})
if n_low_confidence > 0:
warnings.warn(f"get_dmarc_records: for {n_low_confidence} domain(s), \
@@ -226,92 +291,99 @@ def get_dmarc_records(self, domains : list) -> list:
return results
def get_dnsinfo(self):
- '''
+ """
Gets DNS Information for Gmail baseline
- '''
- output = {"domains": [], "spf_records": [], "dkim_records": [], "dmarc_records": []}
+ """
+ output = {'domains': [], 'spf_records': [], 'dkim_records': [], 'dmarc_records': []}
domains = {d['domainName'] for d in self.list_domains()}
if len(domains) == 0:
- warnings.warn("No domains found.", RuntimeWarning)
+ warnings.warn('No domains found.', RuntimeWarning)
return output
- output["domains"].extend(domains)
+ output['domains'].extend(domains)
try:
- output["spf_records"] = self.get_spf_records(domains)
- self.successful_calls.add("get_spf_records")
+ output['spf_records'] = self.get_spf_records(domains)
+ self._successful_calls.add('get_spf_records')
except Exception as exc:
- output["spf_records"] = []
- warnings.warn(f"An exception was thrown by get_spf_records: {exc}", RuntimeWarning)
- self.unsuccessful_calls.add("get_spf_records")
+ output['spf_records'] = []
+ warnings.warn(f'An exception was thrown by get_spf_records: {exc}', RuntimeWarning)
+ self._unsuccessful_calls.add('get_spf_records')
try:
- output["dkim_records"] = self.get_dkim_records(domains)
- self.successful_calls.add("get_dkim_records")
+ output['dkim_records'] = self.get_dkim_records(domains)
+ self._successful_calls.add('get_dkim_records')
except Exception as exc:
- output["dkim_records"] = []
- warnings.warn(f"An exception was thrown by get_dkim_records: {exc}", RuntimeWarning)
- self.unsuccessful_calls.add("get_dkim_records")
+ output['dkim_records'] = []
+ warnings.warn(f'An exception was thrown by get_dkim_records: {exc}', RuntimeWarning)
+ self._unsuccessful_calls.add('get_dkim_records')
try:
- output["dmarc_records"] = self.get_dmarc_records(domains)
- self.successful_calls.add("get_dmarc_records")
+ output['dmarc_records'] = self.get_dmarc_records(domains)
+ self._successful_calls.add('get_dmarc_records')
except Exception as exc:
- output["dmarc_records"] = []
- warnings.warn(f"An exception was thrown by get_dmarc_records: {exc}", RuntimeWarning)
- self.unsuccessful_calls.add("get_dmarc_records")
+ output['dmarc_records'] = []
+ warnings.warn(f'An exception was thrown by get_dmarc_records: {exc}', RuntimeWarning)
+ self._unsuccessful_calls.add('get_dmarc_records')
return output
def get_super_admins(self) -> dict:
- '''
+ """
Gets the org unit/primary email of all super admins, using the directory API
- '''
+ """
+
try:
- response = self.services['directory'].users()\
- .list(customer=self.customer_id, query="isAdmin=True").execute()
+ with self._services['directory'].users() as users:
+ user_list = self._get_list(users,
+ 'users',
+ customer = self._customer_id,
+ query = 'isAdmin=True')
+
admins = []
- for user in response['users']:
+ for user in user_list:
org_unit = user['orgUnitPath']
# strip out the leading '/'
org_unit = org_unit[1:] if org_unit.startswith('/') else org_unit
email = user['primaryEmail']
admins.append({'primaryEmail': email, 'orgUnitPath': org_unit})
- self.successful_calls.add(ApiReference.LIST_USERS.value)
+ self._successful_calls.add(ApiReference.LIST_USERS.value)
return {'super_admins': admins}
except Exception as exc:
warnings.warn(
- f"Exception thrown while getting super admins; outputs will be incorrect: {exc}",
+ f'Exception thrown while getting super admins; outputs will be incorrect: {exc}',
RuntimeWarning
)
- self.unsuccessful_calls.add(ApiReference.LIST_USERS.value)
+ self._unsuccessful_calls.add(ApiReference.LIST_USERS.value)
return {'super_admins': []}
def get_ous(self) -> dict:
- '''
+ """
Gets the organizational units using the directory API
- '''
+ """
try:
- response = self.services['directory'].orgunits().list(customerId=self.customer_id)\
- .execute()
- self.successful_calls.add(ApiReference.LIST_OUS.value)
+ with self._services['directory'].orgunits() as orgunits:
+ response = orgunits.list(customerId=self._customer_id).execute()
+ self._successful_calls.add(ApiReference.LIST_OUS.value)
if 'organizationUnits' not in response:
return {}
return response
except Exception as exc:
warnings.warn(
- f"Exception thrown while getting top level OU: {exc}",
+ f'Exception thrown while getting top level OU: {exc}',
RuntimeWarning
)
- self.unsuccessful_calls.add(ApiReference.LIST_OUS.value)
+ self._unsuccessful_calls.add(ApiReference.LIST_OUS.value)
return {}
def get_toplevel_ou(self) -> str:
- '''
+ """
Gets the tenant name using the directory API
- '''
+ """
try:
- response = self.services['directory'].orgunits()\
- .list(customerId=self.customer_id, orgUnitPath='/', type='children').execute()
+ with self._services['directory'].orgunits() as orgunits:
+ response = orgunits.list(customerId = self._customer_id,
+ orgUnitPath = '/',
+ type = 'children').execute()
# Because we set orgUnitPath to / and type to children, the API call will only
# return the second-level OUs, meaning the parentOrgUnitId of any of the OUs returned
# will point us to OU of the entire organization
@@ -324,37 +396,37 @@ def get_toplevel_ou(self) -> str:
# need to check if a setting change was made at the top-level
# OU in the Rego; because no custom OUs have been created, any
# changes have to apply to the top-level OU.
- return ""
+ return ''
parent_ou = response['organizationUnits'][0]['parentOrgUnitId']
- response = self.services['directory'].orgunits()\
- .get(customerId=self.customer_id, orgUnitPath=parent_ou).execute()
+ with self._services['directory'].orgunits() as orgunits:
+ response = orgunits.get(customerId = self._customer_id,
+ orgUnitPath = parent_ou).execute()
ou_name = response['name']
- self.successful_calls.add(ApiReference.LIST_OUS.value)
+ self._successful_calls.add(ApiReference.LIST_OUS.value)
return ou_name
except Exception as exc:
warnings.warn(
- f"Exception thrown while getting top level OU: {exc}",
+ f'Exception thrown while getting top level OU: {exc}',
RuntimeWarning
)
- self.unsuccessful_calls.add(ApiReference.LIST_OUS.value)
- return "Error Retrieving"
-
+ self._unsuccessful_calls.add(ApiReference.LIST_OUS.value)
+ return 'Error Retrieving'
def get_tenant_info(self) -> dict:
- '''
+ """
Gets the high-level tenant info using the directory API
- '''
- primary_domain = "Error Retrieving"
+ """
+ primary_domain = 'Error Retrieving'
for domain in self.list_domains():
if domain['isPrimary']:
primary_domain = domain['domainName']
return {
'domain': primary_domain,
- 'topLevelOU': self.get_toplevel_ou()
+ 'topLevelOU': self._top_ou
}
def get_gws_logs(self, products: list, event: str) -> dict:
- '''
+ """
Gets the GWS admin audit logs with the specified event name.
This function will also some parsing and filtering to ensure that an appropriate
log event is matched to the appropriate product.
@@ -364,13 +436,14 @@ def get_gws_logs(self, products: list, event: str) -> dict:
:param products: a narrowed list of the products being invoked
authenticating in auth.py
:param event: the name of the specific event we are querying for.
- '''
-
- # Filter responses by org_unit id
- response = (self.services['reports'].activities().list(userKey='all',
- applicationName='admin',
- eventName=event).execute()).get('items', [])
+ """
+ with self._services['reports'].activities() as activities:
+ reports = self._get_list(activities,
+ 'items',
+ userKey = 'all',
+ applicationName = 'admin',
+ eventName = event)
# Used for filtering duplicate events
prod_to_app_name_values = {
@@ -418,7 +491,7 @@ def get_gws_logs(self, products: list, event: str) -> dict:
)
if event in dup_events:
app_name = 'APPLICATION_NAME'
- for report in response:
+ for report in reports:
for events in report['events']:
parameters = events.get('parameters', [])
for parameter in parameters:
@@ -427,65 +500,74 @@ def get_gws_logs(self, products: list, event: str) -> dict:
for prod, app_values in subset_prod_to_app_name.items():
if param_val in app_values:
products_to_logs[prod].append(report)
- else: # no filtering append entire response to relevant product
+ else:
+ # no filtering append entire response to relevant product
for prod in products:
- products_to_logs[prod].extend(response)
+ products_to_logs[prod].extend(reports)
except Exception as exc:
warnings.warn(
- f"An exception was thrown while getting the logs; outputs will be incorrect: {exc}",
+ f'An exception was thrown while getting the logs; outputs will be incorrect: {exc}',
RuntimeWarning
)
return products_to_logs
def get_group_settings(self) -> dict:
- '''
+ """
Gets all of the group info using the directory API and group settings API
- '''
+ """
- group_service = self.services['groups']
- directory_service = self.services['directory']
+ group_service = self._services['groups']
+ directory_service = self._services['directory']
domains = {d['domainName'] for d in self.list_domains() if d['verified']}
try:
# get the group settings for each groups
group_settings = []
- for domain in domains:
- response = directory_service.groups().list(domain=domain).execute()
- for group in response.get('groups'):
- email = group.get('email')
- group_settings.append(group_service.groups().get(groupUniqueId=email).execute())
- self.successful_calls.add(ApiReference.LIST_GROUPS.value)
- self.successful_calls.add(ApiReference.GET_GROUP.value)
+
+ with (directory_service.groups() as ds_groups,
+ group_service.groups() as gs_groups):
+ for domain in domains:
+ group_list = self._get_list(ds_groups,
+ 'groups',
+ domain = domain)
+
+ group_settings = [gs_groups.get(groupUniqueId = group['email'])
+ .execute() for group in group_list]
+
+ self._successful_calls.add(ApiReference.LIST_GROUPS.value)
+ self._successful_calls.add(ApiReference.GET_GROUP.value)
return {'group_settings': group_settings}
except Exception as exc:
warnings.warn(
- f"Exception thrown while getting group settings; outputs will be incorrect: {exc}",
+ f'Exception thrown while getting group settings; outputs will be incorrect: {exc}',
RuntimeWarning
)
- self.unsuccessful_calls.add(ApiReference.LIST_GROUPS.value)
- self.unsuccessful_calls.add(ApiReference.GET_GROUP.value)
+ self._unsuccessful_calls.add(ApiReference.LIST_GROUPS.value)
+ self._unsuccessful_calls.add(ApiReference.GET_GROUP.value)
return {'group_settings': []}
def call_gws_providers(self, products: list, quiet) -> dict:
- '''
+ """
Calls the relevant GWS APIs to get the data we need for the baselines.
Data such as the admin audit log, super admin users etc.
:param products: list of product names to check
:param quiet: suppress tqdm output
- '''
+ """
# create a inverse dictionary containing a mapping of event => list of products
events_to_products = create_subset_inverted_dict(EVENTS, products)
- events_to_products_bar = tqdm(events_to_products.items(), leave=False, disable=quiet)
+ events_to_products_bar = tqdm(events_to_products.items(),
+ leave = False,
+ disable = quiet)
# main aggregator dict
product_to_logs = create_key_to_list(products)
product_to_items = {}
ou_ids = set()
- ou_ids.add("") # certain settings have no OU
+ ou_ids.add('') # certain settings have no OU
try:
# Add top level organization unit name
- ou_ids.add(self.get_toplevel_ou())
+ ou_ids.add(self._top_ou)
# get all organizational unit data
product_to_items['organizational_units'] = self.get_ous()
for orgunit in product_to_items['organizational_units']['organizationUnits']:
@@ -494,7 +576,7 @@ def call_gws_providers(self, products: list, quiet) -> dict:
product_to_items['organizational_unit_names'] = list(ou_ids)
except Exception as exc:
warnings.warn(
- f"Exception thrown while getting tenant data: {exc}",
+ f'Exception thrown while getting tenant data: {exc}',
RuntimeWarning
)
@@ -502,36 +584,44 @@ def call_gws_providers(self, products: list, quiet) -> dict:
try:
for event, product_list in events_to_products_bar:
products = ', '.join(product_list)
- bar_descr = f"Running Provider: Exporting {event} events for {products}..."
+ bar_descr = f'Running Provider: Exporting {event} events for {products}...'
events_to_products_bar.set_description(bar_descr)
# gets the GWS admin audit logs and merges them into product_to_logs
# aggregator dict
product_to_logs = merge_dicts(
product_to_logs,
- self.get_gws_logs(products=product_list, event=event)
+ self.get_gws_logs(products = product_list, event = event)
)
- self.successful_calls.add(ApiReference.LIST_ACTIVITIES.value)
+ self._successful_calls.add(ApiReference.LIST_ACTIVITIES.value)
except Exception as exc:
- warnings.warn("Provider Exception thrown while getting the logs; "\
- f"outputs will be incorrect: {exc}", RuntimeWarning)
- self.unsuccessful_calls.add(ApiReference.LIST_ACTIVITIES.value)
+ warnings.warn('Provider Exception thrown while getting the logs; '
+ f'outputs will be incorrect: {exc}', RuntimeWarning)
+ self._unsuccessful_calls.add(ApiReference.LIST_ACTIVITIES.value)
+
+ with PolicyAPI(self._gws_auth, self._top_ou) as policy_api:
+ policies = policy_api.get_policies()
+ policy_api.verify(policies)
+
+ product_to_items['policies'] = policies
# repacks the main aggregator into the original form
# that the api returns the data in; under an 'items' key.
# Then we put this key under a {product}_log key for the Rego code
try:
for product, logs in product_to_logs.items():
- key_name = f"{product}_logs"
+ key_name = f'{product}_logs'
product_to_items[key_name] = {'items': logs}
# get tenant metadata for report front page header
product_to_items['tenant_info'] = self.get_tenant_info()
- if 'gmail' in product_to_logs: # add dns info if gmail is being run
+ if 'gmail' in product_to_logs:
+ # add dns info if gmail is being run
product_to_items.update(self.get_dnsinfo())
- if 'commoncontrols' in product_to_logs: # add list of super admins if CC is being run
+ if 'commoncontrols' in product_to_logs:
+ # add list of super admins if CC is being run
product_to_items.update(self.get_super_admins())
if 'groups' in product_to_logs:
@@ -539,7 +629,45 @@ def call_gws_providers(self, products: list, quiet) -> dict:
except Exception as exc:
warnings.warn(
- f"Uncaught Exception thrown while getting other data: {exc}",
+ f'Uncaught Exception thrown while getting other data: {exc}',
RuntimeWarning
)
+
+ product_to_items['successful_calls'] = list(self._successful_calls)
+ product_to_items['unsuccessful_calls'] = list(self._unsuccessful_calls)
+
return product_to_items
+
+ @staticmethod
+ def _get_list(resource, item: str, **list_args) -> list:
+
+ """Given a Google Resource and the name of an item to retrieve, with
+ possible criteria, this helper method returns a list of results.
+
+ The given Resource object must have both list() and list_next()
+ methods because the intention of this method is to handle the case
+ where the result is too large for Google to return in a single
+ request.
+
+ :param Resource resource: a Google resource instance.
+
+ :param str item: the name of the item to retrieve from the results.
+ This is a key in the returned dictionary.
+
+ :param list_args: optional, keyword/value arguments to be passed
+ to the list() method.
+
+ :return: list of requested items.
+ """
+
+ results = []
+ request = resource.list(**list_args)
+
+ while request is not None:
+ response = request.execute()
+ results += response.get(item, [])
+ # If all the results have been returned, list_next() will return
+ # None.
+ request = resource.list_next(request, response)
+
+ return results
diff --git a/scubagoggles/purge.py b/scubagoggles/purge.py
new file mode 100644
index 00000000..d299c702
--- /dev/null
+++ b/scubagoggles/purge.py
@@ -0,0 +1,132 @@
+"""Implementation of ScubaGoggles conformance report directory purge.
+"""
+
+import argparse
+import datetime
+import logging
+import re
+import shutil
+import time
+
+from operator import itemgetter
+from pathlib import Path
+
+from scubagoggles.user_setup import default_file_names, find_legacy_dir
+
+log = logging.getLogger(__name__)
+
+
+def purge_reports(arguments: argparse.Namespace):
+
+ """Main purge reports function - this calls other functions in this module.
+
+ The arguments provide a keep count, and optionally the number of expiration
+ days. If the keep count is non-zero. the specified number of report
+ directories is kept. The remaining directories are deleted, unless the
+ number of expiration days is given. In that case, any remaining directory
+ newer than the expiration day count is excluded from being deleted.
+
+ NOTE: this only affects ScubaGoggles report output directories in the
+ user's output directory, and only those having names starting with
+ "GWSBaselineConformance" (the default output folder name (i.e., prefix)
+ and ending with a timestamp. Any directory not named in this way is
+ untouched.
+
+ :param arguments: arguments collected by the ArgumentParser.
+ """
+
+ log.info('GWS Conformance Report Directory Purge')
+
+ config = arguments.user_config
+ output_dir = find_legacy_dir(config) or config.output_dir
+
+ # Find all directories with generated names in the user's output directory.
+ # The returned directories are sorted by date (the oldest first).
+
+ report_dir_data = find_report_directories(output_dir)
+ dir_count = len(report_dir_data)
+
+ log.info(' Report directories: %d', dir_count)
+
+ expire_days = arguments.expire
+ keep_count = arguments.keep
+
+ # First, there's nothing to do if the number of directories is less or
+ # equal to the keep count. If there are more, we exclude the newest
+ # directories from consideration.
+
+ if keep_count is None or dir_count <= keep_count:
+ return
+
+ if keep_count < 0:
+ raise ValueError(f'? {keep_count} - negative keep count')
+
+ report_dir_data = report_dir_data[0:dir_count - keep_count]
+
+ if expire_days:
+ # The "expire days" value is the number of days back from the
+ # current date (i.e., now). Any older directory is considered
+ # "expired" and will be deleted (unless excluded by the keep
+ # count above).
+
+ if expire_days < 0:
+ raise ValueError(f'? {expire_days} - negative expire days')
+
+ days = datetime.timedelta(abs(expire_days))
+ expiration_date = datetime.datetime.now() - days
+ expiration_time = time.mktime(expiration_date.timetuple())
+
+ report_dir_data = [s for s in report_dir_data
+ if s[1] < expiration_time]
+
+ # What remains in the list are the directories to be deleted, after
+ # considering both the keep count and expire days values. We do not
+ # care if the directory could not be deleted for some reason - that
+ # is the user's issue.
+
+ delete_count = len(report_dir_data)
+ log.info(' Report directories to be deleted: %d', delete_count)
+ log.debug(' %s', output_dir)
+
+ for data in report_dir_data:
+ output_path = data[0]
+ log.debug(' %s', output_path.name)
+ shutil.rmtree(output_path, ignore_errors = True)
+
+ return
+
+
+def find_report_directories(user_directory: Path) -> list:
+
+ """Finds ScubaGoggles report directories with generated names, and
+ returns them as a list sorted by modification date (the oldest first).
+ Each element in the returned list contains the Path instance of the
+ directory and the modification time as a tuple.
+
+ :return: tuples containing the Path and modification time of each
+ directory found.
+ :rtype: list
+ """
+
+ result = []
+
+ report_root = Path(user_directory)
+
+ if not report_root.exists():
+ return result
+
+ dir_prefix = default_file_names.output_folder_name
+ dirname_re = re.compile(f'(?i){dir_prefix}_' + r'\d{4}(?:_\d{2}){5}$')
+
+ for report_path in report_root.glob(f'{dir_prefix}*'):
+
+ if (not report_path.is_dir()
+ or not dirname_re.match(report_path.name)):
+ continue
+
+ dir_data = (report_path, report_path.stat().st_mtime)
+ result.append(dir_data)
+
+ result.sort(key = itemgetter(1))
+
+ return result
diff --git a/scubagoggles/rego/Calendar.rego b/scubagoggles/rego/Calendar.rego
new file mode 100644
index 00000000..01a41e80
--- /dev/null
+++ b/scubagoggles/rego/Calendar.rego
@@ -0,0 +1,447 @@
+package calendar
+
+import future.keywords
+import data.utils
+import data.utils.PolicyApiInUse
+
+LogEvents := utils.GetEvents("calendar_logs")
+
+CalendarEnabled(orgunit) := utils.AppEnabled(input.policies, "calendar", orgunit)
+
+##################
+# GWS.CALENDAR.1 #
+##################
+
+#
+# Baseline GWS.CALENDAR.1.1
+#--
+
+CalendarId1_1 := utils.PolicyIdWithSuffix("GWS.CALENDAR.1.1")
+
+LogMessage1_1 := "SHARING_OUTSIDE_DOMAIN"
+
+Check1_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage1_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check1_1_OK if {PolicyApiInUse}
+
+GetFriendlyValue1_1(Value) := "Share all information, but outsiders cannot change calendars" if {
+ Value in {"EXTERNAL_ALL_INFO_READ_ONLY", "READ_ONLY_ACCESS"}
+} else := "Share all information, and outsiders can change calendars" if {
+ Value in {"EXTERNAL_ALL_INFO_READ_WRITE", "READ_WRITE_ACCESS"}
+} else := "Share all information, and allow managing of calendars" if {
+ Value in {"EXTERNAL_ALL_INFO_READ_WRITE_MANAGE", "MANAGE_ACCESS"}
+} else := Value
+
+SharingFmtMsg := "External sharing options for %s calendars is set to: %s"
+NonComplianceMessage1_1(value) := sprintf(SharingFmtMsg, ["primary", value])
+
+NonCompliantOUs1_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage1_1(GetFriendlyValue1_1(LastEvent.NewValue))
+}
+if {
+ not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+ Events := utils.FilterEventsOU(LogEvents, LogMessage1_1, OU)
+ # Ignore OUs without any events. We're already asserting that the
+ # top-level OU has at least one event; for all other OUs we assume
+ # they inherit from a parent OU if they have no events.
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ LastEvent.NewValue != "SHOW_ONLY_FREE_BUSY_INFORMATION"
+ LastEvent.NewValue != "INHERIT_FROM_PARENT"
+}
+
+NonCompliantGroups1_1 contains {
+ "Name": Group,
+ "Value": NonComplianceMessage1_1(GetFriendlyValue1_1(LastEvent.NewValue))
+}
+if {
+ not PolicyApiInUse
+ some Group in utils.GroupsWithEvents
+ Events := utils.FilterEventsGroup(LogEvents, LogMessage1_1, Group)
+ # Ignore Group without any events
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ LastEvent.NewValue != "SHOW_ONLY_FREE_BUSY_INFORMATION"
+ LastEvent.NewValue != "INHERIT_FROM_PARENT"
+}
+
+NonCompliantOUs1_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage1_1(GetFriendlyValue1_1(primaryShare))
+}
+if {
+ some OU, settings in input.policies
+ CalendarEnabled(OU)
+ section := settings.calendar_primary_calendar_max_allowed_external_sharing
+ primaryShare := section.maxAllowedExternalSharing
+ primaryShare != "EXTERNAL_FREE_BUSY_ONLY"
+}
+
+tests contains {
+ "PolicyId": CalendarId1_1,
+ "Criticality": "Shall",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event for the top-level OU in the current logs.",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := true
+ not Check1_1_OK
+}
+
+tests contains {
+ "PolicyId": CalendarId1_1,
+ "Criticality": "Shall",
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs1_1, NonCompliantGroups1_1),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs1_1, "NonCompliantGroups": NonCompliantGroups1_1},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check1_1_OK
+ Conditions := {count(NonCompliantOUs1_1) == 0, count(NonCompliantGroups1_1) == 0}
+ Status := (false in Conditions) == false
+}
+#--
+
+#
+# Baseline GWS.CALENDAR.1.2
+#--
+
+CalendarId1_2 := utils.PolicyIdWithSuffix("GWS.CALENDAR.1.2")
+
+LogMessage1_2 := "SHARING_OUTSIDE_DOMAIN_FOR_SECONDARY_CALENDAR"
+
+Check1_2_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage1_2, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check1_2_OK if {PolicyApiInUse}
+
+GetFriendlyValue1_2(Value) := GetFriendlyValue1_1(Value)
+
+NonComplianceMessage1_2(value) := sprintf(SharingFmtMsg, ["secondary", value])
+
+NonCompliantOUs1_2 contains {
+ "Name": utils.TopLevelOU,
+ "Value": NonComplianceMessage1_2(GetFriendlyValue1_2(LastEvent.NewValue))
+}
+if {
+ not PolicyApiInUse
+ Events := utils.FilterEventsNoOU(LogEvents, LogMessage1_2)
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ LastEvent.NewValue != "SHOW_ONLY_FREE_BUSY_INFORMATION"
+ LastEvent.NewValue != "INHERIT_FROM_PARENT"
+}
+
+NonCompliantOUs1_2 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage1_2(GetFriendlyValue1_2(secondaryShare))
+}
+if {
+ some OU, settings in input.policies
+ CalendarEnabled(OU)
+ section := settings.calendar_secondary_calendar_max_allowed_external_sharing
+ secondaryShare := section.maxAllowedExternalSharing
+ secondaryShare != "EXTERNAL_FREE_BUSY_ONLY"
+}
+
+tests contains {
+ "PolicyId": CalendarId1_2,
+ "Criticality": "Shall",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event for the top-level OU in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := false
+ not Check1_2_OK
+}
+
+tests contains {
+ "PolicyId": CalendarId1_2,
+ "Criticality": "Shall",
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs1_2, []),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs1_2},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check1_2_OK
+ Status := count(NonCompliantOUs1_2) == 0
+}
+#--
+
+##################
+# GWS.CALENDAR.2 #
+##################
+
+#
+# Baseline GWS.CALENDAR.2.1
+#--
+
+CalendarId2_1 := utils.PolicyIdWithSuffix("GWS.CALENDAR.2.1")
+
+LogMessage2_1 := "ENABLE_EXTERNAL_GUEST_PROMPT"
+
+Check2_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage2_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check2_1_OK if {PolicyApiInUse}
+
+NonComplianceMessage2_1(value) := sprintf("External Sharing Guest Prompt is %s",
+ [value])
+
+NonCompliantOUs2_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage2_1(utils.GetFriendlyEnabledValue(LastEvent.NewValue))
+}
+if {
+ not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+ Events := utils.FilterEventsOU(LogEvents, LogMessage2_1, OU)
+ # Ignore OUs without any events. We're already asserting that the
+ # top-level OU has at least one event; for all other OUs we assume
+ # they inherit from a parent OU if they have no events.
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ LastEvent.NewValue == "false"
+}
+
+NonCompliantGroups2_1 contains {
+ "Name": Group,
+ "Value": NonComplianceMessage2_1(utils.GetFriendlyEnabledValue(LastEvent.NewValue))
+}
+if {
+ not PolicyApiInUse
+ some Group in utils.GroupsWithEvents
+ Events := utils.FilterEventsGroup(LogEvents, LogMessage2_1, Group)
+ # Ignore groups without any events
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ LastEvent.NewValue == "false"
+}
+
+NonCompliantOUs2_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage2_1(utils.GetFriendlyEnabledValue(extWarnPrompt))
+}
+if {
+ some OU, settings in input.policies
+ CalendarEnabled(OU)
+ extWarnPrompt := settings.calendar_external_invitations.warnOnInvite
+ extWarnPrompt != true
+}
+
+tests contains {
+ "PolicyId": CalendarId2_1,
+ "Criticality": "Shall",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event for the top-level OU in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := true
+ not Check2_1_OK
+}
+
+tests contains {
+ "PolicyId": CalendarId2_1,
+ "Criticality": "Shall",
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs2_1, NonCompliantGroups2_1),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs2_1, "NonCompliantGroups": NonCompliantGroups2_1},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check2_1_OK
+ Conditions := {count(NonCompliantOUs2_1) == 0, count(NonCompliantGroups2_1) == 0}
+ Status := (false in Conditions) == false
+}
+#--
+
+##################
+# GWS.CALENDAR.3 #
+##################
+
+#
+# Baseline GWS.CALENDAR.3.1
+#--
+
+CalendarId3_1 := utils.PolicyIdWithSuffix("GWS.CALENDAR.3.1")
+
+LogMessage3_1 := "ENABLE_EWS_INTEROP"
+
+Check3_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage3_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check3_1_OK if {PolicyApiInUse}
+
+NonComplianceMessage3_1(value) := sprintf("Calendar interoperation is %s",
+ [value])
+
+NonCompliantOUs3_1 contains {
+ "Name": utils.TopLevelOU,
+ "Value": NonComplianceMessage3_1(utils.GetFriendlyEnabledValue(LastEvent.NewValue))
+}
+if {
+ not PolicyApiInUse
+ Events := utils.FilterEventsNoOU(LogEvents, LogMessage3_1)
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ LastEvent.NewValue != "false"
+}
+
+NonCompliantOUs3_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage3_1(utils.GetFriendlyEnabledValue(interoperability))
+}
+if {
+ some OU, settings in input.policies
+ CalendarEnabled(OU)
+ interoperability := settings.calendar_interoperability.enableInteroperability
+ interoperability != false
+}
+
+tests contains {
+ "PolicyId": CalendarId3_1,
+ "Criticality": "Should",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event for the top-level OU in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := true
+ not Check3_1_OK
+}
+
+tests contains {
+ "PolicyId": CalendarId3_1,
+ "Criticality": "Should",
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs3_1, []),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs3_1},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check3_1_OK
+ Status := count(NonCompliantOUs3_1) == 0
+}
+#--
+
+#
+# Baseline GWS.CALENDAR.3.2
+#--
+
+CalendarId3_2 := utils.PolicyIdWithSuffix("GWS.CALENDAR.3.2")
+
+tests contains {
+ "PolicyId": CalendarId3_2,
+ "Criticality": "Shall/Not-Implemented",
+ "ReportDetails": "Currently not able to be tested automatically; please manually check.",
+ "ActualValue": "",
+ "RequirementMet": false,
+ "NoSuchEvent": true
+}
+#--
+
+##################
+# GWS.CALENDAR.4 #
+##################
+
+#
+# Baseline GWS.CALENDAR.4.1
+#--
+
+CalendarId4_1 := utils.PolicyIdWithSuffix("GWS.CALENDAR.4.1")
+
+LogMessage4_1 := "CalendarAppointmentSlotAdminSettingsProto payments_enabled"
+
+Check4_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage4_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check4_1_OK if {PolicyApiInUse}
+
+NonComplianceMessage4_1(value) := sprintf("Paid calendar appointments are %s",
+ [value])
+
+NonCompliantOUs4_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage4_1(utils.GetFriendlyEnabledValue(LastEvent.NewValue))
+}
+if {
+ not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+ Events := utils.FilterEventsOU(LogEvents, LogMessage4_1, OU)
+ # Ignore OUs without any events. We're already asserting that the
+ # top-level OU has at least one event; for all other OUs we assume
+ # they inherit from a parent OU if they have no events.
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ LastEvent.NewValue == "true"
+}
+
+NonCompliantOUs4_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage4_1(utils.GetFriendlyEnabledValue(payments))
+}
+if {
+ some OU, settings in input.policies
+ CalendarEnabled(OU)
+ payments := settings.calendar_appointment_schedules.enablePayments
+ payments != false
+}
+
+tests contains {
+ "PolicyId": CalendarId4_1,
+ "Criticality": "Shall",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event for the top-level OU in the current logs.",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := true
+ not Check4_1_OK
+}
+
+tests contains {
+ "PolicyId": CalendarId4_1,
+ "Criticality": "Shall",
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs4_1, []),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs4_1},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check4_1_OK
+ Status := count(NonCompliantOUs4_1) == 0
+}
+#--
diff --git a/rego/Chat.rego b/scubagoggles/rego/Chat.rego
similarity index 70%
rename from rego/Chat.rego
rename to scubagoggles/rego/Chat.rego
index 73bebfab..d16e2859 100644
--- a/rego/Chat.rego
+++ b/scubagoggles/rego/Chat.rego
@@ -1,41 +1,71 @@
package chat
-import data.utils
import future.keywords
+import data.utils
+import data.utils.PolicyApiInUse
LogEvents := utils.GetEvents("chat_logs")
+ChatEnabled(orgunit) := utils.AppEnabled(input.policies, "chat", orgunit)
+
##############
# GWS.CHAT.1 #
##############
#
-# Baseline GWS.CHAT.1v0.3
+# Baseline GWS.CHAT.1
#--
-GetFriendlyValue1_1(Value) := "History is OFF" if {
- Value == "true"
-} else := "History is ON" if {
- Value == "false"
+ChatId1_1 := utils.PolicyIdWithSuffix("GWS.CHAT.1.1")
+
+LogMessage1_1 := "ChatArchivingProto chatsDefaultToOffTheRecord"
+
+Check1_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage1_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check1_1_OK if {PolicyApiInUse}
+
+# This is a weird one - for logging, history is off if the value is
+# "true" (string), but for the policy API history is off if the value
+# is false (boolean).
