From 3f42e3f217d9a092c237a5be3266eae2b470b576 Mon Sep 17 00:00:00 2001
From: David Bui <105074908+buidav@users.noreply.github.com>
Date: Wed, 6 Dec 2023 11:47:19 -0800
Subject: [PATCH] initial release (#3)
---
.github/workflows/get_opa_hash.yml | 18 +
.github/workflows/pylint.yml | 24 +
.github/workflows/run_opa_tests.yml | 34 +
.github/workflows/run_release.yml | 46 +
.gitignore | 18 +
README.md | 300 ++-
.../RegoTests/calendar/calendar01_test.rego | 408 ++++
.../RegoTests/calendar/calendar02_test.rego | 334 +++
.../RegoTests/calendar/calendar03_test.rego | 196 ++
.../RegoTests/calendar/calendar04_test.rego | 197 ++
.../RegoTests/calendar/calendar05_test.rego | 270 +++
Testing/RegoTests/chat/chat01_test.rego | 649 +++++
Testing/RegoTests/chat/chat02_test.rego | 346 +++
Testing/RegoTests/chat/chat03_test.rego | 364 +++
Testing/RegoTests/chat/chat04_test.rego | 606 +++++
Testing/RegoTests/chat/chat05_test.rego | 233 ++
Testing/RegoTests/chat/chat06_test.rego | 25 +
.../RegoTests/classroom/classroom01_test.rego | 349 +++
.../RegoTests/classroom/classroom02_test.rego | 462 ++++
.../RegoTests/classroom/classroom03_test.rego | 462 ++++
.../RegoTests/classroom/classroom04_test.rego | 462 ++++
.../commoncontrols/commoncontrols01_test.rego | 895 +++++++
.../commoncontrols/commoncontrols02_test.rego | 153 ++
.../commoncontrols/commoncontrols03_test.rego | 292 +++
.../commoncontrols/commoncontrols04_test.rego | 354 +++
.../commoncontrols/commoncontrols05_test.rego | 1304 ++++++++++
.../commoncontrols/commoncontrols06_test.rego | 49 +
.../commoncontrols/commoncontrols07_test.rego | 170 ++
.../commoncontrols/commoncontrols08_test.rego | 25 +
.../commoncontrols/commoncontrols09_test.rego | 409 ++++
.../commoncontrols/commoncontrols10_test.rego | 49 +
.../commoncontrols/commoncontrols11_test.rego | 866 +++++++
.../commoncontrols/commoncontrols12_test.rego | 453 ++++
.../commoncontrols/commoncontrols13_test.rego | 232 ++
.../commoncontrols/commoncontrols14_test.rego | 475 ++++
.../commoncontrols/commoncontrols15_test.rego | 27 +
.../commoncontrols/commoncontrols16_test.rego | 209 ++
.../commoncontrols/commoncontrols17_test.rego | 25 +
.../commoncontrols/commoncontrols18_test.rego | 200 ++
Testing/RegoTests/drive/drive01_test.rego | 2156 +++++++++++++++++
Testing/RegoTests/drive/drive02_test.rego | 1347 ++++++++++
Testing/RegoTests/drive/drive03_test.rego | 363 +++
Testing/RegoTests/drive/drive04_test.rego | 271 +++
Testing/RegoTests/drive/drive05_test.rego | 271 +++
Testing/RegoTests/drive/drive06_test.rego | 391 +++
Testing/RegoTests/drive/drive07_test.rego | 24 +
Testing/RegoTests/gmail/gmail01_test.rego | 271 +++
Testing/RegoTests/gmail/gmail02_test.rego | 91 +
Testing/RegoTests/gmail/gmail03_test.rego | 123 +
Testing/RegoTests/gmail/gmail04_test.rego | 483 ++++
Testing/RegoTests/gmail/gmail05_test.rego | 1385 +++++++++++
Testing/RegoTests/gmail/gmail06_test.rego | 1125 +++++++++
Testing/RegoTests/gmail/gmail07_test.rego | 2049 ++++++++++++++++
Testing/RegoTests/gmail/gmail08_test.rego | 271 +++
Testing/RegoTests/gmail/gmail09_test.rego | 614 +++++
Testing/RegoTests/gmail/gmail10_test.rego | 310 +++
Testing/RegoTests/gmail/gmail11_test.rego | 310 +++
Testing/RegoTests/gmail/gmail12_test.rego | 271 +++
Testing/RegoTests/gmail/gmail13_test.rego | 271 +++
Testing/RegoTests/gmail/gmail14_test.rego | 309 +++
Testing/RegoTests/gmail/gmail15_test.rego | 167 ++
Testing/RegoTests/gmail/gmail16_test.rego | 309 +++
Testing/RegoTests/gmail/gmail17_test.rego | 309 +++
Testing/RegoTests/gmail/gmail18_test.rego | 25 +
Testing/RegoTests/gmail/gmail19_test.rego | 25 +
Testing/RegoTests/gmail/gmail20_test.rego | 25 +
Testing/RegoTests/gmail/gmail21_test.rego | 25 +
Testing/RegoTests/gmail/gmail22_test.rego | 25 +
Testing/RegoTests/gmail/gmail23_test.rego | 25 +
Testing/RegoTests/groups/groups01_test.rego | 168 ++
Testing/RegoTests/groups/groups02_test.rego | 167 ++
Testing/RegoTests/groups/groups03_test.rego | 167 ++
Testing/RegoTests/groups/groups04_test.rego | 166 ++
Testing/RegoTests/groups/groups05_test.rego | 299 +++
Testing/RegoTests/groups/groups06_test.rego | 204 ++
Testing/RegoTests/groups/groups07_test.rego | 223 ++
Testing/RegoTests/meet/meet01_test.rego | 453 ++++
Testing/RegoTests/meet/meet02_test.rego | 607 +++++
Testing/RegoTests/meet/meet03_test.rego | 319 +++
Testing/RegoTests/meet/meet04_test.rego | 319 +++
Testing/RegoTests/rules/rules01_test.rego | 633 +++++
Testing/RegoTests/sites/sites01_test.rego | 396 +++
Testing/run_unit_tests.py | 91 +
...able Secure Configuration Baseline v0.1.md | 1323 ++++++++++
...able Secure Configuration Baseline v0.1.md | 1592 ++++++++++++
...able Secure Configuration Baseline v0.1.md | 268 ++
...able Secure Configuration Baseline v0.1.md | 302 +++
...able Secure Configuration Baseline v0.1.md | 192 ++
...able Secure Configuration Baseline v0.1.md | 484 ++++
...able Secure Configuration Baseline v0.1.md | 191 ++
...able Secure Configuration Baseline v0.1.md | 66 +
...able Secure Configuration Baseline v0.1.md | 305 +++
download_opa.py | 216 ++
.../GWS Drift Monitoring Rules - Calendar.csv | 9 +
.../GWS Drift Monitoring Rules - Chat.csv | 11 +
...GWS Drift Monitoring Rules - Classroom.csv | 6 +
...Rules - Common Controls as of 11-14-23.csv | 42 +
...rift Monitoring Rules - Drive and Docs.csv | 20 +
.../GWS Drift Monitoring Rules - Gmail.csv | 67 +
.../GWS Drift Monitoring Rules - Groups.csv | 8 +
.../GWS Drift Monitoring Rules - Meet.csv | 5 +
.../GWS Drift Monitoring Rules - Sites.csv | 2 +
guides/CONTENTSTYLEGUIDE.md | 361 +++
guides/GithubFlowDemo.pdf | Bin 0 -> 118833 bytes
images/Change Management.JPG | Bin 0 -> 125078 bytes
images/GWS Update Workflow.JPG | Bin 0 -> 96524 bytes
images/MFA.PNG | Bin 0 -> 148530 bytes
rego/Calendar.rego | 503 ++++
rego/Chat.rego | 451 ++++
rego/Classroom.rego | 351 +++
rego/Commoncontrols.rego | 1724 +++++++++++++
rego/Drive.rego | 853 +++++++
rego/Gmail.rego | 1757 ++++++++++++++
rego/Groups.rego | 434 ++++
rego/Meet.rego | 310 +++
rego/Rules.rego | 417 ++++
rego/Sites.rego | 210 ++
rego/Utils.rego | 28 +
requirements.txt | 8 +
sample-report/BaselineReports.html | 259 ++
.../IndividualReports/CalendarReport.html | 315 +++
.../IndividualReports/ChatReport.html | 327 +++
.../IndividualReports/ClassroomReport.html | 282 +++
.../CommoncontrolsReport.html | 674 ++++++
.../IndividualReports/DriveReport.html | 409 ++++
.../IndividualReports/GmailReport.html | 776 ++++++
.../IndividualReports/GroupsReport.html | 332 +++
.../IndividualReports/MeetReport.html | 275 +++
.../IndividualReports/RulesReport.html | 484 ++++
.../IndividualReports/SitesReport.html | 218 ++
.../IndividualReports/images/cisa_logo.png | Bin 0 -> 329167 bytes
.../images/triangle-exclamation-solid.svg | 1 +
sample-report/ProviderSettingsExport.json | 20 +
sample-report/TestResults.json | 1407 +++++++++++
scuba.py | 23 +
scubagoggles/__init__.py | 0
scubagoggles/auth.py | 48 +
scubagoggles/main.py | 130 +
scubagoggles/orchestrator.py | 323 +++
scubagoggles/provider.py | 663 +++++
.../FrontPageReportTemplate.html | 28 +
.../IndividualReportTemplate.html | 25 +
scubagoggles/reporter/__init__.py | 0
scubagoggles/reporter/images/cisa_logo.png | Bin 0 -> 329167 bytes
.../images/triangle-exclamation-solid.svg | 1 +
scubagoggles/reporter/md_parser.py | 88 +
scubagoggles/reporter/reporter.py | 224 ++
scubagoggles/reporter/scripts/main.js | 48 +
.../reporter/styles/FrontPageStyle.css | 56 +
scubagoggles/reporter/styles/main.css | 128 +
scubagoggles/run_rego.py | 68 +
scubagoggles/utils.py | 55 +
setup.py | 29 +
utils/checkOPAHash.sh | 32 +
utils/test_opa.sh | 24 +
utils/update_policyid_version.py | 63 +
156 files changed, 50193 insertions(+), 1 deletion(-)
create mode 100644 .github/workflows/get_opa_hash.yml
create mode 100644 .github/workflows/pylint.yml
create mode 100644 .github/workflows/run_opa_tests.yml
create mode 100644 .github/workflows/run_release.yml
create mode 100644 .gitignore
create mode 100644 Testing/RegoTests/calendar/calendar01_test.rego
create mode 100644 Testing/RegoTests/calendar/calendar02_test.rego
create mode 100644 Testing/RegoTests/calendar/calendar03_test.rego
create mode 100644 Testing/RegoTests/calendar/calendar04_test.rego
create mode 100644 Testing/RegoTests/calendar/calendar05_test.rego
create mode 100644 Testing/RegoTests/chat/chat01_test.rego
create mode 100644 Testing/RegoTests/chat/chat02_test.rego
create mode 100644 Testing/RegoTests/chat/chat03_test.rego
create mode 100644 Testing/RegoTests/chat/chat04_test.rego
create mode 100644 Testing/RegoTests/chat/chat05_test.rego
create mode 100644 Testing/RegoTests/chat/chat06_test.rego
create mode 100644 Testing/RegoTests/classroom/classroom01_test.rego
create mode 100644 Testing/RegoTests/classroom/classroom02_test.rego
create mode 100644 Testing/RegoTests/classroom/classroom03_test.rego
create mode 100644 Testing/RegoTests/classroom/classroom04_test.rego
create mode 100644 Testing/RegoTests/commoncontrols/commoncontrols01_test.rego
create mode 100644 Testing/RegoTests/commoncontrols/commoncontrols02_test.rego
create mode 100644 Testing/RegoTests/commoncontrols/commoncontrols03_test.rego
create mode 100644 Testing/RegoTests/commoncontrols/commoncontrols04_test.rego
create mode 100644 Testing/RegoTests/commoncontrols/commoncontrols05_test.rego
create mode 100644 Testing/RegoTests/commoncontrols/commoncontrols06_test.rego
create mode 100644 Testing/RegoTests/commoncontrols/commoncontrols07_test.rego
create mode 100644 Testing/RegoTests/commoncontrols/commoncontrols08_test.rego
create mode 100644 Testing/RegoTests/commoncontrols/commoncontrols09_test.rego
create mode 100644 Testing/RegoTests/commoncontrols/commoncontrols10_test.rego
create mode 100644 Testing/RegoTests/commoncontrols/commoncontrols11_test.rego
create mode 100644 Testing/RegoTests/commoncontrols/commoncontrols12_test.rego
create mode 100644 Testing/RegoTests/commoncontrols/commoncontrols13_test.rego
create mode 100644 Testing/RegoTests/commoncontrols/commoncontrols14_test.rego
create mode 100644 Testing/RegoTests/commoncontrols/commoncontrols15_test.rego
create mode 100644 Testing/RegoTests/commoncontrols/commoncontrols16_test.rego
create mode 100644 Testing/RegoTests/commoncontrols/commoncontrols17_test.rego
create mode 100644 Testing/RegoTests/commoncontrols/commoncontrols18_test.rego
create mode 100644 Testing/RegoTests/drive/drive01_test.rego
create mode 100644 Testing/RegoTests/drive/drive02_test.rego
create mode 100644 Testing/RegoTests/drive/drive03_test.rego
create mode 100644 Testing/RegoTests/drive/drive04_test.rego
create mode 100644 Testing/RegoTests/drive/drive05_test.rego
create mode 100644 Testing/RegoTests/drive/drive06_test.rego
create mode 100644 Testing/RegoTests/drive/drive07_test.rego
create mode 100644 Testing/RegoTests/gmail/gmail01_test.rego
create mode 100644 Testing/RegoTests/gmail/gmail02_test.rego
create mode 100644 Testing/RegoTests/gmail/gmail03_test.rego
create mode 100644 Testing/RegoTests/gmail/gmail04_test.rego
create mode 100644 Testing/RegoTests/gmail/gmail05_test.rego