+
+GetFriendlyValue1_1(Value) := "OFF" if {
+ Value in {false, "true"}
+} else := "ON" if {
+ Value in {true, "false"}
} else := Value
+NonComplianceMessage1_1(value) := sprintf("Default conversation history is set to: %s",
+ [value])
+
NonCompliantOUs1_1 contains {
"Name": OU,
- "Value": concat(" ", [
- "Default conversation history is set to",
- GetFriendlyValue1_1(LastEvent.NewValue)
- ])
+ "Value": NonComplianceMessage1_1(GetFriendlyValue1_1(LastEvent.NewValue))
}
if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents, "ChatArchivingProto chatsDefaultToOffTheRecord", OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage1_1, OU)
count(Events) > 0
LastEvent := utils.GetLastEvent(Events)
LastEvent.NewValue == "true"
}
+NonCompliantOUs1_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage1_1(GetFriendlyValue1_1(chatHistory))
+} if {
+ some OU, settings in input.policies
+ ChatEnabled(OU)
+ chatHistory := settings.chat_chat_history.historyOnByDefault
+ chatHistory == false
+}
+
tests contains {
- "PolicyId": "GWS.CHAT.1.1v0.3",
+ "PolicyId": ChatId1_1,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event in the current logs",
@@ -43,47 +73,76 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := true
- Events := utils.FilterEventsOU(LogEvents, "ChatArchivingProto chatsDefaultToOffTheRecord", utils.TopLevelOU)
- count(Events) == 0
+ not Check1_1_OK
}
tests contains {
- "PolicyId": "GWS.CHAT.1.1v0.3",
+ "PolicyId": ChatId1_1,
"Criticality": "Shall",
- # Empty list in next line for non compliant groups, as this setting can't be changed at the group level
+ # Empty list in next line for non compliant groups, as this setting can't
+ # be changed at the group level
"ReportDetails": utils.ReportDetails(NonCompliantOUs1_1, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs1_1},
"RequirementMet": Status,
"NoSuchEvent": false
}
if {
- Events := utils.FilterEventsOU(LogEvents, "ChatArchivingProto chatsDefaultToOffTheRecord", utils.TopLevelOU)
- count(Events) > 0
+ Check1_1_OK
Status := count(NonCompliantOUs1_1) == 0
}
#--
#
-# Baseline GWS.CHAT.1.2v0.3
+# Baseline GWS.CHAT.1.2
#--
+ChatId1_2 := utils.PolicyIdWithSuffix("GWS.CHAT.1.2")
+
+LogMessage1_2 := "ChatArchivingProto allow_chat_archiving_setting_modification"
+
+Check1_2_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage1_2, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check1_2_OK if {PolicyApiInUse}
+
+GetFriendlyValue1_2(Value) := "Yes" if {
+ Value in {true, "true"}
+} else := "No" if {
+ Value in {false, "false"}
+} else := Value
+
+NonComplianceMessage1_2(value) := sprintf("Allow users to change their history setting is set to: %s",
+ [value])
+
NonCompliantOUs1_2 contains {
"Name": OU,
- "Value": concat(" ", [
- "Allow users to change their history setting is set to",
- LastEvent.NewValue
- ])
+ "Value": NonComplianceMessage1_2(GetFriendlyValue1_2(LastEvent.NewValue))
}
if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents, "ChatArchivingProto allow_chat_archiving_setting_modification", OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage1_2, OU)
count(Events) > 0
LastEvent := utils.GetLastEvent(Events)
LastEvent.NewValue == "true"
}
+NonCompliantOUs1_2 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage1_2(GetFriendlyValue1_2(changeHistory))
+} if {
+ some OU, settings in input.policies
+ ChatEnabled(OU)
+ changeHistory := settings.chat_chat_history.allowUserModification
+ changeHistory != false
+}
+
tests contains {
- "PolicyId": "GWS.CHAT.1.2v0.3",
+ "PolicyId": ChatId1_2,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event in the current logs",
@@ -91,14 +150,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := false
- SettingName := "ChatArchivingProto allow_chat_archiving_setting_modification"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) == 0
+ not Check1_2_OK
}
tests contains {
- "PolicyId": "GWS.CHAT.1.2v0.3",
+ "PolicyId": ChatId1_2,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs1_2, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs1_2},
@@ -106,45 +164,68 @@ tests contains {
"NoSuchEvent": false
}
if {
- SettingName := "ChatArchivingProto allow_chat_archiving_setting_modification"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) > 0
+ Check1_2_OK
Status := count(NonCompliantOUs1_2) == 0
}
#--
-
##############
# GWS.CHAT.2 #
##############
#
-# Baseline GWS.CHAT.2.1v0.3
+# Baseline GWS.CHAT.2.1
#--
+
+ChatId2_1 := utils.PolicyIdWithSuffix("GWS.CHAT.2.1")
+
+LogMessage2_1 := "DynamiteFileSharingSettingsProto external_file_sharing_setting"
+
+Check2_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage2_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check2_1_OK if {PolicyApiInUse}
+
GetFriendlyValue2_1(Value) := "Allow all files" if {
Value == "ALL_FILES"
} else := "Images only" if {
Value == "IMAGES_ONLY"
+} else := "Unspecified" if {
+ Value == "FILE_SHARING_OPTION_UNSPECIFIED"
} else := Value
+NonComplianceMessage2_1(value) := sprintf("External file sharing is set to: %s",
+ [value])
+
NonCompliantOUs2_1 contains {
"Name": OU,
- "Value": concat(" ", [
- "External filesharing is set to",
- GetFriendlyValue2_1(LastEvent.NewValue)
- ])
+ "Value": NonComplianceMessage2_1(GetFriendlyValue2_1(LastEvent.NewValue))
}
if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents, "DynamiteFileSharingSettingsProto external_file_sharing_setting", OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage2_1, OU)
count(Events) > 0
LastEvent := utils.GetLastEvent(Events)
LastEvent.NewValue != "NO_FILES"
LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
}
+NonCompliantOUs2_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage2_1(GetFriendlyValue2_1(allowSharing))
+} if {
+ some OU, settings in input.policies
+ ChatEnabled(OU)
+ allowSharing := settings.chat_chat_file_sharing.externalFileSharing
+ allowSharing != "NO_FILES"
+}
+
tests contains {
- "PolicyId": "GWS.CHAT.2.1v0.3",
+ "PolicyId": ChatId2_1,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -152,14 +233,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := false
- SettingName := "DynamiteFileSharingSettingsProto external_file_sharing_setting"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) == 0
+ not Check2_1_OK
}
tests contains {
- "PolicyId": "GWS.CHAT.2.1v0.3",
+ "PolicyId": ChatId2_1,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs2_1, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs2_1},
@@ -167,9 +247,7 @@ tests contains {
"NoSuchEvent": false
}
if {
- SettingName := "DynamiteFileSharingSettingsProto external_file_sharing_setting"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) > 0
+ Check2_1_OK
Status := count(NonCompliantOUs2_1) == 0
}
#--
@@ -179,30 +257,60 @@ if {
##############
#
-# Baseline GWS.CHAT.3.1v0.3
+# Baseline GWS.CHAT.3.1
#--
-GetFriendlyValue3_1(Value) := "History is OFF by default" if {
- Value == "DEFAULT_OFF_THE_RECORD"
-} else := "History is ALWAYS OFF" if {
- Value == "ALWAYS_OFF_THE_RECORD"
+
+ChatId3_1 := utils.PolicyIdWithSuffix("GWS.CHAT.3.1")
+
+LogMessage3_1 := "RoomOtrSettingsProto otr_state"
+
+Check3_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage3_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check3_1_OK if {PolicyApiInUse}
+
+NonComplianceMessage3_1(value) := sprintf("Conversation history settings for spaces is set to: %s",
+ [value])
+
+GetFriendlyValue3_1(Value) := "OFF by default" if {
+ Value in {"DEFAULT_HISTORY_OFF", "DEFAULT_OFF_THE_RECORD"}
+} else := "ON by default" if {
+ Value == "DEFAULT_HISTORY_ON"
+} else := "ALWAYS ON" if {
+ Value == "HISTORY_ALWAYS_ON"
+} else := "Unspecified" if {
+ Value == "HISTORY_STATE_UNSPECIFIED"
+} else := "ALWAYS OFF" if {
+ Value in {"HISTORY_ALWAYS_OFF", "ALWAYS_OFF_THE_RECORD"}
} else := Value
NonCompliantOUs3_1 contains {
"Name": OU,
- "Value": concat(" ", [
- "Conversation history settings for spaces is set to",
- GetFriendlyValue3_1(LastEvent.NewValue)
- ])
+ "Value": NonComplianceMessage3_1(GetFriendlyValue3_1(LastEvent.NewValue))
} if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents, "RoomOtrSettingsProto otr_state", OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage3_1, OU)
count(Events) > 0
LastEvent := utils.GetLastEvent(Events)
not contains("DEFAULT_ON_THE_RECORD ALWAYS_ON_THE_RECORD", LastEvent.NewValue)
}
+NonCompliantOUs3_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage3_1(GetFriendlyValue3_1(spaceHistory))
+} if {
+ some OU, settings in input.policies
+ ChatEnabled(OU)
+ spaceHistory := settings.chat_space_history.historyState
+ not spaceHistory in ["DEFAULT_HISTORY_ON", "HISTORY_ALWAYS_ON"]
+}
+
tests contains {
- "PolicyId": "GWS.CHAT.3.1v0.3",
+ "PolicyId": ChatId3_1,
"Criticality": "Should",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -210,13 +318,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := true
- Events := utils.FilterEventsOU(LogEvents, "RoomOtrSettingsProto otr_state", utils.TopLevelOU)
- count(Events) == 0
+ not Check3_1_OK
}
tests contains {
- "PolicyId": "GWS.CHAT.3.1v0.3",
+ "PolicyId": ChatId3_1,
"Criticality": "Should",
"ReportDetails": utils.ReportDetails(NonCompliantOUs3_1, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs3_1},
@@ -224,8 +332,7 @@ tests contains {
"NoSuchEvent": false
}
if {
- Events := utils.FilterEventsOU(LogEvents, "RoomOtrSettingsProto otr_state", utils.TopLevelOU)
- count(Events) > 0
+ Check3_1_OK
Status := count(NonCompliantOUs3_1) == 0
}
#--
@@ -235,27 +342,51 @@ if {
##############
#
-# Baseline GWS.CHAT.4.1v0.3
+# Baseline GWS.CHAT.4.1
#--
+
+ChatId4_1 := utils.PolicyIdWithSuffix("GWS.CHAT.4.1")
+
+LogMessage4_1 := "RestrictChatProto restrictChatToOrganization"
+
default NoSuchEvent4_1(_) := false
NoSuchEvent4_1(TopLevelOU) := true if {
- Events := utils.FilterEventsOU(LogEvents, "RestrictChatProto restrictChatToOrganization", TopLevelOU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage4_1, TopLevelOU)
count(Events) == 0
}
NoSuchEvent4_1(TopLevelOU) := true if {
- Events := utils.FilterEventsOU(LogEvents, "RestrictChatProto externalChatRestriction", TopLevelOU)
+ Events := utils.FilterEventsOU(LogEvents,
+ "RestrictChatProto externalChatRestriction",
+ TopLevelOU)
count(Events) == 0
}
+Check4_1_OK if {
+ not PolicyApiInUse
+ not NoSuchEvent4_1(utils.TopLevelOU)
+}
+
+Check4_1_OK if {PolicyApiInUse}
+
+GetFriendlyValue4_1(Value) := "all domains" if {
+ Value == "NO_RESTRICTION"
+} else := "Unspecified" if {
+ Value == "RESTRICTION_UNSPECIFIED"
+} else := Value
+
+NonComplianceMessage4_1(value) := sprintf("Allow external chat within: %s",
+ [value])
+
NonCompliantOUs4_1 contains {
"Name": OU,
"Value": "External chat is enabled for all domains"
}
if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events_A := utils.FilterEventsOU(LogEvents, "RestrictChatProto restrictChatToOrganization", OU)
+ Events_A := utils.FilterEventsOU(LogEvents, LogMessage4_1, OU)
count(Events_A) > 0
LastEvent_A := utils.GetLastEvent(Events_A)
LastEvent_A.NewValue != "DELETE_APPLICATION_SETTING"
@@ -269,8 +400,20 @@ NonCompliantOUs4_1 contains {
LastEvent_B.NewValue != "TRUSTED_DOMAINS"
}
+NonCompliantOUs4_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage4_1(GetFriendlyValue4_1(externalRestrict))
+} if {
+ some OU, settings in input.policies
+ ChatEnabled(OU)
+ externalEnable := settings.chat_external_chat_restriction.allowExternalChat
+ externalEnable == true
+ externalRestrict := settings.chat_external_chat_restriction.externalChatRestriction
+ externalRestrict != "TRUSTED_DOMAINS"
+}
+
tests contains {
- "PolicyId": "GWS.CHAT.4.1v0.3",
+ "PolicyId": ChatId4_1,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -278,12 +421,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := false
- NoSuchEvent4_1(utils.TopLevelOU)
+ not Check4_1_OK
}
tests contains {
- "PolicyId": "GWS.CHAT.4.1v0.3",
+ "PolicyId": ChatId4_1,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs4_1, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs4_1},
@@ -291,7 +435,7 @@ tests contains {
"NoSuchEvent": false
}
if {
- not NoSuchEvent4_1(utils.TopLevelOU)
+ Check4_1_OK
Status := count(NonCompliantOUs4_1) == 0
}
#--
@@ -319,9 +463,11 @@ Chat5Warning := concat("", [
])
#
-# GWS.CHAT.5.1v0.3
+# GWS.CHAT.5.1
#--
+ChatId5_1 := utils.PolicyIdWithSuffix("GWS.CHAT.5.1")
+
GetFriendlyValue5_1(NonCompBooleans) := Description if {
StatusMessages = [
"Content reporting for 1:1 direct messages is disabled.",
@@ -433,7 +579,7 @@ NoSuchEvent5_1 := true if {
}
tests contains {
- "PolicyId": "GWS.CHAT.5.1v0.3",
+ "PolicyId": ChatId5_1,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -446,7 +592,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.CHAT.5.1v0.3",
+ "PolicyId": ChatId5_1,
"Criticality": "Shall",
"ReportDetails": concat("
", [utils.ReportDetails(NonCompliantOUs5_1, []), Chat5Warning]),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs5_1},
@@ -460,8 +606,11 @@ if {
#--
#
-# GWS.CHAT.5.2v0.3
+# GWS.CHAT.5.2
#--
+
+ChatId5_2 := utils.PolicyIdWithSuffix("GWS.CHAT.5.2")
+
AllReportingCategories := {
"system_violation: HARASSMENT",
"system_violation: DISCRIMINATION",
@@ -541,7 +690,7 @@ NonCompliantOUs5_2 contains {
}
tests contains {
- "PolicyId": "GWS.CHAT.5.2v0.3",
+ "PolicyId": ChatId5_2,
"Criticality": "Should",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -555,7 +704,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.CHAT.5.2v0.3",
+ "PolicyId": ChatId5_2,
"Criticality": "Should",
"ReportDetails": utils.ReportDetails(NonCompliantOUs5_2, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs5_2},
@@ -567,4 +716,4 @@ if {
count(Events) > 0
Status := count(NonCompliantOUs5_2) == 0
}
-#--
\ No newline at end of file
+#--
diff --git a/scubagoggles/rego/Classroom.rego b/scubagoggles/rego/Classroom.rego
new file mode 100644
index 00000000..86fcfbc5
--- /dev/null
+++ b/scubagoggles/rego/Classroom.rego
@@ -0,0 +1,509 @@
+package classroom
+
+import future.keywords
+import data.utils
+import data.utils.PolicyApiInUse
+
+LogEvents := utils.GetEvents("classroom_logs")
+
+ClassroomEnabled(orgunit) := utils.AppEnabled(input.policies, "classroom", orgunit)
+
+###################
+# GWS.CLASSROOM.1 #
+###################
+
+#
+# Baseline GWS.CLASSROOM.1.1
+#--
+
+ClassroomId1_1 := utils.PolicyIdWithSuffix("GWS.CLASSROOM.1.1")
+
+LogMessage1_1 := "ClassMembershipSettingProto who_can_join_classes"
+
+GetFriendlyValue1_1(Value) := "Users in your domain only" if {
+ Value in {"1", "ANYONE_IN_DOMAIN"}
+} else := "Users in allowlisted domains" if {
+ Value in {"2", "ANYONE_IN_ALLOWLISTED_DOMAINS"}
+} else := "Any Google Workspace user" if {
+ Value in {"3", "ANY_GOOGLE_WORKSPACE_USER"}
+} else := "Any user" if {
+ Value in {"4", "ANYONE"}
+} else := Value
+
+Check1_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage1_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check1_1_OK if {PolicyApiInUse}
+
+NonComplianceMessage1_1(value) := sprintf("Who can join classes in your domain is set to: %s", [value])
+
+NonCompliantOUs1_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage1_1(GetFriendlyValue1_1(LastEvent.NewValue))
+} if {
+ not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+ Events := utils.FilterEventsOU(LogEvents, LogMessage1_1, OU)
+ # Ignore OUs without any events. We're already asserting that the
+ # top-level OU has at least one event; for all other OUs we assume
+ # they inherit from a parent OU if they have no events.
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ LastEvent.NewValue != "1"
+}
+
+NonCompliantOUs1_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage1_1(GetFriendlyValue1_1(whoCanJoin))
+} if {
+ some OU, settings in input.policies
+ ClassroomEnabled(OU)
+ whoCanJoin := settings.classroom_class_membership.whoCanJoinClasses
+ whoCanJoin != "ANYONE_IN_DOMAIN"
+}
+
+tests contains {
+ "PolicyId": ClassroomId1_1,
+ "Criticality": "Shall",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := true
+ not Check1_1_OK
+}
+
+tests contains {
+ "PolicyId": ClassroomId1_1,
+ "Criticality": "Shall",
+ # Empty list is for noncompliant groups as classroom settings can't be
+ # modified at the group level
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs1_1, []),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs1_1},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check1_1_OK
+ Status := count(NonCompliantOUs1_1) == 0
+}
+#--
+
+#
+# Baseline GWS.CLASSROOM.1.2
+#--
+
+ClassroomId1_2 := utils.PolicyIdWithSuffix("GWS.CLASSROOM.1.2")
+
+LogMessage1_2 := "ClassMembershipSettingProto which_classes_can_users_join"
+
+GetFriendlyValue1_2(Value) := "Classes in your domain only" if {
+ Value in {"1", "CLASSES_IN_DOMAIN"}
+} else := "Classes in allowlisted domains" if {
+ Value in {"2", "CLASSES_IN_ALLOWLISTED_DOMAINS"}
+} else := "Any Google Workspace class" if {
+ Value in {"3", "ANY_GOOGLE_WORKSPACE_CLASS"}
+} else := Value
+
+Check1_2_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage1_2, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check1_2_OK if {PolicyApiInUse}
+
+NonComplianceMessage1_2(value) := sprintf("Which classes can users in your domain join is set to: %s", [value])
+
+NonCompliantOUs1_2 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage1_2(GetFriendlyValue1_2(LastEvent.NewValue))
+} if {
+ not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+ Events := utils.FilterEventsOU(LogEvents, LogMessage1_2, OU)
+ # Ignore OUs without any events. We're already asserting that the
+ # top-level OU has at least one event; for all other OUs we assume
+ # they inherit from a parent OU if they have no events.
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ LastEvent.NewValue != "1"
+}
+
+NonCompliantOUs1_2 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage1_2(GetFriendlyValue1_2(whichClasses))
+} if {
+ some OU, settings in input.policies
+ ClassroomEnabled(OU)
+ whichClasses := settings.classroom_class_membership.whichClassesCanUsersJoin
+ whichClasses != "CLASSES_IN_DOMAIN"
+}
+
+tests contains {
+ "PolicyId": ClassroomId1_2,
+ "Criticality": "Shall",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := true
+ not Check1_2_OK
+}
+
+tests contains {
+ "PolicyId": ClassroomId1_2,
+ "Criticality": "Shall",
+ # Empty list is for noncompliant groups as classroom settings can't be
+ # modified at the group level
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs1_2, []),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs1_2},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check1_2_OK
+ Status := count(NonCompliantOUs1_2) == 0
+}
+#--
+
+###################
+# GWS.CLASSROOM.2 #
+###################
+
+#
+# Baseline GWS.CLASSROOM.2.1
+#--
+
+ClassroomId2_1 := utils.PolicyIdWithSuffix("GWS.CLASSROOM.2.1")
+
+LogMessage2_1 := "ApiDataAccessSettingProto api_access_enabled"
+
+GetFriendlyValue2_1(Value) := "unable" if {
+ Value in {"false", false}
+} else := "able" if {
+ Value in {"true", true}
+} else := Value
+
+Check2_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage2_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check2_1_OK if {PolicyApiInUse}
+
+NonComplianceMessage2_1(value) := sprintf("Users %s to authorize apps to %s",
+ [value,
+ "access their Google Classroom data"])
+
+NonCompliantOUs2_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage2_1(GetFriendlyValue2_1(LastEvent.NewValue))
+} if {
+ not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+ Events := utils.FilterEventsOU(LogEvents, LogMessage2_1, OU)
+ # Ignore OUs without any events. We're already asserting that the
+ # top-level OU has at least one event; for all other OUs we assume
+ # they inherit from a parent OU if they have no events.
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ LastEvent.NewValue != "false"
+ LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
+}
+
+NonCompliantOUs2_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage2_1(GetFriendlyValue2_1(dataAccessEnabled))
+} if {
+ some OU, settings in input.policies
+ ClassroomEnabled(OU)
+ dataAccessEnabled := settings.classroom_api_data_access.enableApiAccess
+ dataAccessEnabled != false
+}
+
+tests contains {
+ "PolicyId": ClassroomId2_1,
+ "Criticality": "Shall",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := false
+ not Check2_1_OK
+}
+
+tests contains {
+ "PolicyId": ClassroomId2_1,
+ "Criticality": "Shall",
+ # Empty list is for noncompliant groups as classroom settings can't be
+ # modified at the group level
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs2_1, []),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs2_1},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check2_1_OK
+ Status := count(NonCompliantOUs2_1) == 0
+}
+#--
+
+###################
+# GWS.CLASSROOM.3 #
+###################
+
+#
+# Baseline GWS.CLASSROOM.3.1
+#--
+
+ClassroomId3_1 := utils.PolicyIdWithSuffix("GWS.CLASSROOM.3.1")
+
+LogMessage3_1 := "RosterImportSettingsProto sis_integrator"
+
+GetFriendlyValue3_1(Value) := "OFF" if {
+ Value in {"SIS_INTEGRATOR_NONE", "OFF"}
+} else := "ON - CLEVER" if {
+ Value in {"SIS_INTEGRATOR_CLEVER", "ON_CLEVER"}
+} else := Value
+
+Check3_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage3_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check3_1_OK if {PolicyApiInUse}
+
+NonComplianceMessage3_1(value) := sprintf("Roster import is set to: %s", [value])
+
+NonCompliantOUs3_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage3_1(GetFriendlyValue3_1(LastEvent.NewValue))
+} if {
+ not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+ Events := utils.FilterEventsOU(LogEvents, LogMessage3_1, OU)
+ # Ignore OUs without any events. We're already asserting that the
+ # top-level OU has at least one event; for all other OUs we assume
+ # they inherit from a parent OU if they have no events.
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ LastEvent.NewValue != "SIS_INTEGRATOR_NONE"
+ LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
+}
+
+NonCompliantOUs3_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage3_1(GetFriendlyValue3_1(rosterImportOption))
+} if {
+ some OU, settings in input.policies
+ ClassroomEnabled(OU)
+ rosterImportOption := settings.classroom_roster_import.rosterImportOption
+ rosterImportOption != "OFF"
+}
+
+tests contains {
+ "PolicyId": ClassroomId3_1,
+ "Criticality": "Should",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := true
+ not Check3_1_OK
+}
+
+tests contains {
+ "PolicyId": ClassroomId3_1,
+ "Criticality": "Should",
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs3_1, []),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs3_1},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check3_1_OK
+ Status := count(NonCompliantOUs3_1) == 0
+}
+#--
+
+###################
+# GWS.CLASSROOM.4 #
+###################
+
+#
+# Baseline GWS.CLASSROOM.4.1
+#--
+
+ClassroomId4_1 := utils.PolicyIdWithSuffix("GWS.CLASSROOM.4.1")
+
+LogMessage4_1 := "StudentUnenrollmentSettingsProto who_can_unenroll_students"
+
+GetFriendlyValue4_1(Value) := "Students and teachers" if {
+ startswith(Value, "STUDENTS_AND_TEACHERS") == true
+} else := "Only teachers" if {
+ Value in {"ONLY_TEACHERS_CAN_UNENROLL_STUDENTS", "TEACHERS_ONLY"}
+} else := Value
+
+Check4_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage4_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check4_1_OK if {PolicyApiInUse}
+
+NonComplianceMessage4_1(value) := sprintf("Who can unenroll students from classes is set to: %s", [value])
+
+NonCompliantOUs4_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage4_1(GetFriendlyValue4_1(LastEvent.NewValue))
+} if {
+ not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+ Events := utils.FilterEventsOU(LogEvents, LogMessage4_1, OU)
+ # Ignore OUs without any events. We're already asserting that the
+ # top-level OU has at least one event; for all other OUs we assume
+ # they inherit from a parent OU if they have no events.
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ LastEvent.NewValue != "ONLY_TEACHERS_CAN_UNENROLL_STUDENTS"
+ LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
+}
+
+NonCompliantOUs4_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage4_1(GetFriendlyValue4_1(whoCanUnenroll))
+} if {
+ some OU, settings in input.policies
+ ClassroomEnabled(OU)
+ whoCanUnenroll := settings.classroom_student_unenrollment.whoCanUnenrollStudents
+ whoCanUnenroll != "TEACHERS_ONLY"
+}
+
+tests contains {
+ "PolicyId": ClassroomId4_1,
+ "Criticality": "Shall",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := false
+ not Check4_1_OK
+}
+
+tests contains {
+ "PolicyId": ClassroomId4_1,
+ "Criticality": "Shall",
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs4_1, []),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs4_1},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check4_1_OK
+ Status := count(NonCompliantOUs4_1) == 0
+}
+#--
+
+###################
+# GWS.CLASSROOM.5 #
+###################
+
+#
+# Baseline GWS.CLASSROOM.5.1
+#--
+
+ClassroomId5_1 := utils.PolicyIdWithSuffix("GWS.CLASSROOM.5.1")
+
+LogMessage5_1 := "TeacherPermissionsSettingProto who_can_create_class"
+
+GetFriendlyValue5_1(Value) := "anyone in this domain" if {
+ Value in {"1", "ANYONE_IN_DOMAIN"}
+} else := "all pending and verified teachers" if {
+ Value in {"2", "ALL_PENDING_AND_VERIFIED_TEACHERS"}
+} else := Value
+
+Check5_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage5_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check5_1_OK if {PolicyApiInUse}
+
+NonComplianceMessage5_1(value) := sprintf("Who can create classes is set to: %s", [value])
+
+NonCompliantOUs5_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage5_1(GetFriendlyValue5_1(LastEvent.NewValue))
+} if {
+ not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+ Events := utils.FilterEventsOU(LogEvents, LogMessage5_1, OU)
+ # Ignore OUs without any events. We're already asserting that the
+ # top-level OU has at least one event; for all other OUs we assume
+ # they inherit from a parent OU if they have no events.
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ LastEvent.NewValue != "3"
+ LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
+}
+
+NonCompliantOUs5_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage5_1(GetFriendlyValue5_1(whoCanCreate))
+} if {
+ some OU, settings in input.policies
+ ClassroomEnabled(OU)
+ whoCanCreate := settings.classroom_teacher_permissions.whoCanCreateClasses
+ whoCanCreate != "VERIFIED_TEACHERS_ONLY"
+}
+
+tests contains {
+ "PolicyId": ClassroomId5_1,
+ "Criticality": "Shall",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := false
+ not Check5_1_OK
+}
+
+tests contains {
+ "PolicyId": ClassroomId5_1,
+ "Criticality": "Shall",
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs5_1, []),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs5_1},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check5_1_OK
+ Status := count(NonCompliantOUs5_1) == 0
+}
+#--
diff --git a/rego/Commoncontrols.rego b/scubagoggles/rego/Commoncontrols.rego
similarity index 75%
rename from rego/Commoncontrols.rego
rename to scubagoggles/rego/Commoncontrols.rego
index f333d029..eb4f54d7 100644
--- a/rego/Commoncontrols.rego
+++ b/scubagoggles/rego/Commoncontrols.rego
@@ -1,7 +1,8 @@
package commoncontrols
-import data.utils
import future.keywords
+import data.utils
+import data.utils.PolicyApiInUse
# Note that we need to implement custom FilterEvents and SettingChangeEvents
# rules here, instead of importing the standard ones from utils.
@@ -100,9 +101,11 @@ LogEvents := utils.GetEvents("commoncontrols_logs")
########################
#
-# Baseline GWS.COMMONCONTROLS.1.1v0.3
+# Baseline GWS.COMMONCONTROLS.1.1
#--
+CommonControlsId1_1 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.1.1")
+
# For 1.1, we need to assert three different things:
# - MFA is allowed
# - MFA is enforced
@@ -111,6 +114,8 @@ LogEvents := utils.GetEvents("commoncontrols_logs")
# Custom NoSuchEvent function needed as we're checking
# three different settings simultaneously. No such event
# if any are missing
+default NoSuchEvent1_1 := false
+
NoSuchEvent1_1 := true if {
Events := FilterEventsOU("ALLOW_STRONG_AUTHENTICATION", utils.TopLevelOU)
count(Events) == 0
@@ -126,8 +131,6 @@ NoSuchEvent1_1 := true if {
count(Events) == 0
}
-default NoSuchEvent1_1 := false
-
GetFriendlyMethods(Value) := "Any" if {
Value == "ANY"
} else := "Any except verification codes via text, phone call" if {
@@ -141,7 +144,8 @@ GetFriendlyMethods(Value) := "Any" if {
NonCompliantOUs1_1 contains {
"Name": OU,
"Value": "Allow users to turn on 2-Step Verification is OFF"
-} if {
+}
+if {
some OU in utils.OUsWithEvents
Events := FilterEventsOU("ALLOW_STRONG_AUTHENTICATION", OU)
# Ignore OUs without any events. We're already asserting that the
@@ -155,7 +159,8 @@ NonCompliantOUs1_1 contains {
NonCompliantOUs1_1 contains {
"Name": OU,
"Value": "2-Step Verification Enforcement is OFF"
-} if {
+}
+if {
some OU in utils.OUsWithEvents
Events := FilterEventsOU("ENFORCE_STRONG_AUTHENTICATION", OU)
# Ignore OUs without any events. We're already asserting that the
@@ -169,7 +174,8 @@ NonCompliantOUs1_1 contains {
NonCompliantOUs1_1 contains {
"Name": OU,
"Value": concat("", ["Allowed methods is set to ", GetFriendlyMethods(LastEvent.NewValue)])
-} if {
+}
+if {
some OU in utils.OUsWithEvents
Events := FilterEventsOU("CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS", OU)
# Ignore OUs without any events. We're already asserting that the
@@ -184,7 +190,8 @@ NonCompliantOUs1_1 contains {
NonCompliantGroups1_1 contains {
"Name": Group,
"Value": "Allow users to turn on 2-Step Verification is Off"
-} if {
+}
+if {
some Group in utils.GroupsWithEvents
Events := FilterEventsGroup("ALLOW_STRONG_AUTHENTICATION", Group)
# Ignore Groups without any events.
@@ -196,7 +203,8 @@ NonCompliantGroups1_1 contains {
NonCompliantGroups1_1 contains {
"Name": Group,
"Value": "2-Step Verification Enforcement is Off"
-} if {
+}
+if {
some Group in utils.GroupsWithEvents
Events := FilterEventsGroup("ENFORCE_STRONG_AUTHENTICATION", Group)
# Ignore Groups without any events.
@@ -208,7 +216,8 @@ NonCompliantGroups1_1 contains {
NonCompliantGroups1_1 contains {
"Name": Group,
"Value": concat("", ["Allowed methods is set to ", GetFriendlyMethods(LastEvent.NewValue)])
-} if {
+}
+if {
some Group in utils.GroupsWithEvents
Events := FilterEventsGroup("CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS", Group)
# Ignore Groups without any events.
@@ -219,7 +228,7 @@ NonCompliantGroups1_1 contains {
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.1.1v0.3",
+ "PolicyId": CommonControlsId1_1,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -232,7 +241,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.1.1v0.3",
+ "PolicyId": CommonControlsId1_1,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs1_1, NonCompliantGroups1_1),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs1_1, "NonCompliantGroups": NonCompliantGroups1_1},
@@ -247,13 +256,16 @@ if {
#--
#
-# Baseline GWS.COMMONCONTROLS.1.2v0.3
+# Baseline GWS.COMMONCONTROLS.1.2
#--
+CommonControlsId1_2 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.1.2")
+
NonCompliantOUs1_2 contains {
"Name": OU,
"Value": concat("", ["New user enrollment period is set to ", LastEvent.NewValue])
-} if {
+}
+if {
some OU in utils.OUsWithEvents
Events := FilterEventsOU("CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION", OU)
# Ignore OUs without any events. We're already asserting that the
@@ -268,7 +280,8 @@ NonCompliantOUs1_2 contains {
NonCompliantGroups1_2 contains {
"Name": Group,
"Value": concat("", ["New user enrollment period is set to ", LastEvent.NewValue])
-} if {
+}
+if {
some Group in utils.GroupsWithEvents
Events := FilterEventsGroup("CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION", Group)
# Ignore groups without any events.
@@ -279,7 +292,7 @@ NonCompliantGroups1_2 contains {
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.1.2v0.3",
+ "PolicyId": CommonControlsId1_2,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -293,7 +306,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.1.2v0.3",
+ "PolicyId": CommonControlsId1_2,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs1_2, NonCompliantGroups1_2),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs1_2, "NonCompliantGroups": NonCompliantGroups1_2},
@@ -309,9 +322,11 @@ if {
#--
#
-# Baseline GWS.COMMONCONTROLS.1.3v0.3
+# Baseline GWS.COMMONCONTROLS.1.3
#--
+CommonControlsId1_3 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.1.3")
+
GetFriendlyValue1_3(Value) := "ON" if {
Value == "ENABLE_USERS_TO_TRUST_DEVICE"
} else := Value
@@ -319,7 +334,8 @@ GetFriendlyValue1_3(Value) := "ON" if {
NonCompliantOUs1_3 contains {
"Name": OU,
"Value": concat("", ["Allow user to trust the device is ", GetFriendlyValue1_3(LastEvent.NewValue)])
-} if {
+}
+if {
some OU in utils.OUsWithEvents
Events := FilterEventsOU("CHANGE_TWO_STEP_VERIFICATION_FREQUENCY", OU)
# Ignore OUs without any events. We're already asserting that the
@@ -334,7 +350,8 @@ NonCompliantOUs1_3 contains {
NonCompliantGroups1_3 contains {
"Name": Group,
"Value": concat("", ["Allow user to trust the device is ", GetFriendlyValue1_3(LastEvent.NewValue)])
-} if {
+}
+if {
some Group in utils.GroupsWithEvents
Events := FilterEventsGroup("CHANGE_TWO_STEP_VERIFICATION_FREQUENCY", Group)
# Ignore groups without any events.
@@ -345,7 +362,7 @@ NonCompliantGroups1_3 contains {
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.1.3v0.3",
+ "PolicyId": CommonControlsId1_3,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -359,7 +376,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.1.3v0.3",
+ "PolicyId": CommonControlsId1_3,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs1_3, NonCompliantGroups1_3),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs1_3, "NonCompliantGroups": NonCompliantGroups1_3},
@@ -375,13 +392,16 @@ if {
#--
#
-# Baseline GWS.COMMONCONTROLS.1.4v0.3
+# Baseline GWS.COMMONCONTROLS.1.4
#--
+CommonControlsId1_4 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.1.4")
+
NonCompliantOUs1_4 contains {
"Name": OU,
"Value": "Allowed methods is set to Any"
-} if {
+}
+if {
some OU in utils.OUsWithEvents
Events := FilterEventsOU("CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS", OU)
# Ignore OUs without any events. We're already asserting that the
@@ -395,7 +415,8 @@ NonCompliantOUs1_4 contains {
NonCompliantGroups1_4 contains {
"Name": Group,
"Value": "Allowed methods is set to Any"
-} if {
+}
+if {
some Group in utils.GroupsWithEvents
Events := FilterEventsGroup("CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS", Group)
# Ignore groups without any events.
@@ -405,7 +426,7 @@ NonCompliantGroups1_4 contains {
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.1.4v0.3",
+ "PolicyId": CommonControlsId1_4,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -419,7 +440,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.1.4v0.3",
+ "PolicyId": CommonControlsId1_4,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs1_4, NonCompliantGroups1_4),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs1_4, "NonCompliantGroups": NonCompliantGroups1_4},
@@ -437,15 +458,17 @@ if {
########################
#
-# Baseline GWS.COMMONCONTROLS.2.1v0.3
+# Baseline GWS.COMMONCONTROLS.2.1
#--
+CommonControlsId2_1 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.2.1")
+
# This setting isn't controlled at the OU level, and in this case,
# the logs don't even list an OU for the events. So in this case,
# we just need to ensure the last event is compliant, we don't need
# to check each OU.
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.2.1v0.3",
+ "PolicyId": CommonControlsId2_1,
"Criticality": "Should",
"ReportDetails": concat("", [
"No relevant event in the current logs. While we are unable ",
@@ -464,7 +487,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.2.1v0.3",
+ "PolicyId": CommonControlsId2_1,
"Criticality": "Should",
"ReportDetails": utils.ReportDetailsBoolean(Status),
"ActualValue": {"TOGGLE_CAA_ENABLEMENT": LastEvent.NewValue},
@@ -484,17 +507,29 @@ if {
########################
#
-# Baseline GWS.COMMONCONTROLS.3.1v0.3
+# Baseline GWS.COMMONCONTROLS.3.1
#--
+CommonControlsId3_1 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.3.1")
+
+LogMessage3_1 := "SsoPolicyProto challenge_selection_behavior"
+
+Check3_1_OK if {
+ events := utils.FilterEventsOU(LogEvents, LogMessage3_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+NonComplianceMessage3_1 := "Post Single Sign-on (SSO) verification is disabled."
+
# NOTE: this setting cannot be controlled at the group-level,
# so only a check at the OU-level is implemented here.
NonCompliantOUs3_1 contains {
"Name": OU,
- "Value": "Post-SSO verification is disabled"
-} if {
+ "Value": NonComplianceMessage3_1
+}
+if {
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents, "SsoPolicyProto challenge_selection_behavior", OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage3_1, OU)
# Ignore OUs without any events. We're already asserting that the
# top-level OU has at least one event; for all other OUs we assume
# they inherit from a parent OU if they have no events.
@@ -505,7 +540,7 @@ NonCompliantOUs3_1 contains {
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.3.1v0.3",
+ "PolicyId": CommonControlsId3_1,
"Criticality": "Should",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -514,12 +549,11 @@ tests contains {
}
if {
DefaultSafe := false
- Events := utils.FilterEventsOU(LogEvents, "SsoPolicyProto challenge_selection_behavior", utils.TopLevelOU)
- count(Events) == 0
+ not Check3_1_OK
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.3.1v0.3",
+ "PolicyId": CommonControlsId3_1,
"Criticality": "Should",
# Empty list on the next line as this setting can't be set at the group level
"ReportDetails": utils.ReportDetails(NonCompliantOUs3_1, []),
@@ -528,19 +562,21 @@ tests contains {
"NoSuchEvent": false
}
if {
- Events := utils.FilterEventsOU(LogEvents, "SsoPolicyProto challenge_selection_behavior", utils.TopLevelOU)
- count(Events) > 0
+ Check3_1_OK
Status := count(NonCompliantOUs3_1) == 0
}
#--
#
-# Baseline GWS.COMMONCONTROLS.3.2v0.3
+# Baseline GWS.COMMONCONTROLS.3.2
#--
+
+CommonControlsId3_2 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.3.2")
+
# TODO replace the following placeholder with actual implementation
# SsoPolicyProto sso_profile_challenge_selection_behavior appears to the appropriate log event
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.3.2v0.3",
+ "PolicyId": CommonControlsId3_2,
"Criticality": "Should/Not-Implemented",
"ReportDetails": "Currently not able to be tested automatically; please manually check.",
"ActualValue": "",
@@ -554,14 +590,26 @@ tests contains {
########################
#
-# Baseline GWS.COMMONCONTROLS.4.1v0.3
+# Baseline GWS.COMMONCONTROLS.4.1
#--
+CommonControlsId4_1 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.4.1")
+
# NOTE: this setting cannot be controlled at the group-level,
# so only a check at the OU-level is implemented here.
GoodLimits := {"3600", "14400", "28800", "43200"}
+LogMessage4_1 := "Session management settings - Session length in seconds"
+
+Check4_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage4_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check4_1_OK if {PolicyApiInUse}
+
IsGoodLimit(ActualLim) := true if {
count({GoodLim | some GoodLim in GoodLimits; GoodLim == ActualLim}) > 0
}
@@ -570,26 +618,31 @@ IsGoodLimit(ActualLim) := false if {
count({GoodLim | some GoodLim in GoodLimits; GoodLim == ActualLim}) == 0
}
+NonComplianceMessage4_1(Value) := sprintf("Web session duration: %s",
+ [Value])
+
GetFriendlyValue4_1(Value) := "Session never expires" if {
- Value == "63072000"
+ Value == 63072000
} else := "30 days" if {
- Value == "2592000"
+ Value == 2592000
} else := "14 days" if {
- Value == "1209600"
+ Value == 1209600
} else := "7 days" if {
- Value == "604800"
+ Value == 604800
} else := "24 hours" if {
- Value == "86400"
+ Value == 86400
} else := "20 hours" if {
- Value == "72000"
-} else := concat(" ", [Value, "seconds"])
+ Value == 72000
+} else := sprintf("%d seconds", [Value])
NonCompliantOUs4_1 contains {
"Name": OU,
- "Value": concat("", ["Web session duration is set to ", GetFriendlyValue4_1(LastEvent.NewValue)])
-} if {
+ "Value": NonComplianceMessage4_1(GetFriendlyValue4_1(to_number(LastEvent.NewValue)))
+}
+if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents, "Session management settings - Session length in seconds", OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage4_1, OU)
# Ignore OUs without any events. We're already asserting that the
# top-level OU has at least one event; for all other OUs we assume
# they inherit from a parent OU if they have no events.
@@ -599,8 +652,29 @@ NonCompliantOUs4_1 contains {
not IsGoodLimit(LastEvent.NewValue)
}
-tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.4.1v0.3",
+NonCompliantOUs4_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage4_1(GetFriendlyValue4_1(durationSeconds))
+}
+if {
+ multipliers := {"s": 1, "m": 60, "h": 3600}
+ # This is the requirement limit for session duration:
+ webSessionMax := 12 * multipliers["h"]
+ some OU, settings in input.policies
+ duration := settings.security_session_controls.webSessionDuration
+ result := regex.find_all_string_submatch_n(`(?i)^(\d+)([hms])$`,
+ duration,
+ 1)
+ firstMatch := result[0]
+ value := to_number(firstMatch[1])
+ unit := firstMatch[2]
+ multiplier := multipliers[lower(unit)]
+ durationSeconds := value * multiplier
+ durationSeconds > webSessionMax
+}
+
+tests contains {
+ "PolicyId": CommonControlsId4_1,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -608,14 +682,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := false
- SettingName := "Session management settings - Session length in seconds"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) == 0
+ not Check4_1_OK
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.4.1v0.3",
+ "PolicyId": CommonControlsId4_1,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs4_1, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs4_1},
@@ -623,9 +696,7 @@ tests contains {
"NoSuchEvent": false
}
if {
- SettingName := "Session management settings - Session length in seconds"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) > 0
+ Check4_1_OK
Status := count(NonCompliantOUs4_1) == 0
}
#--
@@ -638,15 +709,29 @@ if {
# so only checks at the OU-level are implemented here.
#
-# Baseline GWS.COMMONCONTROLS.5.1v0.3
+# Baseline GWS.COMMONCONTROLS.5.1
#--
+CommonControlsId5_1 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.5.1")
+LogMessage5_1 := "Password Management - Enforce strong password"
+PasswordStrength := "STRONG"
+
+Check5_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage5_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check5_1_OK if {PolicyApiInUse}
+
NonCompliantOUs5_1 contains {
"Name": OU,
"Value": "Enforce strong password is OFF"
-} if {
+}
+if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents, "Password Management - Enforce strong password", OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage5_1, OU)
# Ignore OUs without any events. We're already asserting that the
# top-level OU has at least one event; for all other OUs we assume
# they inherit from a parent OU if they have no events.
@@ -656,8 +741,19 @@ NonCompliantOUs5_1 contains {
LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
}
+NonCompliantOUs5_1 contains {
+ "Name": OU,
+ "Value": sprintf("Password strength is %s, not %s",
+ [CurrentStrength, PasswordStrength])
+}
+if {
+ some OU, settings in input.policies
+ CurrentStrength := upper(settings.security_password.allowedStrength)
+ CurrentStrength != PasswordStrength
+}
+
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.5.1v0.3",
+ "PolicyId": CommonControlsId5_1,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -665,35 +761,55 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := true
- Events := utils.FilterEventsOU(LogEvents, "Password Management - Enforce strong password", utils.TopLevelOU)
- count(Events) == 0
+ not Check5_1_OK
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.5.1v0.3",
+ "PolicyId": CommonControlsId5_1,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs5_1, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs5_1},
"RequirementMet": Status,
"NoSuchEvent": false
-} if {
- Events := utils.FilterEventsOU(LogEvents, "Password Management - Enforce strong password", utils.TopLevelOU)
- count(Events) > 0
+}
+if {
+ Check5_1_OK
Status := count(NonCompliantOUs5_1) == 0
}
#--
#
-# Baseline GWS.COMMONCONTROLS.5.2v0.3
+# Baseline GWS.COMMONCONTROLS.5.2
#--
+CommonControlsId5_2 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.5.2")
+
+LogMessageMinPassword := "Password Management - Minimum password length"
+
+MinimumPasswordLength := 12
+
+Check5_2_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessageMinPassword, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check5_2_OK if {PolicyApiInUse}
+
+FormatMessage5_2 := "Minimum password length: %d, less than %d"
+NonComplianceMessage5_2(Value) := sprintf(FormatMessage5_2,
+ [Value, MinimumPasswordLength])
+
NonCompliantOUs5_2 contains {
"Name": OU,
- "Value": concat("", ["Minimum password length is set to ", LastEvent.NewValue])
-} if {
+ "Value": NonComplianceMessage5_2(Minimum)
+}
+if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents, "Password Management - Minimum password length", OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessageMinPassword, OU)