create mode 100644 Testing/RegoTests/gmail/gmail06_test.rego
create mode 100644 Testing/RegoTests/gmail/gmail07_test.rego
create mode 100644 Testing/RegoTests/gmail/gmail08_test.rego
create mode 100644 Testing/RegoTests/gmail/gmail09_test.rego
create mode 100644 Testing/RegoTests/gmail/gmail10_test.rego
create mode 100644 Testing/RegoTests/gmail/gmail11_test.rego
create mode 100644 Testing/RegoTests/gmail/gmail12_test.rego
create mode 100644 Testing/RegoTests/gmail/gmail13_test.rego
create mode 100644 Testing/RegoTests/gmail/gmail14_test.rego
create mode 100644 Testing/RegoTests/gmail/gmail15_test.rego
create mode 100644 Testing/RegoTests/gmail/gmail16_test.rego
create mode 100644 Testing/RegoTests/gmail/gmail17_test.rego
create mode 100644 Testing/RegoTests/gmail/gmail18_test.rego
create mode 100644 Testing/RegoTests/gmail/gmail19_test.rego
create mode 100644 Testing/RegoTests/gmail/gmail20_test.rego
create mode 100644 Testing/RegoTests/gmail/gmail21_test.rego
create mode 100644 Testing/RegoTests/gmail/gmail22_test.rego
create mode 100644 Testing/RegoTests/gmail/gmail23_test.rego
create mode 100644 Testing/RegoTests/groups/groups01_test.rego
create mode 100644 Testing/RegoTests/groups/groups02_test.rego
create mode 100644 Testing/RegoTests/groups/groups03_test.rego
create mode 100644 Testing/RegoTests/groups/groups04_test.rego
create mode 100644 Testing/RegoTests/groups/groups05_test.rego
create mode 100644 Testing/RegoTests/groups/groups06_test.rego
create mode 100644 Testing/RegoTests/groups/groups07_test.rego
create mode 100644 Testing/RegoTests/meet/meet01_test.rego
create mode 100644 Testing/RegoTests/meet/meet02_test.rego
create mode 100644 Testing/RegoTests/meet/meet03_test.rego
create mode 100644 Testing/RegoTests/meet/meet04_test.rego
create mode 100644 Testing/RegoTests/rules/rules01_test.rego
create mode 100644 Testing/RegoTests/sites/sites01_test.rego
create mode 100644 Testing/run_unit_tests.py
create mode 100644 baselines/Common Controls Minimum Viable Secure Configuration Baseline v0.1.md
create mode 100644 baselines/Gmail Minimum Viable Secure Configuration Baseline v0.1.md
create mode 100644 baselines/Google Calendar Minimum Viable Secure Configuration Baseline v0.1.md
create mode 100644 baselines/Google Chat Minimum Viable Secure Configuration Baseline v0.1.md
create mode 100644 baselines/Google Classroom Minimum Viable Secure Configuration Baseline v0.1.md
create mode 100644 baselines/Google Drive and Docs Minimum Viable Secure Configuration Baseline v0.1.md
create mode 100644 baselines/Google Meet Minimum Viable Secure Configuration Baseline v0.1.md
create mode 100644 baselines/Google Sites Minimum Viable Secure Configuration Baseline v0.1.md
create mode 100644 baselines/Groups for Business Minimum Viable Secure Configuration Baseline v0.1.md
create mode 100644 download_opa.py
create mode 100644 drift-rules/GWS Drift Monitoring Rules - Calendar.csv
create mode 100644 drift-rules/GWS Drift Monitoring Rules - Chat.csv
create mode 100644 drift-rules/GWS Drift Monitoring Rules - Classroom.csv
create mode 100644 drift-rules/GWS Drift Monitoring Rules - Common Controls as of 11-14-23.csv
create mode 100644 drift-rules/GWS Drift Monitoring Rules - Drive and Docs.csv
create mode 100644 drift-rules/GWS Drift Monitoring Rules - Gmail.csv
create mode 100644 drift-rules/GWS Drift Monitoring Rules - Groups.csv
create mode 100644 drift-rules/GWS Drift Monitoring Rules - Meet.csv
create mode 100644 drift-rules/GWS Drift Monitoring Rules - Sites.csv
create mode 100644 guides/CONTENTSTYLEGUIDE.md
create mode 100644 guides/GithubFlowDemo.pdf
create mode 100644 images/Change Management.JPG
create mode 100644 images/GWS Update Workflow.JPG
create mode 100644 images/MFA.PNG
create mode 100644 rego/Calendar.rego
create mode 100644 rego/Chat.rego
create mode 100644 rego/Classroom.rego
create mode 100644 rego/Commoncontrols.rego
create mode 100644 rego/Drive.rego
create mode 100644 rego/Gmail.rego
create mode 100644 rego/Groups.rego
create mode 100644 rego/Meet.rego
create mode 100644 rego/Rules.rego
create mode 100644 rego/Sites.rego
create mode 100644 rego/Utils.rego
create mode 100644 requirements.txt
create mode 100644 sample-report/BaselineReports.html
create mode 100644 sample-report/IndividualReports/CalendarReport.html
create mode 100644 sample-report/IndividualReports/ChatReport.html
create mode 100644 sample-report/IndividualReports/ClassroomReport.html
create mode 100644 sample-report/IndividualReports/CommoncontrolsReport.html
create mode 100644 sample-report/IndividualReports/DriveReport.html
create mode 100644 sample-report/IndividualReports/GmailReport.html
create mode 100644 sample-report/IndividualReports/GroupsReport.html
create mode 100644 sample-report/IndividualReports/MeetReport.html
create mode 100644 sample-report/IndividualReports/RulesReport.html
create mode 100644 sample-report/IndividualReports/SitesReport.html
create mode 100644 sample-report/IndividualReports/images/cisa_logo.png
create mode 100644 sample-report/IndividualReports/images/triangle-exclamation-solid.svg
create mode 100644 sample-report/ProviderSettingsExport.json
create mode 100644 sample-report/TestResults.json
create mode 100644 scuba.py
create mode 100644 scubagoggles/__init__.py
create mode 100644 scubagoggles/auth.py
create mode 100644 scubagoggles/main.py
create mode 100644 scubagoggles/orchestrator.py
create mode 100644 scubagoggles/provider.py
create mode 100644 scubagoggles/reporter/FrontPageReport/FrontPageReportTemplate.html
create mode 100644 scubagoggles/reporter/IndividualReport/IndividualReportTemplate.html
create mode 100644 scubagoggles/reporter/__init__.py
create mode 100644 scubagoggles/reporter/images/cisa_logo.png
create mode 100644 scubagoggles/reporter/images/triangle-exclamation-solid.svg
create mode 100644 scubagoggles/reporter/md_parser.py
create mode 100644 scubagoggles/reporter/reporter.py
create mode 100644 scubagoggles/reporter/scripts/main.js
create mode 100644 scubagoggles/reporter/styles/FrontPageStyle.css
create mode 100644 scubagoggles/reporter/styles/main.css
create mode 100644 scubagoggles/run_rego.py
create mode 100644 scubagoggles/utils.py
create mode 100644 setup.py
create mode 100644 utils/checkOPAHash.sh
create mode 100644 utils/test_opa.sh
create mode 100644 utils/update_policyid_version.py
diff --git a/.github/workflows/get_opa_hash.yml b/.github/workflows/get_opa_hash.yml
new file mode 100644
index 00000000..bd376d53
--- /dev/null
+++ b/.github/workflows/get_opa_hash.yml
@@ -0,0 +1,18 @@
+name: Check OPA Hash
+on: [workflow_dispatch]
+jobs:
+ build-and-deploy:
+ runs-on: ubuntu-latest
+ permissions:
+ contents: write
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v4
+ with:
+ path: repo
+ ref: main
+ - name: Get OPA Hash
+ run: |
+ cd ./repo/utils
+ chmod +x checkOPAHash.sh
+ ./checkOPAHash.sh
diff --git a/.github/workflows/pylint.yml b/.github/workflows/pylint.yml
new file mode 100644
index 00000000..979b05e7
--- /dev/null
+++ b/.github/workflows/pylint.yml
@@ -0,0 +1,24 @@
+name: Pylint
+
+on: [push]
+
+jobs:
+ build:
+ runs-on: ubuntu-20.04
+ strategy:
+ matrix:
+ python-version: ["3.9.2"]
+ steps:
+ - uses: actions/checkout@v4
+ - name: Set up Python ${{ matrix.python-version }}
+ uses: actions/setup-python@v3
+ with:
+ python-version: ${{ matrix.python-version }}
+ - name: Install dependencies
+ run: |
+ python -m pip install --upgrade pip
+ pip install -r requirements.txt
+ pip install pylint
+ - name: Analysing the code with pylint
+ run: |
+ pylint -d R0913,R0914,R0915,R1702,W0718,W0719,R0801 $(git ls-files '*.py')
diff --git a/.github/workflows/run_opa_tests.yml b/.github/workflows/run_opa_tests.yml
new file mode 100644
index 00000000..9d1005f4
--- /dev/null
+++ b/.github/workflows/run_opa_tests.yml
@@ -0,0 +1,34 @@
+name: Run OPA Tests
+on:
+ # Run tests on each commit, newly opened/reopened PR, and
+ # PR review submission (e.g. approval)
+ workflow_dispatch:
+ push:
+ paths:
+ - "**.rego"
+ pull_request:
+ types: [opened, reopened]
+ branches:
+ - "main"
+ paths:
+ - "**.rego"
+ pull_request_review:
+ types: [submitted]
+
+jobs:
+ Run-OPA-Tests:
+ runs-on: ubuntu-latest
+ steps:
+ - name: Check out repository code
+ uses: actions/checkout@v4
+
+ - name: Setup OPA
+ uses: open-policy-agent/setup-opa@v2
+ with:
+ version: latest
+
+ - name: Run OPA Check
+ run: opa check rego Testing/RegoTests --strict
+
+ - name: Run OPA Tests
+ run: opa test rego/*.rego Testing/RegoTests/**/*.rego -v
diff --git a/.github/workflows/run_release.yml b/.github/workflows/run_release.yml
new file mode 100644
index 00000000..4aa433ce
--- /dev/null
+++ b/.github/workflows/run_release.yml
@@ -0,0 +1,46 @@
+on:
+ workflow_dispatch:
+ inputs:
+ releaseName:
+ description: "Release Name (e.g., 1.2.4)"
+ required: true
+ type: string
+ version:
+ description: "Release Version (e.g., 1.2.4)"
+ required: true
+ type: string
+
+name: Build Release
+
+jobs:
+ build-and-deploy:
+ runs-on: windows-latest
+ env:
+ RELEASE_VERSION: ${{ inputs.version }}
+ permissions:
+ contents: write
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v4
+ with:
+ path: repo
+ ref: main
+ - name: Package Repo for release
+ shell: pwsh
+ run: |
+ $PackageName = "scubagoggles"
+ Remove-Item -Recurse -Force repo -Include .git*
+ Move-Item -Path repo -Destination "${PackageName}-${env:RELEASE_VERSION}" -Force
+ Compress-Archive -Path "${PackageName}-${env:RELEASE_VERSION}" -DestinationPath "${PackageName}-${env:RELEASE_VERSION}.zip"
+ Get-ChildItem -Path . | Write-Output
+ - name: release
+ uses: softprops/action-gh-release@v1
+ id: create_release
+ with:
+ draft: true
+ prerelease: false
+ name: v${{ inputs.releaseName }}
+ tag_name: v${{ inputs.version }}
+ files: scubagoggles-${{ inputs.version }}.zip
+ generate_release_notes: true
+ fail_on_unmatched_files: true
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 00000000..05c89b69
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,18 @@
+.vscode
+.venv
+build
+scubagoggles.egg-info
+.DS_Store
+**/__pycache__
+**/.DS_Store
+**/file.txt
+**/token.json
+**/credentials.json
+**/report/*
+**/output*
+**/GWSBaselineConformance*
+*.bak
+opa
+opa_windows_amd64.exe
+opa_darwin_amd64
+opa_linux_amd64_static
\ No newline at end of file
diff --git a/README.md b/README.md
index e2215433..abc81ff2 100644
--- a/README.md
+++ b/README.md
@@ -1 +1,299 @@
-# ScubaGoggles
\ No newline at end of file
+
+GWS Secure Configuration Baseline Assessment Tool
+
+Developed by CISA, ScubaGoggles is an assessment tool that verifies a Google Workspace (GWS) organization's configuration conforms to the policies described in the Secure Cloud Business Applications ([SCuBA](https://cisa.gov/scuba)) Security Configuration Baseline [documents](https://github.com/cisagov/ScubaGoggles/tree/main/baselines).
+
+For the Microsoft 365 (M365) rendition of this tool, see [ScubaGear](https://github.com/cisagov/ScubaGear).
+
+> [!WARNING]
+> This tool is in an alpha state and in active development. At this time, outputs could be incorrect and should be reviewed carefully.
+
+## Table of Contents
+- [Limitations of the tool](#limitations-of-the-tool)
+- [Getting Started](#getting-started)
+ - [Downloading the Latest Release](#downloading-the-latest-release)
+ - [Python Dependencies](#install-python-dependencies)
+ - [Installing in a Virtual Environment](#installing-in-a-virtual-environment)
+ - [Downloading the OPA executable](#download-the-opa-executable)
+ - [Permissions](#permissions)
+ - [Create a Project](#create-a-project)
+ - [Create an OAuth credential](#create-an-oauth-credential)
+ - [Add the Oauth App to the allowlist](#add-the-oauth-app-to-the-allowlist)
+- [Usage](#usage)
+ - [Examples](#example-1-run-an-assessment-against-all-gws-products)
+- [Organization](#organization)
+- [Design](#project-license)
+- [Troubleshooting](#troubleshooting)
+ - [Not Authorized to Access this Resource](#not-authorized-to-access-this-resource)
+- [Project License](#project-license)
+
+## Limitations of the tool
+The majority of the conformance checks done by ScubaGoggles rely on [GWS Admin log events](https://support.google.com/a/answer/4579579?hl=en). If there is no log event corresponding to a SCuBA baseline policy, ScubaGoggles will indicate that the setting currently can not be checked on its HTML report output. In this situation, we recommend you manually review your GWS security configurations with the SCuBA security baselines.
+
+Additionally, some events will not be visible due to data retention time limits, as the admin logs are only retained for 6 months (see [Data retention and lag times](https://support.google.com/a/answer/7061566)). However, if you wish to generate a log event for testing ScubaGoggles' capabilities, follow the implementation instructions in the [SCuBA GWS baseline documents](https://github.com/cisagov/ScubaGoggles/tree/main/baselines) to change your GWS configuration settings. Toggling certain settings, off and on will be enough to generate a log event. Other settings will require implementing more substantive configuration changes.
+
+Many of the these controls can be scoped down to the organizational unit level. We recommend [creating a new organization unit](https://support.google.com/a/answer/182537?hl=en#:~:text=An%20organizational%20unit%20is%20simply,level%20(parent)%20organizational%20unit) and applying these controls just to that new organizational unit for testing. Rerun ScubaGoggles after you've saved your configuration changes to see if the policy requirement is met.
+
+## Getting started
+
+### Downloading the Latest Release
+To download ScubaGoggles:
+
+1. Click [here](https://github.com/cisagov/ScubaGoggles/releases) to see the latest release.
+2. Click scubagoggles-[latest-version].zip to download the release.
+3. Extract the folder in the zip file.
+
+### Install Python dependencies
+Minimum required Python version to run the tool is `3.7.16`.
+
+### Installing in a Virtual Environment
+The following commands are used to set up a python virtual environment (venv) to install the needed python dependencies.
+Inside the release or repo folder, open up a terminal and run the following commands based on your OS.
+
+#### Windows
+```
+pip3 install virtualenv
+python -m venv .venv
+.venv\Scripts\activate
+```
+
+#### macOS
+```
+pip3 install virtualenv
+virtualenv -p python3 .venv
+source .venv/bin/activate
+```
+
+Users can run the tool via the `scuba.py` script as a developer or by installing the `scubagoggles` package in a python venv.
+Choose either of these next steps to install the needed python dependencies in the `venv`.
+
+#### Installing dependencies for running scubagoggles directly
+In the root directory of the release/repo, install the `scubagoggles` package and dependencies with the following command.
+```
+python3 -m pip install .
+```
+
+#### Installing dependencies for running via scuba.py script
+In the root directory of the release/repo, install the the required dependencies with the following command.
+```
+pip3 install -r requirements.txt
+```
+
+> [!IMPORTANT]
+> Users will need to rerun the `activate` script from the OS specific directions above in each new terminal session to reactivate the `venv` containing the dependencies.
+
+### Download the OPA executable
+
+The tool makes use of [Open Policy Agent's Rego Policy language](https://www.openpolicyagent.org/docs/latest/policy-language/).
+An OPA executable is required to execute this tool and can be downloaded using our `download_opa.py` script.
+
+```
+python download_opa.py --help
+usage: download_opa.py [-h] [-v] [-os]
+
+Download executable the OPA executable file required to run this SCuBA tool.
+
+options:
+ -h, --help show this help message and exit
+ -v {0.42.2,0.43.1,0.44.0,0.45.0,0.46.3,0.47.4,0.48.0,0.49.2,0.50.2,0.51.0,0.52.0,0.53.1,0.54.0,0.55.0,0.56.0,0.57.1,0.58.0}
+ What version of OPA to download: Default version: 0.57.1
+ -os {windows,macos,linux}
+ Operating system version of OPA to download. Default os: windows
+ --disablessl If there are proxy errors, try adding this switch to disable ssl verification
+```
+```
+# example
+python download_opa.py -v 0.53.0 -os macos
+```
+1. If the above script can not execute for any reason or you would prefer to download OPA manually, go to the [Open Policy Agent website](https://www.openpolicyagent.org/docs/latest/#running-opa)
+2. Check the website for a compatible OPA version (Currently v0.42.2 and above) for ScubaGoggles and select the corresponding version on top left of the website
+3. Navigate to the menu on left side of the screen: `Introduction -> Running OPA -> Download OPA`
+4. Follow the instructions for downloading the respective OPA executable for your OS.
+
+> [!NOTE]
+> The following notes apply only for MAC and Linux users.
+- By default on MAC and Linux systems the OPA executable will be run with `sudo`.
+- Use the `scubagoggles gws --omitsudo` flag to omit running the executable with `sudo`.
+- MAC and Linux OS users should have their OPA executables named `opa_darwin_amd64` or `opa_linux_amd64_static` respectively for scubagoggles execution.
+- The OPA executable must also be given execute permissions
+```bash
+chmod +x opa_darwin_amd64 # give the opa executable execute permissions
+```
+
+### Permissions
+
+#### OAuth API Scopes
+The tool uses the following OAUTH API scopes.
+- `https://www.googleapis.com/auth/admin.reports.audit.readonly`
+- `https://www.googleapis.com/auth/admin.directory.domain.readonly`
+- `https://www.googleapis.com/auth/admin.directory.customer.readonly`
+- `https://www.googleapis.com/auth/admin.directory.group.readonly`
+- `https://www.googleapis.com/auth/admin.directory.orgunit.readonly`
+- `https://www.googleapis.com/auth/admin.directory.user.readonly`
+- `https://www.googleapis.com/auth/apps.groups.settings`
+
+When running ScubaGoggles for the first time you will be prompted to consent to these API scopes. Users with the Super Admin role automatically have the privilege to consent to these scopes. A custom admin role can also be made with the minimum permissions to consent to these scopes. See this [Google Admin SDK Prerequisites guide](https://developers.google.com/admin-sdk/reports/v1/guides/prerequisites) for more information.
+
+### Create a project
+1. If you already have a Google Cloud Project that you want to utilize skip to [Create an OAuth credential](#create-an-oauth-credential)
+2. Otherwise start by signing into http://console.cloud.google.com/.
+3. Follow the [directions outlined in this guide to create a project](https://developers.google.com/workspace/guides/create-project)
+
+### Create an OAuth credential
+1. Be signed into [http://console.cloud.google.com/]().
+1. From the hamburger menu on the left, select **APIs & Services** -> **OAuth consent screen**
+1. Select **Internal** for **User Type**
+1. Click **Create**
+1. Fill in your **App name** and **User support email**
+1. Scroll down to the **Authorized Domains** section
+1. Under **Authorized domains**, add the primary domain of your GWS organization.
+1. Add another email address for **Developer contact information**
+1. Click **SAVE AND CONTINUE**
+1. Do nothing on the **Scopes** screen, just click **SAVE AND CONTINUE**
+1. Review summary, then click **BACK TO DASHBOARD**
+1. Click **Credentials** from the menu on the left
+1. Click **CREATE CREDENTIALS**
+1. Select **Oauth client ID**
+1. Select **Web application** for **Application type**
+1. Give name as appropriate
+1. Under **Authorized redirect URIs**, click "ADD URI." Add `http://localhost` and `http://localhost:8080/`
+1. Click **CREATE**
+1. Click **DOWNLOAD JSON** from the resulting **OAuth client created** page
+1. Click **OK**
+1. Move the downloaded file (begins with `client_secret*.json`) to the root directory folder of this repo, rename to `credentials.json`
+1. Go back the menu on the left and click **Enabled API Services**
+1. In the center screen click **Enable APIS AND Services**
+1. Search for and enable the **Admin SDK API**
+1. Search for and enable the **Groups Settings API**
+1. During the first run of this tool your default web browser will open up a page to consent to the API scopes needed to run this tool. Sign in
+with an account with the necessary privileges and click allow.
+
+### Add the Oauth App to the allowlist
+If you've limited application access to Google's APIs in your organization, the [Common Controls: App Access to Google APIs](https://github.com/cisagov/ScubaGoggles/blob/main/baselines/Common%20Controls%20Minimum%20Viable%20Secure%20Configuration%20Baseline%20v0.1.md#11-app-access-to-google-apis) baseline covers this topic, follow the directions below to allowlist the OAuth app.
+
+1. Login to https://console.cloud.google.com
+2. Navigate to the appropriate project
+3. Select **API's & Services** from the top left hamburger icon
+4. Select **Credentials**
+5. Copy your client ID under **OAuth 2.0 Client IDs**
+
+#### GWS Admin Console
+
+1. Navigate to **Security** -> **Access and Data Control** -> **API Controls** -> **Manage Third-Party App Access**
+2. Select **Add App** -> **Oauth App Name** or **Client ID**
+3. Search by your **OAuth client ID**
+4. Select the App
+5. Select your root organization as the domain
+6. Select **Trusted**
+
+## Usage
+Execute the ScubaGoggles tool using the `scubagoggles` command. For GWS, all commands will be under the `gws` subparser.
+
+```
+scubagoggles gws -h
+usage: scubagoggles gws [-h] [-b [...]] [-o] [-c] [--opapath] [--regopath] [--documentpath] [--runcached]
+ [--skipexport] [--outputfoldername] [--outputproviderfilename] [--outputregofilename]
+ [--outputreportfilename] [--debug]
+
+options:
+ -h, --help show this help message and exit
+ -b [ ...], --baselines [ ...]
+ A list of one or more abbreviated GWS baseline names that the tool will assess. Defaults to all
+ baselines. Choices: gmail, calendar, groups, chat, drive, meet, sites, commoncontrols, rules
+ -o , --outputpath The folder path where both the output JSON & HTML report will be created. Defaults to "./" The
+ current directory.
+ -c , --credentials The relative path and name of the OAuth credentials json file. Defaults to "./credentials.json"
+ which means the tool will look for the file named credentials.json in the current directory.
+ --opapath The relative path to the directory containing the OPA executable. Defaults to "./" the current
+ executing directory.
+ --regopath The relative path to the directory contain the folder containing the rego files. Defaults to
+ "./rego" the "rego" folder inside the current executing directory.
+ --documentpath The relative path to the directory containing the SCuBA baseline documents. Defaults to
+ "./baselines" the "baselines" folder inside the current executing directory.
+ --runcached This switch when added will run in the tool in "RunCached mode". When combined with -sa allows
+ to the user to skip authentication and provider export.
+ --skipexport This switch when added will skip the provider export.To be used in conjunction with
+ --runcached.
+ --outputfoldername The name of the folder created in --outputpath where both the output JSON and the HTML report
+ will be created. Defaults to GWSBaselineConformance. The client's local timestamp will be
+ appended to this name.
+ --outputproviderfilename
+ The name of the Provider output json in --outputpath. Defaults to ProviderSettingsExport.
+ --outputregofilename
+ The name of the Rego output json in --outputpath. Defaults to TestResults.
+ --outputreportfilename
+ The name of the main html file homepage created in --outputpath. Defaults to BaselineReports.
+ --omitsudo This switch prevents running the OPA executable with sudo.
+ --quiet This switch suppresses automatically launching a web browser to open the html report output and
+ the loading bar output.
+ --debug This switch is used to print debugging information for OPA
+```
+
+### Example 1: Run an assessment against all GWS products
+```
+scubagoggles gws
+```
+
+### Example 2: Run an assessment against just Gmail and Google Calendar
+```
+scubagoggles gws -b gmail calendar
+```
+
+### Example 3: Run an assessment and store the results under a folder called output
+```
+scubagoggles gws -b calendar gmail groups chat meet sites -o ./output
+```
+
+### Example 4: Do a run cached assessment
+```
+# skip authentication and provider export stage
+# used for running against a cached provider json
+
+scubagoggles gws --runcached --skipexport
+```
+
+See the `help` options yourself
+```
+scubagoggles gws -h
+```
+
+The html report should open automatically. If not, navigate to the output folder and open the `*.html` file using a browser of your choice. The json output will also be located in this folder.
+
+> [!NOTE]
+> If you chose not install the `scubagoggles` package in a venv but do have the dependencies installed from `requirements.txt`, you may execute the tool using the `scuba.py` script located in the root directory of this repository. Replace any `scubagoggles` directions with `python scuba.py`
+
+## Organization
+- The Python scripts are saved in the `scubagoggles` folder.
+- The `rego` folder holds the Rego files. Each `*.rego` file holds the "desired state" for each product, per the baseline policy statements.
+- Style and developer guides are located in the `guides` folder.