# Ignore OUs without any events. We're already asserting that the
# top-level OU has at least one event; for all other OUs we assume
# they inherit from a parent OU if they have no events.
@@ -701,11 +817,21 @@ NonCompliantOUs5_2 contains {
LastEvent := utils.GetLastEvent(Events)
LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
Minimum := to_number(LastEvent.NewValue)
- Minimum < 12
+ Minimum < MinimumPasswordLength
+}
+
+NonCompliantOUs5_2 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage5_2(CurrentLength)
+}
+if {
+ some OU, settings in input.policies
+ CurrentLength := settings.security_password.minimumLength
+ CurrentLength < MinimumPasswordLength
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.5.2v0.3",
+ "PolicyId": CommonControlsId5_2,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -713,13 +839,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := false
- Events := utils.FilterEventsOU(LogEvents, "Password Management - Minimum password length", utils.TopLevelOU)
- count(Events) == 0
+ not Check5_2_OK
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.5.2v0.3",
+ "PolicyId": CommonControlsId5_2,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs5_2, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs5_2},
@@ -727,22 +853,39 @@ tests contains {
"NoSuchEvent": false
}
if {
- Events := utils.FilterEventsOU(LogEvents, "Password Management - Minimum password length", utils.TopLevelOU)
- count(Events) > 0
+ Check5_2_OK
Status := count(NonCompliantOUs5_2) == 0
}
#--
#
-# Baseline GWS.COMMONCONTROLS.5.3v0.3
+# Baseline GWS.COMMONCONTROLS.5.3
#--
+CommonControlsId5_3 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.5.3")
+
+SuggestedPasswordLength := 15
+
+Check5_3_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessageMinPassword, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check5_3_OK if {PolicyApiInUse}
+
+FormatMessage5_3 := "Minimum password length: %d, recommended is at least %d"
+NonComplianceMessage5_3(Value) := sprintf(FormatMessage5_3,
+ [Value, SuggestedPasswordLength])
+
NonCompliantOUs5_3 contains {
"Name": OU,
- "Value": concat("", ["Minimum password length is set to ", LastEvent.NewValue])
-} if {
+ "Value": NonComplianceMessage5_3(Minimum)
+}
+if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents, "Password Management - Minimum password length", OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessageMinPassword, OU)
# Ignore OUs without any events. We're already asserting that the
# top-level OU has at least one event; for all other OUs we assume
# they inherit from a parent OU if they have no events.
@@ -750,11 +893,21 @@ NonCompliantOUs5_3 contains {
LastEvent := utils.GetLastEvent(Events)
LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
Minimum := to_number(LastEvent.NewValue)
- Minimum < 15
+ Minimum < SuggestedPasswordLength
+}
+
+NonCompliantOUs5_3 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage5_3(CurrentLength)
+}
+if {
+ some OU, settings in input.policies
+ CurrentLength := settings.security_password.minimumLength
+ CurrentLength < SuggestedPasswordLength
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.5.3v0.3",
+ "PolicyId": CommonControlsId5_3,
"Criticality": "Should",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -762,13 +915,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := false
- Events := utils.FilterEventsOU(LogEvents, "Password Management - Minimum password length", utils.TopLevelOU)
- count(Events) == 0
+ not Check5_3_OK
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.5.3v0.3",
+ "PolicyId": CommonControlsId5_3,
"Criticality": "Should",
"ReportDetails": utils.ReportDetails(NonCompliantOUs5_3, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs5_3},
@@ -776,21 +929,35 @@ tests contains {
"NoSuchEvent": false
}
if {
- Events := utils.FilterEventsOU(LogEvents, "Password Management - Minimum password length", utils.TopLevelOU)
- count(Events) > 0
+ Check5_3_OK
Status := count(NonCompliantOUs5_3) == 0
}
#--
#
-# Baseline GWS.COMMONCONTROLS.5.4v0.3
+# Baseline GWS.COMMONCONTROLS.5.4
#--
+
+CommonControlsId5_4 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.5.4")
+LogMessage5_4 := "Password Management - Enforce password policy at next login"
+NonComplianceMessage5_4 := "Enforce password policy at next sign-in is OFF"
+
+Check5_4_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage5_4, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check5_4_OK if {PolicyApiInUse}
+
NonCompliantOUs5_4 contains {
"Name": OU,
- "Value": "Enforce password policy at next sign-in is OFF"
-} if {
+ "Value": NonComplianceMessage5_4
+}
+if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents, "Password Management - Enforce password policy at next login", OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage5_4, OU)
# Ignore OUs without any events. We're already asserting that the
# top-level OU has at least one event; for all other OUs we assume
# they inherit from a parent OU if they have no events.
@@ -800,8 +967,17 @@ NonCompliantOUs5_4 contains {
LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
}
+NonCompliantOUs5_4 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage5_4
+}
+if {
+ some OU, settings in input.policies
+ settings.security_password.enforceRequirementsAtLogin != true
+}
+
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.5.4v0.3",
+ "PolicyId": CommonControlsId5_4,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -809,14 +985,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := false
- SettingName := "Password Management - Enforce password policy at next login"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) == 0
+ not Check5_4_OK
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.5.4v0.3",
+ "PolicyId": CommonControlsId5_4,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs5_4, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs5_4},
@@ -824,22 +999,35 @@ tests contains {
"NoSuchEvent": false
}
if {
- SettingName := "Password Management - Enforce password policy at next login"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) > 0
+ Check5_4_OK
Status := count(NonCompliantOUs5_4) == 0
}
#--
#
-# Baseline GWS.COMMONCONTROLS.5.5v0.3
+# Baseline GWS.COMMONCONTROLS.5.5
#--
+
+CommonControlsId5_5 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.5.5")
+LogMessage5_5 := "Password Management - Enable password reuse"
+NonComplianceMessage5_5 := "Allow password reuse is ON"
+
+Check5_5_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage5_5, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check5_5_OK if {PolicyApiInUse}
+
NonCompliantOUs5_5 contains {
"Name": OU,
- "Value": "Allow password reuse is ON"
-} if {
+ "Value": NonComplianceMessage5_5
+}
+if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents, "Password Management - Enable password reuse", OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage5_5, OU)
# Ignore OUs without any events. We're already asserting that the
# top-level OU has at least one event; for all other OUs we assume
# they inherit from a parent OU if they have no events.
@@ -849,8 +1037,17 @@ NonCompliantOUs5_5 contains {
LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
}
+NonCompliantOUs5_5 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage5_5
+}
+if {
+ some OU, settings in input.policies
+ settings.security_password.allowReuse == true
+}
+
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.5.5v0.3",
+ "PolicyId": CommonControlsId5_5,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -858,13 +1055,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := true
- Events := utils.FilterEventsOU(LogEvents, "Password Management - Enable password reuse", utils.TopLevelOU)
- count(Events) == 0
+ not Check5_5_OK
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.5.5v0.3",
+ "PolicyId": CommonControlsId5_5,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs5_5, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs5_5},
@@ -872,21 +1069,34 @@ tests contains {
"NoSuchEvent": false
}
if {
- Events := utils.FilterEventsOU(LogEvents, "Password Management - Enable password reuse", utils.TopLevelOU)
- count(Events) > 0
+ Check5_5_OK
Status := count(NonCompliantOUs5_5) == 0
}
#--
#
-# Baseline GWS.COMMONCONTROLS.5.6v0.3
+# Baseline GWS.COMMONCONTROLS.5.6
#--
+
+CommonControlsId5_6 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.5.6")
+LogMessage5_6 := "Password Management - Password reset frequency"
+
+Check5_6_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage5_6, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check5_6_OK if {PolicyApiInUse}
+
NonCompliantOUs5_6 contains {
"Name": OU,
"Value": concat(" ", ["Password reset frequency is", LastEvent.NewValue, "days"])
-} if {
+}
+if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents, "Password Management - Password reset frequency", OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage5_6, OU)
# Ignore OUs without any events. We're already asserting that the
# top-level OU has at least one event; for all other OUs we assume
# they inherit from a parent OU if they have no events.
@@ -896,8 +1106,23 @@ NonCompliantOUs5_6 contains {
LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
}
+NonCompliantOUs5_6 contains {
+ "Name": OU,
+ "Value": sprintf("Password reset frequency is %s", [passwordExpiration])
+}
+if {
+ some OU, settings in input.policies
+ passwordExpiration := settings.security_password.expirationDuration
+ result := regex.find_all_string_submatch_n(`(?i)^(\d+)[hms]$`,
+ passwordExpiration,
+ -1)
+ firstMatch := result[0]
+ expirationValue := to_number(firstMatch[1])
+ expirationValue != 0
+}
+
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.5.6v0.3",
+ "PolicyId": CommonControlsId5_6,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -905,13 +1130,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := true
- Events := utils.FilterEventsOU(LogEvents, "Password Management - Password reset frequency", utils.TopLevelOU)
- count(Events) == 0
+ not Check5_6_OK
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.5.6v0.3",
+ "PolicyId": CommonControlsId5_6,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs5_6, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs5_6},
@@ -919,8 +1144,7 @@ tests contains {
"NoSuchEvent": false
}
if {
- Events := utils.FilterEventsOU(LogEvents, "Password Management - Password reset frequency", utils.TopLevelOU)
- count(Events) > 0
+ Check5_6_OK
Status := count(NonCompliantOUs5_6) == 0
}
#--
@@ -930,10 +1154,13 @@ if {
########################
#
-# Baseline GWS.COMMONCONTROLS.6.1v0.3
+# Baseline GWS.COMMONCONTROLS.6.1
#--
+
+CommonControlsId6_1 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.6.1")
+
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.6.1v0.3",
+ "PolicyId": CommonControlsId6_1,
"Criticality": "Shall/Not-Implemented",
"ReportDetails": "Currently not able to be tested automatically; please manually check.",
"ActualValue": "",
@@ -943,10 +1170,13 @@ tests contains {
#--
#
-# Baseline GWS.COMMONCONTROLS.6.2v0.3
+# Baseline GWS.COMMONCONTROLS.6.2
#--
+
+CommonControlsId6_2 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.6.2")
+
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.6.2v0.3",
+ "PolicyId": CommonControlsId6_2,
"Prerequisites": ["directory/v1/users/list"],
"Criticality": "Shall",
"ReportDetails": concat("", [
@@ -970,10 +1200,13 @@ if {
########################
#
-# Baseline GWS.COMMONCONTROLS.7.1v0.3
+# Baseline GWS.COMMONCONTROLS.7.1
#--
+
+CommonControlsId7_1 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.7.1")
+
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.7.1v0.3",
+ "PolicyId": CommonControlsId7_1,
"Criticality": "Shall/Not-Implemented",
"ReportDetails": "Currently not able to be tested automatically; please manually check.",
"ActualValue": "",
@@ -987,14 +1220,29 @@ tests contains {
########################
#
-# Baseline GWS.COMMONCONTROLS.8.1v0.3
+# Baseline GWS.COMMONCONTROLS.8.1
#--
+
+CommonControlsId8_1 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.8.1")
+LogMessage8_1 := "AdminAccountRecoverySettingsProto Enable admin account recovery"
+NonComplianceMessage8_1 := "Allow super admins to recover their account is ON"
+
+Check8_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage8_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check8_1_OK if {PolicyApiInUse}
+
NonCompliantOUs8_1 contains {
"Name": OU,
- "Value": "Allow super admins to recover their account is ON"
-} if {
+ "Value": NonComplianceMessage8_1
+}
+if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- SettingName := "AdminAccountRecoverySettingsProto Enable admin account recovery"
+ SettingName := LogMessage8_1
Events := utils.FilterEventsOU(LogEvents, SettingName, OU)
# Ignore OUs without any events. We're already asserting that the
# top-level OU has at least one event; for all other OUs we assume
@@ -1007,10 +1255,12 @@ NonCompliantOUs8_1 contains {
NonCompliantGroups8_1 contains {
"Name": Group,
- "Value": "Allow super admins to recover their account is ON"
-} if {
+ "Value": NonComplianceMessage8_1
+}
+if {
+ not PolicyApiInUse
some Group in utils.GroupsWithEvents
- SettingName := "AdminAccountRecoverySettingsProto Enable admin account recovery"
+ SettingName := LogMessage8_1
Events := utils.FilterEventsGroup(LogEvents, SettingName, Group)
# Ignore groups without any events.
count(Events) > 0
@@ -1019,8 +1269,17 @@ NonCompliantGroups8_1 contains {
LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
}
+NonCompliantOUs8_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage8_1
+}
+if {
+ some OU, settings in input.policies
+ settings.security_super_admin_account_recovery.enableAccountRecovery == true
+}
+
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.8.1v0.3",
+ "PolicyId": CommonControlsId8_1,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -1028,23 +1287,21 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := false
- SettingName := "AdminAccountRecoverySettingsProto Enable admin account recovery"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) == 0
+ not Check8_1_OK
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.8.1v0.3",
+ "PolicyId": CommonControlsId8_1,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs8_1, NonCompliantGroups8_1),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs8_1, "NonCompliantGroups": NonCompliantGroups8_1},
"RequirementMet": Status,
"NoSuchEvent": false
-} if {
- SettingName := "AdminAccountRecoverySettingsProto Enable admin account recovery"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) > 0
+}
+if {
+ Check8_1_OK
Conditions := {count(NonCompliantOUs8_1) == 0, count(NonCompliantGroups8_1) == 0}
Status := (false in Conditions) == false
}
@@ -1055,10 +1312,13 @@ tests contains {
########################
#
-# Baseline GWS.COMMONCONTROLS.9.1v0.3
+# Baseline GWS.COMMONCONTROLS.9.1
#--
+
+CommonControlsId9_1 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.9.1")
+
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.9.1v0.3",
+ "PolicyId": CommonControlsId9_1,
"Criticality": "Shall/Not-Implemented",
"ReportDetails": "Currently not able to be tested automatically; please manually check.",
"ActualValue": "",
@@ -1068,10 +1328,13 @@ tests contains {
#--
#
-# Baseline GWS.COMMONCONTROLS.9.2v0.3
+# Baseline GWS.COMMONCONTROLS.9.2
#--
+
+CommonControlsId9_2 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.9.2")
+
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.9.2v0.3",
+ "PolicyId": CommonControlsId9_2,
"Criticality": "Should/Not-Implemented",
"ReportDetails": "Currently not able to be tested automatically; please manually check.",
"ActualValue": "",
@@ -1085,9 +1348,11 @@ tests contains {
#########################
#
-# Baseline GWS.COMMONCONTROLS.10.1v0.3
+# Baseline GWS.COMMONCONTROLS.10.1
#--
+CommonControlsId10_1 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.10.1")
+
# NOTE: App access cannot be controlled at the group/OU level
# Step 1: Get the set of services that have either an API access allow or API access block event
@@ -1155,11 +1420,11 @@ ReportDetails10_1(true) := "Requirement met."
ReportDetails10_1(false) := concat("", [
"The following services allow access: ",
- concat(", ", UnrestrictedServices10_2), "."
+ concat(", ", UnrestrictedServices10_1), "."
])
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.10.1v0.3",
+ "PolicyId": CommonControlsId10_1,
"Criticality": "Shall",
"ReportDetails": concat("", [
"No API Access Allowed/Blocked events in the current logs. ",
@@ -1177,7 +1442,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.10.1v0.3",
+ "PolicyId": CommonControlsId10_1,
"Criticality": "Shall",
"ReportDetails": ReportDetails10_1(Status),
"RequirementMet": Status,
@@ -1195,8 +1460,11 @@ if {
#--
#
-# Baseline GWS.COMMONCONTROLS.10.2v0.3
+# Baseline GWS.COMMONCONTROLS.10.2
#--
+
+CommonControlsId10_2 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.10.2")
+
# Identify services whose most recent event is an allow event
UnrestrictedServices10_2 contains Service if {
# Iterate through all services
@@ -1222,7 +1490,7 @@ ReportDetails10_2(false) := concat("", [
])
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.10.2v0.3",
+ "PolicyId": CommonControlsId10_2,
"Criticality": "SHALL",
"ReportDetails": concat("", [
"No API Access Allowed/Blocked events in the current logs. ",
@@ -1240,7 +1508,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.10.2v0.3",
+ "PolicyId": CommonControlsId10_2,
"Criticality": "Shall",
"ReportDetails": ReportDetails10_2(Status),
"RequirementMet": Status,
@@ -1254,9 +1522,11 @@ if {
#--
#
-# Baseline GWS.COMMONCONTROLS.10.3v0.3
+# Baseline GWS.COMMONCONTROLS.10.3
#--
+CommonControlsId10_3 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.10.3")
+
# NOTE: this setting cannot be set at the group level.
DomainOwnedAppAccessEvents contains {
@@ -1279,7 +1549,8 @@ if {
NonCompliantOUs10_3 contains {
"Name": OU,
"Value": "Trust internal apps is ON"
-} if {
+}
+if {
some OU in utils.OUsWithEvents
Events := {Event | some Event in DomainOwnedAppAccessEvents; Event.OrgUnit == OU}
# Ignore OUs without any events. We're already asserting that the
@@ -1291,7 +1562,7 @@ NonCompliantOUs10_3 contains {
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.10.3v0.3",
+ "PolicyId": CommonControlsId10_3,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -1305,7 +1576,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.10.3v0.3",
+ "PolicyId": CommonControlsId10_3,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs10_3, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs10_3},
@@ -1320,9 +1591,11 @@ if {
#--
#
-# Baseline GWS.COMMONCONTROLS.10.4v0.3
+# Baseline GWS.COMMONCONTROLS.10.4
#--
+CommonControlsId10_4 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.10.4")
+
# NOTE: this setting cannot be set at the group level.
UnconfiguredAppAccessEvents contains {
@@ -1352,7 +1625,8 @@ GetFriendlyValue10_4(Value) := "Allow users to access any third-party apps" if {
NonCompliantOUs10_4 contains {
"Name": OU,
"Value": concat("", ["Unconfigured third-party app access is set to ", GetFriendlyValue10_4(LastEvent.EventName)])
-} if {
+}
+if {
some OU in utils.OUsWithEvents
Events := {Event | some Event in UnconfiguredAppAccessEvents; Event.OrgUnit == OU}
# Ignore OUs without any events. We're already asserting that the
@@ -1364,7 +1638,7 @@ NonCompliantOUs10_4 contains {
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.10.4v0.3",
+ "PolicyId": CommonControlsId10_4,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -1378,7 +1652,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.10.4v0.3",
+ "PolicyId": CommonControlsId10_4,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs10_4, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs10_4},
@@ -1393,14 +1667,31 @@ if {
#--
#
-# Baseline GWS.COMMONCONTROLS.10.5v0.3
+# Baseline GWS.COMMONCONTROLS.10.5
#--
+
+CommonControlsId10_5 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.10.5")
+
+EventName10_5 := "WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED"
+
+Check10_5_OK if {
+ not PolicyApiInUse
+ events := FilterEventsOU(EventName10_5, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check10_5_OK if {PolicyApiInUse}
+
+NonComplianceMessage10_5 := "Users are allowed to manage access to less secure apps."
+
NonCompliantOUs10_5 contains {
"Name": OU,
- "Value": "Allow users to manage their access to less secure apps is ON"
-} if {
+ "Value": NonComplianceMessage10_5
+}
+if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := FilterEventsOU("WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED", OU)
+ Events := FilterEventsOU(EventName10_5, OU)
# Ignore OUs without any events. We're already asserting that the
# top-level OU has at least one event; for all other OUs we assume
# they inherit from a parent OU if they have no events.
@@ -1418,10 +1709,12 @@ NonCompliantOUs10_5 contains {
NonCompliantGroups10_5 contains {
"Name": Group,
- "Value": "Allow users to manage their access to less secure apps is ON"
-} if {
+ "Value": NonComplianceMessage10_5
+}
+if {
+ not PolicyApiInUse
some Group in utils.GroupsWithEvents
- Events := FilterEventsGroup("WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED", Group)
+ Events := FilterEventsGroup(EventName10_5, Group)
# Ignore groups without any events.
count(Events) > 0
LastEvent := utils.GetLastEvent(Events)
@@ -1429,8 +1722,18 @@ NonCompliantGroups10_5 contains {
LastEvent.NewValue != "INHERIT_FROM_PARENT"
}
+NonCompliantOUs10_5 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage10_5
+}
+if {
+ some OU, settings in input.policies
+ lessSecure := settings.security_less_secure_apps.allowLessSecureApps
+ lessSecure != false
+}
+
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.10.5v0.3",
+ "PolicyId": CommonControlsId10_5,
"Criticality": "Should",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -1438,13 +1741,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := true
- Events := FilterEventsOU("WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED", utils.TopLevelOU)
- count(Events) == 0
+ not Check10_5_OK
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.10.5v0.3",
+ "PolicyId": CommonControlsId10_5,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs10_5, NonCompliantGroups10_5),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs10_5, "NonCompliantGroups": NonCompliantGroups10_5},
@@ -1452,8 +1755,7 @@ tests contains {
"NoSuchEvent": false
}
if {
- Events := FilterEventsOU("WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED", utils.TopLevelOU)
- count(Events) > 0
+ Check10_5_OK
Conditions := {count(NonCompliantOUs10_5) == 0, count(NonCompliantGroups10_5) == 0}
Status := (false in Conditions) == false
}
@@ -1464,33 +1766,55 @@ if {
#########################
#
-# Baseline GWS.COMMONCONTROLS.11.1v0.3
+# Baseline GWS.COMMONCONTROLS.11.1
#--
+CommonControlsId11_1 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.11.1")
+
+LogMessage11_1_A := "Apps Access Setting Allowlist access"
+LogMessage11_1_B := "Apps Access Setting allow_all_internal_apps"
+
+NonCompliancePrefix11_1 := "Users can install and run any"
+NonComplianceMessage11_1(anyApp) := sprintf("%s app from the Marketplace.",
+ [NonCompliancePrefix11_1]) if {
+ anyApp
+} else := sprintf("%s internal app, even if it's not allowlisted.",
+ [NonCompliancePrefix11_1])
+
# For 11.1, we need to assert two different things:
# - Users can only allow whitelisted apps
# - Exceptions aren't allowed for internal apps
# Custom NoSuchEvent function needed as we're checking
# two different settings simultaneously.
+
+default NoSuchEvent11_1 := false
+
NoSuchEvent11_1 := true if {
- Events := utils.FilterEventsOU(LogEvents, "Apps Access Setting Allowlist access", utils.TopLevelOU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage11_1_A, utils.TopLevelOU)
count(Events) == 0
}
NoSuchEvent11_1 := true if {
- Events := utils.FilterEventsOU(LogEvents, "Apps Access Setting allow_all_internal_apps", utils.TopLevelOU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage11_1_B, utils.TopLevelOU)
count(Events) == 0
}
-default NoSuchEvent11_1 := false
+Check11_1_OK if {
+ not PolicyApiInUse
+ not NoSuchEvent11_1
+}
+
+Check11_1_OK if {PolicyApiInUse}
NonCompliantOUs11_1 contains {
"Name": OU,
- "Value": "Users can install and run any app from the Marketplace"
-} if {
+ "Value": NonComplianceMessage11_1(true)
+}
+if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents, "Apps Access Setting Allowlist access", OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage11_1_A, OU)
# Ignore OUs without any events. We're already asserting that the
# top-level OU has at least one event; for all other OUs we assume
# they inherit from a parent OU if they have no events.
@@ -1503,10 +1827,12 @@ NonCompliantOUs11_1 contains {
NonCompliantGroups11_1 contains {
"Name": Group,
- "Value": "Users can install and run any app from the Marketplace"
-} if {
+ "Value": NonComplianceMessage11_1(true)
+}
+if {
+ not PolicyApiInUse
some Group in utils.GroupsWithEvents
- Events := utils.FilterEventsGroup(LogEvents, "Apps Access Setting Allowlist access", Group)
+ Events := utils.FilterEventsGroup(LogEvents, LogMessage11_1_A, Group)
# Ignore groups without any events.
count(Events) > 0
LastEvent := utils.GetLastEvent(Events)
@@ -1516,10 +1842,12 @@ NonCompliantGroups11_1 contains {
NonCompliantOUs11_1 contains {
"Name": OU,
- "Value": "Users can install and run any internal app, even if it's not allowlisted"
-} if {
+ "Value": NonComplianceMessage11_1(false)
+}
+if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents, "Apps Access Setting allow_all_internal_apps", OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage11_1_B, OU)
# Ignore OUs without any events. We're already asserting that the
# top-level OU has at least one event; for all other OUs we assume
# they inherit from a parent OU if they have no events.
@@ -1531,10 +1859,12 @@ NonCompliantOUs11_1 contains {
NonCompliantGroups11_1 contains {
"Name": Group,
- "Value": "Users can install and run any internal app, even if it's not allowlisted"
-} if {
+ "Value": NonComplianceMessage11_1(false)
+}
+if {
+ not PolicyApiInUse
some Group in utils.GroupsWithEvents
- Events := utils.FilterEventsGroup(LogEvents, "Apps Access Setting allow_all_internal_apps", Group)
+ Events := utils.FilterEventsGroup(LogEvents, LogMessage11_1_B, Group)
# Ignore groups without any events.
count(Events) > 0
LastEvent := utils.GetLastEvent(Events)
@@ -1542,8 +1872,30 @@ NonCompliantGroups11_1 contains {
LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
}
+NonCompliantOUs11_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage11_1(true)
+}
+if {
+ some OU, settings in input.policies
+ access := settings.workspace_marketplace_apps_access_options.accessLevel
+ not access in {"ALLOW_LISTED_APPS", "ALLOW_NONE"}
+}
+
+NonCompliantOUs11_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage11_1(false)
+}
+if {
+ some OU, settings in input.policies
+ access := settings.workspace_marketplace_apps_access_options.accessLevel
+ allowInternal := settings.workspace_marketplace_apps_access_options.allowAllInternalApps
+ access == "ALLOW_LISTED_APPS"
+ allowInternal != false
+}
+
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.11.1v0.3",
+ "PolicyId": CommonControlsId11_1,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -1551,12 +1903,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := false
- NoSuchEvent11_1 == true
+ not Check11_1_OK
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.11.1v0.3",
+ "PolicyId": CommonControlsId11_1,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs11_1, NonCompliantGroups11_1),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs11_1, "NonCompliantGroups": NonCompliantGroups11_1},
@@ -1564,7 +1917,7 @@ tests contains {
"NoSuchEvent": false
}
if {
- NoSuchEvent11_1 == false
+ Check11_1_OK
Conditions := {count(NonCompliantOUs11_1) == 0, count(NonCompliantGroups11_1) == 0}
Status := (false in Conditions) == false
}
@@ -1574,6 +1927,12 @@ if {
# GWS.COMMONCONTROLS.12 #
#########################
+LogMessage12_1 := "UserTakeoutSettingsProto User Takeout "
+
+Msg12_1 := "The following apps with individual admin control have Takeout enabled: %s"
+NonComplianceMessage12_1(EnabledApps) := sprintf(Msg12_1,
+ [concat(", ", sort(EnabledApps))])
+
#### Part 1: detecting service toggle events for OUs/groups *without* an individual admin control
TakeoutServiceEnableEvents contains {
"Timestamp": time.parse_rfc3339_ns(Item.id.time),
@@ -1583,6 +1942,7 @@ TakeoutServiceEnableEvents contains {
"Group": Group
}
if {
+ not PolicyApiInUse
some Item in input.commoncontrols_logs.items
some Event in Item.events
Event.name == "TOGGLE_SERVICE_ENABLED"
@@ -1598,10 +1958,14 @@ if {
ServiceName == "Google Takeout"
}
+NonComplianceMessage12_1a := "Takeout is enabled for services without an individual admin control."
+
NonCompliantOUs12_1 contains {
"Name": OU,
- "Value": "Takeout is enabled for services without an individual admin control"
-} if {
+ "Value": NonComplianceMessage12_1a
+}
+if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
Events := {
Event | some Event in TakeoutServiceEnableEvents;
@@ -1618,8 +1982,10 @@ NonCompliantOUs12_1 contains {
NonCompliantGroups12_1 contains {
"Name": Group,
- "Value": "Takeout is enabled for services without an individual admin control"
-} if {
+ "Value": NonComplianceMessage12_1a
+}
+if {
+ not PolicyApiInUse
some Group in utils.GroupsWithEvents
Events := {
Event | some Event in TakeoutServiceEnableEvents;
@@ -1636,7 +2002,8 @@ Apps := {"Blogger", "Google Books", "Google Maps", "Google Pay", "Google Photos"
"Google Play Console", "Timeline - Location History", "YouTube"}
AppsAllowingTakoutOU contains App if {
- Events := utils.FilterEventsNoOU(LogEvents, "UserTakeoutSettingsProto User Takeout ")
+ not PolicyApiInUse
+ Events := utils.FilterEventsNoOU(LogEvents, LogMessage12_1)
some App in Apps
Filtered := {Event | some Event in Events; Event.AppName == App; Event.OrgUnit == data.OrgUnit}
# Note the data.OrgUnit. This means this
@@ -1648,7 +2015,8 @@ AppsAllowingTakoutOU contains App if {
}
AppsAllowingTakoutGroup contains App if {
- Events := utils.FilterEventsNoOU(LogEvents, "UserTakeoutSettingsProto User Takeout ")
+ not PolicyApiInUse
+ Events := utils.FilterEventsNoOU(LogEvents, LogMessage12_1)
some App in Apps
Filtered := {Event | some Event in Events; Event.AppName == App; Event.Group == data.Group}
# Note the data.Group. This means this
@@ -1661,13 +2029,12 @@ AppsAllowingTakoutGroup contains App if {
NonCompliantOUs12_1 contains {
"Name": OU,
- "Value": concat("", [
- "The following apps with individual admin control have Takeout enabled: ",
- concat(", ", EnabledApps)
- ])
-} if {
+ "Value": NonComplianceMessage12_1(EnabledApps)
+}
+if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents, "UserTakeoutSettingsProto User Takeout ", OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage12_1, OU)
# Ignore OUs without any events. We're already asserting that the
# top-level OU has at least one event; for all other OUs we assume
# they inherit from a parent OU if they have no events.
@@ -1678,13 +2045,13 @@ NonCompliantOUs12_1 contains {
NonCompliantGroups12_1 contains {
"Name": Group,
- "Value": concat("", [
- "The following apps with individual admin control have Takeout enabled: ",
- concat(", ", EnabledApps)
- ])
-} if {
+ "Value": NonComplianceMessage12_1(EnabledApps)
+
+}
+if {
+ not PolicyApiInUse
some Group in utils.GroupsWithEvents
- Events := utils.FilterEventsGroup(LogEvents, "UserTakeoutSettingsProto User Takeout ", Group)
+ Events := utils.FilterEventsGroup(LogEvents, LogMessage12_1, Group)
# Ignore groups without any events.
count(Events) > 0
EnabledApps := AppsAllowingTakoutGroup with data.Group as Group
@@ -1692,11 +2059,13 @@ NonCompliantGroups12_1 contains {
}
#
-# Baseline GWS.COMMONCONTROLS.12.1v0.3
+# Baseline GWS.COMMONCONTROLS.12.1
#--
+default NoSuchEvent12_1 := false
+
NoSuchEvent12_1 := true if {
- Events := utils.FilterEventsOU(LogEvents, "UserTakeoutSettingsProto User Takeout ", utils.TopLevelOU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage12_1, utils.TopLevelOU)
count(Events) == 0
}
@@ -1705,10 +2074,44 @@ NoSuchEvent12_1 := true if {
count(Events) == 0
}
-default NoSuchEvent12_1 := false
+CommonControlsId12_1 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.12.1")
+
+Check12_1_OK if {
+ not PolicyApiInUse
+ not NoSuchEvent12_1
+}
+
+Check12_1_OK if {PolicyApiInUse}
+
+Takeout := {"blogger": "Blogger",
+ "books": "Google Books",
+ "location_history": "Timeline - Location History",
+ "maps": "Google Maps",
+ "pay": "Google Pay",
+ "photos": "Google Photos",
+ "play": "Google Play",
+ "play_console": "Google Play Console",
+ "youtube": "YouTube"}
+
+NonCompliantOUs12_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage12_1(EnabledApps)
+
+}
+if {
+ some OU, settings in input.policies
+ utils.AppEnabled(input.policies, "takeout", OU)
+ EnabledApps :=[value
+ | some key, value in Takeout
+ section := sprintf("%s_user_takeout", [key])
+ section in object.keys(settings)
+ state := settings[section].takeoutStatus
+ state != "DISABLED"]
+ count(EnabledApps) > 0
+}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.12.1v0.3",
+ "PolicyId": CommonControlsId12_1,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -1716,12 +2119,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := false
- NoSuchEvent12_1 == true
+ not Check12_1_OK
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.12.1v0.3",
+ "PolicyId": CommonControlsId12_1,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs12_1, NonCompliantGroups12_1),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs12_1, "NonCompliantGroups": NonCompliantGroups12_1},
@@ -1729,7 +2133,7 @@ tests contains {
"NoSuchEvent": false
}
if {
- NoSuchEvent12_1 == false
+ Check12_1_OK
Conditions := {count(NonCompliantOUs12_1) == 0, count(NonCompliantGroups12_1) == 0}
Status := (false in Conditions) == false
}
@@ -1740,10 +2144,13 @@ if {
#########################
#
-# Baseline GWS.COMMONCONTROLS.13.1v0.3
+# Baseline GWS.COMMONCONTROLS.13.1
#--
+
+CommonControlsId13_1 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.13.1")
+
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.13.1v0.3",
+ "PolicyId": CommonControlsId13_1,
"Criticality": "Shall/Not-Implemented",
"ReportDetails": concat("", [
"Results for GWS.COMMONCONTROLS.13 are listed in the ",
@@ -1760,10 +2167,13 @@ tests contains {
#########################
#
-# Baseline GWS.COMMONCONTROLS.14.1v0.3
+# Baseline GWS.COMMONCONTROLS.14.1
#--
+
+CommonControlsId14_1 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.14.1")
+
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.14.1v0.3",
+ "PolicyId": CommonControlsId14_1,
"Criticality": "Shall/Not-Implemented",
"ReportDetails": "Currently not able to be tested automatically; please manually check.",
"ActualValue": "",
@@ -1773,10 +2183,13 @@ tests contains {
#--
#
-# Baseline GWS.COMMONCONTROLS.14.2v0.3
+# Baseline GWS.COMMONCONTROLS.14.2
#--
+
+CommonControlsId14_2 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.14.2")
+
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.14.2v0.3",
+ "PolicyId": CommonControlsId14_2,
"Criticality": "Shall/Not-Implemented",
"ReportDetails": "Currently not able to be tested automatically; please manually check.",
"ActualValue": "",
@@ -1790,10 +2203,13 @@ tests contains {
#########################
#
-# Baseline GWS.COMMONCONTROLS.15.1v0.3
+# Baseline GWS.COMMONCONTROLS.15.1
#--
+
+CommonControlsId15_1 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.15.1")
+
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.15.1v0.3",
+ "PolicyId": CommonControlsId15_1,
"Criticality": "Shall/Not-Implemented",
"ReportDetails": "Currently not able to be tested automatically; please manually check.",
"ActualValue": "",
@@ -1802,10 +2218,11 @@ tests contains {
}
#--
-
#
-# Baseline GWS.COMMONCONTROLS.15.2v0.3
+# Baseline GWS.COMMONCONTROLS.15.2
#--
+CommonControlsId15_2 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.15.2")
+
NonCompliantOUs15_2 contains {
"Name": OU,
"Value": "Data processing in the region selected for data at rest is set to OFF"
@@ -1834,7 +2251,7 @@ NonCompliantGroups15_2 contains {
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.15.2v0.3",
+ "PolicyId": CommonControlsId15_2,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -1849,7 +2266,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.15.2v0.3",
+ "PolicyId": CommonControlsId15_2,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs15_2, NonCompliantGroups15_2),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs15_2, "NonCompliantGroups": NonCompliantGroups15_2},
@@ -1870,15 +2287,18 @@ if {
#--
#
-# Baseline GWS.COMMONCONTROLS.15.3v0.3
+# Baseline GWS.COMMONCONTROLS.15.3
#--
+CommonControlsId15_3 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.15.3")
+
# NOTE: This setting cannot be controlled at the group level
NonCompliantOUs15_3 contains {
"Name": OU,
"Value": "Supplemental data storage is set to Russian Federation"
-} if {
+}
+if {
some OU in utils.OUsWithEvents
Events := utils.FilterEventsOU(LogEvents, "CHANGE_DATA_LOCALIZATION_FOR_RUSSIA", OU)
# Ignore OUs without any events. We're already asserting that the
@@ -1890,7 +2310,7 @@ NonCompliantOUs15_3 contains {
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.15.3v0.3",
+ "PolicyId": CommonControlsId15_3,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -1904,7 +2324,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.15.3v0.3",
+ "PolicyId": CommonControlsId15_3,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs15_3, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs15_3},
@@ -1919,15 +2339,18 @@ if {
#--
#
-# Baseline GWS.COMMONCONTROLS.16.1v0.3
+# Baseline GWS.COMMONCONTROLS.16.1
#--
+CommonControlsId16_1 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.16.1")
+
# NOTE: This setting cannot be controlled at the group level
NonCompliantOUs16_1 contains {
"Name": OU,
"Value": "Access to additional services without individual control is turned on"
-} if {
+}
+if {
some OU in utils.OUsWithEvents
# Note that this setting requires the custom ToggleServiceEvents rule.
# Filter based on the service name of the event, otherwise all events are returned.
@@ -1945,7 +2368,7 @@ NonCompliantOUs16_1 contains {
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.16.1v0.3",
+ "PolicyId": CommonControlsId16_1,
"Criticality": "Should",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -1964,7 +2387,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.16.1v0.3",
+ "PolicyId": CommonControlsId16_1,
"Criticality": "Should",
"ReportDetails": utils.ReportDetails(NonCompliantOUs16_1, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs16_1},
@@ -1984,13 +2407,16 @@ if {
#--
#
-# Baseline GWS.COMMONCONTROLS.16.2v0.3
+# Baseline GWS.COMMONCONTROLS.16.2
#--
+CommonControlsId16_2 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.16.2")
+
NonCompliantOUs16_2 contains {
"Name": OU,
"Value": "Service status is ON"
-} if {
+}
+if {
some OU in utils.OUsWithEvents
# Note that this setting requires the custom ToggleServiceEvents rule.
# Filter based on the service name of the event, otherwise all events are returned.
@@ -2013,7 +2439,8 @@ NonCompliantOUs16_2 contains {
NonCompliantGroups16_2 contains {
"Name": Group,
"Value": "Service status is ON"