+
+## Design
+We use a three-step process:
+1. **Export**. In this step, we primarily use the Google Admin SDK API to export and serialize all the relevant logs and settings into json. ScubaGoggles also uses various other Google APIs to grab organization metadata, user privileges etc.
+2. **Verify**. Compare the exported settings from the previous step with the configuration prescribed in the baselines. We do this using [OPA Rego](https://www.openpolicyagent.org/docs/latest/policy-language/#what-is-rego), a declarative query language for defining policy.
+3. **Report**. Package the data output by Rego into a human-friendly html report.
+
+## Troubleshooting
+### Not Authorized to Access This Resource
+
+If an authorization error similar to the one below appears:
+```
+/Users/scubagoggles/provider.py:463: RuntimeWarning: An exception was thrown trying to get the tenant info:
+
+```
+Ensure that you consented to the following API scopes as a user with the proper [permissions to consent](#permissions) and have enabled the required [APIs and Services](#create-an-oauth-credential).
+
+## Project License
+Unless otherwise noted, this project is distributed under the Creative Commons Zero license. With developer approval, contributions may be submitted with an alternate compatible license. If accepted, those contributions will be listed herein with the appropriate license.
diff --git a/Testing/RegoTests/calendar/calendar01_test.rego b/Testing/RegoTests/calendar/calendar01_test.rego
new file mode 100644
index 00000000..de2761f6
--- /dev/null
+++ b/Testing/RegoTests/calendar/calendar01_test.rego
@@ -0,0 +1,408 @@
+package calendar
+import future.keywords
+
+#
+# Policy 1
+#--
+test_ExtSharingPrimaryCal_Correct_V1 if {
+ # Test external sharing for primary calendars when there's only one event
+ PolicyId := "GWS.CALENDAR.1.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHOW_ONLY_FREE_BUSY_INFORMATION"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_ExtSharingPrimaryCal_Correct_V2 if {
+ # Test external sharing for primary calendars when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.CALENDAR.1.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHOW_ONLY_FREE_BUSY_INFORMATION"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "READ_ONLY_ACCESS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_ExtSharingPrimaryCal_Correct_V3 if {
+ # Test external sharing for primary calendars when there's multiple OUs
+ PolicyId := "GWS.CALENDAR.1.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHOW_ONLY_FREE_BUSY_INFORMATION"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHOW_ONLY_FREE_BUSY_INFORMATION"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_ExtSharingPrimaryCal_Correct_V4 if {
+ # Test external sharing for primary calendars when there's multiple OUs, and an older event is non-compliant
+ PolicyId := "GWS.CALENDAR.1.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHOW_ONLY_FREE_BUSY_INFORMATION"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHOW_ONLY_FREE_BUSY_INFORMATION"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2020-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "READ_ONLY_ACCESS"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_ExtSharingPrimaryCal_Correct_V4 if {
+ # Test external sharing for primary, inherit from parent
+ PolicyId := "GWS.CALENDAR.1.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2020-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHOW_ONLY_FREE_BUSY_INFORMATION"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "something else"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "INHERIT_FROM_PARENT"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_ExtSharingPrimaryCal_Incorrect_V1 if {
+ # Test external sharing for primary calendars when there are no relevant events
+ PolicyId := "GWS.CALENDAR.1.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "SAME_DOMAIN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_ExtSharingPrimaryCal_Incorrect_V2 if {
+ # Test external sharing for primary calendars when there's only one event and it's wrong
+ PolicyId := "GWS.CALENDAR.1.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "READ_ONLY_ACCESS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_ExtSharingPrimaryCal_Incorrect_V3 if {
+ # Test external sharing for primary calendars when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.CALENDAR.1.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "READ_ONLY_ACCESS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHOW_ONLY_FREE_BUSY_INFORMATION"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_ExtSharingPrimaryCal_Incorrect_V4 if {
+ # Test external sharing for primary calendars when there is no event for the Top-level OU but there is one for a different OU
+ PolicyId := "GWS.CALENDAR.1.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "READ_ONLY_ACCESS"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_ExtSharingPrimaryCal_Incorrect_V5 if {
+ # Test external sharing for primary calendars when the Top-Level OU is compliant, but a secondary OU is non-compliant
+ PolicyId := "GWS.CALENDAR.1.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHOW_ONLY_FREE_BUSY_INFORMATION"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "READ_ONLY_ACCESS"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ print(RuleOutput[0].ReportDetails)
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+
+}
+
+#
+# GWS.CALENDAR.1.2v0.1
+#--
+
+test_External_Sharing_Options_V1 if {
+ # Not-Implemented
+ PolicyId := "GWS.CALENDAR.1.2v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Currently not able to be tested automatically; please manually check."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/calendar/calendar02_test.rego b/Testing/RegoTests/calendar/calendar02_test.rego
new file mode 100644
index 00000000..b772105d
--- /dev/null
+++ b/Testing/RegoTests/calendar/calendar02_test.rego
@@ -0,0 +1,334 @@
+package calendar
+import future.keywords
+
+#
+# Policy 1
+#--
+test_ExtInvitationsWarning_Correct_V1 if {
+ # Test external invitations warnings when there's only one event
+ PolicyId := "GWS.CALENDAR.2.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EXTERNAL_GUEST_PROMPT"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_ExtInvitationsWarning_Correct_V2 if {
+ # Test external invitations warning when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.CALENDAR.2.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EXTERNAL_GUEST_PROMPT"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EXTERNAL_GUEST_PROMPT"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_ExtInvitationsWarning_Correct_V3 if {
+ # Test external invitations warning when there's multiple OUs
+ PolicyId := "GWS.CALENDAR.2.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EXTERNAL_GUEST_PROMPT"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EXTERNAL_GUEST_PROMPT"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_ExtInvitationsWarning_Correct_V4 if {
+ # Test external invitations warning when there's multiple OUs, and an older event is non-compliant
+ PolicyId := "GWS.CALENDAR.2.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EXTERNAL_GUEST_PROMPT"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EXTERNAL_GUEST_PROMPT"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2020-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EXTERNAL_GUEST_PROMPT"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_ExtInvitationsWarning_Incorrect_V1 if {
+ # Test external invitations warning when there are no relevant events
+ PolicyId := "GWS.CALENDAR.2.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "SAME_DOMAIN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_ExtInvitationsWarning_Incorrect_V2 if {
+ # Test external invitations warning when there's only one event and it's wrong
+ PolicyId := "GWS.CALENDAR.2.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EXTERNAL_GUEST_PROMPT"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_ExtInvitationsWarning_Incorrect_V3 if {
+ # Test external invitations warning when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.CALENDAR.2.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EXTERNAL_GUEST_PROMPT"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EXTERNAL_GUEST_PROMPT"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_ExtInvitationsWarning_Incorrect_V4 if {
+ # Test external invitations warning when there is no event for the Top-level OU but there is one for a different OU
+ PolicyId := "GWS.CALENDAR.2.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EXTERNAL_GUEST_PROMPT"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_ExtInvitationsWarning_Incorrect_V5 if {
+ # Test external invitations warning when the Top-Level OU is compliant, but a secondary OU is non-compliant
+ PolicyId := "GWS.CALENDAR.2.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EXTERNAL_GUEST_PROMPT"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EXTERNAL_GUEST_PROMPT"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/calendar/calendar03_test.rego b/Testing/RegoTests/calendar/calendar03_test.rego
new file mode 100644
index 00000000..14608fb2
--- /dev/null
+++ b/Testing/RegoTests/calendar/calendar03_test.rego
@@ -0,0 +1,196 @@
+package calendar
+import future.keywords
+
+
+#
+# Policy 1
+#--
+test_ExtSharingSecondaryCal_Correct_V1 if {
+ # Test external sharing for secondary calendars when there's only one event
+ PolicyId := "GWS.CALENDAR.3.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN_FOR_SECONDARY_CALENDAR"},
+ {"name": "NEW_VALUE", "value": "SHOW_ONLY_FREE_BUSY_INFORMATION"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Only free busy/information for secondary calendars is shared outside Test Top-Level Domain"
+}
+
+test_ExtSharingSecondaryCal_Correct_V2 if {
+ # Test external sharing for secondary calendars when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.CALENDAR.3.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN_FOR_SECONDARY_CALENDAR"},
+ {"name": "NEW_VALUE", "value": "SHOW_ONLY_FREE_BUSY_INFORMATION"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN_FOR_SECONDARY_CALENDAR"},
+ {"name": "NEW_VALUE", "value": "READ_ONLY_ACCESS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Only free busy/information for secondary calendars is shared outside Test Top-Level Domain"
+}
+
+test_ExtSharingSecondaryCal_Incorrect_V1 if {
+ # Test external sharing for secondary calendars when there are no relevant events
+ PolicyId := "GWS.CALENDAR.3.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "SAME_DOMAIN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Sharing options for secondary calendars are set to the default value."
+}
+
+test_ExtSharingSecondaryCal_Incorrect_V2 if {
+ # Test external sharing for secondary calendars when there's only one event and it's wrong
+ PolicyId := "GWS.CALENDAR.3.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN_FOR_SECONDARY_CALENDAR"},
+ {"name": "NEW_VALUE", "value": "READ_ONLY_ACCESS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "All information for secondary calendars is shared outside Test Top-Level Domain but outsiders cannot change calendars."
+}
+
+test_ExtSharingSecondaryCal_Incorrect_V3 if {
+ # Test external sharing for secondary calendars when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.CALENDAR.3.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN_FOR_SECONDARY_CALENDAR"},
+ {"name": "NEW_VALUE", "value": "READ_ONLY_ACCESS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN_FOR_SECONDARY_CALENDAR"},
+ {"name": "NEW_VALUE", "value": "READ_WRITE_ACCESS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "All information for secondary calendars is shared outside Test Top-Level Domain but outsiders cannot change calendars."
+}
+
+#
+# GWS.CALENDAR.3.2v0.1
+#--
+
+test_ExternalSharingOptions_Secondary__Correct_V1 if {
+ # Not-Implemented
+ PolicyId := "GWS.CALENDAR.3.2v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Currently not able to be tested automatically; please manually check."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/calendar/calendar04_test.rego b/Testing/RegoTests/calendar/calendar04_test.rego
new file mode 100644
index 00000000..f5aa82aa
--- /dev/null
+++ b/Testing/RegoTests/calendar/calendar04_test.rego
@@ -0,0 +1,197 @@
+package calendar
+import future.keywords
+
+
+#
+# Policy 1
+#--
+test_CalInteropMan_Correct_V1 if {
+# Test calendar interop management when there's only one event
+ PolicyId := "GWS.CALENDAR.4.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EWS_INTEROP"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Calendar interop is not enabled for Test Top-Level Domain"
+}
+
+test_CalInteropMan_Correct_V2 if {
+ # Test calendar interop management when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.CALENDAR.4.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EWS_INTEROP"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EWS_INTEROP"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Calendar interop is not enabled for Test Top-Level Domain"
+}
+
+test_CalInteropMan_Incorrect_V1 if {
+ # Test calendar interop management when there are no relevant events
+ PolicyId := "GWS.CALENDAR.4.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "SAME_DOMAIN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Calendar Interop Management settings are set to the default value."
+}
+
+test_CalInteropMan_Incorrect_V2 if {
+ # Test calendar interop management when there's only one event and it's wrong
+ PolicyId := "GWS.CALENDAR.4.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EWS_INTEROP"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Calendar interop is enabled for Test Top-Level Domain"
+}
+
+test_CalInteropMan_Incorrect_V3 if {
+ # Test calendar interop management when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.CALENDAR.4.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EWS_INTEROP"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EWS_INTEROP"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Calendar interop is enabled for Test Top-Level Domain"
+}
+#--
+
+#
+# GWS.CALENDAR.4.2v0.1
+#--
+
+test_OAuth_Correct_V1 if {
+ # Not-Implemented
+ PolicyId := "GWS.CALENDAR.4.2v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Currently not able to be tested automatically; please manually check."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/calendar/calendar05_test.rego b/Testing/RegoTests/calendar/calendar05_test.rego
new file mode 100644
index 00000000..b6ea0dc7
--- /dev/null
+++ b/Testing/RegoTests/calendar/calendar05_test.rego
@@ -0,0 +1,270 @@
+package calendar
+import future.keywords
+
+#
+# GWS.CALENDAR.5.1v0.1
+#--
+test_CalendarAppointmentSlot_Correct_V1 if {
+ # Test Calendar Appointment Slot when there's only one event
+ PolicyId := "GWS.CALENDAR.5.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "CalendarAppointmentSlotAdminSettingsProto payments_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_CalendarAppointmentSlot_Correct_V2 if {
+ # Test Calendar Appointment Slot when there's multiple events and the most recent is correct
+ PolicyId := "GWS.CALENDAR.5.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "CalendarAppointmentSlotAdminSettingsProto payments_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "CalendarAppointmentSlotAdminSettingsProto payments_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_CalendarAppointmentSlot_Correct_V3 if {
+ # Test Calendar Appointment Slot when there's correct events in multiple OUs
+ PolicyId := "GWS.CALENDAR.5.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "CalendarAppointmentSlotAdminSettingsProto payments_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "CalendarAppointmentSlotAdminSettingsProto payments_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_CalendarAppointmentSlot_Incorrect_V1 if {
+ # Test Calendar Appointment Slot when there are no relevant events
+ PolicyId := "GWS.CALENDAR.5.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_CalendarAppointmentSlot_Incorrect_V2 if {
+ # Test Calendar Appointment Slot when there's only one event and it's wrong
+ PolicyId := "GWS.CALENDAR.5.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "CalendarAppointmentSlotAdminSettingsProto payments_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_CalendarAppointmentSlot_Incorrect_V3 if {
+ # Test Calendar Appointment Slot when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.CALENDAR.5.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "CalendarAppointmentSlotAdminSettingsProto payments_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "CalendarAppointmentSlotAdminSettingsProto payments_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_CalendarAppointmentSlot_Incorrect_V4 if {
+ # Test Calendar Appointment Slot when there's only one event and it's wrong
+ PolicyId := "GWS.CALENDAR.5.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "CalendarAppointmentSlotAdminSettingsProto payments_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+test_CalendarAppointmentSlot_Incorrect_V5 if {
+ # Test Calendar Appointment Slot when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.CALENDAR.5.1v0.1"
+ Output := tests with input as {
+ "calendar_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "CalendarAppointmentSlotAdminSettingsProto payments_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "CalendarAppointmentSlotAdminSettingsProto payments_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/chat/chat01_test.rego b/Testing/RegoTests/chat/chat01_test.rego
new file mode 100644
index 00000000..0baa185b
--- /dev/null
+++ b/Testing/RegoTests/chat/chat01_test.rego
@@ -0,0 +1,649 @@
+package chat
+import future.keywords
+
+#
+#GWS.CHAT.1.1v0.1
+#--
+test_History_Correct_V1 if {
+ # Test history setting when there's only one event
+ PolicyId := "GWS.CHAT.1.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ChatArchivingProto chatsDefaultToOffTheRecord"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_History_Correct_V2 if {
+ # Test history setting when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.CHAT.1.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ChatArchivingProto chatsDefaultToOffTheRecord"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ChatArchivingProto chatsDefaultToOffTheRecord"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_History_Correct_V3 if {
+ # Test history setting when there's multiple OUs
+ PolicyId := "GWS.CHAT.1.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ChatArchivingProto chatsDefaultToOffTheRecord"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ChatArchivingProto chatsDefaultToOffTheRecord"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_History_Correct_V4 if {
+ # Test history setting when there's multiple OUs and an older event non-compliant
+ PolicyId := "GWS.CHAT.1.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ChatArchivingProto chatsDefaultToOffTheRecord"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2020-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ChatArchivingProto chatsDefaultToOffTheRecord"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ChatArchivingProto chatsDefaultToOffTheRecord"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_History_Correct_V5 if {
+ # Test history setting when set to inherit from parent
+ PolicyId := "GWS.CHAT.1.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2020-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ChatArchivingProto chatsDefaultToOffTheRecord"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ChatArchivingProto chatsDefaultToOffTheRecord"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ChatArchivingProto chatsDefaultToOffTheRecord"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput)
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_History_Incorrect_V1 if {
+ # Test history setting when there are no relevant events
+ PolicyId := "GWS.CHAT.1.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_History_Incorrect_V2 if {
+ # Test history setting when there's only one event and it's wrong
+ PolicyId := "GWS.CHAT.1.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ChatArchivingProto chatsDefaultToOffTheRecord"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_History_Incorrect_V3 if {
+ # Test history setting when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.CHAT.1.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ChatArchivingProto chatsDefaultToOffTheRecord"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ChatArchivingProto chatsDefaultToOffTheRecord"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_History_Incorrect_V4 if {
+ # Test history setting when there is no event for the Top-level OU but there is one for a different OU
+ PolicyId := "GWS.CHAT.1.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ChatArchivingProto chatsDefaultToOffTheRecord"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+#--
+
+test_History_Incorrect_V5 if {
+ # Test history setting when the Top-level OU is compliant but a secondary OU is non-compliant
+ PolicyId := "GWS.CHAT.1.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ChatArchivingProto chatsDefaultToOffTheRecord"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ChatArchivingProto chatsDefaultToOffTheRecord"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+#--
+
+#
+# GWS.CHAT.1.2v0.1
+#--
+test_Change_History_Setting_Correct_V1 if {
+ # Test allow user to change history setting when there's only one event
+ PolicyId := "GWS.CHAT.1.2v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ChatArchivingProto allow_chat_archiving_setting_modification"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Change_History_Setting_Correct_V2 if {
+ # Test allow user to change history setting when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.CHAT.1.2v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ChatArchivingProto allow_chat_archiving_setting_modification"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ChatArchivingProto allow_chat_archiving_setting_modification"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Change_History_Setting_Correct_V3 if {
+ # Test history setting when set to inherit from parent
+ PolicyId := "GWS.CHAT.1.2v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2020-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ChatArchivingProto allow_chat_archiving_setting_modification"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ChatArchivingProto allow_chat_archiving_setting_modification"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ChatArchivingProto allow_chat_archiving_setting_modification"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput)
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Change_History_Setting_Incorrect_V1 if {
+ # Test allow user to change history setting when there are no relevant events
+ PolicyId := "GWS.CHAT.1.2v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_Change_History_Setting_Incorrect_V2 if {
+ # Test allow user to change history setting when there's only one event and it's wrong
+ PolicyId := "GWS.CHAT.1.2v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ChatArchivingProto allow_chat_archiving_setting_modification"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Change_History_Setting_Incorrect_V3 if {
+ # Test allow user to change history setting when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.CHAT.1.2v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ChatArchivingProto allow_chat_archiving_setting_modification"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ChatArchivingProto allow_chat_archiving_setting_modification"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+#--
+
+test_Change_History_Setting_Incorrect_V4 if {
+ # Test allow user to change history setting when there are multiple OU and a secondary OU is wrong
+ PolicyId := "GWS.CHAT.1.2v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ChatArchivingProto allow_chat_archiving_setting_modification"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ChatArchivingProto allow_chat_archiving_setting_modification"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Secondary OU."
+}
+#--
+
+test_Change_History_Setting_Incorrect_V5 if {
+ # Test allow user to change history setting when the primary OU is missing but a different one is present
+ PolicyId := "GWS.CHAT.1.2v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ChatArchivingProto allow_chat_archiving_setting_modification"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/chat/chat02_test.rego b/Testing/RegoTests/chat/chat02_test.rego
new file mode 100644
index 00000000..b7d98615
--- /dev/null
+++ b/Testing/RegoTests/chat/chat02_test.rego
@@ -0,0 +1,346 @@
+package chat
+import future.keywords
+
+#
+# GWS.CHAT.2.1v0.1
+#--
+test_External_File_Sharing_Correct_V1 if {
+ # Test users are not allowed to share files externally when there's only one event
+ PolicyId := "GWS.CHAT.2.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DynamiteFileSharingSettingsProto external_file_sharing_setting"},
+ {"name": "NEW_VALUE", "value": "NO_FILES"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_External_File_Sharing_Correct_V2 if {
+ # Test users are not allowed to share files externally when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.CHAT.2.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DynamiteFileSharingSettingsProto external_file_sharing_setting"},
+ {"name": "NEW_VALUE", "value": "NO_FILES"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DynamiteFileSharingSettingsProto external_file_sharing_setting"},
+ {"name": "NEW_VALUE", "value": "ALLOW_ALL_FILES"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_External_File_Sharing_Correct_V3 if {
+ # Test OU inheriting from parent
+ PolicyId := "GWS.CHAT.2.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2020-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DynamiteFileSharingSettingsProto external_file_sharing_setting"},
+ {"name": "NEW_VALUE", "value": "NO_FILES"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DynamiteFileSharingSettingsProto external_file_sharing_setting"},
+ {"name": "NEW_VALUE", "value": "ALLOW_ALL_FILES"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DynamiteFileSharingSettingsProto external_file_sharing_setting"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_External_File_Sharing_Incorrect_V1 if {
+ # Test no relevant events
+ PolicyId := "GWS.CHAT.2.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "NO_FILES"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_External_File_Sharing_Incorrect_V2 if {
+ # Test all allowed
+ PolicyId := "GWS.CHAT.2.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DynamiteFileSharingSettingsProto external_file_sharing_setting"},
+ {"name": "NEW_VALUE", "value": "ALLOW_ALL_FILES"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_External_File_Sharing_Incorrect_V3 if {
+ # Test images allowed
+ PolicyId := "GWS.CHAT.2.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DynamiteFileSharingSettingsProto external_file_sharing_setting"},
+ {"name": "NEW_VALUE", "value": "IMAGES_ONLY"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_External_File_Sharing_Incorrect_V4 if {
+ # Test sharing allowed when there are multiple events
+ PolicyId := "GWS.CHAT.2.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DynamiteFileSharingSettingsProto external_file_sharing_setting"},
+ {"name": "NEW_VALUE", "value": "ALLOW_ALL_FILES"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DynamiteFileSharingSettingsProto external_file_sharing_setting"},
+ {"name": "NEW_VALUE", "value": "NO_FILES"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_External_File_Sharing_Incorrect_V5 if {
+ # Test allowing images, multiple events
+ PolicyId := "GWS.CHAT.2.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DynamiteFileSharingSettingsProto external_file_sharing_setting"},
+ {"name": "NEW_VALUE", "value": "IMAGES_ONLY"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DynamiteFileSharingSettingsProto external_file_sharing_setting"},
+ {"name": "NEW_VALUE", "value": "NO_FILES"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_External_File_Sharing_Incorrect_V6 if {
+ # Test there's one event for a secondary OU but none for the primary OU
+ PolicyId := "GWS.CHAT.2.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DynamiteFileSharingSettingsProto external_file_sharing_setting"},
+ {"name": "NEW_VALUE", "value": "NO_FILES"},
+ {"name": "ORG_UNIT_NAME", "value": "Some other OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_External_File_Sharing_Incorrect_V7 if {
+ # Test there's multiple OUs
+ PolicyId := "GWS.CHAT.2.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DynamiteFileSharingSettingsProto external_file_sharing_setting"},
+ {"name": "NEW_VALUE", "value": "ALLOW_ALL_FILES"},
+ {"name": "ORG_UNIT_NAME", "value": "Some other OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DynamiteFileSharingSettingsProto external_file_sharing_setting"},
+ {"name": "NEW_VALUE", "value": "NO_FILES"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Some other OU."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/chat/chat03_test.rego b/Testing/RegoTests/chat/chat03_test.rego
new file mode 100644
index 00000000..e9e325fd
--- /dev/null
+++ b/Testing/RegoTests/chat/chat03_test.rego
@@ -0,0 +1,364 @@
+package chat
+import future.keywords
+
+#
+# GWS.CHAT.3.1v0.1
+#--
+test_Space_History_Setting_Correct_V1 if {
+ # Test space history setting when there's only one event - use case #1
+ PolicyId := "GWS.CHAT.3.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RoomOtrSettingsProto otr_state"},
+ {"name": "NEW_VALUE", "value": "DEFAULT_ON_THE_RECORD"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Space_History_Setting_Correct_V2 if {
+ # Test space history setting when there's only one event - use case #2
+ PolicyId := "GWS.CHAT.3.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RoomOtrSettingsProto otr_state"},
+ {"name": "NEW_VALUE", "value": "ALWAYS_ON_THE_RECORD"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Space_History_Setting_Correct_V3 if {
+ # Test space history setting when there's multiple events and the most most recent is correct - use case #1
+ PolicyId := "GWS.CHAT.3.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RoomOtrSettingsProto otr_state"},
+ {"name": "NEW_VALUE", "value": "DEFAULT_ON_THE_RECORD"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RoomOtrSettingsProto otr_state"},
+ {"name": "NEW_VALUE", "value": "DEFAULT_OFF_THE_RECORD"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Space_History_Setting_Correct_V4 if {
+ # Test space history setting when there's multiple events and the most most recent is correct - use case #2
+ PolicyId := "GWS.CHAT.3.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RoomOtrSettingsProto otr_state"},
+ {"name": "NEW_VALUE", "value": "ALWAYS_ON_THE_RECORD"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RoomOtrSettingsProto otr_state"},
+ {"name": "NEW_VALUE", "value": "ALWAYS_OFF_THE_RECORD"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Space_History_Setting_Incorrect_V1 if {
+ # Test space history setting when there are no relevant events
+ PolicyId := "GWS.CHAT.3.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "ALWAYS_ON_THE_RECORD"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_Space_History_Setting_Incorrect_V2 if {
+ # Test space history setting when there's only one event and it's wrong - use case #1
+ PolicyId := "GWS.CHAT.3.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RoomOtrSettingsProto otr_state"},
+ {"name": "NEW_VALUE", "value": "ALWAYS_OFF_THE_RECORD"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Space_History_Setting_Incorrect_V3 if {
+ # Test space history setting when there's only one event and it's wrong - use case #2
+ PolicyId := "GWS.CHAT.3.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RoomOtrSettingsProto otr_state"},
+ {"name": "NEW_VALUE", "value": "DEFAULT_OFF_THE_RECORD"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Space_History_Setting_Incorrect_V4 if {
+ # Test space history setting when there are multiple events and the most recent is wrong - use case #1
+ PolicyId := "GWS.CHAT.3.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RoomOtrSettingsProto otr_state"},
+ {"name": "NEW_VALUE", "value": "DEFAULT_OFF_THE_RECORD"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RoomOtrSettingsProto otr_state"},
+ {"name": "NEW_VALUE", "value": "DEFAULT_ON_THE_RECORD"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Space_History_Setting_Incorrect_V5 if {
+ # Test space history setting when there are multiple events and the most recent is wrong - use case #2
+ PolicyId := "GWS.CHAT.3.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RoomOtrSettingsProto otr_state"},
+ {"name": "NEW_VALUE", "value": "ALWAYS_OFF_THE_RECORD"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RoomOtrSettingsProto otr_state"},
+ {"name": "NEW_VALUE", "value": "ALWAYS_ON_THE_RECORD"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Space_History_Setting_Incorrect_V6 if {
+ # Test there's an event for a secondary OU but not the top-level OU
+ PolicyId := "GWS.CHAT.3.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RoomOtrSettingsProto otr_state"},
+ {"name": "NEW_VALUE", "value": "ALWAYS_OFF_THE_RECORD"},
+ {"name": "ORG_UNIT_NAME", "value": "Some other OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_Space_History_Setting_Incorrect_V7 if {
+ # Test multiple OUs
+ PolicyId := "GWS.CHAT.3.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RoomOtrSettingsProto otr_state"},
+ {"name": "NEW_VALUE", "value": "ALWAYS_OFF_THE_RECORD"},
+ {"name": "ORG_UNIT_NAME", "value": "Some other OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RoomOtrSettingsProto otr_state"},
+ {"name": "NEW_VALUE", "value": "ALWAYS_OFF_THE_RECORD"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Some other OU, Test Top-Level OU."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/chat/chat04_test.rego b/Testing/RegoTests/chat/chat04_test.rego
new file mode 100644
index 00000000..33a50e29
--- /dev/null
+++ b/Testing/RegoTests/chat/chat04_test.rego
@@ -0,0 +1,606 @@
+package chat
+import future.keywords
+
+#
+# GWS.CHAT.4.1v0.1
+#--
+test_External_Chat_Setting_Correct_V1 if {
+ # Test external chat setting setting when there's only one event
+ PolicyId := "GWS.CHAT.4.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RestrictChatProto restrictChatToOrganization"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_External_Chat_Setting_Correct_V2 if {
+ # Test external chat setting when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.CHAT.4.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RestrictChatProto restrictChatToOrganization"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RestrictChatProto restrictChatToOrganization"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_External_Chat_Setting_Correct_V3 if {
+ # Test external on but whitelist
+ PolicyId := "GWS.CHAT.4.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RestrictChatProto restrictChatToOrganization"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2023-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RestrictChatProto externalChatRestriction"},
+ {"name": "NEW_VALUE", "value": "TRUSTED_DOMAINS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_External_Chat_Setting_Correct_V4 if {
+ # Test inheritance
+ PolicyId := "GWS.CHAT.4.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2020-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RestrictChatProto restrictChatToOrganization"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RestrictChatProto restrictChatToOrganization"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RestrictChatProto restrictChatToOrganization"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_External_Chat_Setting_Incorrect_V1 if {
+ # Test external chat setting when there are no relevant events
+ PolicyId := "GWS.CHAT.4.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_External_Chat_Setting_Incorrect_V2 if {
+ # Test external chat setting there's only one event and it's wrong
+ PolicyId := "GWS.CHAT.4.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RestrictChatProto restrictChatToOrganization"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_External_Chat_Setting_Incorrect_V3 if {
+ # Test external chat setting there are multiple events and the most recent is wrong
+ PolicyId := "GWS.CHAT.4.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RestrictChatProto restrictChatToOrganization"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RestrictChatProto restrictChatToOrganization"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_External_Chat_Setting_Incorrect_V4 if {
+ # Test secondary OU has an event but the top-level one does not
+ PolicyId := "GWS.CHAT.4.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RestrictChatProto restrictChatToOrganization"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Some other OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2023-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RestrictChatProto externalChatRestriction"},
+ {"name": "NEW_VALUE", "value": "NO_RESTRICTION"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_External_Chat_Setting_Incorrect_V5 if {
+ # Test multiple OUs
+ PolicyId := "GWS.CHAT.4.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RestrictChatProto restrictChatToOrganization"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Some other OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RestrictChatProto restrictChatToOrganization"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Some other OU."