-} if {
+}
+if {
some Group in utils.GroupsWithEvents
# Note that this setting requires the custom ToggleServiceEvents rule.
Events := {
@@ -2028,7 +2455,7 @@ NonCompliantGroups16_2 contains {
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.16.2v0.3",
+ "PolicyId": CommonControlsId16_2,
"Criticality": "Should",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -2047,13 +2474,14 @@ if {
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.16.2v0.3",
+ "PolicyId": CommonControlsId16_2,
"Criticality": "Should",
"ReportDetails": utils.ReportDetails(NonCompliantOUs16_2, NonCompliantGroups16_2),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs16_2, "NonCompliantGroups": NonCompliantGroups16_2},
"RequirementMet": Status,
"NoSuchEvent": false
-} if {
+}
+if {
# This rule should execute only when log events exist
Events := {
Event | some Event in ToggleServiceEvents;
@@ -2071,15 +2499,18 @@ tests contains {
#--
#
-# Baseline GWS.COMMONCONTROLS.17.1v0.3
+# Baseline GWS.COMMONCONTROLS.17.1
#--
+CommonControlsId17_1 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.17.1")
+
# NOTE: This setting cannot be controlled at the group level
NonCompliantOUs17_1 contains {
"Name": OU,
"Value": "Require multi party approval for sensitive admin actions is DISABLED"
-} if {
+}
+if {
some OU in utils.OUsWithEvents
Events := utils.FilterEventsOU(LogEvents, "Multi Party Approval (MPA) Control Multi Party Approval Control", OU)
# Ignore OUs without any events. We're already asserting that the
@@ -2091,7 +2522,7 @@ NonCompliantOUs17_1 contains {
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.17.1v0.3",
+ "PolicyId": CommonControlsId17_1,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -2106,7 +2537,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.17.1v0.3",
+ "PolicyId": CommonControlsId17_1,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs17_1, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs17_1},
@@ -2128,23 +2559,13 @@ if {
# TODO access actual API capabilities for DLP, the following checks are placeholders.
#
-# Baseline GWS.COMMONCONTROLS.18.1v0.3
-#--
-tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.18.1v0.3",
- "Criticality": "Shall/Not-Implemented",
- "ReportDetails": "Currently not able to be tested automatically; please manually check.",
- "ActualValue": "",
- "RequirementMet": false,
- "NoSuchEvent": true
-}
+# Baseline GWS.COMMONCONTROLS.18.1
#--
-#
-# Baseline GWS.COMMONCONTROLS.18.1v0.3
-#--
+CommonControlsId18_1 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.18.1")
+
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.18.1v0.3",
+ "PolicyId": CommonControlsId18_1,
"Criticality": "Shall/Not-Implemented",
"ReportDetails": "Currently not able to be tested automatically; please manually check.",
"ActualValue": "",
@@ -2154,10 +2575,13 @@ tests contains {
#--
#
-# Baseline GWS.COMMONCONTROLS.18.2v0.3
+# Baseline GWS.COMMONCONTROLS.18.2
#--
+
+CommonControlsId18_2 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.18.2")
+
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.18.2v0.3",
+ "PolicyId": CommonControlsId18_2,
"Criticality": "Shall/Not-Implemented",
"ReportDetails": "Currently not able to be tested automatically; please manually check.",
"ActualValue": "",
@@ -2167,10 +2591,13 @@ tests contains {
#--
#
-# Baseline GWS.COMMONCONTROLS.18.3v0.3
+# Baseline GWS.COMMONCONTROLS.18.3
#--
+
+CommonControlsId18_3 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.18.3")
+
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.18.3v0.3",
+ "PolicyId": CommonControlsId18_3,
"Criticality": "Shall/Not-Implemented",
"ReportDetails": "Currently not able to be tested automatically; please manually check.",
"ActualValue": "",
@@ -2180,14 +2607,17 @@ tests contains {
#--
#
-# Baseline GWS.COMMONCONTROLS.18.4v0.3
+# Baseline GWS.COMMONCONTROLS.18.4
#--
+
+CommonControlsId18_4 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.18.4")
+
tests contains {
- "PolicyId": "GWS.COMMONCONTROLS.18.4v0.3",
+ "PolicyId": CommonControlsId18_4,
"Criticality": "Should/Not-Implemented",
"ReportDetails": "Currently not able to be tested automatically; please manually check.",
"ActualValue": "",
"RequirementMet": false,
"NoSuchEvent": true
}
-#--
\ No newline at end of file
+#--
diff --git a/scubagoggles/rego/Drive.rego b/scubagoggles/rego/Drive.rego
new file mode 100644
index 00000000..0ecf7955
--- /dev/null
+++ b/scubagoggles/rego/Drive.rego
@@ -0,0 +1,1693 @@
+package drive
+
+import future.keywords
+import data.utils
+import data.utils.PolicyApiInUse
+
+LogEvents := utils.GetEvents("drive_logs")
+
+DriveEnabled(orgunit) := utils.AppEnabled(input.policies, "drive_and_docs", orgunit)
+
+###################
+# GWS.DRIVEDOCS.1 #
+###################
+
+#
+# Baseline GWS.DRIVEDOCS.1.1
+#--
+
+DriveId1_1 := utils.PolicyIdWithSuffix("GWS.DRIVEDOCS.1.1")
+
+LogMessage1_1 := "SHARING_OUTSIDE_DOMAIN"
+
+Check1_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage1_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check1_1_OK if {PolicyApiInUse}
+
+GetFriendlyValue1_1(Value) := "with Google accounts in compatible allowlisted domains" if {
+ Value in {"TRUSTED_DOMAINS", "ALLOWLISTED_DOMAINS"}
+} else := "outside of the organization" if {
+ Value in {"SHARING_ALLOWED", "ALLOWED"}
+} else := Value
+
+NonComplianceMessage1_1(value) := sprintf("Files owned by users or shared drives can be shared %s",
+ [value])
+
+NonCompliantOUs1_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage1_1(GetFriendlyValue1_1(LastEvent.NewValue))
+}
+if {
+ not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+ Events := utils.FilterEventsOU(LogEvents, LogMessage1_1, OU)
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ AcceptableValues := {"SHARING_NOT_ALLOWED", "INHERIT_FROM_PARENT",
+ "SHARING_NOT_ALLOWED_BUT_MAY_RECEIVE_FILES"}
+ not LastEvent.NewValue in AcceptableValues
+}
+
+NonCompliantGroups1_1 contains {
+ "Name": Group,
+ "Value": NonComplianceMessage1_1(GetFriendlyValue1_1(LastEvent.NewValue))
+}
+if {
+ not PolicyApiInUse
+ some Group in utils.GroupsWithEvents
+ Events := utils.FilterEventsGroup(LogEvents, LogMessage1_1, Group)
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ AcceptableValues := {"SHARING_NOT_ALLOWED", "INHERIT_FROM_PARENT",
+ "SHARING_NOT_ALLOWED_BUT_MAY_RECEIVE_FILES"}
+ not LastEvent.NewValue in AcceptableValues
+}
+
+# There are subsequent baselines that apply only if external sharing is
+# allowed. For a given OU, sharing is enabled if either it's enabled in
+# the top-level OU or it has been enabled explicitly in the OU. First,
+# we have to determine if the setting is even present in the OU. If it
+# is not present, the top-level OU setting is checked; otherwise the
+# OU setting takes precedence.
+
+ExternalSharingAllowed(OU) := true if {
+ externalSharing := utils.GetApiSettingValue("drive_and_docs_external_sharing",
+ "externalSharingMode",
+ OU)
+ externalSharing != "DISALLOWED"
+}
+
+NonCompliantOUs1_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage1_1(GetFriendlyValue1_1(externalSharing))
+}
+if {
+ some OU, settings in input.policies
+ DriveEnabled(OU)
+ externalSharing := settings.drive_and_docs_external_sharing.externalSharingMode
+ externalSharing != "DISALLOWED"
+}
+
+tests contains {
+ "PolicyId": DriveId1_1,
+ "Criticality": "Should",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event for the top-level OU in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := false
+ not Check1_1_OK
+}
+
+tests contains {
+ "PolicyId": DriveId1_1,
+ "Criticality": "Should",
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs1_1, NonCompliantGroups1_1),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs1_1, "NonCompliantGroups": NonCompliantGroups1_1},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check1_1_OK
+ Conditions := {count(NonCompliantOUs1_1) == 0, count(NonCompliantGroups1_1) == 0 }
+ Status := (false in Conditions) == false
+}
+#--
+
+#
+# Baseline GWS.DRIVEDOCS.1.2
+#--
+
+DriveId1_2 := utils.PolicyIdWithSuffix("GWS.DRIVEDOCS.1.2")
+
+LogMessage1_2 := "SHARING_OUTSIDE_DOMAIN"
+
+Check1_2_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage1_2, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check1_2_OK if {PolicyApiInUse}
+
+EventGetFriendlyValue1_2(Value) := "cannot" if {
+ Value in {"SHARING_NOT_ALLOWED INHERIT_FROM_PARENT", false}
+} else := "can"
+
+EventNonComplianceMessage1_2(value) := sprintf("Users %s receive files outside the domain",
+ [value])
+
+GetSharingValue(ShareSetting) := "allowlisted" if {
+ ShareSetting == "ALLOWLISTED_DOMAINS"
+} else := "any" if {
+ ShareSetting == "ALLOWED"
+} else := "no" if {
+ ShareSetting == "DISALLOWED"
+} else := ShareSetting
+
+NonComplianceMessage1_2(Value) := sprintf("File sharing with %s domains, %s",
+ [Value, "receiving files permitted."])
+
+NonCompliantOUs1_2 contains {
+ "Name": OU,
+ "Value": EventNonComplianceMessage1_2(EventGetFriendlyValue1_2(LastEvent.NewValue))
+}
+if {
+ not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+ Events := utils.FilterEventsOU(LogEvents, LogMessage1_2, OU)
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ AcceptableValues = {"SHARING_NOT_ALLOWED", "INHERIT_FROM_PARENT",
+ "TRUSTED_DOMAINS_ALLOWED", "TRUSTED_DOMAINS_ALLOWED_WITH_WARNING"}
+ not LastEvent.NewValue in AcceptableValues
+}
+
+NonCompliantGroups1_2 contains {
+ "Name": Group,
+ "Value": EventNonComplianceMessage1_2(EventGetFriendlyValue1_2(LastEvent.NewValue))
+}
+if {
+ not PolicyApiInUse
+ some Group in utils.GroupsWithEvents
+ Events := utils.FilterEventsGroup(LogEvents, LogMessage1_2, Group)
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ AcceptableValues = {"SHARING_NOT_ALLOWED", "INHERIT_FROM_PARENT",
+ "TRUSTED_DOMAINS_ALLOWED", "TRUSTED_DOMAINS_ALLOWED_WITH_WARNING"}
+ not LastEvent.NewValue in AcceptableValues
+ }
+
+NonCompliantOUs1_2 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage1_2(GetSharingValue("DISALLOWED"))
+}
+if {
+ some OU, settings in input.policies
+ DriveEnabled(OU)
+ not ExternalSharingAllowed(OU)
+ receiveExternal := settings.drive_and_docs_external_sharing.allowReceivingExternalFiles
+ receiveExternal != false
+}
+
+NonCompliantOUs1_2 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage1_2(GetSharingValue(extShare))
+}
+if {
+ some OU, settings in input.policies
+ DriveEnabled(OU)
+ section := "drive_and_docs_external_sharing"
+ shareSetting := "externalSharingMode"
+ extShare := utils.GetApiSettingValue(section, shareSetting, OU)
+ extShare == "ALLOWLISTED_DOMAINS"
+ extShareSet := utils.ApiSettingExists(section, shareSetting, OU)
+ receiveSetting := "allowReceivingFilesOutsideAllowlistedDomains"
+ receiveExternal := utils.GetApiSettingValue(section, receiveSetting, OU)
+ receiveExternal != false
+ receiveExternalSet := utils.ApiSettingExists(section, receiveSetting, OU)
+ true in {extShareSet, receiveExternalSet}
+}
+
+tests contains {
+ "PolicyId": DriveId1_2,
+ "Criticality": "Should",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event for the top-level OU in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := false
+ not Check1_2_OK
+}
+
+tests contains {
+ "PolicyId": DriveId1_2,
+ "Criticality": "Should",
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs1_2, NonCompliantGroups1_2),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs1_2,
+ "NonCompliantGroups": NonCompliantGroups1_2},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check1_2_OK
+ Conditions := {count(NonCompliantOUs1_2) == 0, count(NonCompliantGroups1_2) == 0 }
+ Status := (false in Conditions) == false
+}
+#--
+
+#
+# Baseline GWS.DRIVEDOCS.1.3
+#--
+
+DriveId1_3 := utils.PolicyIdWithSuffix("GWS.DRIVEDOCS.1.3")
+
+LogMessage1_3 := "SHARING_OUTSIDE_DOMAIN"
+
+Check1_3_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage1_3, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check1_3_OK if {PolicyApiInUse}
+
+AcceptableValues1_3 := {"SHARING_ALLOWED_WITH_WARNING",
+ "SHARING_NOT_ALLOWED",
+ "INHERIT_FROM_PARENT",
+ "SHARING_NOT_ALLOWED_BUT_MAY_RECEIVE_FILES",
+ "TRUSTED_DOMAINS_ALLOWED_WITH_WARNING",
+ "TRUSTED_DOMAINS_ALLOWED_WITH_WARNING_MAY_RECEIVE_FILES_FROM_ANYONE"}
+
+EventGetFriendlyValue1_3(Value) := "enabled" if {
+ Value in AcceptableValues1_3 == true
+} else := "disabled"
+
+EventNonComplianceMessage1_3(value) := sprintf("External Sharing Warning is %s",
+ [value])
+
+NonComplianceMessage1_3(Value) := sprintf("File sharing with %s domains, %s",
+ [Value, "without warnings."])
+
+NonCompliantOUs1_3 contains {
+ "Name": OU,
+ "Value": EventNonComplianceMessage1_3(EventGetFriendlyValue1_3(LastEvent.NewValue))
+}
+if {
+ not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+ Events := utils.FilterEventsOU(LogEvents, LogMessage1_3, OU)
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ not LastEvent.NewValue in AcceptableValues1_3
+}
+
+NonCompliantGroups1_3 contains {
+ "Name": Group,
+ "Value": EventNonComplianceMessage1_3(EventGetFriendlyValue1_3(LastEvent.NewValue))
+}
+if {
+ not PolicyApiInUse
+ some Group in utils.GroupsWithEvents
+ Events := utils.FilterEventsGroup(LogEvents, LogMessage1_3, Group)
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ not LastEvent.NewValue in AcceptableValues1_3
+}
+
+NonCompliantOUs1_3 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage1_3(GetSharingValue(extShare))
+}
+if {
+ some OU, settings in input.policies
+ DriveEnabled(OU)
+ section := "drive_and_docs_external_sharing"
+ shareSetting := "externalSharingMode"
+ extShare := utils.GetApiSettingValue(section, shareSetting, OU)
+ extShare == "ALLOWLISTED_DOMAINS"
+ extShareSet := utils.ApiSettingExists(section, shareSetting, OU)
+ warnSetting := "warnForSharingOutsideAllowlistedDomains"
+ warnShared := utils.GetApiSettingValue(section, warnSetting, OU)
+ warnShared != true
+ warnSharedSet := utils.ApiSettingExists(section, warnSetting, OU)
+ true in {extShareSet, warnSharedSet}
+}
+
+NonCompliantOUs1_3 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage1_3(GetSharingValue(extShare))
+}
+if {
+ some OU, settings in input.policies
+ DriveEnabled(OU)
+ section := "drive_and_docs_external_sharing"
+ shareSetting := "externalSharingMode"
+ extShare := utils.GetApiSettingValue(section, shareSetting, OU)
+ extShare == "ALLOWED"
+ extShareSet := utils.ApiSettingExists(section, shareSetting, OU)
+ warnSetting := "warnForExternalSharing"
+ warnShared := utils.GetApiSettingValue(section, warnSetting, OU)
+ warnShared != true
+ warnSharedSet := utils.ApiSettingExists(section, warnSetting, OU)
+ true in {extShareSet, warnSharedSet}
+}
+
+tests contains {
+ "PolicyId": DriveId1_3,
+ "Criticality": "Shall",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event for the top-level OU in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := true
+ not Check1_3_OK
+}
+
+tests contains {
+ "PolicyId": DriveId1_3,
+ "Criticality": "Shall",
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs1_3, NonCompliantGroups1_3),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs1_3,
+ "NonCompliantGroups": NonCompliantGroups1_3},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check1_3_OK
+ Conditions := {count(NonCompliantOUs1_3) == 0, count(NonCompliantGroups1_3) == 0}
+ Status := (false in Conditions) == false
+}
+
+#--
+
+#
+# Baseline GWS.DRIVEDOCS.1.4
+#--
+
+DriveId1_4 := utils.PolicyIdWithSuffix("GWS.DRIVEDOCS.1.4")
+
+LogMessage1_4_A := "SHARING_INVITES_TO_NON_GOOGLE_ACCOUNTS"
+
+LogMessage1_4_B := "SHARING_OUTSIDE_DOMAIN"
+
+default NoSuchEvent1_4(_) := false
+
+NoSuchEvent1_4(TopLevelOU) := true if {
+ Events_A := utils.FilterEvents(LogEvents, LogMessage1_4_A, TopLevelOU)
+ count(Events_A) == 0
+}
+
+NoSuchEvent1_4(TopLevelOU) := true if {
+ Events_B := utils.FilterEvents(LogEvents, LogMessage1_4_B, TopLevelOU)
+ count(Events_B) == 0
+}
+
+Check1_4_OK if {
+ not PolicyApiInUse
+ not NoSuchEvent1_4(utils.TopLevelOU)
+}
+
+Check1_4_OK if {PolicyApiInUse}
+
+AcceptableValues1_4_A := {"NOT_ALLOWED", "INHERIT_FROM_PARENT", true}
+
+AcceptableValues1_4_B := {"SHARING_NOT_ALLOWED", "INHERIT_FROM_PARENT"}
+
+EventGetFriendlyValue1_4(Value_A, Value_B) := "disabled" if {
+ Value_B in AcceptableValues1_4_B
+} else := "enabled but sharing items to non-google accounts is disabled" if {
+ Value_A in AcceptableValues1_4_A
+} else := "enabled and items can be shared to non-google accounts"
+
+EventNonComplianceMessage1_4(value) := sprintf("External Sharing is %s",
+ [value])
+
+NonComplianceMessage1_4(Value) := sprintf("File sharing with %s domains, %s",
+ [Value, "with non-Google users."])
+
+NonCompliantOUs1_4 contains {
+ "Name": OU,
+ "Value": EventNonComplianceMessage1_4(EventGetFriendlyValue1_4(LastEvent_A.NewValue,
+ LastEvent_B.NewValue))
+}
+if {
+ not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+ Events_A := utils.FilterEventsOU(LogEvents, LogMessage1_4_A, OU)
+ count(Events_A) > 0
+ LastEvent_A := utils.GetLastEvent(Events_A)
+
+ Events_B := utils.FilterEventsOU(LogEvents, LogMessage1_4_B, OU)
+ count(Events_B) > 0
+ LastEvent_B := utils.GetLastEvent(Events_B)
+
+ not LastEvent_A.NewValue in AcceptableValues1_4_A
+ not LastEvent_B.NewValue in AcceptableValues1_4_B
+}
+
+NonCompliantGroups1_4 contains {
+ "Name": Group,
+ "Value": EventNonComplianceMessage1_4(EventGetFriendlyValue1_4(LastEvent_A.NewValue,
+ LastEvent_B.NewValue))
+}
+if {
+ not PolicyApiInUse
+ some Group in utils.GroupsWithEvents
+ Events_A := utils.FilterEventsGroup(LogEvents, LogMessage1_4_A, Group)
+ count(Events_A) > 0
+ LastEvent_A := utils.GetLastEvent(Events_A)
+
+ Events_B := utils.FilterEventsGroup(LogEvents, LogMessage1_4_B, Group)
+ count(Events_B) > 0
+ LastEvent_B := utils.GetLastEvent(Events_B)
+
+ not LastEvent_A.NewValue in AcceptableValues1_4_A
+ not LastEvent_B.NewValue in AcceptableValues1_4_B
+}
+
+NonCompliantOUs1_4 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage1_4(GetSharingValue(extShare))
+}
+if {
+ some OU, settings in input.policies
+ DriveEnabled(OU)
+ section := "drive_and_docs_external_sharing"
+ shareSetting := "externalSharingMode"
+ extShare := utils.GetApiSettingValue(section, shareSetting, OU)
+ extShare == "ALLOWLISTED_DOMAINS"
+ extShareSet := utils.ApiSettingExists(section, shareSetting, OU)
+ nonGoogleSetting := "allowNonGoogleInvitesInAllowlistedDomains"
+ nonGoogle := utils.GetApiSettingValue(section, nonGoogleSetting, OU)
+ nonGoogle != false
+ nonGoogleSet := utils.ApiSettingExists(section, nonGoogleSetting, OU)
+ true in {extShareSet, nonGoogleSet}
+}
+
+NonCompliantOUs1_4 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage1_4(GetSharingValue(extShare))
+}
+if {
+ some OU, settings in input.policies
+ DriveEnabled(OU)
+ section := "drive_and_docs_external_sharing"
+ shareSetting := "externalSharingMode"
+ extShare := utils.GetApiSettingValue(section, shareSetting, OU)
+ extShare == "ALLOWED"
+ extShareSet := utils.ApiSettingExists(section, shareSetting, OU)
+ nonGoogleSetting := "allowNonGoogleInvites"
+ nonGoogle := utils.GetApiSettingValue(section, nonGoogleSetting, OU)
+ nonGoogle != false
+ nonGoogleSet := utils.ApiSettingExists(section, nonGoogleSetting, OU)
+ true in {extShareSet, nonGoogleSet}
+}
+
+tests contains {
+ "PolicyId": DriveId1_4,
+ "Criticality": "Shall",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event for the top-level OU in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := false
+ not Check1_4_OK
+}
+
+tests contains {
+ "PolicyId": DriveId1_4,
+ "Criticality": "Shall",
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs1_4, NonCompliantGroups1_4),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs1_4,
+ "NonCompliantGroups": NonCompliantGroups1_4},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check1_4_OK
+ Conditions := {count(NonCompliantOUs1_4) == 0, count(NonCompliantGroups1_4) == 0}
+ Status := (false in Conditions) == false
+}
+
+#--
+
+#
+# Baseline GWS.DRIVEDOCS.1.5
+#--
+
+DriveId1_5 := utils.PolicyIdWithSuffix("GWS.DRIVEDOCS.1.5")
+
+LogMessage1_5 := "PUBLISHING_TO_WEB"
+
+Check1_5_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage1_5, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check1_5_OK if {PolicyApiInUse}
+
+NonComplianceMessage1_5 := "Published web content can be made visible to anyone with a link"
+
+NonCompliantOUs1_5 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage1_5
+}
+if {
+ not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+ Events := utils.FilterEventsOU(LogEvents, LogMessage1_5, OU)
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ contains("ALLOWED", LastEvent.NewValue) == true
+}
+
+NonCompliantGroups1_5 contains {
+ "Name": Group,
+ "Value": NonComplianceMessage1_5
+}
+if {
+ not PolicyApiInUse
+ some Group in utils.GroupsWithEvents
+ Events := utils.FilterEventsGroup(LogEvents, LogMessage1_5, Group)
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ contains("ALLOWED", LastEvent.NewValue) == true
+}
+
+NonCompliantOUs1_5 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage1_5
+}
+if {
+ some OU, settings in input.policies
+ DriveEnabled(OU)
+ section := "drive_and_docs_external_sharing"
+ shareSetting := "externalSharingMode"
+ extShare := utils.GetApiSettingValue(section, shareSetting, OU)
+ extShare != "DISALLOWED"
+ extShareSet := utils.ApiSettingExists(section, shareSetting, OU)
+ allowPublishSetting := "allowPublishingFiles"
+ allowPublish := utils.GetApiSettingValue(section, allowPublishSetting, OU)
+ allowPublish != false
+ allowPublishSet := utils.ApiSettingExists(section, allowPublishSetting, OU)
+ true in {extShareSet, allowPublishSet}
+}
+
+tests contains {
+ "PolicyId": DriveId1_5,
+ "Criticality": "Shall",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event for the top-level OU in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := false
+ not Check1_5_OK
+}
+
+tests contains {
+ "PolicyId": DriveId1_5,
+ "Criticality": "Shall",
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs1_5, NonCompliantGroups1_5),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs1_5,
+ "NonCompliantGroups": NonCompliantGroups1_5},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check1_5_OK
+ Conditions := {count(NonCompliantOUs1_5) == 0, count(NonCompliantGroups1_5) == 0}
+ Status := (false in Conditions) == false
+}
+#--
+
+#
+# Baseline GWS.DRIVEDOCS.1.6
+#--
+
+DriveId1_6 := utils.PolicyIdWithSuffix("GWS.DRIVEDOCS.1.6")
+
+LogMessage1_6 := "SHARING_ACCESS_CHECKER_OPTIONS"
+
+Check1_6_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage1_6, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check1_6_OK if {PolicyApiInUse}
+
+NonComplianceMessage1_6(value) := sprintf("Access Checker allows users to share files to %s",
+ [value])
+
+GetFriendlyValue1_6(Value) :=
+"recipients only, suggested target audience, or public (no Google account required)" if {
+ Value in {"ALL", "RECIPIENTS_OR_AUDIENCE_OR_PUBLIC"}
+} else := "recipients only, or suggested target audience" if {
+ Value in {"DOMAIN_OR_NAMED_PARTIES", "RECIPIENTS_OR_AUDIENCE"}
+} else := Value
+
+NonCompliantOUs1_6 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage1_6(GetFriendlyValue1_6(LastEvent.NewValue))
+}
+if {
+ not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+ Events := utils.FilterEventsOU(LogEvents, LogMessage1_6, OU)
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ AcceptableValues := {"NAMED_PARTIES_ONLY", "INHERIT_FROM_PARENT"}
+ not LastEvent.NewValue in AcceptableValues
+}
+
+NonCompliantGroups1_6 contains {
+ "Name":Group,
+ "Value": NonComplianceMessage1_6(GetFriendlyValue1_6(LastEvent.NewValue))
+}
+if {
+ not PolicyApiInUse
+ some Group in utils.GroupsWithEvents
+ Events := utils.FilterEventsGroup(LogEvents, LogMessage1_6, Group)
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ AcceptableValues := {"NAMED_PARTIES_ONLY", "INHERIT_FROM_PARENT"}
+ not LastEvent.NewValue in AcceptableValues
+}
+
+NonCompliantOUs1_6 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage1_6(GetFriendlyValue1_6(accessCheck))
+}
+if {
+ some OU, settings in input.policies
+ DriveEnabled(OU)
+ accessCheck := settings.drive_and_docs_external_sharing.accessCheckerSuggestions
+ accessCheck != "RECIPIENTS_ONLY"
+}
+
+tests contains {
+ "PolicyId": DriveId1_6,
+ "Criticality": "Shall",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event for the top-level OU in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := false
+ not Check1_6_OK
+}
+
+tests contains {
+ "PolicyId": DriveId1_6,
+ "Criticality": "Shall",
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs1_6, NonCompliantGroups1_6),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs1_6,
+ "NonCompliantGroups": NonCompliantGroups1_6},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check1_6_OK
+ Conditions := {count(NonCompliantOUs1_6) == 0, count(NonCompliantGroups1_6) == 0}
+ Status := (false in Conditions) == false
+}
+#--
+
+#
+# Baseline GWS.DRIVEDOCS.1.7
+#--
+
+DriveId1_7 := utils.PolicyIdWithSuffix("GWS.DRIVEDOCS.1.7")
+
+LogMessage1_7 := "SHARING_TEAM_DRIVE_CROSS_DOMAIN_OPTIONS"
+
+Check1_7_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage1_7, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check1_7_OK if {PolicyApiInUse}
+
+NonComplianceMessage1_7(value) := sprintf("%s can distribute content outside of the organization",
+ [value])
+
+GetFriendlyValue1_7(Value):= "Setting is compliant." if {
+ Value in {"CROSS_DOMAIN_MOVES_BLOCKED", "NONE"}
+} else := "Only users inside the organization" if {
+ Value in {"CROSS_DOMAIN_FROM_INTERNAL_ONLY", "ELIGIBLE_INTERNAL_USERS"}
+} else := "Anyone" if {
+ Value in {"CROSS_DOMAIN_FROM_INTERNAL_OR_EXTERNAL", "ALL_ELIGIBLE_USERS"}
+} else := Value
+
+NonCompliantOUs1_7 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage1_7(GetFriendlyValue1_7(LastEvent.NewValue))
+}
+if {
+ not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+ Events := utils.FilterEventsOU(LogEvents, LogMessage1_7, OU)
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ SettingValue := "CROSS_DOMAIN_MOVES_BLOCKED INHERIT_FROM_PARENT"
+ contains(SettingValue, LastEvent.NewValue) == false
+}
+
+NonCompliantGroups1_7 contains {
+ "Name": Group,
+ "Value": GetFriendlyValue1_7(LastEvent.NewValue)
+}
+if {
+ not PolicyApiInUse
+ some Group in utils.GroupsWithEvents
+ Events := utils.FilterEventsGroup(LogEvents, LogMessage1_7, Group)
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ SettingValue := "CROSS_DOMAIN_MOVES_BLOCKED INHERIT_FROM_PARENT"
+ contains(SettingValue, LastEvent.NewValue) == false
+}
+
+NonCompliantOUs1_7 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage1_7(GetFriendlyValue1_7(moveContent))
+}
+if {
+ some OU, settings in input.policies
+ DriveEnabled(OU)
+ section := "drive_and_docs_external_sharing"
+ shareSetting := "externalSharingMode"
+ extShare := utils.GetApiSettingValue(section, shareSetting, OU)
+ extShare != "DISALLOWED"
+ extShareSet := utils.ApiSettingExists(section, shareSetting, OU)
+ moveContentSetting := "allowedPartiesForDistributingContent"
+ moveContent := utils.GetApiSettingValue(section, moveContentSetting, OU)
+ moveContent != "NONE"
+ moveContentSet := utils.ApiSettingExists(section, moveContentSetting, OU)
+ true in {extShareSet, moveContentSet}
+}
+
+tests contains {
+ "PolicyId": DriveId1_7,
+ "Criticality": "Shall",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event for the top-level OU in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := false
+ not Check1_7_OK
+}
+
+tests contains {
+ "PolicyId": DriveId1_7,
+ "Criticality": "Shall",
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs1_7, NonCompliantGroups1_7),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs1_7, "NonCompliantGroups": NonCompliantGroups1_7},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check1_7_OK
+ Conditions := {count(NonCompliantOUs1_7) == 0, count(NonCompliantGroups1_7) == 0}
+ Status := (false in Conditions) == false
+}
+#--
+
+#
+# Baseline GWS.DRIVEDOCS.1.8
+#--
+
+DriveId1_8 := utils.PolicyIdWithSuffix("GWS.DRIVEDOCS.1.8")
+
+LogMessage1_8 := "DEFAULT_LINK_SHARING_FOR_NEW_DOCS"
+
+Check1_8_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage1_8, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check1_8_OK if {PolicyApiInUse}
+
+NonComplianceMessage1_8(value) := sprintf("When users create items, the default access is set to: %s",
+ [value])
+
+GetFriendlyValue1_8(Value):= "private to the owner." if {
+ Value in {"PRIVATE", "PRIVATE_TO_OWNER"}
+} else := "the primary target audience can access the item if they have the link" if {
+ Value in {"PEOPLE_WITH_LINK", "PRIMARY_AUDIENCE_WITH_LINK"}
+} else := "the primary target audience can search and find the item." if {
+ Value in {"PUBLIC", "PRIMARY_AUDIENCE_WITH_LINK_OR_SEARCH"}
+} else := Value
+
+NonCompliantOUs1_8 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage1_8(GetFriendlyValue1_8(LastEvent.NewValue))
+}
+if {
+ not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+ Events := utils.FilterEventsOU(LogEvents, LogMessage1_8, OU)
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ LastEvent.NewValue != "PRIVATE"
+ LastEvent.NewValue != "INHERIT_FROM_PARENT"
+}
+
+NonCompliantGroups1_8 contains {
+ "Name": Group,
+ "Value": NonComplianceMessage1_8(GetFriendlyValue1_8(LastEvent.NewValue))
+}
+if {
+ not PolicyApiInUse
+ some Group in utils.GroupsWithEvents
+ Events := utils.FilterEventsGroup(LogEvents, LogMessage1_8, Group)
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ LastEvent.NewValue != "PRIVATE"
+ LastEvent.NewValue != "INHERIT_FROM_PARENT"
+}
+
+NonCompliantOUs1_8 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage1_8(GetFriendlyValue1_8(defaultAccess))
+}
+if {
+ some OU, settings in input.policies
+ DriveEnabled(OU)
+ defaultAccess := settings.drive_and_docs_general_access_default.defaultFileAccess
+ defaultAccess != "PRIVATE_TO_OWNER"
+}
+
+tests contains {
+ "PolicyId": DriveId1_8,
+ "Criticality": "Shall",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event for the top-level OU in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := true
+ not Check1_8_OK
+}
+
+tests contains {
+ "PolicyId": DriveId1_8,
+ "Criticality": "Shall",
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs1_8, NonCompliantGroups1_8),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs1_8, "NonCompliantGroups": NonCompliantGroups1_8},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check1_8_OK
+ Conditions := {count(NonCompliantOUs1_8) == 0, count(NonCompliantGroups1_8) == 0}
+ Status := (false in Conditions) == false
+}
+#--
+
+###################
+# GWS.DRIVEDOCS.2 #
+###################
+
+#
+# Baseline GWS.DRIVEDOCS.2.1
+#--
+
+DriveId2_1 := utils.PolicyIdWithSuffix("GWS.DRIVEDOCS.2.1")
+
+LogMessage2_1 := "Shared Drive Creation new_team_drive_admin_only"
+
+Check2_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage2_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check2_1_OK if {PolicyApiInUse}
+
+NonComplianceMessage2_1 := "Members with manager access can override shared drive settings."
+
+NonCompliantOUs2_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage2_1
+}
+if {
+ not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+ Events := utils.FilterEventsOU(LogEvents, LogMessage2_1, OU)
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ contains("true", LastEvent.NewValue) == false
+ LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
+}
+
+NonCompliantGroups2_1 contains {
+ "Name": Group,
+ "Value": NonComplianceMessage2_1
+}
+if {
+ not PolicyApiInUse
+ some Group in utils.GroupsWithEvents
+ Events := utils.FilterEventsGroup(LogEvents, LogMessage2_1, Group)
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ contains("true", LastEvent.NewValue) == false
+ LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
+}
+
+NonCompliantOUs2_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage2_1
+}
+if {
+ some OU, settings in input.policies
+ DriveEnabled(OU)
+ managerOverride := settings.drive_and_docs_shared_drive_creation.allowManagersToOverrideSettings
+ managerOverride != false
+}
+
+tests contains {
+ "PolicyId": DriveId2_1,
+ "Criticality": "Should",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event for the top-level OU in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := false
+ not Check2_1_OK
+}
+
+tests contains {
+ "PolicyId": DriveId2_1,
+ "Criticality": "Should",
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs2_1, NonCompliantGroups2_1),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs2_1, "NonCompliantGroups": NonCompliantGroups2_1},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check2_1_OK
+ Conditions := {count(NonCompliantOUs2_1) == 0, count(NonCompliantGroups2_1) == 0 }
+ Status := (false in Conditions) == false
+}
+#--
+
+#
+# Baseline GWS.DRIVEDOCS.2.2
+#--
+
+DriveId2_2 := utils.PolicyIdWithSuffix("GWS.DRIVEDOCS.2.2")
+
+LogMessage2_2 := "Shared Drive Creation new_team_drive_restricts_cross_domain_access"
+
+Check2_2_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage2_2, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check2_2_OK if {PolicyApiInUse}
+
+NonComplianceMessage2_2 := "Users outside the organization can access files in shared drives."
+
+NonCompliantOUs2_2 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage2_2
+}
+if {
+ not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+ Events := utils.FilterEventsOU(LogEvents, LogMessage2_2, OU)
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ contains("true", LastEvent.NewValue) == false
+ LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
+}
+
+NonCompliantGroups2_2 contains {
+ "Name": Group,
+ "Value": NonComplianceMessage2_2
+}
+if {
+ not PolicyApiInUse
+ some Group in utils.GroupsWithEvents
+ Events := utils.FilterEventsGroup(LogEvents, LogMessage2_2, Group)
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ contains("true", LastEvent.NewValue) == false
+ LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
+}
+
+NonCompliantOUs2_2 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage2_2
+}
+if {
+ some OU, settings in input.policies
+ DriveEnabled(OU)
+ externalAccess := settings.drive_and_docs_shared_drive_creation.allowExternalUserAccess
+ externalAccess != false
+}
+
+tests contains {
+ "PolicyId": DriveId2_2,
+ "Criticality": "Should",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event for the top-level OU in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := false
+ not Check2_2_OK
+}
+
+tests contains {
+ "PolicyId": DriveId2_2,
+ "Criticality": "Should",
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs2_2, NonCompliantGroups2_2),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs2_2, "NonCompliantGroups": NonCompliantGroups2_2},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check2_2_OK
+ Conditions := {count(NonCompliantOUs2_2) == 0, count(NonCompliantGroups2_2) == 0 }
+ Status := (false in Conditions) == false
+}
+#--
+
+#
+# Baseline GWS.DRIVEDOCS.2.3
+#--
+
+DriveId2_3 := utils.PolicyIdWithSuffix("GWS.DRIVEDOCS.2.3")
+
+LogMessage2_3 := "Shared Drive Creation new_team_drive_restricts_direct_access"
+
+Check2_3_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage2_3, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check2_3_OK if {PolicyApiInUse}
+
+NonComplianceMessage2_3 := "Users who aren't shared drive members are not allowed to be added to files."
+
+NonCompliantOUs2_3 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage2_3
+}
+if {
+ not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+ Events := utils.FilterEventsOU(LogEvents, LogMessage2_3, OU)
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ contains("true", LastEvent.NewValue) == false
+ LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
+}
+NonCompliantGroups2_3 contains {
+ "Name": Group,
+ "Value": NonComplianceMessage2_3
+}
+if {
+ not PolicyApiInUse
+ some Group in utils.GroupsWithEvents
+ Events := utils.FilterEventsGroup(LogEvents, LogMessage2_3, Group)
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ contains("true", LastEvent.NewValue) == false
+ LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
+}
+
+NonCompliantOUs2_3 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage2_3
+}
+if {
+ some OU, settings in input.policies
+ DriveEnabled(OU)
+ nonMemberAccess := settings.drive_and_docs_shared_drive_creation.allowNonMemberAccess
+ nonMemberAccess != true
+}
+
+tests contains {
+ "PolicyId": DriveId2_3,
+ "Criticality": "Shall",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event for the top-level OU in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := true
+ not Check2_3_OK
+}
+
+tests contains {
+ "PolicyId": DriveId2_3,
+ "Criticality": "Shall",
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs2_3, NonCompliantGroups2_3),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs2_3,
+ "NonCompliantGroups": NonCompliantGroups2_3},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check2_3_OK
+ Conditions := {count(NonCompliantOUs2_3) == 0, count(NonCompliantGroups2_3) == 0 }
+ Status := (false in Conditions) == false
+}
+#--
+
+#
+# Baseline GWS.DRIVEDOCS.2.4
+#--
+
+DriveId2_4 := utils.PolicyIdWithSuffix("GWS.DRIVEDOCS.2.4")
+
+LogMessage2_4 := "Shared Drive Creation new_team_drive_restricts_download"
+
+Check2_4_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage2_4, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check2_4_OK if {PolicyApiInUse}
+
+NonComplianceMessage2_4 := "Viewers and commenters are allowed to download, print, and copy files."