+}
+#--
+
+#
+# GWS.CHAT.4.2v0.1
+#--
+test_AllowListed_Setting_Correct_V1 if {
+ # Test external chat setting setting when there's only one event
+ PolicyId := "GWS.CHAT.4.2v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RestrictChatProto externalChatRestriction"},
+ {"name": "NEW_VALUE", "value": "TRUSTED_DOMAINS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_AllowListed_Setting_Correct_V2 if {
+ # Test external chat setting when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.CHAT.4.2v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RestrictChatProto externalChatRestriction"},
+ {"name": "NEW_VALUE", "value": "TRUSTED_DOMAINS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RestrictChatProto externalChatRestriction"},
+ {"name": "NEW_VALUE", "value": "NO_RESTRICTION"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_AllowListed_Setting_Correct_V3 if {
+ # Test inheritance
+ PolicyId := "GWS.CHAT.4.2v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2020-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RestrictChatProto externalChatRestriction"},
+ {"name": "NEW_VALUE", "value": "TRUSTED_DOMAINS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RestrictChatProto externalChatRestriction"},
+ {"name": "NEW_VALUE", "value": "NO_RESTRICTION"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RestrictChatProto externalChatRestriction"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_AllowListed_Setting_Incorrect_V1 if {
+ # Test external chat setting when there are no relevant events
+ PolicyId := "GWS.CHAT.4.2v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_AllowListed_Setting_Incorrect_V2 if {
+ # Test external chat setting there's only one event and it's wrong
+ PolicyId := "GWS.CHAT.4.2v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2023-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RestrictChatProto externalChatRestriction"},
+ {"name": "NEW_VALUE", "value": "NO_RESTRICTION"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_AllowListed_Setting_Incorrect_V3 if {
+ # Test external chat setting there are multiple events and the most recent is wrong
+ PolicyId := "GWS.CHAT.4.2v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2023-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RestrictChatProto externalChatRestriction"},
+ {"name": "NEW_VALUE", "value": "NO_RESTRICTION"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RestrictChatProto externalChatRestriction"},
+ {"name": "NEW_VALUE", "value": "TRUSTED_DOMAINS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_AllowListed_Setting_Incorrect_V4 if {
+ # Test secondary OU has an event but the top-level one does not
+ PolicyId := "GWS.CHAT.4.2v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2023-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RestrictChatProto externalChatRestriction"},
+ {"name": "NEW_VALUE", "value": "NO_RESTRICTION"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_AllowListed_Setting_Incorrect_V5 if {
+ # Test multiple OUs
+ PolicyId := "GWS.CHAT.4.2v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2023-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RestrictChatProto externalChatRestriction"},
+ {"name": "NEW_VALUE", "value": "NO_RESTRICTION"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2023-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RestrictChatProto externalChatRestriction"},
+ {"name": "NEW_VALUE", "value": "TRUSTED_DOMAINS"},
+ {"name": "ORG_UNIT_NAME", "value": "Some other OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/chat/chat05_test.rego b/Testing/RegoTests/chat/chat05_test.rego
new file mode 100644
index 00000000..10d031b8
--- /dev/null
+++ b/Testing/RegoTests/chat/chat05_test.rego
@@ -0,0 +1,233 @@
+package chat
+import future.keywords
+
+#
+# GWS.CHAT.5.1v0.1
+#--
+test_External_Chat_App_Setting_Correct_V1 if {
+ # Test external chat app setting setting when there's only one event
+ PolicyId := "GWS.CHAT.5.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Chat app Settings - Chat apps enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_External_Chat_App_Setting_Correct_V2 if {
+ # Test external chat app setting when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.CHAT.5.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Chat app Settings - Chat apps enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Chat app Settings - Chat apps enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+
+test_External_Chat_App_Setting_Incorrect_V1 if {
+ # Test external chat app setting when there are no relevant events
+ PolicyId := "GWS.CHAT.5.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_External_Chat_App_Setting_Incorrect_V2 if {
+ # Test external chat app setting there's only one event and it's wrong
+ PolicyId := "GWS.CHAT.5.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Chat app Settings - Chat apps enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_External_Chat_App_Setting_Incorrect_V3 if {
+ # Test external chat app setting there are multiple events and the most recent is wrong
+ PolicyId := "GWS.CHAT.5.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Chat app Settings - Chat apps enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Chat app Settings - Chat apps enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_External_Chat_App_Setting_Incorrect_V4 if {
+ # Test no event for top-level OU but an event for a different OU
+ PolicyId := "GWS.CHAT.5.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Chat app Settings - Chat apps enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_External_Chat_App_Setting_Incorrect_V5 if {
+ # Test multiple OUs
+ PolicyId := "GWS.CHAT.5.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Chat app Settings - Chat apps enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Chat app Settings - Chat apps enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Second-Level OU, Test Top-Level OU."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/chat/chat06_test.rego b/Testing/RegoTests/chat/chat06_test.rego
new file mode 100644
index 00000000..8a8991d5
--- /dev/null
+++ b/Testing/RegoTests/chat/chat06_test.rego
@@ -0,0 +1,25 @@
+package chat
+import future.keywords
+
+#
+# GWS.CHAT.6.1v0.1
+#--
+
+test_FromList_Correct_V1 if {
+ # Test enforcing MFA when there's only one event set to only key
+ PolicyId := "GWS.CHAT.6.1v0.1"
+ Output := tests with input as {
+ "chat_logs": {"items": [
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Currently not able to be tested automatically; please manually check."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/classroom/classroom01_test.rego b/Testing/RegoTests/classroom/classroom01_test.rego
new file mode 100644
index 00000000..a43dd204
--- /dev/null
+++ b/Testing/RegoTests/classroom/classroom01_test.rego
@@ -0,0 +1,349 @@
+package classroom
+import future.keywords
+
+#
+# GWS.CLASSROOM.1.1v0.1
+#--
+
+test_JoinClassroom_Correct_V1 if {
+ # Test enforcing who can join classroom when there's only one event
+ PolicyId := "GWS.CLASSROOM.1.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "ClassMembershipSettingsGroup who_can_join_classes"},
+ {"name": "NEW_VALUE", "value": "1"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_JoinClassroom_Correct_V2 if {
+ # Test enforcing MFA when there's multiple events, with the chronological latest
+ # correct but not last in json list
+ PolicyId := "GWS.CLASSROOM.1.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "ClassMembershipSettingsGroup who_can_join_classes"},
+ {"name": "NEW_VALUE", "value": "1"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "ClassMembershipSettingsGroup who_can_join_classes"},
+ {"name": "NEW_VALUE", "value": "2"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_JoinClassroom_Incorrect_V1 if {
+ # Test enforcing who can join classroom when there's only one event and it's wrong
+ PolicyId := "GWS.CLASSROOM.1.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "ClassMembershipSettingsGroup who_can_join_classes"},
+ {"name": "NEW_VALUE", "value": "2"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_JoinClassroom_Incorrect_V2 if {
+ # Test who can join classroom when there's multiple events, with the chronological latest
+ # incorrect but not last in json list
+ PolicyId := "GWS.CLASSROOM.1.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "ClassMembershipSettingsGroup who_can_join_classes"},
+ {"name": "NEW_VALUE", "value": "2"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "ClassMembershipSettingsGroup who_can_join_classes"},
+ {"name": "NEW_VALUE", "value": "1"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+
+test_JoinClassroom_Incorrect_V3 if {
+ # Test enforcing who can join classroom when there no applicable event
+ PolicyId := "GWS.CLASSROOM.1.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "SOMETHING_ELSE",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "2"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+#--
+
+
+#
+# GWS.CLASSROOM.1.2v0.1
+#--
+
+test_WhichClasses_Correct_V1 if {
+ # Test enforcing which classes users can join when there's only one event
+ PolicyId := "GWS.CLASSROOM.1.2v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "ClassMembershipSettingsGroup which_classes_can_users_join"},
+ {"name": "NEW_VALUE", "value": "1"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_WhichClasses_Correct_V2 if {
+ # Test enforcing which classes users can join when there's multiple events, with the chronological latest
+ # correct but not last in json list
+ PolicyId := "GWS.CLASSROOM.1.2v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "ClassMembershipSettingsGroup which_classes_can_users_join"},
+ {"name": "NEW_VALUE", "value": "1"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "ClassMembershipSettingsGroup which_classes_can_users_join"},
+ {"name": "NEW_VALUE", "value": "2"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_WhichClasses_Incorrect_V1 if {
+ # Test enforcing which classes users can join when there's only one event and it's wrong
+ PolicyId := "GWS.CLASSROOM.1.2v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "ClassMembershipSettingsGroup which_classes_can_users_join"},
+ {"name": "NEW_VALUE", "value": "2"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_WhichClasses_Incorrect_V2 if {
+ # Test enforcing which classes users can join when there's multiple events, with the chronological latest
+ # incorrect but not last in json list
+ PolicyId := "GWS.CLASSROOM.1.2v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "ClassMembershipSettingsGroup which_classes_can_users_join"},
+ {"name": "NEW_VALUE", "value": "2"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "ClassMembershipSettingsGroup who_can_join_classes",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "1"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+
+test_WhichClasses_Incorrect_V3 if {
+ # Test enforcing which classes users can join when there no applicable event
+ PolicyId := "GWS.CLASSROOM.1.2v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "SOMETHING_ELSE",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "2"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
\ No newline at end of file
diff --git a/Testing/RegoTests/classroom/classroom02_test.rego b/Testing/RegoTests/classroom/classroom02_test.rego
new file mode 100644
index 00000000..82d4b3e8
--- /dev/null
+++ b/Testing/RegoTests/classroom/classroom02_test.rego
@@ -0,0 +1,462 @@
+package classroom
+import future.keywords
+
+
+# GWS.CLASSROOM.2.1v0.1
+#--
+
+test_APIAccess_Correct_V1 if {
+ # Test API Access is disabled when there's only one event
+ PolicyId := "GWS.CLASSROOM.2.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "ApiDataAccessSettingProto api_access_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_APIAccess_Correct_V2 if {
+ # Test enforcing API Access is disabled when there's multiple events, with the chronological latest
+ # correct but not last in json list
+ PolicyId := "GWS.CLASSROOM.2.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "ApiDataAccessSettingProto api_access_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "ApiDataAccessSettingProto api_access_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_APIAccess_Correct_V3 if {
+ # Test enforcing API Access is disabled is correct when there are events in multiple OUs
+ PolicyId := "GWS.CLASSROOM.2.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ApiDataAccessSettingProto api_access_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ApiDataAccessSettingProto api_access_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_APIAccess_Correct_V4 if {
+ # Test API Access is disabled when set to inherit from parent
+ PolicyId := "GWS.CLASSROOM.2.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2020-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ApiDataAccessSettingProto api_access_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ApiDataAccessSettingProto api_access_enabled"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ApiDataAccessSettingProto api_access_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_APIAccess_Incorrect_V1 if {
+ # Test API Access is disabled when there's only one event and it's wrong
+ PolicyId := "GWS.CLASSROOM.2.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "ApiDataAccessSettingProto api_access_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_APIAccess_Incorrect_V2 if {
+ # Test API Access is disabled when there's multiple events, with the chronological latest
+ # incorrect but not last in json list
+ PolicyId := "GWS.CLASSROOM.2.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "ApiDataAccessSettingProto api_access_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "ApiDataAccessSettingProto api_access_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+
+test_APIAccess_Incorrect_V3 if {
+ # Test API Access is disabled when there no applicable event
+ PolicyId := "GWS.CLASSROOM.2.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "something else"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+test_APIAccess_Incorrect_V4 if {
+ # Test allow API Access is disabled when there are multiple OU and a secondary OU is wrong
+ PolicyId := "GWS.CLASSROOM.2.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ApiDataAccessSettingProto api_access_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ApiDataAccessSettingProto api_access_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Secondary OU."