+
+NonCompliantOUs2_4 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage2_4
+}
+if {
+ not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+ Events := utils.FilterEventsOU(LogEvents, LogMessage2_4, OU)
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ contains("false", LastEvent.NewValue) == true
+ LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
+}
+
+NonCompliantGroups2_4 contains {
+ "Name": Group,
+ "Value": NonComplianceMessage2_4
+}
+if {
+ not PolicyApiInUse
+ some Group in utils.GroupsWithEvents
+ Events := utils.FilterEventsGroup(LogEvents, LogMessage2_4, Group)
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ contains("false", LastEvent.NewValue) == true
+ LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
+}
+
+NonCompliantOUs2_4 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage2_4
+}
+if {
+ some OU, settings in input.policies
+ DriveEnabled(OU)
+ allowPrint := settings.drive_and_docs_shared_drive_creation.allowedPartiesForDownloadPrintCopy
+ allowPrint != "EDITORS_ONLY"
+}
+
+tests contains {
+ "PolicyId": DriveId2_4,
+ "Criticality": "Shall",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event for the top-level OU in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := true
+ not Check2_4_OK
+}
+
+tests contains {
+ "PolicyId": DriveId2_4,
+ "Criticality": "Shall",
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs2_4, NonCompliantGroups2_4),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs2_4,
+ "NonCompliantGroups": NonCompliantGroups2_4},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check2_4_OK
+ Conditions := {count(NonCompliantOUs2_4) == 0, count(NonCompliantGroups2_4) == 0 }
+ Status := (false in Conditions) == false
+}
+#--
+
+###################
+# GWS.DRIVEDOCS.3 #
+###################
+
+#
+# Baseline GWS.DRIVEDOCS.3.1
+#--
+
+DriveId3_1 := utils.PolicyIdWithSuffix("GWS.DRIVEDOCS.3.1")
+
+LogMessage3_1a := "Link Security Update Settings allow_less_secure_link_user_restore"
+LogMessage3_1b := "Link Security Update Settings less_secure_link_option"
+
+default NoSuchEvent3_1(_) := false
+
+NoSuchEvent3_1(TopLevelOU) := true if {
+ Events_A := utils.FilterEventsOU(LogEvents, LogMessage3_1a, TopLevelOU)
+ count(Events_A) == 0
+}
+
+NoSuchEvent3_1(TopLevelOU) := true if {
+ Events := utils.FilterEventsOU(LogEvents, LogMessage3_1b, TopLevelOU)
+ count(Events) == 0
+}
+
+Check3_1_OK if {
+ not PolicyApiInUse
+ not NoSuchEvent3_1(utils.TopLevelOU)
+}
+
+Check3_1_OK if {PolicyApiInUse}
+
+NonComplianceMessage3_1(securityUpdate, userUpdate) := "The security update is removed from all impacted files." if {
+ securityUpdate in {"REQUIRE_LESS_SECURE_LINKS", "REMOVE_FROM_IMPACTED_FILES"}
+}
+else := "Users are allowed to remove/apply the security update for files they own or manage." if {
+ userUpdate in {"true", true}
+}
+
+NonCompliantOUs3_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage3_1(LastEvent_B.NewValue, LastEvent_A.NewValue)
+}
+if {
+ not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+ Events_A := utils.FilterEventsOU(LogEvents, LogMessage3_1a, OU)
+ count(Events_A) > 0
+ LastEvent_A := utils.GetLastEvent(Events_A)
+
+ Events_B := utils.FilterEventsOU(LogEvents, LogMessage3_1b, OU)
+ count(Events_B) > 0
+ LastEvent_B := utils.GetLastEvent(Events_B)
+
+ true in {
+ LastEvent_A.NewValue != "false",
+ LastEvent_B.NewValue != "REMOVE_LESS_SECURE_LINKS"
+ }
+}
+
+NonCompliantOUs3_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage3_1(securityUpdate, userUpdate)
+}
+if {
+ some OU, settings in input.policies
+ DriveEnabled(OU)
+ userUpdate := settings.drive_and_docs_file_security_update.allowUsersToManageUpdate
+ securityUpdate := settings.drive_and_docs_file_security_update.securityUpdate
+
+ true in {
+ userUpdate != false,
+ securityUpdate != "APPLY_TO_IMPACTED_FILES"
+ }
+}
+
+tests contains {
+ "PolicyId": DriveId3_1,
+ "Criticality": "Shall",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event for the top-level OU in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := true
+ not Check3_1_OK
+}
+
+tests contains {
+ "PolicyId": DriveId3_1,
+ "Criticality": "Shall",
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs3_1, []),
+ "ActualValue" : {"NonCompliantOUs": NonCompliantOUs3_1},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check3_1_OK
+ Status := count(NonCompliantOUs3_1) == 0
+}
+#--
+
+###################
+# GWS.DRIVEDOCS.4 #
+###################
+
+#
+# Baseline GWS.DRIVEDOCS.4.1
+#--
+
+DriveId4_1 := utils.PolicyIdWithSuffix("GWS.DRIVEDOCS.4.1")
+
+LogMessage4_1 := "ENABLE_DRIVE_APPS"
+
+Check4_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage4_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check4_1_OK if {PolicyApiInUse}
+
+NonComplianceMessage4_1 := "Drive SDK is enabled."
+
+NonCompliantOUs4_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage4_1
+}
+if {
+ not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+ Events := utils.FilterEventsOU(LogEvents, LogMessage4_1, OU)
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ LastEvent.NewValue != "false"
+ LastEvent.NewValue != "INHERIT_FROM_PARENT"
+}
+NonCompliantGroups4_1 contains {
+ "Name": Group,
+ "Value": NonComplianceMessage4_1
+}
+if {
+ not PolicyApiInUse
+ some Group in utils.GroupsWithEvents
+ Events := utils.FilterEventsGroup(LogEvents, LogMessage4_1, Group)
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ LastEvent.NewValue != "false"
+ LastEvent.NewValue != "INHERIT_FROM_PARENT"
+}
+
+NonCompliantOUs4_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage4_1
+}
+if {
+ some OU, settings in input.policies
+ DriveEnabled(OU)
+ sdkAccess := settings.drive_and_docs_drive_sdk.enableDriveSdkApiAccess
+ sdkAccess != false
+}
+
+tests contains {
+ "PolicyId": DriveId4_1,
+ "Criticality": "Should",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event for the top-level OU in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := false
+ not Check4_1_OK
+}
+
+tests contains {
+ "PolicyId": DriveId4_1,
+ "Criticality": "Should",
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs4_1, NonCompliantGroups4_1),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs4_1, "NonCompliantGroups": NonCompliantGroups4_1},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check4_1_OK
+ Conditions := {count(NonCompliantOUs4_1) == 0, count(NonCompliantGroups4_1) == 0}
+ Status := (false in Conditions) == false
+}
+
+#--
+
+###################
+# GWS.DRIVEDOCS.5 #
+###################
+
+#
+# Baseline GWS.DRIVEDOCS.5.1
+#--
+
+DriveId5_1 := utils.PolicyIdWithSuffix("GWS.DRIVEDOCS.5.1")
+
+LogMessage5_1 := "ENABLE_DOCS_ADD_ONS"
+
+Check5_1_OK if {
+ # not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage5_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+# Check5_1_OK if {PolicyApiInUse}
+
+NonComplianceMessage5_1 := "Users can install Google Docs add-ons from add-ons store."
+
+NonCompliantOUs5_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage5_1
+}
+if {
+ # not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+ Events := utils.FilterEventsOU(LogEvents, LogMessage5_1, OU)
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ LastEvent.NewValue != "false"
+ LastEvent.NewValue != "INHERIT_FROM_PARENT"
+}
+
+NonCompliantGroups5_1 contains {
+ "Name": Group,
+ "Value": NonComplianceMessage5_1
+}
+if {
+ # not PolicyApiInUse
+ some Group in utils.GroupsWithEvents
+ Events := utils.FilterEventsGroup(LogEvents, LogMessage5_1, Group)
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ LastEvent.NewValue != "false"
+ LastEvent.NewValue != "INHERIT_FROM_PARENT"
+}
+
+# NOT yet implemented in policy API
+#NonCompliantOUs5_1 contains {
+# "Name": OU,
+# "Value": NonComplianceMessage5_1
+#}
+#if {
+# some OU, settings in input.policies
+# DriveEnabled(OU)
+# addOns := settings.drive_and_docs_drive_sdk.enableDriveSdkApiAccess
+# addOns != false
+#}
+
+tests contains {
+ "PolicyId": DriveId5_1,
+ "Criticality": "Shall",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event for the top-level OU in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ # not PolicyApiInUse
+ DefaultSafe := false
+ not Check5_1_OK
+}
+
+tests contains {
+ "PolicyId": DriveId5_1,
+ "Criticality": "Shall",
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs5_1, NonCompliantGroups5_1),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs5_1,
+ "NonCompliantGroups": NonCompliantGroups5_1},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check5_1_OK
+ Conditions := {count(NonCompliantOUs5_1) == 0, count(NonCompliantGroups5_1) == 0}
+ Status := (false in Conditions) == false
+}
+#--
+
+###################
+# GWS.DRIVEDOCS.6 #
+###################
+
+#
+# Baseline GWS.DRIVEDOCS.6.1
+#--
+
+DriveId6_1 := utils.PolicyIdWithSuffix("GWS.DRIVEDOCS.6.1")
+
+LogMessage6_1 := "ENABLE_DOCS_ADD_ONS"
+
+LogMessage6_1a := "DriveFsSettingsProto drive_fs_enabled"
+LogMessage6_1b := "DriveFsSettingsProto company_owned_only_enabled"
+
+default NoSuchEvent6_1(_) := true
+
+NoSuchEvent6_1(TopLevelOU) := false if {
+ Events := utils.FilterEventsOU(LogEvents, LogMessage6_1a, TopLevelOU)
+ count(Events) != 0
+}
+
+NoSuchEvent6_1(TopLevelOU) := false if {
+ Events := utils.FilterEventsOU(LogEvents, LogMessage6_1b, TopLevelOU)
+ count(Events) != 0
+}
+
+Check6_1_OK if {
+ not PolicyApiInUse
+ not NoSuchEvent6_1(utils.TopLevelOU)
+}
+
+Check6_1_OK if {PolicyApiInUse}
+
+NonComplianceMessage6_1(Value) := sprintf("Drive for Desktop is %s.", [Value])
+
+GetFriendlyValue6_1(CompanyOnly, DesktopEnabled) := "enabled and can be used on any device" if {
+ CompanyOnly in {"false", false}
+ DesktopEnabled in {"true", true}
+ }
+ else := "disabled" if {
+ DesktopEnabled in {"false", false}
+ }
+ else := "enabled but only on approved devices" if {
+ CompanyOnly in {"true", true}
+ DesktopEnabled in {"true", true}
+ }
+
+NonCompliantOUs6_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage6_1(GetFriendlyValue6_1(LastCompanyOnlyEvent.NewValue,
+ LastDriveEnabledEvent.NewValue))
+}
+if {
+ not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+
+ DriveEnabledEvents := utils.FilterEventsOU(LogEvents, LogMessage6_1a, OU)
+ count(DriveEnabledEvents) > 0
+ LastDriveEnabledEvent := utils.GetLastEvent(DriveEnabledEvents)
+ LastDriveEnabledEvent.NewValue != "DELETE_APPLICATION_SETTING"
+
+ CompanyOnlyEvents := utils.FilterEventsOU(LogEvents, LogMessage6_1b, OU)
+ count(CompanyOnlyEvents) > 0
+ LastCompanyOnlyEvent := utils.GetLastEvent(CompanyOnlyEvents)
+ LastCompanyOnlyEvent.NewValue != "DELETE_APPLICATION_SETTING"
+
+ LastDriveEnabledEvent.NewValue == "true"
+ LastCompanyOnlyEvent.NewValue != "true"
+ }
+
+NonCompliantGroups6_1 contains {
+ "Name": Group,
+ "Value": NonComplianceMessage6_1(GetFriendlyValue6_1(LastCompanyOnlyEvent.NewValue,
+ LastDriveEnabledEvent.NewValue))
+}
+if {
+ not PolicyApiInUse
+ some Group in utils.GroupsWithEvents
+
+ DriveEnabledEvents := utils.FilterEventsGroup(LogEvents, LogMessage6_1a, Group)
+ count(DriveEnabledEvents) > 0
+ LastDriveEnabledEvent := utils.GetLastEvent(DriveEnabledEvents)
+ LastDriveEnabledEvent.NewValue != "DELETE_APPLICATION_SETTING"
+
+ CompanyOnlyEvents := utils.FilterEventsGroup(LogEvents, LogMessage6_1b, Group)
+ count(CompanyOnlyEvents) > 0
+ LastCompanyOnlyEvent := utils.GetLastEvent(CompanyOnlyEvents)
+ LastCompanyOnlyEvent.NewValue != "DELETE_APPLICATION_SETTING"
+
+ LastDriveEnabledEvent.NewValue == "true"
+ LastCompanyOnlyEvent.NewValue != "true"
+ }
+
+NonCompliantOUs6_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage6_1(GetFriendlyValue6_1(allowAuthorized,
+ desktopEnabled))
+}
+if {
+ some OU, settings in input.policies
+ DriveEnabled(OU)
+ section := "drive_and_docs_drive_for_desktop"
+ desktopSetting := "allowDriveForDesktop"
+ desktopEnabled := utils.GetApiSettingValue(section, desktopSetting, OU)
+ desktopEnabled
+ desktopSet := utils.ApiSettingExists(section, desktopSetting, OU)
+ authDevicesSetting := "restrictToAuthorizedDevices"
+ allowAuthorized := utils.GetApiSettingValue(section, authDevicesSetting, OU)
+ not allowAuthorized
+ authDevicesSet := utils.ApiSettingExists(section, authDevicesSetting, OU)
+ true in {desktopSet, authDevicesSet}
+}
+
+tests contains {
+ "PolicyId": DriveId6_1,
+ "Criticality": "Should",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event for the top-level OU in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := false
+ not Check6_1_OK
+}
+
+tests contains {
+ "PolicyId": DriveId6_1,
+ "Criticality": "Should",
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs6_1, NonCompliantGroups6_1),
+ "ActualValue" : {"NonCompliantOUs": NonCompliantOUs6_1, "NonCompliantGroups": NonCompliantGroups6_1},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check6_1_OK
+ Conditions := {count(NonCompliantOUs6_1) == 0, count(NonCompliantGroups6_1) == 0}
+ Status := (false in Conditions) == false
+}
+#--
diff --git a/rego/Gmail.rego b/scubagoggles/rego/Gmail.rego
similarity index 62%
rename from rego/Gmail.rego
rename to scubagoggles/rego/Gmail.rego
index 8b63cb02..77307f25 100644
--- a/rego/Gmail.rego
+++ b/scubagoggles/rego/Gmail.rego
@@ -1,7 +1,11 @@
package gmail
-import data.utils
import future.keywords
+import data.utils
+import data.utils.GetFriendlyEnabledValue
+import data.utils.PolicyApiInUse
+
+GmailEnabled(orgunit) := utils.AppEnabled(input.policies, "gmail", orgunit)
Format(Array) := format_int(count(Array), 10)
@@ -28,21 +32,18 @@ LogEvents := utils.GetEvents("gmail_logs")
###############
#
-# Baseline GWS.GMAIL.1.1v0.3
+# Baseline GWS.GMAIL.1.1
#--
+GmailId1_1 := utils.PolicyIdWithSuffix("GWS.GMAIL.1.1")
+
# Cannot be controlled at group level
-GetFriendlyValue1_1(Value) := "enabled" if {
- Value == "true"
-} else := "disabled" if {
- Value == "false"
-} else := Value
NonCompliantOUs1_1 contains {
"Name": OU,
"Value": concat(" ", [
"Mail delegation is set to",
- GetFriendlyValue1_1(LastEvent.NewValue)
+ GetFriendlyEnabledValue(LastEvent.NewValue)
])
}
if {
@@ -54,7 +55,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.GMAIL.1.1v0.3",
+ "PolicyId": GmailId1_1,
"Criticality": "Should",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event in the current logs",
@@ -68,7 +69,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.GMAIL.1.1v0.3",
+ "PolicyId": GmailId1_1,
"Criticality": "Should",
"ReportDetails": utils.ReportDetails(NonCompliantOUs1_1, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs1_1},
@@ -87,9 +88,11 @@ if {
###############
#
-# Baseline GWS.GMAIL.2.1v0.3
+# Baseline GWS.GMAIL.2.1
#--
+GmailId2_1 := utils.PolicyIdWithSuffix("GWS.GMAIL.2.1")
+
# Not applicable at OU or Group level
DomainsWithDkim contains DkimRecord.domain if {
some DkimRecord in input.dkim_records
@@ -98,7 +101,7 @@ DomainsWithDkim contains DkimRecord.domain if {
}
tests contains {
- "PolicyId": "GWS.GMAIL.2.1v0.3",
+ "PolicyId": GmailId2_1,
"Prerequisites": ["directory/v1/domains/list", "get_dkim_records"],
"Criticality": "Should",
"ReportDetails": ReportDetailsArray(Status, DomainsWithoutDkim, AllDomains),
@@ -118,9 +121,11 @@ if {
###############
#
-# Baseline GWS.GMAIL.3.1v0.3
+# Baseline GWS.GMAIL.3.1
#--
+GmailId3_1 := utils.PolicyIdWithSuffix("GWS.GMAIL.3.1")
+
# Not applicable at OU or Group level
DomainsWithSpf contains SpfRecord.domain if {
some SpfRecord in input.spf_records
@@ -134,7 +139,7 @@ DomainsWithSpf contains SpfRecord.domain if {
}
tests contains {
- "PolicyId": "GWS.GMAIL.3.1v0.3",
+ "PolicyId": GmailId3_1,
"Prerequisites": ["directory/v1/domains/list", "get_spf_records"],
"Criticality": "Shall",
"ReportDetails": ReportDetailsArray(Status, DomainsWithoutSpf, AllDomains),
@@ -154,9 +159,11 @@ if {
###############
#
-# Baseline GWS.GMAIL.4.1v0.3
+# Baseline GWS.GMAIL.4.1
#--
+GmailId4_1 := utils.PolicyIdWithSuffix("GWS.GMAIL.4.1")
+
# Not applicable at OU or Group level
DomainsWithDmarc contains DmarcRecord.domain if {
some DmarcRecord in input.dmarc_records
@@ -165,7 +172,7 @@ DomainsWithDmarc contains DmarcRecord.domain if {
}
tests contains {
- "PolicyId": "GWS.GMAIL.4.1v0.3",
+ "PolicyId": GmailId4_1,
"Prerequisites": ["directory/v1/domains/list", "get_dmarc_records"],
"Criticality": "Shall",
"ReportDetails": ReportDetailsArray(Status, DomainsWithoutDmarc, AllDomains),
@@ -180,9 +187,11 @@ if {
#--
#
-# Baseline GWS.GMAIL.4.2v0.3
+# Baseline GWS.GMAIL.4.2
#--
+GmailId4_2 := utils.PolicyIdWithSuffix("GWS.GMAIL.4.2")
+
# Not applicable at OU or Group level
DomainsWithPreject contains DmarcRecord.domain if {
some DmarcRecord in input.dmarc_records
@@ -191,7 +200,7 @@ DomainsWithPreject contains DmarcRecord.domain if {
}
tests contains {
- "PolicyId": "GWS.GMAIL.4.2v0.3",
+ "PolicyId": GmailId4_2,
"Prerequisites": ["directory/v1/domains/list", "get_dmarc_records"],
"Criticality": "Shall",
"ReportDetails": ReportDetailsArray(Status, DomainsWithoutPreject, AllDomains),
@@ -206,9 +215,11 @@ if {
#--
#
-# Baseline GWS.GMAIL.4.3v0.3
+# Baseline GWS.GMAIL.4.3
#--
+GmailId4_3 := utils.PolicyIdWithSuffix("GWS.GMAIL.4.3")
+
# Not applicable at OU or Group level
DomainsWithDHSContact contains DmarcRecord.domain if {
some DmarcRecord in input.dmarc_records
@@ -217,7 +228,7 @@ DomainsWithDHSContact contains DmarcRecord.domain if {
}
tests contains {
- "PolicyId": "GWS.GMAIL.4.3v0.3",
+ "PolicyId": GmailId4_3,
"Prerequisites": ["directory/v1/domains/list", "get_dmarc_records"],
"Criticality": "Shall",
"ReportDetails": ReportDetailsArray(Status, DomainsWithoutDHSContact, AllDomains),
@@ -232,9 +243,11 @@ if {
#--
#
-# Baseline GWS.GMAIL.4.4v0.3
+# Baseline GWS.GMAIL.4.4
#--
+GmailId4_4 := utils.PolicyIdWithSuffix("GWS.GMAIL.4.4")
+
# Not applicable at OU or Group level
DomainsWithAgencyContact contains DmarcRecord.domain if {
some DmarcRecord in input.dmarc_records
@@ -243,7 +256,7 @@ DomainsWithAgencyContact contains DmarcRecord.domain if {
}
tests contains {
- "PolicyId": "GWS.GMAIL.4.4v0.3",
+ "PolicyId": GmailId4_4,
"Prerequisites": ["directory/v1/domains/list", "get_dmarc_records"],
"Criticality": "Should",
"ReportDetails": ReportDetailsArray(Status, DomainsWithoutAgencyContact, AllDomains),
@@ -263,25 +276,35 @@ if {
###############
#
-# Baseline GWS.GMAIL.5.1v0.3
+# Baseline GWS.GMAIL.5.1
#--
# Cannot be controlled at group level
-GetFriendlyValue5_1(Value) := "enabled" if {
- Value == "true"
-} else := "disabled" if {
- Value == "false"
-} else := Value
+GmailId5_1 := utils.PolicyIdWithSuffix("GWS.GMAIL.5.1")
+
+LogMessage5_1 := "Attachment safety Enable: protect against encrypted attachments from untrusted senders"
+
+Check5_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage5_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check5_1_OK if {PolicyApiInUse}
+
+# The following prefix applies to the next 2 baselines and is used to keep
+# string length from getting too long.
+ProtectionEncryptAttPrefix := "Protection against encrypted attachments"
+NonComplianceMessage5_1(value) := sprintf("%s from untrusted senders is set to: %s",
+ [ProtectionEncryptAttPrefix, value])
NonCompliantOUs5_1 contains {
"Name": OU,
- "Value": concat(" ", [
- "Protection against encrypted attachments from untrusted senders is set to",
- GetFriendlyValue5_1(LastEvent.NewValue)
- ])
+ "Value": NonComplianceMessage5_1(GetFriendlyEnabledValue(LastEvent.NewValue))
}
if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
Events := utils.FilterEventsOU(LogEvents,
concat("", ["Attachment safety Enable: ",
@@ -292,22 +315,31 @@ if {
LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
}
+NonCompliantOUs5_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage5_1(GetFriendlyEnabledValue(noEncrypt))
+} if {
+ some OU, settings in input.policies
+ GmailEnabled(OU)
+ noEncrypt := settings.gmail_email_attachment_safety.enableEncryptedAttachmentProtection
+ noEncrypt != true
+}
+
tests contains {
- "PolicyId": "GWS.GMAIL.5.1v0.3",
+ "PolicyId": GmailId5_1,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event in the current logs",
"RequirementMet": DefaultSafe,
"NoSuchEvent": true
} if {
+ not PolicyApiInUse
DefaultSafe := true
- SettingName := "Attachment safety Enable: protect against encrypted attachments from untrusted senders"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) == 0
+ not Check5_1_OK
}
tests contains {
- "PolicyId": "GWS.GMAIL.5.1v0.3",
+ "PolicyId": GmailId5_1,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs5_1, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs5_1},
@@ -315,32 +347,37 @@ tests contains {
"NoSuchEvent": false
}
if {
- SettingName := "Attachment safety Enable: protect against encrypted attachments from untrusted senders"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) > 0
+ Check5_1_OK
Status := count(NonCompliantOUs5_1) == 0
}
#
-# Baseline GWS.GMAIL.5.2v0.3
+# Baseline GWS.GMAIL.5.2
#--
-GetFriendlyValue5_2(Value) := "enabled" if {
- Value == "true"
-} else := "disabled" if {
- Value == "false"
-} else := Value
+GmailId5_2 := utils.PolicyIdWithSuffix("GWS.GMAIL.5.2")
+
+LogMessage5_2 := "Attachment safety Enable: protect against attachments with scripts from untrusted senders"
+
+Check5_2_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage5_2, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check5_2_OK if {PolicyApiInUse}
+
+NonComplianceMessage5_2(value) := sprintf("%s with scripts from untrusted senders is set to: %s",
+ [ProtectionEncryptAttPrefix, value])
NonCompliantOUs5_2 contains {
"Name": OU,
- "Value": concat(" ", [
- "Protection against encrypted attachments with scripts from untrusted senders is set to",
- GetFriendlyValue5_2(LastEvent.NewValue)
- ])
+ "Value": NonComplianceMessage5_2(GetFriendlyEnabledValue(LastEvent.NewValue))
}
if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents,
+ Events := utils.FilterEventsOU(LogEvents,
concat("", ["Attachment safety Enable: ",
"protect against attachments with scripts from untrusted senders"]), OU)
count(Events) > 0
@@ -349,8 +386,18 @@ if {
LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
}
+NonCompliantOUs5_2 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage5_2(GetFriendlyEnabledValue(noEncrypt))
+} if {
+ some OU, settings in input.policies
+ GmailEnabled(OU)
+ noEncrypt := settings.gmail_email_attachment_safety.enableAttachmentWithScriptsProtection
+ noEncrypt != true
+}
+
tests contains {
- "PolicyId": "GWS.GMAIL.5.2v0.3",
+ "PolicyId": GmailId5_2,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event in the current logs",
@@ -358,14 +405,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := true
- SettingName := "Attachment safety Enable: protect against attachments with scripts from untrusted senders"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) == 0
+ not Check5_2_OK
}
tests contains {
- "PolicyId": "GWS.GMAIL.5.2v0.3",
+ "PolicyId": GmailId5_2,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs5_2, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs5_2},
@@ -373,32 +419,37 @@ tests contains {
"NoSuchEvent": false
}
if {
- SettingName := "Attachment safety Enable: protect against attachments with scripts from untrusted senders"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) > 0
+ Check5_2_OK
Status := count(NonCompliantOUs5_2) == 0
}
#--
#
-# Baseline GWS.GMAIL.5.3v0.3
+# Baseline GWS.GMAIL.5.3
#--
-GetFriendlyValue5_3(Value) := "enabled" if {
- Value == "true"
-} else := "disabled" if {
- Value == "false"
-} else := Value
+GmailId5_3 := utils.PolicyIdWithSuffix("GWS.GMAIL.5.3")
+
+LogMessage5_3 := "Attachment safety Enable: Protect against anomalous attachment types in emails"
+
+Check5_3_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage5_3, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check5_3_OK if {PolicyApiInUse}
+
+NonComplianceMessage5_3(value) := sprintf("Protection against anomalous attachment types in emails is set to: %s",
+ [value])
NonCompliantOUs5_3 contains {
"Name": OU,
- "Value": concat(" ", [
- "Protection against anomalous attachment types in emails is set to",
- GetFriendlyValue5_3(LastEvent.NewValue)
- ])
+ "Value": NonComplianceMessage5_3(GetFriendlyEnabledValue(LastEvent.NewValue))
}
if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
Events := utils.FilterEventsOU(LogEvents,
concat("", ["Attachment safety Enable: Protect against anomalous attachment types in emails"]), OU)
@@ -408,8 +459,18 @@ if {
LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
}
+NonCompliantOUs5_3 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage5_3(GetFriendlyEnabledValue(protectAtt))
+} if {
+ some OU, settings in input.policies
+ GmailEnabled(OU)
+ protectAtt := settings.gmail_email_attachment_safety.enableAnomalousAttachmentProtection
+ protectAtt != true
+}
+
tests contains {
- "PolicyId": "GWS.GMAIL.5.3v0.3",
+ "PolicyId": GmailId5_3,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event in the current logs",
@@ -417,14 +478,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := false
- SettingName := "Attachment safety Enable: Protect against anomalous attachment types in emails"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) == 0
+ not Check5_3_OK
}
tests contains {
- "PolicyId": "GWS.GMAIL.5.3v0.3",
+ "PolicyId": GmailId5_3,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs5_3, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs5_3},
@@ -432,31 +492,36 @@ tests contains {
"NoSuchEvent": false
}
if {
- SettingName := "Attachment safety Enable: Protect against anomalous attachment types in emails"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) > 0
+ Check5_3_OK
Status := count(NonCompliantOUs5_3) == 0
}
#--
#
-# Baseline GWS.GMAIL.5.4v0.3
+# Baseline GWS.GMAIL.5.4
#--
-GetFriendlyValue5_4(Value) := "enabled" if {
- Value == "true"
-} else := "disabled" if {
- Value == "false"
-} else := Value
+GmailId5_4 := utils.PolicyIdWithSuffix("GWS.GMAIL.5.4")
+
+LogMessage5_4 := "Attachment safety Enable: automatically enables all future added settings"
+
+Check5_4_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage5_4, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check5_4_OK if {PolicyApiInUse}
+
+NonComplianceMessage5_4(value) := sprintf("Automatically enables all future added settings is set to: %s",
+ [value])
NonCompliantOUs5_4 contains {
"Name": OU,
- "Value": concat(" ", [
- "Automatically enables all future added settings is set to",
- GetFriendlyValue5_4(LastEvent.NewValue)
- ])
+ "Value": NonComplianceMessage5_4(GetFriendlyEnabledValue(LastEvent.NewValue))
}
if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
Events := utils.FilterEventsOU(LogEvents, concat("", ["Attachment safety Enable: ",
"automatically enables all future added settings"]), OU)
@@ -466,8 +531,18 @@ if {
LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
}
+NonCompliantOUs5_4 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage5_4(GetFriendlyEnabledValue(futureAtt))
+} if {
+ some OU, settings in input.policies
+ GmailEnabled(OU)
+ futureAtt := settings.gmail_email_attachment_safety.applyFutureRecommendedSettingsAutomatically
+ futureAtt != true
+}
+
tests contains {
- "PolicyId": "GWS.GMAIL.5.4v0.3",
+ "PolicyId": GmailId5_4,
"Criticality": "Should",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event in the current logs",
@@ -475,14 +550,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := true
- SettingName := "Attachment safety Enable: automatically enables all future added settings"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) == 0
+ not Check5_4_OK
}
tests contains {
- "PolicyId": "GWS.GMAIL.5.4v0.3",
+ "PolicyId": GmailId5_4,
"Criticality": "Should",
"ReportDetails": utils.ReportDetails(NonCompliantOUs5_4, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs5_4},
@@ -490,19 +564,25 @@ tests contains {
"NoSuchEvent": false
}
if {
- SettingName := "Attachment safety Enable: automatically enables all future added settings"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) > 0
+ Check5_4_OK
Status := count(NonCompliantOUs5_4) == 0
}
#--
#
-# Baseline GWS.GMAIL.5.5v0.3
+# Baseline GWS.GMAIL.5.5
#--
+GmailId5_5 := utils.PolicyIdWithSuffix("GWS.GMAIL.5.5")
+
+NonComplianceMessage5_5(types) := sprintf("%s attachment emails not removed from inbox",
+ [concat(", ", sort(types))])
+
default NoSuchEvent5_5 := false
-NoSuchEvent5_5 := true if {
+
+NoSuchEvent5_5 := false if {
+ PolicyApiInUse
+} else := true if {
SettingName := "Attachment safety Encrypted attachment protection setting action"
Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
count(Events) == 0
@@ -527,7 +607,7 @@ AttachmentWithScriptsMessage(NewValueAttachmentWithScripts)
else := ""
AnomalousAttachmentMessage(NewValueAnomalousAttachment)
- := "Emails with anamolous attachements"
+ := "Emails with anomalous attachments"
if { NewValueAnomalousAttachment == "Show warning" }
else := ""
@@ -568,6 +648,7 @@ NonCompliantOUs5_5 contains {
LastEventAttachmentWithScripts.NewValue,
LastEventAnomalousAttachment.NewValue)
} if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
EncryptedAttachmentEvents := utils.FilterEventsOU(LogEvents,
"Attachment safety Encrypted attachment protection setting action", OU)
@@ -592,8 +673,31 @@ NonCompliantOUs5_5 contains {
]
}
+AttachConfigs := [
+ {"type": "anomalous type",
+ "setting": "anomalousAttachmentProtectionConsequence"},
+ {"type": "encrypted",
+ "setting": "encryptedAttachmentProtectionConsequence"},
+ {"type": "scripts",
+ "setting": "attachmentWithScriptsProtectionConsequence"}
+]
+
+NonCompliantOUs5_5 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage5_5(types)
+} if {
+ some OU, settings in input.policies
+ GmailEnabled(OU)
+ types := [config.type |
+ some config in AttachConfigs
+ consequence = settings.gmail_email_attachment_safety[config.setting]
+ not consequence in ["SPAM_FOLDER", "QUARANTINE"]
+ ]
+ count(types) > 0
+}
+
tests contains {
- "PolicyId": "GWS.GMAIL.5.5v0.3",
+ "PolicyId": GmailId5_5,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -601,12 +705,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := false
NoSuchEvent5_5
}
tests contains {
- "PolicyId": "GWS.GMAIL.5.5v0.3",
+ "PolicyId": GmailId5_5,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs5_5, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs5_5},
@@ -620,11 +725,14 @@ if {
#--
#
-# Baseline GWS.GMAIL.5.6v0.3
+# Baseline GWS.GMAIL.5.6
#--
# No implementation steps provided for this policy
+
+GmailId5_6 := utils.PolicyIdWithSuffix("GWS.GMAIL.5.6")
+
tests contains {
- "PolicyId": "GWS.GMAIL.5.6v0.3",
+ "PolicyId": GmailId5_6,
"Criticality": "Should/Not-Implemented",
"ReportDetails": "Currently not able to be tested automatically; please check manually.",
"ActualValue": "",
@@ -640,34 +748,49 @@ tests contains {
# Cannot be controlled at Group level
#
-# Baseline GWS.GMAIL.6.1v0.3
+# Baseline GWS.GMAIL.6.1
#--
-GetFriendlyValue6_1(Value) := "enabled" if {
- Value == "true"
-} else := "disabled" if {
- Value == "false"
-} else := Value
+GmailId6_1 := utils.PolicyIdWithSuffix("GWS.GMAIL.6.1")
+
+LogMessage6_1 := "Links and external images safety Enable: identify links behind shortened URLs"
+
+Check6_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage6_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check6_1_OK if {PolicyApiInUse}
+
+NonComplianceMessage6_1(value) := sprintf("Identify links behind shortened URLs is: %s",
+ [value])
NonCompliantOUs6_1 contains {
"Name": OU,
- "Value": concat(" ", [
- "Identify links behind shortened URLs is",
- GetFriendlyValue6_1(LastEvent.NewValue)
- ])
-}
-if {
+ "Value": NonComplianceMessage6_1(GetFriendlyEnabledValue(LastEvent.NewValue))
+} if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents,
- concat("", ["Links and external images safety Enable: identify links behind shortened URLs"]), OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage6_1, OU)
count(Events) > 0
LastEvent := utils.GetLastEvent(Events)
LastEvent.NewValue == "false"
LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
}
+NonCompliantOUs6_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage6_1(GetFriendlyEnabledValue(shortLinks))
+} if {
+ some OU, settings in input.policies
+ GmailEnabled(OU)
+ shortLinks := settings.gmail_links_and_external_images.enableShortenerScanning
+ shortLinks != true
+}
+
tests contains {
- "PolicyId": "GWS.GMAIL.6.1v0.3",
+ "PolicyId": GmailId6_1,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -675,14 +798,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := true
- SettingName := "Links and external images safety Enable: identify links behind shortened URLs"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) == 0
+ not Check6_1_OK
}
tests contains {
- "PolicyId": "GWS.GMAIL.6.1v0.3",
+ "PolicyId": GmailId6_1,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs6_1, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs6_1},
@@ -690,41 +812,56 @@ tests contains {
"NoSuchEvent": false
}
if {
- SettingName := "Links and external images safety Enable: identify links behind shortened URLs"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) > 0
+ Check6_1_OK
Status := count(NonCompliantOUs6_1) == 0
}
#--
#
-# Baseline GWS.GMAIL.6.2v0.3
+# Baseline GWS.GMAIL.6.2
#--
-GetFriendlyValue6_2(Value) := "enabled" if {
- Value == "true"
-} else := "disabled" if {
- Value == "false"
-} else := Value
+GmailId6_2 := utils.PolicyIdWithSuffix("GWS.GMAIL.6.2")
+
+LogMessage6_2 := "Links and external images safety Enable: scan linked images"
+
+Check6_2_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage6_2, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check6_2_OK if {PolicyApiInUse}
+
+NonComplianceMessage6_2(value) := sprintf("Scan linked images is: %s",
+ [value])
NonCompliantOUs6_2 contains {
"Name": OU,
- "Value": concat(" ", [
- "Scan linked images is",
- GetFriendlyValue6_2(LastEvent.NewValue)
- ])
+ "Value": NonComplianceMessage6_2(GetFriendlyEnabledValue(LastEvent.NewValue))
}
if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents, "Links and external images safety Enable: scan linked images", OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage6_2, OU)
count(Events) > 0
LastEvent := utils.GetLastEvent(Events)
LastEvent.NewValue == "false"
LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
}
+NonCompliantOUs6_2 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage6_2(GetFriendlyEnabledValue(scanImages))
+} if {
+ some OU, settings in input.policies
+ GmailEnabled(OU)
+ scanImages := settings.gmail_links_and_external_images.enableExternalImageScanning
+ scanImages != true
+}
+
tests contains {
- "PolicyId": "GWS.GMAIL.6.2v0.3",
+ "PolicyId": GmailId6_2,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -732,14 +869,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := true
- SettingName := "Links and external images safety Enable: scan linked images"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) == 0
+ not Check6_2_OK
}
tests contains {
- "PolicyId": "GWS.GMAIL.6.2v0.3",
+ "PolicyId": GmailId6_2,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs6_2, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs6_2},
@@ -747,42 +883,59 @@ tests contains {
"NoSuchEvent": false
}
if {
- SettingName := "Links and external images safety Enable: scan linked images"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) > 0
+ Check6_2_OK
Status := count(NonCompliantOUs6_2) == 0
}
#--
#
-# Baseline GWS.GMAIL.6.3v0.3
+# Baseline GWS.GMAIL.6.3
#--
-GetFriendlyValue6_3(Value) := "enabled" if {
- Value == "true"
-} else := "disabled" if {
- Value == "false"
-} else := Value
+GmailId6_3 := utils.PolicyIdWithSuffix("GWS.GMAIL.6.3")
+
+# NOTE: "unstrusted" really is the spelling the API uses:
+LogMessage6_3 := sprintf("%s %s %s", ["Links and external images safety Enable:",
+ "show warning prompt for click on links",
+ "to unstrusted domains"])
+
+Check6_3_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage6_3, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check6_3_OK if {PolicyApiInUse}
+
+NonComplianceMessage6_3(value) := sprintf("Show warning prompt for click on links to untrusted domains is: %s",
+ [value])
NonCompliantOUs6_3 contains {
"Name": OU,
- "Value": concat(" ", [
- "Show warning prompt for click on links to untrusted domains is",
- GetFriendlyValue6_3(LastEvent.NewValue)
- ])
+ "Value": NonComplianceMessage6_3(GetFriendlyEnabledValue(LastEvent.NewValue))
}
if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents, concat("", ["Links and external images safety Enable: ",
- "show warning prompt for click on links to unstrusted domains"]), OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage6_3, OU)
count(Events) > 0
LastEvent := utils.GetLastEvent(Events)
LastEvent.NewValue == "false"
LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
}
+NonCompliantOUs6_3 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage6_3(GetFriendlyEnabledValue(warnEnabled))
+} if {
+ some OU, settings in input.policies
+ GmailEnabled(OU)
+ warnEnabled := settings.gmail_links_and_external_images.enableAggressiveWarningsOnUntrustedLinks
+ warnEnabled != true
+}
+
tests contains {
- "PolicyId": "GWS.GMAIL.6.3v0.3",
+ "PolicyId": GmailId6_3,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -790,17 +943,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := true
- SettingName := concat("", [
- "Links and external images safety Enable: show warning prompt for click on links to ",
- "unstrusted domains" # NOTE: "unstrusted" really is the spelling the API uses
- ])
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) == 0
+ not Check6_3_OK
}
tests contains {
- "PolicyId": "GWS.GMAIL.6.3v0.3",
+ "PolicyId": GmailId6_3,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs6_3, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs6_3},
@@ -808,46 +957,58 @@ tests contains {
"NoSuchEvent": false
}
if {
- SettingName := concat("", [
- "Links and external images safety Enable: show warning prompt for click on links to ",
- "unstrusted domains" # NOTE: "unstrusted" really is the spelling the API uses
- ])
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) > 0
+ Check6_3_OK
Status := count(NonCompliantOUs6_3) == 0
}
#--
#
-# Baseline GWS.GMAIL.6.4v0.3
+# Baseline GWS.GMAIL.6.4
#--
-GetFriendlyValue6_4(Value) := "enabled" if {
- Value == "true"
-} else := "disabled" if {
- Value == "false"
-} else := Value
+GmailId6_4 := utils.PolicyIdWithSuffix("GWS.GMAIL.6.4")
+
+LogMessage6_4 := sprintf("%s %s %s", ["Links and external images safety Enable:",
+ "automatically enables all future",
+ "added settings"])
+
+Check6_4_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage6_4, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check6_4_OK if {PolicyApiInUse}
+
+NonComplianceMessage6_4(value) := sprintf("Apply future recommended settings automatically is: %s",
+ [value])
NonCompliantOUs6_4 contains {
"Name": OU,
- "Value": concat(" ", [
- "Apply future recommended settings automatically is",
- GetFriendlyValue6_4(LastEvent.NewValue)
- ])
+ "Value": NonComplianceMessage6_4(GetFriendlyEnabledValue(LastEvent.NewValue))
}
if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents,
- concat("", ["Links and external images safety Enable: ",
- "automatically enables all future added settings"]), OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage6_4, OU)
count(Events) > 0
LastEvent := utils.GetLastEvent(Events)
LastEvent.NewValue == "false"
LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
}
+NonCompliantOUs6_4 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage6_4(GetFriendlyEnabledValue(applyFuture))
+} if {
+ some OU, settings in input.policies
+ GmailEnabled(OU)
+ applyFuture := settings.gmail_links_and_external_images.applyFutureSettingsAutomatically
+ applyFuture != true
+}
+
tests contains {
- "PolicyId": "GWS.GMAIL.6.4v0.3",
+ "PolicyId": GmailId6_4,
"Criticality": "Should",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event in the current logs",
@@ -855,14 +1016,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := true
- SettingName := "Links and external images safety Enable: automatically enables all future added settings"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) == 0
+ not Check6_4_OK
}
tests contains {
- "PolicyId": "GWS.GMAIL.6.4v0.3",
+ "PolicyId": GmailId6_4,
"Criticality": "Should",
"ReportDetails": utils.ReportDetails(NonCompliantOUs6_4, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs6_4},
@@ -870,19 +1030,20 @@ tests contains {
"NoSuchEvent": false
}
if {
- SettingName := "Links and external images safety Enable: automatically enables all future added settings"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) > 0
+ Check6_4_OK
Status := count(NonCompliantOUs6_4) == 0
}
#--
#
-# Baseline GWS.GMAIL.6.5v0.3
+# Baseline GWS.GMAIL.6.5
#--
+
+GmailId6_5 := utils.PolicyIdWithSuffix("GWS.GMAIL.6.5")
+
# No implementation steps provided for this policy
tests contains {
- "PolicyId": "GWS.GMAIL.6.5v0.3",
+ "PolicyId": GmailId6_5,
"Criticality": "Should/Not-Implemented",
"ReportDetails": "Currently not able to be tested automatically; please manually check.",
"ActualValue": "",
@@ -895,38 +1056,54 @@ tests contains {
###############
#
-# Baseline GWS.GMAIL.7.1v0.3
+# Baseline GWS.GMAIL.7.1
#--
# No group level control
-GetFriendlyValue7_1(Value) := "enabled" if {
- Value == "true"
-} else := "disabled" if {
- Value == "false"
-} else := Value
+GmailId7_1 := utils.PolicyIdWithSuffix("GWS.GMAIL.7.1")
+
+LogMessage7_1 := sprintf("%s %s %s", ["Spoofing and authentication safety",
+ "Enable: protect against domain spoofing",
+ "using similar domain names"])
+
+Check7_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage7_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check7_1_OK if {PolicyApiInUse}
+
+NonComplianceMessage7_1(value) := sprintf("Protect against domain spoofing using similar domain names is set to: %s",
+ [value])
NonCompliantOUs7_1 contains {
"Name": OU,
- "Value": concat(" ", [
- "Protect against domain spoofing using similar domain names is set to",
- GetFriendlyValue7_1(LastEvent.NewValue)
- ])
+ "Value": NonComplianceMessage7_1(GetFriendlyEnabledValue(LastEvent.NewValue))
}
if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents, concat("", [
- "Spoofing and authentication safety Enable: protect against domain spoofing using ",
- "similar domain names"
- ]), OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage7_1, OU)
count(Events) > 0
LastEvent := utils.GetLastEvent(Events)
LastEvent.NewValue == "false"
LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
}
+NonCompliantOUs7_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage7_1(GetFriendlyEnabledValue(spoofProtect))
+} if {
+ some OU, settings in input.policies
+ GmailEnabled(OU)
+ spoofProtect := settings.gmail_spoofing_and_authentication.detectDomainNameSpoofing
+ spoofProtect != true
+}
+
tests contains {
- "PolicyId": "GWS.GMAIL.7.1v0.3",
+ "PolicyId": GmailId7_1,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event in the current logs",
@@ -934,17 +1111,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := true
- SettingName := concat("", [
- "Spoofing and authentication safety Enable: protect against domain spoofing using ",
- "similar domain names"
- ])
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) == 0
+ not Check7_1_OK
}
tests contains {
- "PolicyId": "GWS.GMAIL.7.1v0.3",
+ "PolicyId": GmailId7_1,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs7_1, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs7_1},
@@ -952,46 +1125,58 @@ tests contains {
"NoSuchEvent": false
}
if {
- SettingName := concat("", [
- "Spoofing and authentication safety Enable: protect against domain spoofing using ",
- "similar domain names"
- ])
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) > 0
+ Check7_1_OK
Status := count(NonCompliantOUs7_1) == 0
}
#--
#
-# Baseline GWS.GMAIL.7.2v0.3
+# Baseline GWS.GMAIL.7.2
#--
-GetFriendlyValue7_2(Value) := "enabled" if {
- Value == "true"
-} else := "disabled" if {
- Value == "false"
-} else := Value
+GmailId7_2 := utils.PolicyIdWithSuffix("GWS.GMAIL.7.2")
+
+LogMessage7_2 := sprintf("%s %s %s", ["Spoofing and authentication safety",
+ "Enable: protect against spoofing of",
+ "employee names"])
+
+Check7_2_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage7_2, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check7_2_OK if {PolicyApiInUse}
+
+NonComplianceMessage7_2(value) := sprintf("Protect against spoofing of employee names is set to: %s",
+ [value])
NonCompliantOUs7_2 contains {
"Name": OU,
- "Value": concat(" ", [
- "Protect against spoofing of employee names is set to",
- GetFriendlyValue7_2(LastEvent.NewValue)
- ])
+ "Value": NonComplianceMessage7_2(GetFriendlyEnabledValue(LastEvent.NewValue))
}
if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents,
- concat("", ["Spoofing and authentication safety Enable: ",
- "protect against spoofing of employee names"]), OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage7_2, OU)
count(Events) > 0
LastEvent := utils.GetLastEvent(Events)
LastEvent.NewValue == "false"
LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
}
+NonCompliantOUs7_2 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage7_2(GetFriendlyEnabledValue(spoofProtect))
+} if {
+ some OU, settings in input.policies
+ GmailEnabled(OU)
+ spoofProtect := settings.gmail_spoofing_and_authentication.detectEmployeeNameSpoofing
+ spoofProtect != true
+}
+
tests contains {
- "PolicyId": "GWS.GMAIL.7.2v0.3",
+ "PolicyId": GmailId7_2,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event in the current logs",
@@ -999,15 +1184,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := true
- SettingName := concat("", ["Spoofing and authentication safety Enable: ",
- "protect against spoofing of employee names"])
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) == 0
+ not Check7_2_OK
}
tests contains {
- "PolicyId": "GWS.GMAIL.7.2v0.3",
+ "PolicyId": GmailId7_2,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs7_2, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs7_2},
@@ -1015,57 +1198,58 @@ tests contains {
"NoSuchEvent": false
}
if {
- SettingName := concat("", ["Spoofing and authentication safety Enable: ",
- "protect against spoofing of employee names"])
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) > 0
+ Check7_2_OK
Status := count(NonCompliantOUs7_2) == 0
}
#--
#
-# Baseline GWS.GMAIL.7.3v0.3
+# Baseline GWS.GMAIL.7.3
#--
-GetFriendlyValue7_3(Value) := "enabled" if {
- Value == "true"
-} else := "disabled" if {
- Value == "false"
-} else := Value
+GmailId7_3 := utils.PolicyIdWithSuffix("GWS.GMAIL.7.3")
+
+LogMessage7_3 := sprintf("%s %s %s", ["Spoofing and authentication safety",
+ "Enable: protect against inbound emails",
+ "spoofing your domain"])
+
+Check7_3_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage7_3, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check7_3_OK if {PolicyApiInUse}
+
+NonComplianceMessage7_3(value) := sprintf("Protect against inbound emails spoofing your domain is set to: %s",
+ [value])
NonCompliantOUs7_3 contains {
"Name": OU,
- "Value": concat(" ", [
- "Protect against inbound emails spoofing your domain is set to",
- GetFriendlyValue7_3(LastEvent.NewValue)
- ])
+ "Value": NonComplianceMessage7_3(GetFriendlyEnabledValue(LastEvent.NewValue))
}
if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents,
- concat("", ["Spoofing and authentication safety Enable: ",
- "protect against inbound emails spoofing your domain"]), OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage7_3, OU)
count(Events) > 0
LastEvent := utils.GetLastEvent(Events)
LastEvent.NewValue == "false"
LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
}
-NonCompliantOUs7_3 contains OU if {
- some OU in utils.OUsWithEvents
- SettingName := "Spoofing and authentication safety Enable: protect against inbound emails spoofing your domain"
- Events := utils.FilterEventsOU(LogEvents, SettingName, OU)
- # Ignore OUs without any events. We're already asserting that the
- # top-level OU has at least one event; for all other OUs we assume
- # they inherit from a parent OU if they have no events.
- count(Events) > 0
- LastEvent := utils.GetLastEvent(Events)
- LastEvent.NewValue == "false"
- LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
+NonCompliantOUs7_3 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage7_3(GetFriendlyEnabledValue(spoofProtect))
+} if {
+ some OU, settings in input.policies
+ GmailEnabled(OU)
+ spoofProtect := settings.gmail_spoofing_and_authentication.detectDomainSpoofingFromUnauthenticatedSenders
+ spoofProtect != true
}
tests contains {
- "PolicyId": "GWS.GMAIL.7.3v0.3",
+ "PolicyId": GmailId7_3,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event in the current logs",
@@ -1073,14 +1257,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := true
- SettingName := "Spoofing and authentication safety Enable: protect against inbound emails spoofing your domain"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) == 0
+ not Check7_3_OK
}
tests contains {
- "PolicyId": "GWS.GMAIL.7.3v0.3",
+ "PolicyId": GmailId7_3,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs7_3, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs7_3},
@@ -1088,43 +1271,58 @@ tests contains {
"NoSuchEvent": false
}
if {
- SettingName := "Spoofing and authentication safety Enable: protect against inbound emails spoofing your domain"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) > 0
+ Check7_3_OK
Status := count(NonCompliantOUs7_3) == 0
}
#--
#
-# Baseline GWS.GMAIL.7.4v0.3
+# Baseline GWS.GMAIL.7.4
#--
-GetFriendlyValue7_4(Value) := "enabled" if {
- Value == "true"
-} else := "disabled" if {
- Value == "false"
-} else := Value
+GmailId7_4 := utils.PolicyIdWithSuffix("GWS.GMAIL.7.4")
+
+LogMessage7_4 := sprintf("%s %s %s", ["Spoofing and authentication safety",
+ "Enable: protect against any",
+ "unauthenticated emails"])
+
+Check7_4_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage7_4, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check7_4_OK if {PolicyApiInUse}
+
+NonComplianceMessage7_4(value) := sprintf("Protect against any unauthenticated emails is set to: %s",
+ [value])
NonCompliantOUs7_4 contains {
"Name": OU,
- "Value": concat(" ", [
- "Protect against any unauthenticated emails is set to",
- GetFriendlyValue7_4(LastEvent.NewValue)
- ])
+ "Value": NonComplianceMessage7_4(GetFriendlyEnabledValue(LastEvent.NewValue))
}
if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents,
- concat("", ["Spoofing and authentication safety Enable: ",
- "protect against any unauthenticated emails"]), OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage7_4, OU)
count(Events) > 0
LastEvent := utils.GetLastEvent(Events)
LastEvent.NewValue == "false"
LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
}
+NonCompliantOUs7_4 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage7_4(GetFriendlyEnabledValue(unauthEmail))
+} if {
+ some OU, settings in input.policies
+ GmailEnabled(OU)
+ unauthEmail := settings.gmail_spoofing_and_authentication.detectUnauthenticatedEmails
+ unauthEmail != true
+}
+
tests contains {
- "PolicyId": "GWS.GMAIL.7.4v0.3",
+ "PolicyId": GmailId7_4,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event in the current logs",
@@ -1132,14 +1330,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := false
- SettingName := "Spoofing and authentication safety Enable: protect against any unauthenticated emails"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) == 0
+ not Check7_4_OK
}
tests contains {
- "PolicyId": "GWS.GMAIL.7.4v0.3",
+ "PolicyId": GmailId7_4,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs7_4, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs7_4},
@@ -1147,44 +1344,58 @@ tests contains {
"NoSuchEvent": false
}
if {
- SettingName := "Spoofing and authentication safety Enable: protect against any unauthenticated emails"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) > 0
+ Check7_4_OK
Status := count(NonCompliantOUs7_4) == 0
}
#--
#
-# Baseline GWS.GMAIL.7.5v0.3
+# Baseline GWS.GMAIL.7.5
#--
-GetFriendlyValue7_5(Value) := "enabled" if {
- Value == "true"
-} else := "disabled" if {
- Value == "false"
-} else := Value
+GmailId7_5 := utils.PolicyIdWithSuffix("GWS.GMAIL.7.5")
+
+LogMessage7_5 := sprintf("%s %s %s", ["Spoofing and authentication safety",
+ "Enable: protect your Groups from",
+ "inbound emails spoofing your domain"])
+
+Check7_5_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage7_5, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check7_5_OK if {PolicyApiInUse}
+
+NonComplianceMessage7_5(value) := sprintf("Protect your Groups from inbound emails spoofing your domain is set to: %s",
+ [value])
NonCompliantOUs7_5 contains {
"Name": OU,
- "Value": concat(" ", [
- "Protect your Groups from inbound emails spoofing your domain is set to",
- GetFriendlyValue7_5(LastEvent.NewValue)
- ])
+ "Value": NonComplianceMessage7_5(GetFriendlyEnabledValue(LastEvent.NewValue))
}
if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents, concat("", [
- "Spoofing and authentication safety Enable: protect your Groups from inbound emails ",
- "spoofing your domain"
- ]), OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage7_5, OU)
count(Events) > 0
LastEvent := utils.GetLastEvent(Events)
LastEvent.NewValue == "false"
LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
}
+NonCompliantOUs7_5 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage7_5(GetFriendlyEnabledValue(detectSpoof))
+} if {
+ some OU, settings in input.policies
+ GmailEnabled(OU)
+ detectSpoof := settings.gmail_spoofing_and_authentication.detectDomainSpoofingFromUnauthenticatedSenders
+ detectSpoof != true
+}
+
tests contains {
- "PolicyId": "GWS.GMAIL.7.5v0.3",
+ "PolicyId": GmailId7_5,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event in the current logs",
@@ -1192,17 +1403,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := false
- SettingName := concat("", [
- "Spoofing and authentication safety Enable: protect your Groups from inbound emails ",
- "spoofing your domain"
- ])
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) == 0
+ not Check7_5_OK
}
tests contains {
- "PolicyId": "GWS.GMAIL.7.5v0.3",
+ "PolicyId": GmailId7_5,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs7_5, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs7_5},
@@ -1210,23 +1417,26 @@ tests contains {
"NoSuchEvent": false
}
if {
- SettingName := concat("", [
- "Spoofing and authentication safety Enable: protect your Groups from inbound emails ",
- "spoofing your domain"
- ])
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) > 0
+ Check7_5_OK
Status := count(NonCompliantOUs7_5) == 0
}
#--
#
-# Baseline GWS.GMAIL.7.6v0.3
+# Baseline GWS.GMAIL.7.6
#--
-# No such event is true if any of the revelant settings doesn't having any events
+GmailId7_6 := utils.PolicyIdWithSuffix("GWS.GMAIL.7.6")
+
+NonComplianceMessage7_6(types) := sprintf("%s spoof emails not removed from inbox",
+ [concat(", ", sort(types))])
+
+# No such event is true if any of the relevant settings doesn't having any events
default NoSuchEvent7_6 := false
-NoSuchEvent7_6 := true if {
+
+NoSuchEvent7_6 := false if {
+ PolicyApiInUse
+} else := true if {
SettingName :=
"Spoofing and authentication safety Protect against domain spoofing based on similar domain names action"
Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
@@ -1269,7 +1479,7 @@ UnauthenticatedEmailsMessage(NewValueUnauthenticatedEmails) := "Unauthenticated
if { NewValueUnauthenticatedEmails in ["Show warning", "No action"] }
else := ""
-GroupEmailsMessage(NewValueGroupEmails) := "Inbound spoofing emails addresed to groups"
+GroupEmailsMessage(NewValueGroupEmails) := "Inbound spoofing emails addressed to groups"
if { NewValueGroupEmails == "Show warning" }
else := ""
@@ -1306,6 +1516,7 @@ NonCompliantOUs7_6 contains {
LastEventInboundEmails.NewValue, LastEventUnauthenticatedEmails.NewValue,
LastEventGroupEmails.NewValue)
} if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
DomainNamesSetting := concat("", [
@@ -1348,8 +1559,30 @@ NonCompliantOUs7_6 contains {
]
}
+SpoofConfigs := [
+ {"type": "domain", "setting": "domainSpoofingConsequence"},
+ {"type": "domain name", "setting": "domainNameSpoofingConsequence"},
+ {"type": "employee name", "setting": "employeeNameSpoofingConsequence"},
+ {"type": "groups", "setting": "groupsSpoofingConsequence"},
+ {"type": "unauthenticated", "setting": "unauthenticatedEmailConsequence"}
+]
+
+NonCompliantOUs7_6 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage7_6(types)
+} if {
+ some OU, settings in input.policies
+ GmailEnabled(OU)
+ types := [config.type |
+ some config in SpoofConfigs
+ consequence = settings.gmail_spoofing_and_authentication[config.setting]
+ not consequence in ["SPAM_FOLDER", "QUARANTINE"]
+ ]
+ count(types) > 0
+}
+
tests contains {
- "PolicyId": "GWS.GMAIL.7.6v0.3",
+ "PolicyId": GmailId7_6,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -1357,12 +1590,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := false
NoSuchEvent7_6
}
tests contains {
- "PolicyId": "GWS.GMAIL.7.6v0.3",
+ "PolicyId": GmailId7_6,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs7_6, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs7_6},
@@ -1376,35 +1610,52 @@ if {
#--
#
-# Baseline GWS.GMAIL.7.7v0.3
+# Baseline GWS.GMAIL.7.7
#--
-GetFriendlyValue7_7(Value) := "enabled" if {
- Value == "true"
-} else := "disabled" if {
- Value == "false"
-} else := Value
+GmailId7_7 := utils.PolicyIdWithSuffix("GWS.GMAIL.7.7")
+
+LogMessage7_7 := sprintf("%s %s %s", ["Spoofing and authentication safety",
+ "Enable: automatically enables all",
+ "future added settings"])
+
+Check7_7_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsNoOU(LogEvents, LogMessage7_7)
+ count(events) > 0
+}
+
+Check7_7_OK if {PolicyApiInUse}
+
+NonComplianceMessage7_7(value) := sprintf("Automatically enable all future added settings is set to: %s",
+ [value])
NonCompliantOUs7_7 contains {
"Name": OU,
- "Value": concat(" ", [
- "Automatically enable all future added settings is set to",
- GetFriendlyValue7_7(LastEvent.NewValue)
- ])
+ "Value": NonComplianceMessage7_7(GetFriendlyEnabledValue(LastEvent.NewValue))
}
if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents,
- concat("", ["Spoofing and authentication safety Enable: ",
- "automatically enables all future added settings"]), OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage7_7, OU)
count(Events) > 0
LastEvent := utils.GetLastEvent(Events)
LastEvent.NewValue == "false"
LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
}
+NonCompliantOUs7_7 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage7_7(GetFriendlyEnabledValue(applyFuture))
+} if {
+ some OU, settings in input.policies
+ GmailEnabled(OU)
+ applyFuture := settings.gmail_spoofing_and_authentication.applyFutureSettingsAutomatically
+ applyFuture != true
+}
+
tests contains {
- "PolicyId": "GWS.GMAIL.7.7v0.3",
+ "PolicyId": GmailId7_7,
"Criticality": "Should",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event in the current logs",
@@ -1412,15 +1663,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := false
- SettingName :=
- "Spoofing and authentication safety Enable: automatically enables all future added settings"
- Events := utils.FilterEventsNoOU(LogEvents, SettingName)
- count(Events) == 0
+ not Check7_7_OK
}
tests contains {
- "PolicyId": "GWS.GMAIL.7.7v0.3",
+ "PolicyId": GmailId7_7,
"Criticality": "Should",
"ReportDetails": utils.ReportDetails(NonCompliantOUs7_7, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs7_7},
@@ -1428,20 +1677,20 @@ tests contains {
"NoSuchEvent": false
}
if {
- SettingName :=
- "Spoofing and authentication safety Enable: automatically enables all future added settings"
- Events := utils.FilterEventsNoOU(LogEvents, SettingName)
- count(Events) > 0
+ Check7_7_OK
Status := count(NonCompliantOUs7_7) == 0
}
#--
#
-# Baseline GWS.GMAIL.7.8v0.3
+# Baseline GWS.GMAIL.7.8
#--
+
+GmailId7_8 := utils.PolicyIdWithSuffix("GWS.GMAIL.7.8")
+
# No implementation steps provided for this policy
tests contains {
- "PolicyId": "GWS.GMAIL.7.8v0.3",
+ "PolicyId": GmailId7_8,
"Criticality": "Should/Not-Implemented",
"ReportDetails": "Currently not able to be tested automatically; please manually check.",
"ActualValue": "",
@@ -1456,19 +1705,16 @@ tests contains {
###############
#
-# Baseline GWS.GMAIL.8.1v0.3
+# Baseline GWS.GMAIL.8.1
#--
-GetFriendlyValue8_1(Value) := "enabled" if {
- Value == "true"
-} else := "disabled" if {
- Value == "false"
-} else := Value
+
+GmailId8_1 := utils.PolicyIdWithSuffix("GWS.GMAIL.8.1")
NonCompliantOUs8_1 contains {
"Name": OU,
"Value": concat(" ", [
"User email uploads is set to",
- GetFriendlyValue8_1(LastEvent.NewValue)
+ GetFriendlyEnabledValue(LastEvent.NewValue)
])
}
if {
@@ -1480,7 +1726,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.GMAIL.8.1v0.3",
+ "PolicyId": GmailId8_1,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event in the current logs",
@@ -1494,7 +1740,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.GMAIL.8.1v0.3",
+ "PolicyId": GmailId8_1,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs8_1, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs8_1},
@@ -1513,8 +1759,11 @@ if {
###############
#
-# Baseline GWS.GMAIL.9.1v0.3
+# Baseline GWS.GMAIL.9.1
#--
+
+GmailId9_1 := utils.PolicyIdWithSuffix("GWS.GMAIL.9.1")
+
default NoSuchEvent9_1(_) := false
NoSuchEvent9_1(TopLevelOU) := true if {
@@ -1557,8 +1806,8 @@ if {
count(PopEvents) > 0
LastPopEvent := utils.GetLastEvent(PopEvents)
- ImapEnabled := (LastImapEvent.NewValue in ["DISABLED", "INHERIT_FROM_PARENT"]) == false
- PopEnabled := (LastPopEvent.NewValue in ["false", "INHERIT_FROM_PARENT"]) == false
+ ImapEnabled := (LastImapEvent.NewValue in {"DISABLED", "INHERIT_FROM_PARENT"}) == false
+ PopEnabled := (LastPopEvent.NewValue in {"false", "INHERIT_FROM_PARENT"}) == false
true in {
ImapEnabled,
PopEnabled
@@ -1580,8 +1829,8 @@ if {
count(PopEvents) > 0
LastPopEvent := utils.GetLastEvent(PopEvents)
- ImapEnabled := (LastImapEvent.NewValue in ["DISABLED", "INHERIT_FROM_PARENT"]) == false
- PopEnabled := (LastPopEvent.NewValue in ["false", "INHERIT_FROM_PARENT"]) == false
+ ImapEnabled := (LastImapEvent.NewValue in {"DISABLED", "INHERIT_FROM_PARENT"}) == false
+ PopEnabled := (LastPopEvent.NewValue in {"false", "INHERIT_FROM_PARENT"}) == false
true in {
ImapEnabled,
PopEnabled
@@ -1589,7 +1838,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.GMAIL.9.1v0.3",
+ "PolicyId": GmailId9_1,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event in the current logs",
@@ -1602,7 +1851,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.GMAIL.9.1v0.3",
+ "PolicyId": GmailId9_1,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs9_1, NonCompliantGroups9_1),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs9_1, "NonCompliantGroups": NonCompliantGroups9_1},
@@ -1622,20 +1871,16 @@ if {
################
#
-# Baseline GWS.GMAIL.10.1v0.3
+# Baseline GWS.GMAIL.10.1
#--
-GetFriendlyValue10_1(Value) := "enabled" if {
- Value == "true"
-} else := "disabled" if {
- Value == "false"
-} else := Value
+GmailId10_1 := utils.PolicyIdWithSuffix("GWS.GMAIL.10.1")
NonCompliantOUs10_1 contains {
"Name": OU,
"Value": concat(" ", [
"Automatically enable outlook sync is set to",
- GetFriendlyValue10_1(LastEvent.NewValue)
+ GetFriendlyEnabledValue(LastEvent.NewValue)
])
}
if {
@@ -1648,7 +1893,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.GMAIL.10.1v0.3",
+ "PolicyId": GmailId10_1,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event in the current logs",
@@ -1662,7 +1907,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.GMAIL.10.1v0.3",
+ "PolicyId": GmailId10_1,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs10_1, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs10_1},
@@ -1677,11 +1922,14 @@ if {
#--
#
-# Baseline GWS.GMAIL.10.2v0.3
+# Baseline GWS.GMAIL.10.2
#--
+
+GmailId10_2 := utils.PolicyIdWithSuffix("GWS.GMAIL.10.2")
+
# No implementation steps provided for this policy
tests contains {
- "PolicyId": "GWS.GMAIL.10.2v0.3",
+ "PolicyId": GmailId10_2,
"Criticality": "May/Not-Implemented",
"ReportDetails": "Currently not able to be tested automatically; please manually check.",
"ActualValue": "",
@@ -1695,33 +1943,51 @@ tests contains {
################
#
-# Baseline GWS.GMAIL.11.1v0.3
+# Baseline GWS.GMAIL.11.1
#--
-GetFriendlyValue11_1(Value) := "enabled" if {
- Value == "true"
-} else := "disabled" if {
- Value == "false"
-} else := Value
+GmailId11_1 := utils.PolicyIdWithSuffix("GWS.GMAIL.11.1")
+
+LogMessage11_1 := "ENABLE_EMAIL_AUTOFORWARDING"
+
+Check11_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage11_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check11_1_OK if {PolicyApiInUse}
+
+NonComplianceMessage11_1(value) := sprintf("Automatic email forwarding is set to: %s",
+ [value])
NonCompliantOUs11_1 contains {
"Name": OU,
- "Value": concat(" ", [
- "Automatically enable email autoforwarding is set to",
- GetFriendlyValue11_1(LastEvent.NewValue)
- ])
+ "Value": NonComplianceMessage11_1(GetFriendlyEnabledValue(LastEvent.NewValue))
}
if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents, "ENABLE_EMAIL_AUTOFORWARDING", OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage11_1, OU)
count(Events) > 0
LastEvent := utils.GetLastEvent(Events)
LastEvent.NewValue == "true"
LastEvent.NewValue != "INHERIT_FROM_PARENT"
}
+NonCompliantOUs11_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage11_1(GetFriendlyEnabledValue(autoforward))
+}
+if {
+ some OU, settings in input.policies
+ GmailEnabled(OU)
+ autoforward := settings.gmail_auto_forwarding.enableAutoForwarding
+ autoforward != false
+}
+
tests contains {
- "PolicyId": "GWS.GMAIL.11.1v0.3",
+ "PolicyId": GmailId11_1,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event in the current logs",
@@ -1729,13 +1995,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := false
- Events := utils.FilterEventsOU(LogEvents, "ENABLE_EMAIL_AUTOFORWARDING", utils.TopLevelOU)
- count(Events) == 0
+ not Check11_1_OK
}
tests contains {
- "PolicyId": "GWS.GMAIL.11.1v0.3",
+ "PolicyId": GmailId11_1,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs11_1, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs11_1},
@@ -1743,8 +2009,7 @@ tests contains {
"NoSuchEvent": false
}
if {
- Events := utils.FilterEventsOU(LogEvents, "ENABLE_EMAIL_AUTOFORWARDING", utils.TopLevelOU)
- count(Events) > 0
+ Check11_1_OK
Status := count(NonCompliantOUs11_1) == 0
}
#--
@@ -1755,20 +2020,16 @@ if {
################
#
-# Baseline GWS.GMAIL.12.1v0.3
+# Baseline GWS.GMAIL.12.1
#--
-GetFriendlyValue12_1(Value) := "enabled" if {
- Value == "true"
-} else := "disabled" if {
- Value == "false"
-} else := Value
+GmailId12_1 := utils.PolicyIdWithSuffix("GWS.GMAIL.12.1")
NonCompliantOUs12_1 contains {
"Name": OU,
"Value": concat(" ", [
"Allow per-user outbound gateways is set to",
- GetFriendlyValue12_1(LastEvent.NewValue)
+ GetFriendlyEnabledValue(LastEvent.NewValue)
])
}
if {
@@ -1780,7 +2041,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.GMAIL.12.1v0.3",
+ "PolicyId": GmailId12_1,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event in the current logs",
@@ -1794,7 +2055,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.GMAIL.12.1v0.3",
+ "PolicyId": GmailId12_1,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs12_1, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs12_1},
@@ -1814,9 +2075,11 @@ if {
################
#
-# Baseline GWS.GMAIL.13.1v0.3
+# Baseline GWS.GMAIL.13.1
#--
+GmailId13_1 := utils.PolicyIdWithSuffix("GWS.GMAIL.13.1")
+
GetFriendlyValue13_1(Value) := "enabled" if {
Value == "false"
} else := "disabled" if {
@@ -1840,7 +2103,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.GMAIL.13.1v0.3",
+ "PolicyId": GmailId13_1,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event in the current logs",
@@ -1855,7 +2118,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.GMAIL.13.1v0.3",
+ "PolicyId": GmailId13_1,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs13_1, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs13_1},
@@ -1876,94 +2139,146 @@ if {
################
#
-# Baseline GWS.GMAIL.14.1v0.3
-#--
-EmailAllowlistSettingDetailsStr(LastEvent) := Description if {
- LastEvent.NewValue != "true"
- Description := concat("", [
- "Email allowlists are enabled in ",
- utils.TopLevelOU,
- "."
- ])
-}
+# Baseline GWS.GMAIL.14.1
+#--
-EmailAllowlistSettingDetailsStr(LastEvent) := Description if {
- LastEvent.NewValue == "true"
- Description := concat("", [
- "Email allowlists are not enabled in ",
- utils.TopLevelOU,
- "."
- ])
+GmailId14_1 := utils.PolicyIdWithSuffix("GWS.GMAIL.14.1")
+
+LogMessage14_1 := "GmailIpWhitelistSpamFilteringProto is_empty"
+
+Check14_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage14_1, utils.TopLevelOU)
+ count(events) > 0
}
+Check14_1_OK if {PolicyApiInUse}
+
+NonComplianceMessage14_1(Value, OU) := sprintf("Email allowlists are %s in %s.",
+ [Value, OU])
+
+# Note that in the event logs, a STRING value of "false" means allowlists are
+# enabled, but policy API checks for a boolean true value.
+
+GetFriendlyValue14_1(Value) := "enabled" if {
+ Value in {true, "false"}
+} else := "disabled" if {
+ Value in {false, "true"}
+} else := Value
+
tests contains {
- "PolicyId": "GWS.GMAIL.14.1v0.3",
+ "PolicyId": GmailId14_1,
"Criticality": "Should",
- "ReportDetails": concat("", [
- "No relevant event in the current logs. ",
- "While we are unable to determine the state from the logs, ",
- "the default setting is compliant; manual check recommended."
- ]),
- "ActualValue": {"GmailIpWhitelistSpamFilteringProto is_empty": "No relevant event in the current logs"},
- "RequirementMet": true,
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": {LogMessage14_1: "No relevant event in the current logs"},
+ "RequirementMet": DefaultSafe,
"NoSuchEvent": true
}
if {
- Events := utils.FilterEventsOU(LogEvents, "GmailIpWhitelistSpamFilteringProto is_empty", utils.TopLevelOU)
- count(Events) == 0
+ not PolicyApiInUse
+ DefaultSafe := true
+ not Check14_1_OK
}
tests contains {
- "PolicyId": "GWS.GMAIL.14.1v0.3",
+ "PolicyId": GmailId14_1,
"Criticality": "Should",
- "ReportDetails": EmailAllowlistSettingDetailsStr(LastEvent),
+ "ReportDetails": NonComplianceMessage14_1(GetFriendlyValue14_1(LastEvent.NewValue),
+ utils.TopLevelOU),
"ActualValue": {LastEvent.Setting: LastEvent.NewValue},
"RequirementMet": Status,
"NoSuchEvent": false
}
if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents, "GmailIpWhitelistSpamFilteringProto is_empty", OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage14_1, OU)
count(Events) > 0
LastEvent := utils.GetLastEvent(Events)
Status := LastEvent.NewValue == "true"
}
-#--
+# This test applies only to the policy API - it is NOT shared with the events
+# implementation. Similar to the above events implementation test, this test
+# always returns a result, even if gmail is disabled - see how this is
+# implemented by converting the enable status to 1/0 (whereas a false value
+# would fail the tests conditional).