+}
+#--
+
+test_APIAccess_Incorrect_V5 if {
+ # Test API Access is disabled when the primary OU is missing but a different one is present
+ PolicyId := "GWS.CLASSROOM.2.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ApiDataAccessSettingProto api_access_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_APIAccess_Incorrect_V6 if {
+ # Test API Access is disabled access when there's only one event and it's wrong
+ PolicyId := "GWS.CLASSROOM.2.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ApiDataAccessSettingProto api_access_enabled"},
+ {"name": "NEW_VALUE", "value": "SAME_DOMAIN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_APIAccess_Incorrect_V7 if {
+ # Test API Access is disabled when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.CLASSROOM.2.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ApiDataAccessSettingProto api_access_enabled"},
+ {"name": "NEW_VALUE", "value": "SAME_DOMAIN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ApiDataAccessSettingProto api_access_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_APIAccess_Incorrect_V8 if {
+ # Test API Access is disabled when there are multiple OU and a secondary OU is wrong
+ PolicyId := "GWS.CLASSROOM.2.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ApiDataAccessSettingProto api_access_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ApiDataAccessSettingProto api_access_enabled"},
+ {"name": "NEW_VALUE", "value": "SAME_DOMAIN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Secondary OU."
+}
+#--
+
+test_APIAccess_Incorrect_V9 if {
+ # Test API Access is disabled when the primary OU is missing but a different one is present
+ PolicyId := "GWS.CLASSROOM.2.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ApiDataAccessSettingProto api_access_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+#--
diff --git a/Testing/RegoTests/classroom/classroom03_test.rego b/Testing/RegoTests/classroom/classroom03_test.rego
new file mode 100644
index 00000000..6d3d935f
--- /dev/null
+++ b/Testing/RegoTests/classroom/classroom03_test.rego
@@ -0,0 +1,462 @@
+package classroom
+import future.keywords
+
+
+# GWS.CLASSROOM.3.1v0.1
+#--
+
+test_CleverRosterDisabled_Correct_V1 if {
+ # Test Clever Roster is disabled when there's only one event
+ PolicyId := "GWS.CLASSROOM.3.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "RosterImportSettingsProto sis_integrator"},
+ {"name": "NEW_VALUE", "value": "SIS_INTEGRATOR_NONE"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_CleverRosterDisabled_Correct_V2 if {
+ # Test enforcing Clever Roster is disabled when there's multiple events, with the chronological latest
+ # correct but not last in json list
+ PolicyId := "GWS.CLASSROOM.3.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "RosterImportSettingsProto sis_integrator"},
+ {"name": "NEW_VALUE", "value": "SIS_INTEGRATOR_NONE"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "RosterImportSettingsProto sis_integrator"},
+ {"name": "NEW_VALUE", "value": "SIS_INTEGRATOR_CLEVER"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_CleverRosterDisabled_Correct_V3 if {
+ # Test enforcing Clever Roster is disabled is correct when there are events in multiple OUs
+ PolicyId := "GWS.CLASSROOM.3.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RosterImportSettingsProto sis_integrator"},
+ {"name": "NEW_VALUE", "value": "SIS_INTEGRATOR_NONE"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RosterImportSettingsProto sis_integrator"},
+ {"name": "NEW_VALUE", "value": "SIS_INTEGRATOR_NONE"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_CleverRosterDisabled_Correct_V4 if {
+ # Test Clever Roster is disabled when set to inherit from parent
+ PolicyId := "GWS.CLASSROOM.3.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2020-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RosterImportSettingsProto sis_integrator"},
+ {"name": "NEW_VALUE", "value": "SIS_INTEGRATOR_NONE"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RosterImportSettingsProto sis_integrator"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RosterImportSettingsProto sis_integrator"},
+ {"name": "NEW_VALUE", "value": "SIS_INTEGRATOR_CLEVER"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_CleverRosterDisabled_Incorrect_V1 if {
+ # Test Clever Roster is disabled when there's only one event and it's wrong
+ PolicyId := "GWS.CLASSROOM.3.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "RosterImportSettingsProto sis_integrator"},
+ {"name": "NEW_VALUE", "value": "SIS_INTEGRATOR_CLEVER"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_CleverRosterDisabled_Incorrect_V2 if {
+ # Test Clever Roster is disabled when there's multiple events, with the chronological latest
+ # incorrect but not last in json list
+ PolicyId := "GWS.CLASSROOM.3.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "RosterImportSettingsProto sis_integrator"},
+ {"name": "NEW_VALUE", "value": "SIS_INTEGRATOR_CLEVER"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "RosterImportSettingsProto sis_integrator"},
+ {"name": "NEW_VALUE", "value": "SIS_INTEGRATOR_NONE"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+
+test_CleverRosterDisabled_Incorrect_V3 if {
+ # Test Clever Roster is disabled when there no applicable event
+ PolicyId := "GWS.CLASSROOM.3.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "something else"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is compliant; manual check recommended."
+}
+test_CleverRosterDisabled_Incorrect_V4 if {
+ # Test allow Clever Roster is disabled when there are multiple OU and a secondary OU is wrong
+ PolicyId := "GWS.CLASSROOM.3.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RosterImportSettingsProto sis_integrator"},
+ {"name": "NEW_VALUE", "value": "SIS_INTEGRATOR_NONE"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RosterImportSettingsProto sis_integrator"},
+ {"name": "NEW_VALUE", "value": "SIS_INTEGRATOR_CLEVER"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Secondary OU."
+}
+#--
+
+test_CleverRosterDisabled_Incorrect_V5 if {
+ # Test Clever Roster is disabled when the primary OU is missing but a different one is present
+ PolicyId := "GWS.CLASSROOM.3.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RosterImportSettingsProto sis_integrator"},
+ {"name": "NEW_VALUE", "value": "SIS_INTEGRATOR_CLEVER"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is compliant; manual check recommended."
+}
+
+test_CleverRosterDisabled_Incorrect_V6 if {
+ # Test Clever Roster is disabled access when there's only one event and it's wrong
+ PolicyId := "GWS.CLASSROOM.3.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RosterImportSettingsProto sis_integrator"},
+ {"name": "NEW_VALUE", "value": "SAME_DOMAIN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_CleverRosterDisabled_Incorrect_V7 if {
+ # Test Clever Roster is disabled when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.CLASSROOM.3.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RosterImportSettingsProto sis_integrator"},
+ {"name": "NEW_VALUE", "value": "SAME_DOMAIN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RosterImportSettingsProto sis_integrator"},
+ {"name": "NEW_VALUE", "value": "SIS_INTEGRATOR_NONE"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_CleverRosterDisabled_Incorrect_V8 if {
+ # Test Clever Roster is disabled when there are multiple OU and a secondary OU is wrong
+ PolicyId := "GWS.CLASSROOM.3.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RosterImportSettingsProto sis_integrator"},
+ {"name": "NEW_VALUE", "value": "SIS_INTEGRATOR_NONE"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RosterImportSettingsProto sis_integrator"},
+ {"name": "NEW_VALUE", "value": "SAME_DOMAIN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Secondary OU."
+}
+#--
+
+test_CleverRosterDisabled_Incorrect_V9 if {
+ # Test Clever Roster is disabled when the primary OU is missing but a different one is present
+ PolicyId := "GWS.CLASSROOM.3.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "RosterImportSettingsProto sis_integrator"},
+ {"name": "NEW_VALUE", "value": "SIS_INTEGRATOR_NONE"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is compliant; manual check recommended."
+}
+#--
diff --git a/Testing/RegoTests/classroom/classroom04_test.rego b/Testing/RegoTests/classroom/classroom04_test.rego
new file mode 100644
index 00000000..bc78f090
--- /dev/null
+++ b/Testing/RegoTests/classroom/classroom04_test.rego
@@ -0,0 +1,462 @@
+package classroom
+import future.keywords
+
+#
+# GWS.CLASSROOM.4.1v0.1
+#--
+
+test_UnenrollStudents_Correct_V1 if {
+ # Test only teachers can unenroll students when there's only one event
+ PolicyId := "GWS.CLASSROOM.4.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "StudentUnenrollmentSettingsProto who_can_unenroll_students"},
+ {"name": "NEW_VALUE", "value": "ONLY_TEACHERS_CAN_UNENROLL_STUDENTS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_UnenrollStudents_Correct_V2 if {
+ # Test enforcing only teachers can unenroll students when there's multiple events, with the chronological latest
+ # correct but not last in json list
+ PolicyId := "GWS.CLASSROOM.4.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "StudentUnenrollmentSettingsProto who_can_unenroll_students"},
+ {"name": "NEW_VALUE", "value": "ONLY_TEACHERS_CAN_UNENROLL_STUDENTS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "StudentUnenrollmentSettingsProto who_can_unenroll_students"},
+ {"name": "NEW_VALUE", "value": "STUDENTS_AND_TEACHERS_CAN_UNENROLL_STUDENTS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_UnenrollStudents_Correct_V3 if {
+ # Test enforcing only teachers can unenroll students is correct when there are events in multiple OUs
+ PolicyId := "GWS.CLASSROOM.4.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "StudentUnenrollmentSettingsProto who_can_unenroll_students"},
+ {"name": "NEW_VALUE", "value": "ONLY_TEACHERS_CAN_UNENROLL_STUDENTS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "StudentUnenrollmentSettingsProto who_can_unenroll_students"},
+ {"name": "NEW_VALUE", "value": "ONLY_TEACHERS_CAN_UNENROLL_STUDENTS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_UnenrollStudents_Correct_V4 if {
+ # Test only teachers can unenroll students when set to inherit from parent
+ PolicyId := "GWS.CLASSROOM.4.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2020-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "StudentUnenrollmentSettingsProto who_can_unenroll_students"},
+ {"name": "NEW_VALUE", "value": "ONLY_TEACHERS_CAN_UNENROLL_STUDENTS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "StudentUnenrollmentSettingsProto who_can_unenroll_students"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "StudentUnenrollmentSettingsProto who_can_unenroll_students"},
+ {"name": "NEW_VALUE", "value": "STUDENTS_AND_TEACHERS_CAN_UNENROLL_STUDENTS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_UnenrollStudents_Incorrect_V1 if {
+ # Test only teachers can unenroll students when there's only one event and it's wrong
+ PolicyId := "GWS.CLASSROOM.4.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "StudentUnenrollmentSettingsProto who_can_unenroll_students"},
+ {"name": "NEW_VALUE", "value": "STUDENTS_AND_TEACHERS_CAN_UNENROLL_STUDENTS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_UnenrollStudents_Incorrect_V2 if {
+ # Test only teachers can unenroll students when there's multiple events, with the chronological latest
+ # incorrect but not last in json list
+ PolicyId := "GWS.CLASSROOM.4.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "StudentUnenrollmentSettingsProto who_can_unenroll_students"},
+ {"name": "NEW_VALUE", "value": "STUDENTS_AND_TEACHERS_CAN_UNENROLL_STUDENTS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "StudentUnenrollmentSettingsProto who_can_unenroll_students"},
+ {"name": "NEW_VALUE", "value": "ONLY_TEACHERS_CAN_UNENROLL_STUDENTS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+
+test_UnenrollStudents_Incorrect_V3 if {
+ # Test only teachers can unenroll students when there no applicable event
+ PolicyId := "GWS.CLASSROOM.4.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name":"SETTING_NAME",
+ "value": "something else"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is compliant; manual check recommended."