+
+tests contains {
+ "PolicyId": GmailId14_1,
+ "Criticality": "Should",
+ "ReportDetails": NonComplianceMessage14_1(GetFriendlyValue14_1(allowListCount > 0),
+ utils.TopLevelOU),
+ "ActualValue": {utils.TopLevelOU: allowList},
+ "RequirementMet": allowListCount == 0,
+ "NoSuchEvent": false
+}
+if {
+ PolicyApiInUse
+ enabled := to_number(GmailEnabled(utils.TopLevelOU))
+ settings := input.policies[utils.TopLevelOU]
+ allowList := settings.gmail_email_spam_filter_ip_allowlist.allowedIpAddresses
+ allowListCount := enabled * count(allowList)
+}
+
+#--
################
# GWS.GMAIL.15 #
################
#
-# Baseline GWS.GMAIL.15.1v0.3
+# Baseline GWS.GMAIL.15.1
#--
+GmailId15_1 := utils.PolicyIdWithSuffix("GWS.GMAIL.15.1")
+
+LogMessage15_1 := "DelayedDeliverySettingsProto disable_delayed_delivery_for_suspicious_email"
+
+Check15_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage15_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check15_1_OK if {PolicyApiInUse}
+
+NonComplianceMessage15_1(value) := sprintf("Enhanced pre-delivery message scanning is %s",
+ [value])
+
GetFriendlyValue15_1(Value) := "enabled" if {
- Value == "false"
+ Value in {true, "false"}
} else := "disabled" if {
- Value == "true"
+ Value in {false, "true"}
} else := Value
NonCompliantOUs15_1 contains {
"Name": OU,
- "Value": concat(" ", [
- "Enhanced pre-delivery message scanning is set to",
- GetFriendlyValue15_1(LastEvent.NewValue)
- ])
+ "Value": NonComplianceMessage15_1(GetFriendlyValue15_1(LastEvent.NewValue))
}
if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents, concat("",
- ["DelayedDeliverySettingsProto disable_delayed_delivery_for_suspicious_email"]), OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage15_1, OU)
count(Events) > 0
LastEvent := utils.GetLastEvent(Events)
LastEvent.NewValue == "true"
LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
}
+NonCompliantOUs15_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage15_1(GetFriendlyValue15_1(preScanning))
+} if {
+ some OU, settings in input.policies
+ GmailEnabled(OU)
+ preDelivery := settings.gmail_enhanced_pre_delivery_message_scanning
+ preScanning := preDelivery.enableImprovedSuspiciousContentDetection
+ preScanning != true
+}
+
tests contains {
- "PolicyId": "GWS.GMAIL.15.1v0.3",
+ "PolicyId": GmailId15_1,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event in the current logs",
@@ -1971,14 +2286,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := true
- SettingName := "DelayedDeliverySettingsProto disable_delayed_delivery_for_suspicious_email"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) == 0
+ not Check15_1_OK
}
tests contains {
- "PolicyId": "GWS.GMAIL.15.1v0.3",
+ "PolicyId": GmailId15_1,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs15_1, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs15_1},
@@ -1986,19 +2300,20 @@ tests contains {
"NoSuchEvent": false
}
if {
- SettingName := "DelayedDeliverySettingsProto disable_delayed_delivery_for_suspicious_email"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) > 0
+ Check15_1_OK
Status := count(NonCompliantOUs15_1) == 0
}
#--
#
-# Baseline GWS.GMAIL.15.2v0.3
+# Baseline GWS.GMAIL.15.2
#--
+
+GmailId15_2 := utils.PolicyIdWithSuffix("GWS.GMAIL.15.2")
+
# No implementation steps provided for this policy
tests contains {
- "PolicyId": "GWS.GMAIL.15.2v0.3",
+ "PolicyId": GmailId15_2,
"Criticality": "Should/Not-Implemented",
"ReportDetails": "Currently not able to be tested automatically; please manually check.",
"ActualValue": "",
@@ -2012,20 +2327,16 @@ tests contains {
################
#
-# Baseline GWS.GMAIL.16.1v0.3
+# Baseline GWS.GMAIL.16.1
#--
-GetFriendlyValue16_1(Value) := "enabled" if {
- Value == "true"
-} else := "disabled" if {
- Value == "false"
-} else := Value
+GmailId16_1 := utils.PolicyIdWithSuffix("GWS.GMAIL.16.1")
NonCompliantOUs16_1 contains {
"Name": OU,
"Value": concat(" ", [
"Security sandbox is",
- GetFriendlyValue16_1(LastEvent.NewValue)
+ GetFriendlyEnabledValue(LastEvent.NewValue)
])
}
if {
@@ -2038,7 +2349,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.GMAIL.16.1v0.3",
+ "PolicyId": GmailId16_1,
"Criticality": "Should",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event in the current logs",
@@ -2053,7 +2364,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.GMAIL.16.1v0.3",
+ "PolicyId": GmailId16_1,
"Criticality": "Should",
"ReportDetails": utils.ReportDetails(NonCompliantOUs16_1, []),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs16_1},
@@ -2069,11 +2380,14 @@ if {
#--
#
-# Baseline GWS.GMAIL.16.2v0.3
+# Baseline GWS.GMAIL.16.2
#--
+
+GmailId16_2 := utils.PolicyIdWithSuffix("GWS.GMAIL.16.2")
+
# No implementation steps provided for this policy
tests contains {
- "PolicyId": "GWS.GMAIL.16.2v0.3",
+ "PolicyId": GmailId16_2,
"Criticality": "Should/Not-Implemented",
"ReportDetails": "Currently not able to be tested automatically; please manually check.",
"ActualValue": "",
@@ -2087,12 +2401,15 @@ tests contains {
################
#
-# Baseline GWS.GMAIL.17.1v0.3
+# Baseline GWS.GMAIL.17.1
#--
+
+GmailId17_1 := utils.PolicyIdWithSuffix("GWS.GMAIL.17.1")
+
# At this time we are unable to test because settings are configured in the GWS Admin Console
# and not available within the generated logs
tests contains {
- "PolicyId": "GWS.GMAIL.17.1v0.3",
+ "PolicyId": GmailId17_1,
"Criticality": "Should/Not-Implemented",
"ReportDetails": "Currently not able to be tested automatically; please manually check.",
"ActualValue": "",
@@ -2107,12 +2424,15 @@ tests contains {
################
#
-# Baseline GWS.GMAIL.18.1v0.3
+# Baseline GWS.GMAIL.18.1
#--
+
+GmailId18_1 := utils.PolicyIdWithSuffix("GWS.GMAIL.18.1")
+
# At this time we are unable to test because settings are configured in the GWS Admin Console
# and not available within the generated logs
tests contains {
- "PolicyId": "GWS.GMAIL.18.1v0.3",
+ "PolicyId": GmailId18_1,
"Criticality": "Should/Not-Implemented",
"ReportDetails": "Currently not able to be tested automatically; please manually check.",
"ActualValue": "",
@@ -2122,12 +2442,15 @@ tests contains {
#--
#
-# Baseline GWS.GMAIL.18.2v0.3
+# Baseline GWS.GMAIL.18.2
#--
+
+GmailId18_2 := utils.PolicyIdWithSuffix("GWS.GMAIL.18.2")
+
# At this time we are unable to test because settings are configured in the GWS Admin Console
# and not available within the generated logs
tests contains {
- "PolicyId": "GWS.GMAIL.18.2v0.3",
+ "PolicyId": GmailId18_2,
"Criticality": "Should/Not-Implemented",
"ReportDetails": "Currently not able to be tested automatically; please manually check.",
"ActualValue": "",
@@ -2137,12 +2460,15 @@ tests contains {
#--
#
-# Baseline GWS.GMAIL.18.3v0.3
+# Baseline GWS.GMAIL.18.3
#--
+
+GmailId18_3 := utils.PolicyIdWithSuffix("GWS.GMAIL.18.3")
+
# At this time we are unable to test because settings are configured in the GWS Admin Console
# and not available within the generated logs
tests contains {
- "PolicyId": "GWS.GMAIL.18.3v0.3",
+ "PolicyId": GmailId18_3,
"Criticality": "Shall/Not-Implemented",
"ReportDetails": "Currently not able to be tested automatically; please manually check.",
"ActualValue": "",
@@ -2156,12 +2482,15 @@ tests contains {
################
#
-# Baseline GWS.GMAIL.19.1v0.3
+# Baseline GWS.GMAIL.19.1
#--
+
+GmailId19_1 := utils.PolicyIdWithSuffix("GWS.GMAIL.19.1")
+
# At this time we are unable to test because settings are configured in the GWS Admin Console
# and not available within the generated logs
tests contains {
- "PolicyId": "GWS.GMAIL.19.1v0.3",
+ "PolicyId": GmailId19_1,
"Criticality": "Shall/Not-Implemented",
"ReportDetails": "Currently not able to be tested automatically; please manually check.",
"ActualValue": "",
@@ -2171,10 +2500,13 @@ tests contains {
#--
#
-# Baseline GWS.GMAIL.19.2v0.3
+# Baseline GWS.GMAIL.19.2
#--
+
+GmailId19_2 := utils.PolicyIdWithSuffix("GWS.GMAIL.19.2")
+
tests contains {
- "PolicyId": "GWS.GMAIL.19.2v0.3",
+ "PolicyId": GmailId19_2,
"Criticality": "Shall/Not-Implemented",
"ReportDetails": "Currently not able to be tested automatically; please manually check.",
"ActualValue": "",
@@ -2184,14 +2516,17 @@ tests contains {
#--
#
-# Baseline GWS.GMAIL.19.3v0.3
+# Baseline GWS.GMAIL.19.3
#--
+
+GmailId19_3 := utils.PolicyIdWithSuffix("GWS.GMAIL.19.3")
+
tests contains {
- "PolicyId": "GWS.GMAIL.19.3v0.3",
+ "PolicyId": GmailId19_3,
"Criticality": "Shall/Not-Implemented",
"ReportDetails": "Currently not able to be tested automatically; please manually check.",
"ActualValue": "",
"RequirementMet": false,
"NoSuchEvent": false
}
-#--
\ No newline at end of file
+#--
diff --git a/scubagoggles/rego/Groups.rego b/scubagoggles/rego/Groups.rego
new file mode 100644
index 00000000..03876922
--- /dev/null
+++ b/scubagoggles/rego/Groups.rego
@@ -0,0 +1,502 @@
+package groups
+
+import future.keywords
+import data.utils
+import data.utils.PolicyApiInUse
+
+LogEvents := utils.GetEvents("groups_logs")
+
+GroupsEnabled(orgunit) := utils.AppEnabled(input.policies, "groups_for_business", orgunit)
+
+################
+# GWS.GROUPS.1 #
+################
+
+#
+# Baseline GWS.GROUPS.1.1
+#--
+
+GroupsId1_1 := utils.PolicyIdWithSuffix("GWS.GROUPS.1.1")
+
+LogMessage1_1 := "GroupsSharingSettingsProto collaboration_policy"
+
+Check1_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage1_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check1_1_OK if {PolicyApiInUse}
+
+GetFriendlyValue1_1(Value) := "Users in your domain only" if {
+ Value in {"CLOSED", "DOMAIN_USERS_ONLY"}
+} else := "Any user" if {
+ Value in {"OPEN", "ANYONE_CAN_ACCESS"}
+} else := Value
+
+NonComplianceMessage1_1(value) := sprintf("Group access set to: %s", [value])
+
+NonCompliantOUs1_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage1_1(GetFriendlyValue1_1(LastEvent.NewValue))
+} if {
+ not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+ Events := utils.FilterEventsOU(LogEvents, LogMessage1_1, OU)
+ # Ignore OUs without any events. We're already asserting that the
+ # top-level OU has at least one event; for all other OUs we assume
+ # they inherit from a parent OU if they have no events.
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ LastEvent.NewValue != "CLOSED"
+}
+
+NonCompliantOUs1_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage1_1(GetFriendlyValue1_1(whoCanShare))
+} if {
+ some OU, settings in input.policies
+ GroupsEnabled(OU)
+ whoCanShare := settings.groups_for_business_groups_sharing.collaborationCapability
+ whoCanShare != "DOMAIN_USERS_ONLY"
+}
+
+tests contains {
+ "PolicyId": GroupsId1_1,
+ "Criticality": "Shall",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := true
+ not Check1_1_OK
+}
+
+tests contains {
+ "PolicyId": GroupsId1_1,
+ "Criticality": "Shall",
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs1_1, []),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs1_1},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check1_1_OK
+ Status := count(NonCompliantOUs1_1) == 0
+}
+#--
+
+################
+# GWS.GROUPS.2 #
+################
+
+#
+# Baseline GWS.GROUPS.2.1
+#--
+
+GroupsId2_1 := utils.PolicyIdWithSuffix("GWS.GROUPS.2.1")
+
+LogMessage2_1 := "GroupsSharingSettingsProto owners_can_allow_external_members"
+
+Check2_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage2_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check2_1_OK if {PolicyApiInUse}
+
+GetFriendlyValue2_1(Value) := "Yes" if {
+ Value in {true, "true"}
+} else := "No" if {
+ Value in {false, "false"}
+} else := Value
+
+NonComplianceMessage2_1(value) := sprintf("Allowing external group members is set to: %s", [value])
+
+NonCompliantOUs2_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage2_1(GetFriendlyValue2_1(LastEvent.NewValue))
+} if {
+ not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+ Events := utils.FilterEventsOU(LogEvents, LogMessage2_1, OU)
+ # Ignore OUs without any events. We're already asserting that the
+ # top-level OU has at least one event; for all other OUs we assume
+ # they inherit from a parent OU if they have no events.
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ LastEvent.NewValue != "false"
+}
+
+NonCompliantOUs2_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage2_1(GetFriendlyValue2_1(allowExternal))
+} if {
+ some OU, settings in input.policies
+ GroupsEnabled(OU)
+ allowExternal := settings.groups_for_business_groups_sharing.ownersCanAllowExternalMembers
+ allowExternal != false
+}
+
+tests contains {
+ "PolicyId": GroupsId2_1,
+ "Criticality": "Should",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := true
+ not Check2_1_OK
+}
+
+tests contains {
+ "PolicyId": GroupsId2_1,
+ "Criticality": "Should",
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs2_1, []),
+ "ActualValue": {"NonCompliantOUs":NonCompliantOUs2_1},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check2_1_OK
+ Status := count(NonCompliantOUs2_1) == 0
+}
+#--
+
+################
+# GWS.GROUPS.3 #
+################
+
+#
+# Baseline GWS.GROUPS.3.1
+#--
+
+GroupsId3_1 := utils.PolicyIdWithSuffix("GWS.GROUPS.3.1")
+
+LogMessage3_1 := "GroupsSharingSettingsProto owners_can_allow_incoming_mail_from_public"
+
+Check3_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage3_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check3_1_OK if {PolicyApiInUse}
+
+GetFriendlyValue3_1(Value) := "Yes" if {
+ Value in {true, "true"}
+} else := "No" if {
+ Value in {false, "false"}
+} else := Value
+
+NonComplianceMessage3_1(value) := sprintf("Allowing external email is set to: %s", [value])
+
+NonCompliantOUs3_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage3_1(GetFriendlyValue3_1(LastEvent.NewValue))
+} if {
+ not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+ Events := utils.FilterEventsOU(LogEvents, LogMessage3_1, OU)
+ # Ignore OUs without any events. We're already asserting that the
+ # top-level OU has at least one event; for all other OUs we assume
+ # they inherit from a parent OU if they have no events.
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ LastEvent.NewValue != "false"
+}
+
+NonCompliantOUs3_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage3_1(GetFriendlyValue3_1(allowExternal))
+} if {
+ some OU, settings in input.policies
+ GroupsEnabled(OU)
+ allowExternal := settings.groups_for_business_groups_sharing.ownersCanAllowIncomingMailFromPublic
+ allowExternal != false
+}
+
+tests contains {
+ "PolicyId": GroupsId3_1,
+ "Criticality": "Should",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := true
+ not Check3_1_OK
+}
+
+tests contains {
+ "PolicyId": GroupsId3_1,
+ "Criticality": "Should",
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs3_1, []),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs3_1},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check3_1_OK
+ Status := count(NonCompliantOUs3_1) == 0
+}
+#--
+
+################
+# GWS.GROUPS.4 #
+################
+
+#
+# Baseline GWS.GROUPS.4.1
+#--
+
+GroupsId4_1 := utils.PolicyIdWithSuffix("GWS.GROUPS.4.1")
+
+LogMessage4_1 := "GroupsSharingSettingsProto who_can_create_groups"
+
+Check4_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage4_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check4_1_OK if {PolicyApiInUse}
+
+GetFriendlyValue4_1(Value) := "Administrators only" if {
+ Value == "ADMIN_ONLY"
+} else := "Users in your domain only" if {
+ Value == "USERS_IN_DOMAIN"
+} else := "Any user" if {
+ Value in {"ANYONE_CAN_CREATE", "WORLD"}
+} else := Value
+
+NonComplianceMessage4_1(value) := sprintf("Groups can be created by: %s", [value])
+
+NonCompliantOUs4_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage4_1(GetFriendlyValue4_1(LastEvent.NewValue))
+} if {
+ not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+ Events := utils.FilterEventsOU(LogEvents, LogMessage4_1, OU)
+ # Ignore OUs without any events. We're already asserting that the
+ # top-level OU has at least one event; for all other OUs we assume
+ # they inherit from a parent OU if they have no events.
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ LastEvent.NewValue != "ADMIN_ONLY"
+}
+
+NonCompliantOUs4_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage4_1(GetFriendlyValue4_1(whoCreates))
+} if {
+ some OU, settings in input.policies
+ GroupsEnabled(OU)
+ whoCreates := settings.groups_for_business_groups_sharing.createGroupsAccessLevel
+ whoCreates != "ADMIN_ONLY"
+}
+
+tests contains {
+ "PolicyId": GroupsId4_1,
+ "Criticality": "Should",
+ "ReportDetails":utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := false
+ not Check4_1_OK
+}
+
+tests contains {
+ "PolicyId": GroupsId4_1,
+ "Criticality": "Should",
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs4_1, []),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs4_1},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check4_1_OK
+ Status := count(NonCompliantOUs4_1) == 0
+}
+#--
+
+################
+# GWS.GROUPS.5 #
+################
+
+#
+# Baseline GWS.GROUPS.5.1
+#--
+
+GroupsId5_1 := utils.PolicyIdWithSuffix("GWS.GROUPS.5.1")
+
+LogMessage5_1 := "GroupsSharingSettingsProto default_view_topics_access_level"
+
+Check5_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage5_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check5_1_OK if {PolicyApiInUse}
+
+GetFriendlyValue5_1(Value) := "Owners" if {
+ Value == "OWNERS"
+} else := "Managers" if {
+ Value == "MANAGERS"
+} else := "Group members only" if {
+ Value == "GROUP_MEMBERS"
+} else := "Users in your domain only" if {
+ Value == "DOMAIN_USERS"
+} else := "Any user" if {
+ Value in {"ANYONE_CAN_VIEW_TOPICS", "PUBLIC"}
+} else := Value
+
+NonComplianceMessage5_1(value) := sprintf("Group conversations can be viewed by: %s", [value])
+
+NonCompliantOUs5_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage5_1(GetFriendlyValue5_1(LastEvent.NewValue))
+} if {
+ not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+ Events := utils.FilterEventsOU(LogEvents, LogMessage5_1, OU)
+ # Ignore OUs without any events. We're already asserting that the
+ # top-level OU has at least one event; for all other OUs we assume
+ # they inherit from a parent OU if they have no events.
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ LastEvent.NewValue != "MEMBERS"
+}
+
+NonCompliantOUs5_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage5_1(GetFriendlyValue5_1(whoCanView))
+} if {
+ some OU, settings in input.policies
+ GroupsEnabled(OU)
+ whoCanView := settings.groups_for_business_groups_sharing.viewTopicsDefaultAccessLevel
+ whoCanView != "GROUP_MEMBERS"
+}
+
+tests contains {
+ "PolicyId": GroupsId5_1,
+ "Criticality": "Should",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue": "No relevant event in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := false
+ not Check5_1_OK
+}
+
+tests contains {
+ "PolicyId": GroupsId5_1,
+ "Criticality": "Should",
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs5_1, []),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs5_1},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check5_1_OK
+ Status := count(NonCompliantOUs5_1) == 0
+}
+#--
+
+################
+# GWS.GROUPS.6 #
+################
+
+#
+# Baseline GWS.GROUPS.6.1
+#--
+
+GroupsId6_1 := utils.PolicyIdWithSuffix("GWS.GROUPS.6.1")
+
+LogMessage6_1 := "GroupsSharingSettingsProto allow_unlisted_groups"
+
+Check6_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage6_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check6_1_OK if {PolicyApiInUse}
+
+GetFriendlyValue6_1(Value) := "Yes" if {
+ Value in {true, "true"}
+} else := "No" if {
+ Value in {false, "false"}
+} else := Value
+
+NonComplianceMessage6_1(value) := sprintf("Group may be hidden: %s", [value])
+
+NonCompliantOUs6_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage6_1(GetFriendlyValue6_1(LastEvent.NewValue))
+} if {
+ not PolicyApiInUse
+ some OU in utils.OUsWithEvents
+ Events := utils.FilterEventsOU(LogEvents, LogMessage6_1, OU)
+ # Ignore OUs without any events. We're already asserting that the
+ # top-level OU has at least one event; for all other OUs we assume
+ # they inherit from a parent OU if they have no events.
+ count(Events) > 0
+ LastEvent := utils.GetLastEvent(Events)
+ LastEvent.NewValue != "false"
+}
+
+NonCompliantOUs6_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage6_1(GetFriendlyValue6_1(canHideGroups))
+} if {
+ some OU, settings in input.policies
+ GroupsEnabled(OU)
+ canHideGroups := settings.groups_for_business_groups_sharing.ownersCanHideGroups
+ canHideGroups != false
+}
+
+tests contains {
+ "PolicyId": GroupsId6_1,
+ "Criticality": "Shall",
+ "ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
+ "ActualValue":"No relevant event in the current logs",
+ "RequirementMet": DefaultSafe,
+ "NoSuchEvent": true
+}
+if {
+ not PolicyApiInUse
+ DefaultSafe := true
+ not Check6_1_OK
+}
+
+tests contains {
+ "PolicyId": GroupsId6_1,
+ "Criticality": "Shall",
+ "ReportDetails":utils.ReportDetails(NonCompliantOUs6_1, []),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs6_1},
+ "RequirementMet": Status,
+ "NoSuchEvent": false
+}
+if {
+ Check6_1_OK
+ Status := count(NonCompliantOUs6_1) == 0
+}
diff --git a/rego/Meet.rego b/scubagoggles/rego/Meet.rego
similarity index 52%
rename from rego/Meet.rego
rename to scubagoggles/rego/Meet.rego
index f0728c5b..9f6db45f 100644
--- a/rego/Meet.rego
+++ b/scubagoggles/rego/Meet.rego
@@ -1,7 +1,11 @@
package meet
-import data.utils
import future.keywords
+import data.utils
+import data.utils.GetFriendlyEnabledValue
+import data.utils.PolicyApiInUse
+
+MeetEnabled(orgunit) := utils.AppEnabled(input.policies, "meet", orgunit)
LogEvents := utils.GetEvents("meet_logs")
@@ -10,22 +14,40 @@ LogEvents := utils.GetEvents("meet_logs")
##############
#
-# Baseline GWS.MEET.1.1v0.3
+# Baseline GWS.MEET.1.1
#--
+
+MeetId1_1 := utils.PolicyIdWithSuffix("GWS.MEET.1.1")
+
+LogMessage1_1 := "SafetyDomainLockProto users_allowed_to_join"
+
+Check1_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage1_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check1_1_OK if {PolicyApiInUse}
+
+NonComplianceMessage1_1(value) := sprintf("Who can join meetings is set to: %s",
+ [value])
+
GetFriendlyValue1_1(Value) := "all users (including users not signed in with a Google account)" if {
Value == "ALL"
+} else := "users in the same organization" if {
+ Value == "SAME_ORGANIZATION_ONLY"
+} else := "logged in users" if {
+ Value == "LOGGED_IN"
} else := Value
NonCompliantOUs1_1 contains {
"Name": OU,
- "Value": concat(" ", [
- "Who can join meetings is set to",
- GetFriendlyValue1_1(LastEvent.NewValue)
- ])
+ "Value": NonComplianceMessage1_1(GetFriendlyValue1_1(LastEvent.NewValue))
}
if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents, "SafetyDomainLockProto users_allowed_to_join", OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage1_1, OU)
count(Events) > 0
LastEvent := utils.GetLastEvent(Events)
LastEvent.NewValue == "ALL"
@@ -34,23 +56,30 @@ if {
NonCompliantGroups1_1 contains {
"Name": Group,
- "Value": concat(" ", [
- "Who can join meetings is set to",
- GetFriendlyValue1_1(LastEvent.NewValue)
- ])
+ "Value": NonComplianceMessage1_1(GetFriendlyValue1_1(LastEvent.NewValue))
}
if {
+ not PolicyApiInUse
some Group in utils.GroupsWithEvents
- SettingName := "SafetyDomainLockProto users_allowed_to_join"
- Events := utils.FilterEventsGroup(LogEvents, SettingName, Group)
+ Events := utils.FilterEventsGroup(LogEvents, LogMessage1_1, Group)
count(Events) > 0
LastEvent := utils.GetLastEvent(Events)
LastEvent.NewValue == "ALL"
LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
}
+NonCompliantOUs1_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage1_1(GetFriendlyValue1_1(meetAccess))
+} if {
+ some OU, settings in input.policies
+ MeetEnabled(OU)
+ meetAccess := settings.meet_safety_domain.usersAllowedToJoin
+ not meetAccess in ["SAME_ORGANIZATION_ONLY", "LOGGED_IN"]
+}
+
tests contains {
- "PolicyId": "GWS.MEET.1.1v0.3",
+ "PolicyId": MeetId1_1,
"Criticality": "Should",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event for the top-level OU in the current logs",
@@ -58,13 +87,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := false
- Events := utils.FilterEventsOU(LogEvents, "SafetyDomainLockProto users_allowed_to_join", utils.TopLevelOU)
- count(Events) == 0
+ not Check1_1_OK
}
tests contains {
- "PolicyId": "GWS.MEET.1.1v0.3",
+ "PolicyId": MeetId1_1,
"Criticality": "Should",
"ReportDetails": utils.ReportDetails(NonCompliantOUs1_1, NonCompliantGroups1_1),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs1_1, "NonCompliantGroups": NonCompliantGroups1_1},
@@ -72,8 +101,7 @@ tests contains {
"NoSuchEvent": false
}
if {
- Events := utils.FilterEventsOU(LogEvents, "SafetyDomainLockProto users_allowed_to_join", utils.TopLevelOU)
- count(Events) > 0
+ Check1_1_OK
Conditions := {count(NonCompliantOUs1_1) == 0, count(NonCompliantGroups1_1) == 0}
Status := (false in Conditions) == false
}
@@ -84,22 +112,40 @@ if {
##############
#
-# Baseline GWS.MEET.2.1v0.3
+# Baseline GWS.MEET.2.1
#--
-GetFriendlyValue2_1(Value) := "any meetings, including meetings created with personal accounts" if {
+
+MeetId2_1 := utils.PolicyIdWithSuffix("GWS.MEET.2.1")
+
+LogMessage2_1 := "SafetyAccessLockProto meetings_allowed_to_join"
+
+Check2_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage2_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check2_1_OK if {PolicyApiInUse}
+
+NonComplianceMessage2_1(value) := sprintf("What meetings can users join is set to: %s",
+ [value])
+
+GetFriendlyValue2_1(Value) := "any meetings (including meetings created with personal accounts)" if {
Value == "ALL"
+} else := "meetings hosted by the same organization" if {
+ Value == "SAME_ORGANIZATION_ONLY"
+} else := "meetings hosted by any workspace organization" if {
+ Value == "ANY_WORKSPACE_ORGANIZATION"
} else := Value
NonCompliantOUs2_1 contains {
"Name": OU,
- "Value": concat(" ", [
- "What meetings can org users join is set to",
- GetFriendlyValue2_1(LastEvent.NewValue)
- ])
+ "Value": NonComplianceMessage2_1(GetFriendlyValue2_1(LastEvent.NewValue))
}
if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents, "SafetyAccessLockProto meetings_allowed_to_join", OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage2_1, OU)
count(Events) > 0
LastEvent := utils.GetLastEvent(Events)
LastEvent.NewValue == "ALL"
@@ -108,23 +154,30 @@ if {
NonCompliantGroups2_1 contains {
"Name": Group,
- "Value": concat(" ", [
- "What meetings can org users join is set to",
- GetFriendlyValue2_1(LastEvent.NewValue)
- ])
+ "Value": NonComplianceMessage2_1(GetFriendlyValue2_1(LastEvent.NewValue))
}
if {
+ not PolicyApiInUse
some Group in utils.GroupsWithEvents
- SettingName := "SafetyAccessLockProto meetings_allowed_to_join"
- Events := utils.FilterEventsGroup(LogEvents, SettingName, Group)
+ Events := utils.FilterEventsGroup(LogEvents, LogMessage2_1, Group)
count(Events) > 0
LastEvent := utils.GetLastEvent(Events)
LastEvent.NewValue == "ALL"
LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
}
+NonCompliantOUs2_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage2_1(GetFriendlyValue2_1(meetAccess))
+} if {
+ some OU, settings in input.policies
+ MeetEnabled(OU)
+ meetAccess := settings.meet_safety_access.meetingsAllowedToJoin
+ not meetAccess in ["SAME_ORGANIZATION_ONLY", "ANY_WORKSPACE_ORGANIZATION"]
+}
+
tests contains {
- "PolicyId": "GWS.MEET.2.1v0.3",
+ "PolicyId": MeetId2_1,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event in the current logs",
@@ -132,23 +185,24 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := false
- Events := utils.FilterEventsOU(LogEvents, "SafetyAccessLockProto meetings_allowed_to_join", utils.TopLevelOU)
- count(Events) == 0
+ not Check2_1_OK
}
tests contains {
- "PolicyId": "GWS.MEET.2.1v0.3",
+ "PolicyId": MeetId2_1,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs2_1, NonCompliantGroups2_1),
- "ActualValue": {"NonCompliantOUs": NonCompliantOUs2_1, "NonCompliantGroups": NonCompliantGroups2_1},
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs2_1,
+ "NonCompliantGroups": NonCompliantGroups2_1},
"RequirementMet": Status,
"NoSuchEvent": false
}
if {
- Events := utils.FilterEventsOU(LogEvents, "SafetyAccessLockProto meetings_allowed_to_join", utils.TopLevelOU)
- count(Events) > 0
- Conditions := {count(NonCompliantOUs2_1) == 0, count(NonCompliantGroups2_1) == 0}
+ Check2_1_OK
+ Conditions := {count(NonCompliantOUs2_1) == 0,
+ count(NonCompliantGroups2_1) == 0}
Status := (false in Conditions) == false
}
#--
@@ -158,22 +212,32 @@ if {
##############
#
-# Baseline GWS.MEET.3.1v0.3
+# Baseline GWS.MEET.3.1
#--
-GetFriendlyValue3_1(Value) := "off" if {
- Value == "false"
-} else := Value
+
+MeetId3_1 := utils.PolicyIdWithSuffix("GWS.MEET.3.1")
+
+LogMessage3_1 := "SafetyModerationLockProto host_management_enabled"
+
+Check3_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage3_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check3_1_OK if {PolicyApiInUse}
+
+NonComplianceMessage3_1(value) := sprintf("Host management when video calls start is: %s",
+ [value])
NonCompliantOUs3_1 contains {
"Name": OU,
- "Value": concat(" ", [
- "Host management when video calls start is set to",
- GetFriendlyValue3_1(LastEvent.NewValue)
- ])
+ "Value": NonComplianceMessage3_1(GetFriendlyEnabledValue(LastEvent.NewValue))
}
if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- Events := utils.FilterEventsOU(LogEvents, "SafetyModerationLockProto host_management_enabled", OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage3_1, OU)
count(Events) > 0
LastEvent := utils.GetLastEvent(Events)
LastEvent.NewValue == "false"
@@ -182,23 +246,30 @@ if {
NonCompliantGroups3_1 contains {
"Name": Group,
- "Value": concat(" ", [
- "Host management when video calls start is set to",
- GetFriendlyValue3_1(LastEvent.NewValue)
- ])
+ "Value": NonComplianceMessage3_1(GetFriendlyEnabledValue(LastEvent.NewValue))
}
if {
+ not PolicyApiInUse
some Group in utils.GroupsWithEvents
- SettingName := "SafetyModerationLockProto host_management_enabled"
- Events := utils.FilterEventsGroup(LogEvents, SettingName, Group)
+ Events := utils.FilterEventsGroup(LogEvents, LogMessage3_1, Group)
count(Events) > 0
LastEvent := utils.GetLastEvent(Events)
LastEvent.NewValue == "false"
LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
}
+NonCompliantOUs3_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage3_1(GetFriendlyEnabledValue(hostMgt))
+} if {
+ some OU, settings in input.policies
+ MeetEnabled(OU)
+ hostMgt := settings.meet_safety_host_management.enableHostManagement
+ hostMgt != true
+}
+
tests contains {
- "PolicyId": "GWS.MEET.3.1v0.3",
+ "PolicyId": MeetId3_1,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event in the current logs",
@@ -206,22 +277,23 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := false
- Events := utils.FilterEventsOU(LogEvents, "SafetyModerationLockProto host_management_enabled", utils.TopLevelOU)
- count(Events) == 0
+ not Check3_1_OK
}
tests contains {
- "PolicyId": "GWS.MEET.3.1v0.3",
+ "PolicyId": MeetId3_1,
"Criticality": "Shall",
- "ReportDetails": utils.ReportDetails(NonCompliantOUs3_1, NonCompliantGroups3_1),
- "ActualValue": {"NonCompliantOUs": NonCompliantOUs3_1, "NonCompliantGroups": NonCompliantGroups3_1},
+ "ReportDetails": utils.ReportDetails(NonCompliantOUs3_1,
+ NonCompliantGroups3_1),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs3_1,
+ "NonCompliantGroups": NonCompliantGroups3_1},
"RequirementMet": Status,
"NoSuchEvent": false
}
if {
- Events := utils.FilterEventsOU(LogEvents, "SafetyModerationLockProto host_management_enabled", utils.TopLevelOU)
- count(Events) > 0
+ Check3_1_OK
Conditions := {count(NonCompliantOUs3_1) == 0, count(NonCompliantGroups3_1) == 0}
Status := (false in Conditions) == false
}
@@ -232,23 +304,34 @@ if {
##############
#
-# Baseline GWS.MEET.4.1v0.3
+# Baseline GWS.MEET.4.1
#--
-GetFriendlyValue4_1(Value) := "no warning label" if {
- Value == "false"
-} else := Value
+
+MeetId4_1 := utils.PolicyIdWithSuffix("GWS.MEET.4.1")
+
+LogMessage4_1 := concat("", ["Warn for external participants External or ",
+ "unidentified participants in a meeting are ",
+ "given a label"])
+
+Check4_1_OK if {
+ not PolicyApiInUse
+ events := utils.FilterEventsOU(LogEvents, LogMessage4_1, utils.TopLevelOU)
+ count(events) > 0
+}
+
+Check4_1_OK if {PolicyApiInUse}
+
+NonComplianceMessage4_1(value) := sprintf("Warning label for external or unidentified meeting participants is: %s",
+ [value])
NonCompliantOUs4_1 contains {
"Name": OU,
- "Value": concat(" ", [
- "Warning label for external or unidentified meeting participants is set to",
- GetFriendlyValue4_1(LastEvent.NewValue)
- ])
+ "Value": NonComplianceMessage4_1(GetFriendlyEnabledValue(LastEvent.NewValue))
}
if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
- SettingName := "Warn for external participants External or unidentified participants in a meeting are given a label"
- Events := utils.FilterEventsOU(LogEvents, SettingName, OU)
+ Events := utils.FilterEventsOU(LogEvents, LogMessage4_1, OU)
count(Events) > 0
LastEvent := utils.GetLastEvent(Events)
LastEvent.NewValue == "false"
@@ -257,23 +340,30 @@ if {
NonCompliantGroups4_1 contains {
"Name": Group,
- "Value": concat(" ", [
- "Warning label for external or unidentified meeting participants is set to",
- GetFriendlyValue4_1(LastEvent.NewValue)
- ])
+ "Value": NonComplianceMessage4_1(GetFriendlyEnabledValue(LastEvent.NewValue))
}
if {
+ not PolicyApiInUse
some Group in utils.GroupsWithEvents
- SettingName := "Warn for external participants External or unidentified participants in a meeting are given a label"
- Events := utils.FilterEventsGroup(LogEvents, SettingName, Group)
+ Events := utils.FilterEventsGroup(LogEvents, LogMessage4_1, Group)
count(Events) > 0
LastEvent := utils.GetLastEvent(Events)
LastEvent.NewValue == "false"
LastEvent.NewValue != "DELETE_APPLICATION_SETTING"
}
+NonCompliantOUs4_1 contains {
+ "Name": OU,
+ "Value": NonComplianceMessage4_1(GetFriendlyEnabledValue(extWarn))
+} if {
+ some OU, settings in input.policies
+ MeetEnabled(OU)
+ extWarn := settings.meet_safety_external_participants.enableExternalLabel
+ extWarn != true
+}
+
tests contains {
- "PolicyId": "GWS.MEET.4.1v0.3",
+ "PolicyId": MeetId4_1,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event in the current logs",
@@ -281,14 +371,13 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := true
- SettingName := "Warn for external participants External or unidentified participants in a meeting are given a label"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) == 0
+ not Check4_1_OK
}
tests contains {
- "PolicyId": "GWS.MEET.4.1v0.3",
+ "PolicyId": MeetId4_1,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs4_1, NonCompliantGroups4_1),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs4_1, "NonCompliantGroups": NonCompliantGroups4_1},
@@ -296,9 +385,7 @@ tests contains {
"NoSuchEvent": false
}
if {
- SettingName := "Warn for external participants External or unidentified participants in a meeting are given a label"
- Events := utils.FilterEventsOU(LogEvents, SettingName, utils.TopLevelOU)
- count(Events) > 0
+ Check4_1_OK
Conditions := {count(NonCompliantOUs4_1) == 0, count(NonCompliantGroups4_1) == 0}
Status := (false in Conditions) == false
}
@@ -309,8 +396,11 @@ if {
##############
#
-# Baseline GWS.MEET.5.1v0.3
+# Baseline GWS.MEET.5.1
#--
+
+MeetId5_1 := utils.PolicyIdWithSuffix("GWS.MEET.5.1")
+
NonCompliantOUs5_1 contains {
"Name": OU,
"Value": "Users can receive calls from anyone"
@@ -338,7 +428,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.MEET.5.1v0.3",
+ "PolicyId": MeetId5_1,
"Criticality": "Shall",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event in the current logs",
@@ -353,7 +443,7 @@ if {
}
tests contains {
- "PolicyId": "GWS.MEET.5.1v0.3",
+ "PolicyId": MeetId5_1,
"Criticality": "Shall",
"ReportDetails": utils.ReportDetails(NonCompliantOUs5_1, NonCompliantGroups5_1),
"ActualValue": {"NonCompliantOUs": NonCompliantOUs5_1, "NonCompliantGroups": NonCompliantGroups5_1},
diff --git a/rego/Rules.rego b/scubagoggles/rego/Rules.rego
similarity index 98%
rename from rego/Rules.rego
rename to scubagoggles/rego/Rules.rego
index 9bc82cd8..eb85e395 100644
--- a/rego/Rules.rego
+++ b/scubagoggles/rego/Rules.rego
@@ -1,5 +1,6 @@
package rules
import future.keywords
+import data.utils
FilterAlertsEvents(RuleName) := FilteredEvents if
{
@@ -344,9 +345,12 @@ EmailOnlyRules := {
#
# This pair of tests handles all of the above rules with alert center actions
#--
+
+CommonControlsId13_1 := utils.PolicyIdWithSuffix("GWS.COMMONCONTROLS.13.1")
+
tests contains {
"Requirement": Rule.RuleName,
- "PolicyId": "GWS.COMMONCONTROLS.13.1v0.3",
+ "PolicyId": CommonControlsId13_1,
"Criticality": Rule.Criticality,
"ReportDetails": Rule.Details,
"ActualValue": Events,
@@ -361,7 +365,7 @@ if {
tests contains {
"Requirement": Rule.RuleName,
- "PolicyId": "GWS.COMMONCONTROLS.13.1v0.3",
+ "PolicyId": CommonControlsId13_1,
"Criticality": Rule.Criticality,
"ReportDetails": Rule.Details,
"ActualValue": Events,
@@ -382,7 +386,7 @@ if {
#--
tests contains {
"Requirement": Rule.RuleName,
- "PolicyId": "GWS.COMMONCONTROLS.13.1v0.3",
+ "PolicyId": CommonControlsId13_1,
"Criticality": Rule.Criticality,
"ReportDetails": Rule.Details,
"ActualValue": Events,
@@ -397,7 +401,7 @@ if {
tests contains {
"Requirement": Rule.RuleName,
- "PolicyId": "GWS.COMMONCONTROLS.13.1v0.3",
+ "PolicyId": CommonControlsId13_1,
"Criticality": Rule.Criticality,
"ReportDetails": Rule.Details,
"ActualValue": Events,
@@ -414,4 +418,4 @@ if {
contains(LastEvent.Change, "receivers changed from NULL to")
}
}
-#--
\ No newline at end of file
+#--
diff --git a/rego/Sites.rego b/scubagoggles/rego/Sites.rego
similarity index 72%
rename from rego/Sites.rego
rename to scubagoggles/rego/Sites.rego
index 75f42a78..c9640e64 100644
--- a/rego/Sites.rego
+++ b/scubagoggles/rego/Sites.rego
@@ -1,7 +1,10 @@
package sites
-import data.utils
import future.keywords
+import data.utils
+import data.utils.PolicyApiInUse
+
+SitesEnabled(orgunit) := utils.AppEnabled(input.policies, "sites", orgunit)
FilterEventsOU(OrgUnit) := FilteredEvents if {
# If there exists at least the root OU and 1 more OU
@@ -70,12 +73,15 @@ if {
###############
#
-# Baseline GWS.SITES.1.1v0.3
+# Baseline GWS.SITES.1.1
#--
+ServiceStatusOnMessage := "Service status for Sites is ON."
+
NonCompliantOUs1_1 contains {
"Name": OU,
- "Value": "Service status for Sites is ON."
+ "Value": ServiceStatusOnMessage
} if {
+ not PolicyApiInUse
some OU in utils.OUsWithEvents
Events := FilterEventsOU(OU)
# Ignore OUs without any events. We're already asserting that the
@@ -89,8 +95,9 @@ NonCompliantOUs1_1 contains {
NonCompliantGroups1_1 contains {
"Name": Group,
- "Value": "Service status for Sites is ON."
+ "Value": ServiceStatusOnMessage
} if {
+ not PolicyApiInUse
some Group in utils.GroupsWithEvents
Events := FilterEventsGroup(Group)
# Ignore Groups without any events.
@@ -100,8 +107,29 @@ NonCompliantGroups1_1 contains {
LastEvent.NewValue != "INHERIT_FROM_PARENT"
}
+NonCompliantOUs1_1 contains {
+ "Name": OU,
+ "Value": ServiceStatusOnMessage
+} if {
+ some OU, settings in input.policies
+ SitesEnabled(OU)
+}
+
+# This check is done a few times below. It's True if either the policy API
+# is in use or there is at least one event returned for the top-level orgunit.
+
+CheckOK if {
+ not PolicyApiInUse
+ events := FilterEventsOU(utils.TopLevelOU)
+ count(events) > 0
+}
+
+CheckOK if {PolicyApiInUse}
+
+SitesId1_1 := utils.PolicyIdWithSuffix("GWS.SITES.1.1")
+
tests contains {
- "PolicyId": "GWS.SITES.1.1v0.3",
+ "PolicyId": SitesId1_1,
"Criticality": "Should",
"ReportDetails": utils.NoSuchEventDetails(DefaultSafe, utils.TopLevelOU),
"ActualValue": "No relevant event in the current logs",
@@ -109,23 +137,25 @@ tests contains {
"NoSuchEvent": true
}
if {
+ not PolicyApiInUse
DefaultSafe := false
- Events := FilterEventsOU(utils.TopLevelOU)
- count(Events) == 0
+ not CheckOK
}
tests contains {
- "PolicyId": "GWS.SITES.1.1v0.3",
+ "PolicyId": SitesId1_1,
"Criticality": "Should",
- "ReportDetails":utils.ReportDetails(NonCompliantOUs1_1, NonCompliantGroups1_1),
- "ActualValue": {"NonCompliantOUs": NonCompliantOUs1_1, "NonCompliantGroups": NonCompliantGroups1_1},
+ "ReportDetails":utils.ReportDetails(NonCompliantOUs1_1,
+ NonCompliantGroups1_1),
+ "ActualValue": {"NonCompliantOUs": NonCompliantOUs1_1,
+ "NonCompliantGroups": NonCompliantGroups1_1},
"RequirementMet": Status,
"NoSuchEvent": false
}
if {
- Events := FilterEventsOU(utils.TopLevelOU)
- count(Events) > 0
- Conditions := {count(NonCompliantOUs1_1) == 0, count(NonCompliantGroups1_1) == 0}
+ CheckOK
+ Conditions := {count(NonCompliantOUs1_1) == 0,
+ count(NonCompliantGroups1_1) == 0}
Status := (false in Conditions) == false
}
-#--
\ No newline at end of file
+#--
diff --git a/rego/Utils.rego b/scubagoggles/rego/Utils.rego
similarity index 63%
rename from rego/Utils.rego
rename to scubagoggles/rego/Utils.rego
index eb00bcbb..333a41b8 100644
--- a/rego/Utils.rego
+++ b/scubagoggles/rego/Utils.rego
@@ -1,6 +1,26 @@
package utils
import future.keywords
+# This is for use in versioning the baseline policy identifiers. Because all
+# policy identifiers have the same baseline version suffix, it makes sense
+# to define the version once here, so it only has to be changed once. The
+# policy identifiers are created with the PolicyIdWithSuffix() function.
+#
+# The baseline version suffix value is included by the Orchestrator in the
+# input data for normal policy evaluation. For testing, the version suffix
+# is not required in the input data, as the default will be used and the
+# results are only processed by OPA (and not the Reporter, which WILL look
+# for matches between policy IDs in the Markdown and OPA results).
+
+default BaseVersionSuffix := "vM.m"
+
+BaseVersionSuffix := input.baseline_suffix if {
+ "baseline_suffix" in object.keys(input)}
+
+PolicyIdWithSuffix(PolicyIdPrefix) := sprintf("%s%s",
+ [PolicyIdPrefix,
+ BaseVersionSuffix])
+
NoSuchEventDetails(DefaultSafe, TopLevelOU) := Message if {
DefaultSafe == true
Message := concat("", [
@@ -47,39 +67,18 @@ ReportDetailsBoolean(true) := "Requirement met."
ReportDetailsBoolean(false) := "Requirement not met."
-ReportDetailsDetailedOU(_, NonCompOUs) := "Requirement met in all OUs." if {
- count(NonCompOUs) == 0
-}
+EnumOUSettings(NonCompOUs) := NonCompliantMessage("OUs", NonCompOUs)
-# Create a html formatted list detailing the settings for each OU
-# - NonCompOUs: a set of dicts, each with a "Name" and "Value" fields
-EnumOUSettings(NonCompOUs) := concat("", [
- "The following OUs are non-compliant:",
- "",
- concat("", [concat("", [
- "- ",
- OU.Name,
- ": ",
- OU.Value,
- "
"
- ]) | some OU in NonCompOUs]),
- "
"
-])
-
-# Create a html formatted list detailing the settings for each group
-# - NonCompGroups: a set of dicts, each with a "Name" and "Value" fields
-EnumGroupSettings(NonCompGroups) := concat("", [
- "The following groups are non-compliant:",
- "",
- concat("", [concat("", [
- "- ",
- Group.Name,
- ": ",
- Group.Value,
- "
"
- ]) | some Group in NonCompGroups]),
- "
"
-])
+EnumGroupSettings(NonCompGroups) := NonCompliantMessage("groups", NonCompGroups)
+
+# Create a html formatted list detailing the settings for each OU/group
+# - Listing: a set of dicts, each with a "Name" and "Value" fields
+NonCompliantMessage(GroupsOrOU, Listing) := message if {
+ items := [concat("", ["", item.Name, ": ", item.Value, ""])
+ | some item in Listing]
+ message := sprintf("The following %s are non-compliant:",
+ [GroupsOrOU, concat("", items)])
+}
ReportDetails(NonCompOUs, NonCompGroups) := Description if {
count(NonCompOUs) > 0
@@ -102,10 +101,12 @@ ReportDetails(NonCompOUs, NonCompGroups) := Description if {
Description := EnumGroupSettings(NonCompGroups)
}
+RequirementsMetMessage := "Requirement met in all OUs and groups."
+
ReportDetails(NonCompOUs, NonCompGroups) := Description if {
count(NonCompOUs) == 0
count(NonCompGroups) == 0
- Description := "Requirement met in all OUs and groups."
+ Description := RequirementsMetMessage
}
OUsWithEvents contains OrgUnit if {
@@ -416,4 +417,150 @@ GetEvents(LogName) := Events if {
# Returns all conditions that match passed value (true/false)
# Commonly used for OR/Any conditions
-FilterArray(Conditions, Boolean) := [Condition | some Condition in Conditions; Condition == Boolean]
\ No newline at end of file
+FilterArray(Conditions, Boolean) := [Condition | some Condition in Conditions; Condition == Boolean]
+
+# Use GetApiSettingValue() when you need to determine for a "sub" orgunit
+# (not the top-level orgunit) the current setting value. It may be set
+# explicitly in the orgunit, but it may be inherited from the top-level
+# orgunit. This function handles both cases. The ApiSettingExists() is
+# a helper function that indicates whether a setting is present in the given
+# orgunit. All settings MUST be present in the top-level orgunit.
+
+ApiSettingExists(Section, Setting, OU) := true if {
+ OUSettings := input.policies[OU]
+ Section in object.keys(OUSettings)
+ Setting in object.keys(OUSettings[Section])
+} else := false
+
+GetApiSettingValue(Section, Setting, OU) := Value if {
+ not ApiSettingExists(Section, Setting, OU)
+ topOUSettings := input.policies[TopLevelOU]
+ Value := topOUSettings[Section][Setting]
+}
+
+GetApiSettingValue(Section, Setting, OU) := Value if {
+ OUSettings := input.policies[OU]
+ Value := OUSettings[Section][Setting]
+}
+
+# The following functions are intended for use in testing the Scubagoggles
+# Rego modules.
+
+PassTestResult(PolicyId, Output) := TestResult(PolicyId,
+ Output,
+ RequirementsMetMessage,
+ true)
+
+PassTestResultWithMessage(PolicyId, Output, Message) := TestResult(PolicyId,
+ Output,
+ Message,
+ true)
+
+FailTestResult(PolicyId, Output, FailMessage) := TestResult(PolicyId,
+ Output,
+ FailMessage,
+ false)
+
+FailTestNoEvent(PolicyId, Output, TopOU, defaultOK) := true if {
+ RuleOutput := FindTestOutput(PolicyId, Output)
+ RuleOutput.RequirementMet == defaultOK
+ RuleOutput.NoSuchEvent
+ RuleOutput.ReportDetails == NoSuchEventDetails(defaultOK, TopOU)
+} else := false
+
+FailTestGroupNonCompliant(PolicyId, Output, Listing) if {
+ RuleOutput := FindTestOutput(PolicyId, Output)
+ not RuleOutput.RequirementMet
+ not RuleOutput.NoSuchEvent
+ RuleOutput.ReportDetails == EnumGroupSettings(Listing)
+} else := false
+
+FailTestOUNonCompliant(PolicyId, Output, Listing) if {
+ RuleOutput := FindTestOutput(PolicyId, Output)
+ not RuleOutput.RequirementMet
+ not RuleOutput.NoSuchEvent
+ RuleOutput.ReportDetails == EnumOUSettings(Listing)
+} else := false
+
+FailTestNonCompliant(PolicyId, Output, Message) if {
+ RuleOutput := FindTestOutput(PolicyId, Output)
+ not RuleOutput.RequirementMet
+ not RuleOutput.NoSuchEvent
+ RuleOutput.ReportDetails == Message
+} else := false
+
+FailTestBothNonCompliant(PolicyId, Output, OUListing, GroupListing) if {
+ RuleOutput := FindTestOutput(PolicyId, Output)
+ not RuleOutput.RequirementMet
+ not RuleOutput.NoSuchEvent
+ RuleOutput.ReportDetails == sprintf("%s
%s",
+ [EnumOUSettings(OUListing),
+ EnumGroupSettings(GroupListing)])
+} else := false
+
+TestResult(PolicyId, Output, ReportDetailString, RequirementMet) := true if {
+ RuleOutput := FindTestOutput(PolicyId, Output)
+ RuleOutput.RequirementMet == RequirementMet
+ EventsOK(RuleOutput)
+ RuleOutput.ReportDetails == ReportDetailString
+} else := false
+
+FindTestOutput(PolicyId, Output) := RuleOutput if {
+ RulesOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RulesOutput) == 1
+ RuleOutput := RulesOutput[0]
+}
+
+EventsOK(RuleOutput) if {
+ PolicyApiInUse
+} else if {
+ not RuleOutput.NoSuchEvent
+} else := false
+
+default PolicyApiInUse := false
+
+PolicyApiInUse if {"policies" in object.keys(input)}
+
+# The function you should use to determine the enabled state is AppEnabled().
+# AppDisabled() only checks whether the orgunit has an explicit disabled
+# state - if it doesn't have an explicit state setting, it'll inherit
+# the setting from the top orgunit. Use AppEnabled() and NOT AppDisabled()!
+# Use it like this, for example (with Chat):
+#
+# ChatEnabled(orgunit) := utils.AppEnabled(input.policies, "chat", orgunit)
+#
+# (you have to make sure the service status name is "chat_service_status" in
+# the policies input data).
+
+AppDisabled(policies, serviceStatusName, orgunit) if {
+ appState := policies[orgunit][serviceStatusName].serviceState
+ upper(appState) == "DISABLED"
+}
+
+default AppEnabled(_, _, _) := false
+
+AppServiceStatusName(appName) := sprintf("%s_service_status", [appName])
+
+AppEnabled(policies, appName, orgunit) if {
+ serviceStatusName := AppServiceStatusName(appName)
+ appState := policies[orgunit][serviceStatusName].serviceState
+ upper(appState) == "ENABLED"
+}
+
+AppEnabled(policies, appName, orgunit) if {
+ serviceStatusName := AppServiceStatusName(appName)
+ not AppDisabled(policies, serviceStatusName, orgunit)
+ appState := policies[TopLevelOU][serviceStatusName].serviceState
+ upper(appState) == "ENABLED"
+}
+
+# There are a lot of policies that have enabled/disabled states. The states
+# (values) in the log events are strings ("true", "false), while the states
+# in the Policy API are booleans (true, false). This is a common function
+# to translate the states to "enabled"/"disabled".
+
+GetFriendlyEnabledValue(Value) := "enabled" if {
+ Value in {true, "true"}
+} else := "disabled" if {
+ Value in {false, "false"}
+} else := Value
diff --git a/scubagoggles/reporter/FrontPageReport/FrontPageReportTemplate.html b/scubagoggles/reporter/FrontPageReport/FrontPageReportTemplate.html
index 303a66ef..6667705c 100644
--- a/scubagoggles/reporter/FrontPageReport/FrontPageReportTemplate.html
+++ b/scubagoggles/reporter/FrontPageReport/FrontPageReportTemplate.html
@@ -17,12 +17,11 @@
SCuBA GWS Secure Configuration Baseline Reports
{{TENANT_DETAILS}}
-
+
{{TABLE}}
-
+
### Policies
@@ -1032,7 +1032,7 @@ Required system-defined alerting rules, as listed in the Policy group descriptio
Configure GWS to send critical logs to the agency's centralized Security Information and Event Management (SIEM) so that they can be audited and queried. Configure GWS to send logs to a storage account and retain them for when incident response is needed.
-### Policy
+### Policies
#### GWS.COMMONCONTROLS.14.1v0.3
The following critical logs SHALL be sent to the agency's centralized SIEM.
@@ -1097,7 +1097,7 @@ Google Workspace administrators can choose to store data in a specific geographi
At the time of writing, data region policies cannot be applied to data types not specifically listed in documentation linked in the resources section. Notably, this includes logs and cached content.
-### Policy
+### Policies
#### GWS.COMMONCONTROLS.15.1v0.3
The data storage region SHALL be set to be the United States for all users in the agency's GWS environment.
@@ -1174,7 +1174,7 @@ To configure Supplemental Data Storage per the policy:
Google Workspace considers some of its services "core services," including Gmail, Calendar, and Drive. Services outside of this core offering are controlled within the "Additional Google services" portion of the admin console. This section outlines requirements relating to those services.
-### Policy
+### Policies
#### GWS.COMMONCONTROLS.16.1v0.3
Service status for Google services that do not have an individual control SHOULD be set to OFF for everyone.
@@ -1223,7 +1223,7 @@ User access to Early Access Apps SHOULD be disabled.
3. Click **Save**.
#### GWS.COMMONCONTROLS.16.2v0.3 Instructions
-1. In the list of all services, scroll to and click on the **Early Access Apps** service.
+1. In the list of all services, scroll to and click on the **Early Access Apps** service.
2. Click on **Service status**.
3. Ensure **OFF for everyone** is checked.
4. Click **Save**.
@@ -1231,7 +1231,7 @@ User access to Early Access Apps SHOULD be disabled.
## 17. Multi-Party Approval
This section covers whether multiple super admins need to approve changes to specific admin console settings.
-### Policy
+### Policies
#### GWS.COMMONCONTROLS.17.1v0.3
Require multi party approval for sensitive admin actions SHALL be enabled.
@@ -1266,7 +1266,7 @@ DLP rules can use predefined content detectors to match PII (e.g., SSN), credent
There are several commercial DLP solutions available that document support for Google Workspace. Google itself offers DLP services. Agencies may select any service that fits their needs and meets the baseline requirements outlined in this policy group. The DLP solution selected by an agency should offer services comparable to those offered by Google.
-Though use of Google's DLP solution is not strictly required, guidance for configuring Google's DLP solution can be found in the instructions of this policy section.
+Though use of Google's DLP solution is not strictly required, guidance for configuring Google's DLP solution can be found in the instructions of this policy section.
### Policies
#### GWS.COMMONCONTROLS.18.1v0.3
@@ -1335,7 +1335,7 @@ Drive DLP and Chat DLP are available to Cloud Identity Premium users with a Goog
#### GWS COMMONCONTROLS 18 Common Instructions
1. Sign in to the [Google Admin Console](https://admin.google.com).
2. Select **Menu -\> Security -\> Access and data control -\> Data protection**.
-3. Under **Data protection rules and detectors** click **Manage Rules**.
+3. Under **Data protection rules and detectors** click **Manage Rules**.
4. Click **Add rule** -\> **New rule**.
#### GWS.COMMONCONTROLS.18.1v0.3 Instructions
@@ -1345,7 +1345,7 @@ Drive DLP and Chat DLP are available to Cloud Identity Premium users with a Goog
4. In the **Conditions** section:
1. Click **Add Condition**. For **Content type to scan** select **All content**. For **What to scan for** select **Matches predefined data type**. For **Select data type** select **Global - Credit card number**. Select the remaining condition properties according to agency need.
2. Click **Add Condition**. For **Content type to scan** select **All content**. For **What to scan for** select **Matches predefined data type**. For **Select data type** select **United States - Individual Taxpayer Identification Number**. Select the remaining condition properties according to agency need.
- 3. Click **Add Condition**. For **Content type to scan** select **All content**. For **What to scan for** select **Matches predefined data type**. For **Select data type** select **United States - Social Security Number***. Select the remaining condition properties according to agency need.
+ 3. Click **Add Condition**. For **Content type to scan** select **All content**. For **What to scan for** select **Matches predefined data type**. For **Select data type** select **United States - Social Security Number***. Select the remaining condition properties according to agency need.
4. Configure other appropriate content and condition definition(s) based upon the agency's individual requirements and click **Continue**.
5. In the **Actions** section, select **Block external sharing** (per [GWS.COMMONCONTROLS.18.4v0.3](#gwscommoncontrols184v03)).
6. In the **Alerting** section, choose a severity level, and optionally, check **Send to alert center to trigger notifications**.
@@ -1353,12 +1353,12 @@ Drive DLP and Chat DLP are available to Cloud Identity Premium users with a Goog
#### GWS.COMMONCONTROLS.18.2v0.3 Instructions
1. In the **Name** section, add the name and description of the rule.
-2. In the **Scope** section, apply this rule to the entire domain and click **Continue**.
+2. In the **Scope** section, apply this rule to the entire domain and click **Continue**.
3. In the **Apps** section, choose the trigger for **Google Chat, Message sent, File uploaded** then click **Continue**.
4. In the **Conditions** section:
1. Click **Add Condition**. For **Content type to scan** select **All content**. For **What to scan for** select **Matches predefined data type**. For **Select data type** select **Global - Credit card number**. Select the remaining condition properties according to agency need.
- 2. Click **Add Condition**. For **Content type to scan** select **All content**. For **What to scan for** select **Matches predefined data type**. For **Select data type** select **United States - Individual Taxpayer Identification Number**. Select the remaining condition properties according to agency need.
- 3. Click **Add Condition**. For **Content type to scan** select **All content**. For **What to scan for** select **Matches predefined data type**. For **Select data type** select **United States - Social Security Number***. Select the remaining condition properties according to agency need.
+ 2. Click **Add Condition**. For **Content type to scan** select **All content**. For **What to scan for** select **Matches predefined data type**. For **Select data type** select **United States - Individual Taxpayer Identification Number**. Select the remaining condition properties according to agency need.
+ 3. Click **Add Condition**. For **Content type to scan** select **All content**. For **What to scan for** select **Matches predefined data type**. For **Select data type** select **United States - Social Security Number***. Select the remaining condition properties according to agency need.
4. Configure other appropriate content and condition definition(s) based upon the agency's individual requirements and click **Continue**.
5. In the **Actions** section, select **Block**. Under **Select when this action should apply**, select **External Conversations**, **Spaces**, **Group chats**, and **1:1 chats** (See [GWS.COMMONCONTROLS.18.4v0.3](#gwscommoncontrols184v03)).
6. In the **Alerting** section, choose a severity level, and optionally, check **Send to alert center to trigger notifications**.
@@ -1366,12 +1366,12 @@ Drive DLP and Chat DLP are available to Cloud Identity Premium users with a Goog
#### GWS.COMMONCONTROLS.18.3v0.3 Instructions
1. In the **Name** section, add the name and description of the rule.
-2. In the **Scope** section, apply this rule to the entire domain and click **Continue**.
+2. In the **Scope** section, apply this rule to the entire domain and click **Continue**.
3. In the **Apps** section, choose the trigger for **Gmail, Message sent** then click **Continue**.
4. In the **Conditions** section:
1. Click **Add Condition**. For **Content type to scan** select **All content**. For **What to scan for** select **Matches predefined data type**. For **Select data type** select **Global - Credit card number**. Select the remaining condition properties according to agency need.
- 2. Click **Add Condition**. For **Content type to scan** select **All content**. For **What to scan for** select **Matches predefined data type**. For **Select data type** select **United States - Individual Taxpayer Identification Number**. Select the remaining condition properties according to agency need.
- 3. Click **Add Condition**. For **Content type to scan** select **All content**. For **What to scan for** select **Matches predefined data type**. For **Select data type** select **United States - Social Security Number***. Select the remaining condition properties according to agency need.
+ 2. Click **Add Condition**. For **Content type to scan** select **All content**. For **What to scan for** select **Matches predefined data type**. For **Select data type** select **United States - Individual Taxpayer Identification Number**. Select the remaining condition properties according to agency need.
+ 3. Click **Add Condition**. For **Content type to scan** select **All content**. For **What to scan for** select **Matches predefined data type**. For **Select data type** select **United States - Social Security Number***. Select the remaining condition properties according to agency need.
4. Configure other appropriate content and condition definition(s) based upon the agency's individual requirements and click **Continue**.
5. In the **Actions** section, select **Block message**. Under **Select when this action should apply**, check **Messages sent to external recipients** (See [GWS.COMMONCONTROLS.18.4v0.3](#gwscommoncontrols184v03)).
6. In the **Alerting** section, choose a severity level, and optionally, check **Send to alert center to trigger notifications**.
diff --git a/baselines/drive.md b/scubagoggles/baselines/drive.md
similarity index 99%
rename from baselines/drive.md
rename to scubagoggles/baselines/drive.md
index 6d597599..44ff5532 100644
--- a/baselines/drive.md
+++ b/scubagoggles/baselines/drive.md
@@ -403,5 +403,3 @@ To limit Google Drive for Desktop to authorized devices:
6. Select Save.
Alternatively, [Context-Aware access policies](https://support.google.com/a/answer/9275380?hl=en) can be configured for more granular controls around authorized devices. The access level applied to Google Drive must have the "Apply to Google desktop and mobile apps" enabled to meet this requirement. For additional guidance, see the *Common Controls Minimum Viable Secure Baseline*, section "Context-Aware Access for All Devices that Connect to GWS SHOULD be Implemented."
-
-
diff --git a/baselines/gmail.md b/scubagoggles/baselines/gmail.md
similarity index 98%
rename from baselines/gmail.md
rename to scubagoggles/baselines/gmail.md
index 2cc39711..0cbbfb08 100644
--- a/baselines/gmail.md
+++ b/scubagoggles/baselines/gmail.md
@@ -139,7 +139,7 @@ An SPF policy SHALL be published for each domain that fails all non-approved sen
- _Rationale:_ Adversaries could potentially manipulate the 'FROM' field in an email to appear as a legitimate sender, increasing the risk of phishing attacks. By publishing an SPF policy for each domain that fails all non-approved senders, this risk can be reduced as it provides a means to detect and block such deceptive emails. Additionally, SPF is required for federal, executive branch, departments and agencies by Binding Operational Directive 18-01, "Enhance Email and Web Security."
- _Last modified:_ February 14, 2024
-- _Note:_ SPF defines two different "fail" mechanisms: fail (indicated by `-`, sometimes referred to as hardfail) and softail (indicated by `~`). Fail, as used in this baseline policy, refers to hardfail (i.e., `-`).
+- _Note:_ SPF defines two different "fail" mechanisms: fail (indicated by `-`, sometimes referred to as hardfail) and softail (indicated by `~`). Fail, as used in this baseline policy, refers to hardfail (i.e., `-`).
- MITRE ATT&CK TTP Mapping
- [T1078: Valid Accounts](https://attack.mitre.org/techniques/T1078/)
@@ -183,7 +183,7 @@ Domain-based Message Authentication, Reporting, and Conformance (DMARC) works wi
#### GWS.GMAIL.4.1v0.3
A DMARC policy SHALL be published for every second-level domain.
-- _Rationale:_ Without proper authentication and a DMARC policy available for each domain, recipients may improperly handle SPF and DKIM failures, possibly enabling adversaries to send deceptive emails that appear to be from your domain. Publishing a DMARC policy for every second-level domain further reduces the risk posed by authentication failures.
+- _Rationale:_ Without proper authentication and a DMARC policy available for each domain, recipients may improperly handle SPF and DKIM failures, possibly enabling adversaries to send deceptive emails that appear to be from your domain. Publishing a DMARC policy for every second-level domain further reduces the risk posed by authentication failures.
- _Last modified:_ November 13, 2023
- MITRE ATT&CK TTP Mapping
@@ -235,6 +235,9 @@ An agency point of contact SHOULD be included for aggregate and failure reports.
### Implementation
+[//]: # (Keep the version suffix out of the anchor.)
+[//]: # (https://stackoverflow.com/questions/5319754/cross-reference-named-anchor-in-markdown)
+
#### GWS.GMAIL.4.1v0.3 Instructions
DMARC is not configured through the Google Admin Console, but rather via DNS records hosted by the agency's domain(s). As such, implementation varies depending on how an agency manages its DNS records. See [Add your DMARC record](https://support.google.com/a/answer/2466563) for Google guidance.
@@ -249,13 +252,13 @@ dig _dmarc.example.com txt
If DMARC is configured, a response resembling `v=DMARC1; p=reject; pct=100; rua=mailto:reports@dmarc.cyber.dhs.gov, mailto:reports@example.com; ruf=mailto:reports@example.com` will be returned, though by necessity, the contents of the record will vary by agency. In this example, the policy indicates all emails failing the SPF/DKIM checks are to be rejected and aggregate reports sent to reports@dmarc.cyber.dhs.gov and reports@example.com. Failure reports will be sent to reports@example.com.
#### GWS.GMAIL.4.2v0.3 Instructions
-See [GWS.GMAIL.4.1v0.3](#gwsgmail41v03-instructions) instructions for an overview of how to publish and check a DMARC record. Ensure the record published includes `p=reject`.
+See [GWS.GMAIL.4.1 instructions](#gmail41-instructions) for an overview of how to publish and check a DMARC record. Ensure the record published includes `p=reject`.
#### GWS.GMAIL.4.3v0.3 Instructions
-See [GWS.GMAIL.4.1v0.3](#gwsgmail41v03-instructions) instructions for an overview of how to publish and check a DMARC record. Ensure the record published includes reports@dmarc.cyber.dhs.gov as one of the emails for the `rua` field.
+See [GWS.GMAIL.4.1 instructions](#gmail41-instructions) for an overview of how to publish and check a DMARC record. Ensure the record published includes reports@dmarc.cyber.dhs.gov as one of the emails for the `rua` field.
#### GWS.GMAIL.4.4v0.3 Instructions
-See [GWS.GMAIL.4.1v0.3](#gwsgmail41v03-instructions) instructions for an overview of how to publish and check a DMARC record. Ensure the record published includes a point of contact specific to your agency, in addition to reports@dmarc.cyber.dhs.gov, as one of the emails for the `rua` field and one or more agency-defined points of contact for the `ruf` field.
+See [GWS.GMAIL.4.1 instructions](#gmail41-instructions) for an overview of how to publish and check a DMARC record. Ensure the record published includes a point of contact specific to your agency, in addition to reports@dmarc.cyber.dhs.gov, as one of the emails for the `rua` field and one or more agency-defined points of contact for the `ruf` field.
## 5. Attachment Protections
@@ -1211,21 +1214,21 @@ To configure the settings for spam filtering:
1. Sign in to the [Google Admin Console](https://admin.google.com).
2. Select **Apps -\> Google Workspace -\> Gmail**.
3. Select **Spam, Phishing, and Malware**.
-
+
#### GWS.GMAIL.19.1v0.3 Instructions
For each rule listed under **Spam**:
1. Ensure that either:
* **Bypass spam filters for messages from senders or domains in selected lists** is not selected, or
* None of the lists shown under **Bypass spam filters for messages from senders or domains in selected lists** contain an entire domain. For example, the entire domain "example.com" is not acceptable, but the specific address, john.doe@example.com, would be.
2. Modify the rule or lists associated with the rule as needed, then select **Save.**
-
+
#### GWS.GMAIL.19.2v0.3 Instructions
For each rule listed under **Spam**:
1. Ensure that either:
* **Bypass spam filters and hide warnings for messages from senders or domains in selected lists** is not selected, or
* None of the lists shown under **Bypass spam filters and hide warnings for messages from senders or domains in selected lists** contain an entire domain. For example, the entire domain "example.com" is not acceptable, but the specific address, john.doe@example.com, would be.
2. Modify the rule or lists associated with the rule as needed, then select **Save.**
-
+
#### GWS.GMAIL.19.3v0.3 Instructions
For each rule listed under **Spam**:
1. Ensure that **Bypass spam filters and hide warnings for all messages from internal and external sender* is not selected.
diff --git a/baselines/groups.md b/scubagoggles/baselines/groups.md
similarity index 99%
rename from baselines/groups.md
rename to scubagoggles/baselines/groups.md
index bc9e4f64..4af5e0d5 100644
--- a/baselines/groups.md
+++ b/scubagoggles/baselines/groups.md
@@ -38,7 +38,7 @@ This control determines whether users outside of an agency's organization can vi
Note: Even with this setting configured, group owners can still explicitly add external POCs to a group ([Adding External Members](#2-adding-external-members)), or explicitly allow posting to a group by an external POC who has not been added to said group ([Allowing Posting by External Members](#3-allowing-posting-by-external-members)).
-### Baseline Policies
+### Policies
#### GWS.GROUPS.1.1v0.3
Group access from outside the organization SHALL be disabled unless explicitly granted by the group owner.
diff --git a/baselines/images/MFA.PNG b/scubagoggles/baselines/images/MFA.PNG
similarity index 100%
rename from baselines/images/MFA.PNG
rename to scubagoggles/baselines/images/MFA.PNG
diff --git a/baselines/meet.md b/scubagoggles/baselines/meet.md
similarity index 99%
rename from baselines/meet.md
rename to scubagoggles/baselines/meet.md
index 16ef8dcf..cf1fa3c3 100644
--- a/baselines/meet.md
+++ b/scubagoggles/baselines/meet.md
@@ -227,4 +227,4 @@ Incoming calls SHALL be restricted to contacts and other users in the organizati
3. Click **Meet safety settings**.
4. Click **Incoming call restrictions**.
5. Ensure **Users receive calls only from contacts and other users in the organization** or **Users can't receive calls** is selected.
-6. Click **Save**.
\ No newline at end of file
+6. Click **Save**.
diff --git a/baselines/sites.md b/scubagoggles/baselines/sites.md
similarity index 99%
rename from baselines/sites.md
rename to scubagoggles/baselines/sites.md
index 2a06b914..84c0b7d5 100644
--- a/baselines/sites.md
+++ b/scubagoggles/baselines/sites.md
@@ -32,7 +32,7 @@ The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "S
This section covers whether users are able to access Google Sites.
-### Policy
+### Policies
#### GWS.SITES.1.1v0.3
Sites Service SHOULD be disabled for all users.
@@ -57,7 +57,7 @@ Sites Service SHOULD be disabled for all users.
To configure the settings for Site creation and editing:
-#### GWS.SITES.1.1v0.2 Instructions
+#### GWS.SITES.1.1v0.3 Instructions
1. Sign in to the [Google Admin Console](https://admin.google.com).
2. Select **Apps** -\> **Google Workspace** -\> **Sites**.
3. Select **Service Status**
diff --git a/scubagoggles/config.py b/scubagoggles/config.py
new file mode 100644
index 00000000..5982d2c0
--- /dev/null
+++ b/scubagoggles/config.py
@@ -0,0 +1,229 @@
+"""ScubaGoggles User Configuration - The UserConfig class implementation
+manages the creation, modification, and use of the ScubaGoggles user
+configuration file.
+"""
+
+import os
+
+from typing import Iterable, Union
+from pathlib import Path
+
+from yaml import dump, Dumper, load, Loader
+
+
+class UserConfig:
+
+ """Implementation of user configuration for ScubaGoggles. Certain
+ settings, such as the directory for ScubaGoggles output, location of the
+ Google API credentials file, and the location of the OPA executable,
+ are managed by this class.
+ """
+
+ # FWIW, this was originally implemented using TOML (Tom's Obvious Minimal
+ # Language) (hence the reference to "_doc"), but was converted to use YAML
+ # for compatibilty with the other user configuration. For ScubaGoggles,
+ # the configuration file is named .scubagoggles (note the leading dot),
+ # located in the user's home directory.
+
+ _defaults = {'scubagoggles': {'opa_dir': None,
+ 'output_dir': '~/scubagoggles'}}
+
+ # This is the main key (TOML: table) in the configuration, and is used to
+ # continue defining the defaults. For example, we want the default
+ # credentials file default after the initial defaults dictionary has been
+ # defined (so we can access the output directory).
+
+ _main = _defaults['scubagoggles']
+
+ _defaults['scubagoggles']['credentials'] = (f'{_main["output_dir"]}/'
+ 'credentials.json')
+
+ _default_config_file = Path('~/.scubagoggles').expanduser()
+
+ def __init__(self, config_file: Union[str, os.PathLike] = None):
+
+ """UserConfig class initialization - this initializes the user
+ configuration stored in the class.
+
+ :param Path config_file: [optional] user configuration file. By
+ default, this is ~/.scubagoggles
+ """
+
+ self._config_file = (Path(os.path.expandvars(config_file))
+ if config_file else self._default_config_file)
+
+ self._config_file = self._config_file.expanduser()
+
+ self._check = True
+
+ if self._config_file.exists():
+ with self._config_file.open(encoding = 'utf-8') as in_stream:
+ self._doc = load(in_stream, Loader)
+ self._validate()
+ self._file_exists = True
+ else:
+ self._doc = dict(self._defaults)
+ self._file_exists = False
+
+ @property
+ def file_exists(self) -> bool:
+
+ """Returns True if the user's configuration file existed at the time
+ this instance was created. False is returned otherwise, including
+ if the file does exist but was written after this instance was
+ created. This property is being used to determine if a user's
+ "legacy" setup area should be looked for.
+ """
+
+ return self._file_exists
+
+ def _get_path_config(self, name: str) -> Union[Path, None]:
+
+ """Returns a Path value corresponding to the given configuration
+ variable name.
+
+ :param str name: name of the configuration value.
+
+ :return: configuration value as a Path.
+ """
+
+ value = (self._doc['scubagoggles'][name]
+ if name in self._doc['scubagoggles'] else None)
+
+ if value:
+ value = Path(os.path.expandvars(value)).expanduser()
+
+ return value
+
+ @property
+ def credentials_file(self) -> Union[Path, None]:
+
+ """Returns the Path to the Google API credentials file.
+ """
+
+ credentials = self._get_path_config('credentials')
+
+ if self._check and credentials and (not credentials.exists()
+ or not credentials.is_file()):
+ raise FileNotFoundError(f'? {credentials} - credentials not found')
+
+ return credentials
+
+ @credentials_file.setter
+ def credentials_file(self, value: Union[str, os.PathLike]):
+
+ """Sets the location of the Google API credentials file.
+
+ :param value: location of the credentials file.
+ """
+
+ self._doc['scubagoggles']['credentials'] = str(value)
+
+ @property
+ def opa_dir(self) -> Union[Path, None]:
+
+ """Returns the directory containing the OPA executable file.
+ """
+
+ return self._get_path_config('opa_dir')
+
+ @opa_dir.setter
+ def opa_dir(self, value: Union[str, os.PathLike]):
+
+ """Sets the directory containing the OPA executable file.
+
+ :param value: location of the OPA executable file.
+ """
+
+ opa_path = Path(os.path.expandvars(value)).expanduser()
+
+ if not opa_path.exists() or not opa_path.is_dir():
+ raise NotADirectoryError(f'? {opa_path} - directory not found')
+
+ # Purposely storing this as the given value, so it's stored in the
+ # file as given. For example, if '~/opa' is given, we check it above
+ # in expanded form, but still store it unexpanded.
+
+ self._doc['scubagoggles']['opa_dir'] = str(value)
+
+ @property
+ def output_dir(self) -> Union[Path, None]:
+
+ """Returns the user's directory used for ScubaGoggles output.
+ """
+
+ return self._get_path_config('output_dir')
+
+ @output_dir.setter
+ def output_dir(self, value: Union[str, os.PathLike]):
+
+ """Sets the user's ScubaGoggles output directory.
+
+ :param value: location of the output directory.
+ """
+
+ output_dir = Path(os.path.expandvars(value)).expanduser()
+
+ if not output_dir.exists() or not output_dir.is_dir():
+ raise NotADirectoryError(f'? {output_dir} - directory not found')
+
+ # Purposely storing this as the given value, so it's stored in the
+ # file as given. For example, if '~/scubagoggles' is given, we check
+ # it above in expanded form, but still store it unexpanded.
+
+ self._doc['scubagoggles']['output_dir'] = str(value)
+
+ def path_check(self, check: bool) -> None:
+
+ """Setter property that alters path checking behavior.
+
+ :param bool check: check valid paths and raise exceptions
+ if True. Should only be False during initial configuration when
+ directories/files may not yet exist.
+ """
+
+ self._check = check
+
+ path_check = property(fset = path_check)
+
+ def write(self):
+
+ """Writes the configuration document in YAML format.
+ """
+
+ with self._config_file.open('w', encoding = 'utf-8') as out_stream:
+ dump(self._doc, out_stream, Dumper)
+
+ def _validate(self, keys: Iterable = None) -> Union[list, None]:
+
+ """Validates the current configuration by checking the dictionary
+ keys to make sure they match the keys in the default configuration.
+ This is a recursive method, initially called without arguments.
+
+ :return: list of bad key names or None if configuration keys are
+ correct.
+ """
+
+ bad_keys = []
+
+ if not keys:
+ for key in self._doc:
+ bad_keys += self._validate((key,))
+ if bad_keys:
+ raise KeyError(f'? {", ".join(bad_keys)} key(s) not '
+ 'recognized')
+ return None
+
+ current_defaults = self._defaults
+
+ current_doc = self._doc
+
+ for key in keys:
+ current_defaults = current_defaults[key]
+ current_doc = current_doc[key]
+
+ if isinstance(current_doc, dict):
+ for key in current_doc:
+ bad_keys += self._validate([*keys, key])
+
+ return bad_keys
diff --git a/scubagoggles/getopa.py b/scubagoggles/getopa.py
new file mode 100644
index 00000000..b09d45eb
--- /dev/null
+++ b/scubagoggles/getopa.py
@@ -0,0 +1,259 @@
+"""Implementation of ScubaGoggles OPA executable dowload.
+"""
+
+import argparse
+import logging
+import platform
+import re
+import stat
+import subprocess
+import sys
+
+from hashlib import sha256
+from pathlib import Path
+from tempfile import TemporaryDirectory
+from urllib.error import HTTPError
+from urllib.parse import urljoin, urlsplit
+from urllib.request import Request, urlcleanup, urlopen, urlretrieve
+
+from scubagoggles.orchestrator import UserRuntimeError
+from scubagoggles.utils import prompt_boolean
+
+log = logging.getLogger(__name__)
+
+
+def getopa(arguments: argparse.Namespace):
+
+ """Main get OPA function - this calls other functions in this module.
+
+ :param arguments: arguments collected by the ArgumentParser.
+ """
+
+ log.info('ScubaGoggles OPA Download')
+
+ config = arguments.user_config
+ opa_dir = arguments.opa_directory or config.opa_dir
+
+ if opa_dir is None:
+ raise UserRuntimeError('No directory set for OPA executable - '
+ 'run "setup" first (see documentation)')
+
+ if not opa_dir.is_dir():
+ answer = prompt_boolean(f'Create directory {opa_dir}')
+ if not answer:
+ log.error('OPA directory required')
+ return
+
+ opa_dir.mkdir(exist_ok = True)
+
+ if arguments.opa_directory and not config.opa_dir:
+ config.opa_dir = arguments.opa_directory
+ config.write()
+
+ verify = not arguments.nocheck
+ force = arguments.force
+ version = arguments.version.lower() if arguments.version else None
+
+ download_opa(opa_dir, version, verify, force)
+
+
+def download_opa(opa_dir: Path,
+ version: str = None,
+ verify: bool = False,
+ force: bool = False):
+
+ """Download the OPA executable for the current operating system
+ environment.
+
+ :param Path opa_dir: directory where OPA executable will be located.
+ :param str version: [optional] version number of a specific OPA release
+ to download (version format vM.m.b). Downloads the latest OPA version
+ if not specified.
+ :param bool verify: [optional] if True, verifies the hash value of the
+ OPA executable with the expected value for the release.
+ :param bool force: [optional] if True, overwrites the OPA executable, if
+ it currently exists in the target download location.
+ :raises RuntimeError: for the case where the latest version number returned
+ by OPA does not look like a version (vM.m.b).
+ """
+
+ # pylint: disable=too-many-branches
+
+ if sys.maxsize <= 2 ** 32:
+ raise UserRuntimeError('64-bit operating environment required for OPA')
+
+ opa_base_url = 'https://github.com/open-policy-agent/opa/releases/'
+ version_re = re.compile(r'v\d+(?:\.\d+){2}')
+
+ if not version:
+ latest_version_url = urljoin(opa_base_url, 'latest')
+ log.debug('Querying latest version from OPA: %s', latest_version_url)
+ request = Request(latest_version_url)
+
+ with urlopen(request) as response:
+ version = urlsplit(response.url).path.split('/')[-1]
+ log.debug(' Version returned: %s', version)
+
+ if not version_re.match(version):
+ raise RuntimeError(f'? "{version}" - unrecognized version string '
+ 'returned as "latest" OPA version')
+ elif not version_re.match(version):
+ if not version_re.match(f'v{version}'):
+ raise UserRuntimeError(f'? "{version}" - unrecognized version '
+ 'string - expected "v