+}
+test_UnenrollStudents_Incorrect_V4 if {
+ # Test allow only teachers can unenroll students when there are multiple OU and a secondary OU is wrong
+ PolicyId := "GWS.CLASSROOM.4.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "StudentUnenrollmentSettingsProto who_can_unenroll_students"},
+ {"name": "NEW_VALUE", "value": "ONLY_TEACHERS_CAN_UNENROLL_STUDENTS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "StudentUnenrollmentSettingsProto who_can_unenroll_students"},
+ {"name": "NEW_VALUE", "value": "STUDENTS_AND_TEACHERS_CAN_UNENROLL_STUDENTS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Secondary OU."
+}
+#--
+
+test_UnenrollStudents_Incorrect_V5 if {
+ # Test only teachers can unenroll students when the primary OU is missing but a different one is present
+ PolicyId := "GWS.CLASSROOM.4.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "StudentUnenrollmentSettingsProto who_can_unenroll_students"},
+ {"name": "NEW_VALUE", "value": "STUDENTS_AND_TEACHERS_CAN_UNENROLL_STUDENTS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is compliant; manual check recommended."
+}
+
+test_UnenrollStudents_Incorrect_V6 if {
+ # Test only teachers can unenroll students access when there's only one event and it's wrong
+ PolicyId := "GWS.CLASSROOM.4.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "StudentUnenrollmentSettingsProto who_can_unenroll_students"},
+ {"name": "NEW_VALUE", "value": "SAME_DOMAIN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_UnenrollStudents_Incorrect_V7 if {
+ # Test only teachers can unenroll students when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.CLASSROOM.4.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "StudentUnenrollmentSettingsProto who_can_unenroll_students"},
+ {"name": "NEW_VALUE", "value": "SAME_DOMAIN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "StudentUnenrollmentSettingsProto who_can_unenroll_students"},
+ {"name": "NEW_VALUE", "value": "ONLY_TEACHERS_CAN_UNENROLL_STUDENTS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_UnenrollStudents_Incorrect_V8 if {
+ # Test only teachers can unenroll students when there are multiple OU and a secondary OU is wrong
+ PolicyId := "GWS.CLASSROOM.4.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "StudentUnenrollmentSettingsProto who_can_unenroll_students"},
+ {"name": "NEW_VALUE", "value": "ONLY_TEACHERS_CAN_UNENROLL_STUDENTS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "StudentUnenrollmentSettingsProto who_can_unenroll_students"},
+ {"name": "NEW_VALUE", "value": "SAME_DOMAIN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Secondary OU."
+}
+#--
+
+test_UnenrollStudents_Incorrect_V9 if {
+ # Test only teachers can unenroll students when the primary OU is missing but a different one is present
+ PolicyId := "GWS.CLASSROOM.4.1v0.1"
+ Output := tests with input as {
+ "classroom_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "StudentUnenrollmentSettingsProto who_can_unenroll_students"},
+ {"name": "NEW_VALUE", "value": "ONLY_TEACHERS_CAN_UNENROLL_STUDENTS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is compliant; manual check recommended."
+}
+#--
diff --git a/Testing/RegoTests/commoncontrols/commoncontrols01_test.rego b/Testing/RegoTests/commoncontrols/commoncontrols01_test.rego
new file mode 100644
index 00000000..03c20ea7
--- /dev/null
+++ b/Testing/RegoTests/commoncontrols/commoncontrols01_test.rego
@@ -0,0 +1,895 @@
+package commoncontrols
+import future.keywords
+
+#
+# GWS.COMMONCONTROLS.1.1v0.1
+#--
+test_EnforceMFA_Correct_V1 if {
+ # Test enforcing MFA when there's only one event
+ PolicyId := "GWS.COMMONCONTROLS.1.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "ENFORCE_STRONG_AUTHENTICATION",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS",
+ "parameters": [
+ {"name": "ALLOWED_TWO_STEP_VERIFICATION_METHOD", "value": "ONLY_SECURITY_KEY"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_EnforceMFA_Correct_V2 if {
+ # Test enforcing MFA when there's multiple events, with the chronological latest
+ # correct but not last in json list
+ PolicyId := "GWS.COMMONCONTROLS.1.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "ENFORCE_STRONG_AUTHENTICATION",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "ENFORCE_STRONG_AUTHENTICATION",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS",
+ "parameters": [
+ {"name": "ALLOWED_TWO_STEP_VERIFICATION_METHOD", "value": "ONLY_SECURITY_KEY"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_EnforceMFA_Incorrect_V1 if {
+ # Test enforcing MFA when there's only one event and it's wrong
+ PolicyId := "GWS.COMMONCONTROLS.1.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "ENFORCE_STRONG_AUTHENTICATION",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS",
+ "parameters": [
+ {"name": "ALLOWED_TWO_STEP_VERIFICATION_METHOD", "value": "ONLY_SECURITY_KEY"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_EnforceMFA_Incorrect_V2 if {
+ # Test enforcing MFA when there's multiple events, with the chronological latest
+ # incorrect but not last in json list
+ PolicyId := "GWS.COMMONCONTROLS.1.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "ENFORCE_STRONG_AUTHENTICATION",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "ENFORCE_STRONG_AUTHENTICATION",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS",
+ "parameters": [
+ {"name": "ALLOWED_TWO_STEP_VERIFICATION_METHOD", "value": "ONLY_SECURITY_KEY"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+
+test_EnforceMFA_Incorrect_V3 if {
+ # Test enforcing MFA when there's no enforce mfa event
+ PolicyId := "GWS.COMMONCONTROLS.1.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])}
+
+test_EnforceMFA_Incorrect_V4 if {
+ # Test enforcing MFA when there's no change methods event
+ PolicyId := "GWS.COMMONCONTROLS.1.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "ENFORCE_STRONG_AUTHENTICATION",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])
+}
+#--
+
+#
+# GWS.COMMONCONTROLS.1.2v0.1
+#--
+test_Enforcement_Correct_V1 if {
+ # Test enforcing MFA when there's only one event
+ PolicyId := "GWS.COMMONCONTROLS.1.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "1 week"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Enforcement_Correct_V2 if {
+ # Test enforcing MFA when there's multiple events, with the chronological latest
+ # correct but not last in json list
+ PolicyId := "GWS.COMMONCONTROLS.1.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "1 week"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "ENFORCE_STRONG_AUTHENTICATION",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "1 day"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Enforcement_Correct_V3 if {
+ # Test enforcing MFA inheritance
+ PolicyId := "GWS.COMMONCONTROLS.1.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "1 week"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "2 weeks"},
+ {"name": "ORG_UNIT_NAME", "value": "Second OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2023-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "INHERIT_FROM_PARENT"},
+ {"name": "ORG_UNIT_NAME", "value": "Second OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Enforcement_Incorrect_V1 if {
+ # Test enforcing MFA when there's only one event and it's wrong
+ PolicyId := "GWS.COMMONCONTROLS.1.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "2 weeks"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Enforcement_Incorrect_V2 if {
+ # Test enforcing MFA when there's multiple events, with the chronological latest
+ # incorrect but not last in json list
+ PolicyId := "GWS.COMMONCONTROLS.1.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "2 weeks"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "1 week"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+
+test_Enforcement_Incorrect_V3 if {
+ # Test enforcing MFA when there no applicable event
+ PolicyId := "GWS.COMMONCONTROLS.1.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "SOMETHING_ELSE",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])
+}
+
+#
+# GWS.COMMONCONTROLS.1.4v0.1
+#--
+test_Disable_Trusted_Device_Correct_V1 if {
+ # Test disable trusted device when there's only one event
+ PolicyId := "GWS.COMMONCONTROLS.1.3v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_TWO_STEP_VERIFICATION_FREQUENCY",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "DISABLE_USERS_TO_TRUST_DEVICE"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Disable_Trusted_Device_Correct_V2 if {
+ # Test disabled trusted device when there's multiple events, with the chronological latest
+ # correct but not last in json list
+ PolicyId := "GWS.COMMONCONTROLS.1.3v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_TWO_STEP_VERIFICATION_FREQUENCY",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "DISABLE_USERS_TO_TRUST_DEVICE"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "ENABLE_USERS_TO_TRUST_DEVICE"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Disable_Trusted_Device_Incorrect_V1 if {
+ # Test disable trusted device when there's only one event and it's wrong
+ PolicyId := "GWS.COMMONCONTROLS.1.3v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_TWO_STEP_VERIFICATION_FREQUENCY",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "ENABLE_USERS_TO_TRUST_DEVICE"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Disable_Trusted_Device_Incorrect_V2 if {
+ # Test disabled trusted device when there's multiple events, with the chronological latest
+ # incorrect but not last in json list
+ PolicyId := "GWS.COMMONCONTROLS.1.3v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_TWO_STEP_VERIFICATION_FREQUENCY",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "ENABLE_USERS_TO_TRUST_DEVICE"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "DISABLE_USERS_TO_TRUST_DEVICE"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+
+test_Disable_Trusted_Device_Incorrect_V3 if {
+ # Test disabled trusted device when there no applicable event
+ PolicyId := "GWS.COMMONCONTROLS.1.3v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "SOMETHING_ELSE",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])
+}
+#--
+
+#
+# GWS.COMMONCONTROLS.1.4v0.1
+#--
+
+test_NotPhone_Correct_V1 if {
+ # Test enforcing MFA when there's only one event set to only key
+ PolicyId := "GWS.COMMONCONTROLS.1.4v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS",
+ "parameters": [
+ {"name": "ALLOWED_TWO_STEP_VERIFICATION_METHOD", "value": "ONLY_SECURITY_KEY"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_NotPhone_Correct_V2 if {
+ # Test enforcing MFA when there's only one event set to any except phone
+ PolicyId := "GWS.COMMONCONTROLS.1.4v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS",
+ "parameters": [
+ {"name": "ALLOWED_TWO_STEP_VERIFICATION_METHOD", "value": "NO_TELEPHONY"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_NotPhone_Correct_V3 if {
+ # Test enforcing MFA when there are multiple events
+ PolicyId := "GWS.COMMONCONTROLS.1.4v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS",
+ "parameters": [
+ {"name": "ALLOWED_TWO_STEP_VERIFICATION_METHOD", "value": "NO_TELEPHONY"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS",
+ "parameters": [
+ {"name": "ALLOWED_TWO_STEP_VERIFICATION_METHOD", "value": "ANY"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_NotPhone_Incorrect_V1 if {
+ # Test enforcing MFA when there's only one event set to any
+ PolicyId := "GWS.COMMONCONTROLS.1.4v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS",
+ "parameters": [
+ {"name": "ALLOWED_TWO_STEP_VERIFICATION_METHOD", "value": "ANY"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_NotPhone_Incorrect_V2 if {
+ # Test enforcing MFA when there's multiple events
+ PolicyId := "GWS.COMMONCONTROLS.1.4v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS",
+ "parameters": [
+ {"name": "ALLOWED_TWO_STEP_VERIFICATION_METHOD", "value": "ONLY_SECURITY_KEY"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS",
+ "parameters": [
+ {"name": "ALLOWED_TWO_STEP_VERIFICATION_METHOD", "value": "ANY"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_NotPhone_Incorrect_V3 if {
+ # Test enforcing MFA when there are no relevant events
+ PolicyId := "GWS.COMMONCONTROLS.1.4v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])}
+#--
+
+test_NotPhone_Incorrect_V4 if {
+ # Test enforcing MFA when there are no relevant events for the top-level OU
+ PolicyId := "GWS.COMMONCONTROLS.1.4v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS",
+ "parameters": [
+ {"name": "ALLOWED_TWO_STEP_VERIFICATION_METHOD", "value": "ONLY_SECURITY_KEY"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ },
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])}
+
+test_NotPhone_Correct_V5 if {
+ # Test enforcing MFA when there are multiple OUs
+ PolicyId := "GWS.COMMONCONTROLS.1.4v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS",
+ "parameters": [
+ {"name": "ALLOWED_TWO_STEP_VERIFICATION_METHOD", "value": "NO_TELEPHONY"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS",
+ "parameters": [
+ {"name": "ALLOWED_TWO_STEP_VERIFICATION_METHOD", "value": "ANY"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/commoncontrols/commoncontrols02_test.rego b/Testing/RegoTests/commoncontrols/commoncontrols02_test.rego
new file mode 100644
index 00000000..3b21d671
--- /dev/null
+++ b/Testing/RegoTests/commoncontrols/commoncontrols02_test.rego
@@ -0,0 +1,153 @@
+package commoncontrols
+import future.keywords
+
+#
+# GWS.COMMONCONTROLS.2.1v0.1
+#--
+
+test_CAA_Correct_V1 if {
+ # Test 1 event
+ PolicyId := "GWS.COMMONCONTROLS.2.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "TOGGLE_CAA_ENABLEMENT",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "ENABLED"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ RuleOutput[0].ReportDetails == "Requirement met."
+}
+
+test_CAA_Correct_V2 if {
+ # Test multiple events
+ PolicyId := "GWS.COMMONCONTROLS.2.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "TOGGLE_CAA_ENABLEMENT",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "ENABLED"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "TOGGLE_CAA_ENABLEMENT",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "DISABLED"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ RuleOutput[0].ReportDetails == "Requirement met."
+}
+
+test_CAA_Incorrect_V1 if {
+ # Test 1 event
+ PolicyId := "GWS.COMMONCONTROLS.2.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "TOGGLE_CAA_ENABLEMENT",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "DISABLED"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement not met."
+}
+
+test_CAA_Incorrect_V2 if {
+ # Test multiple events
+ PolicyId := "GWS.COMMONCONTROLS.2.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "TOGGLE_CAA_ENABLEMENT",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "DISABLED"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "TOGGLE_CAA_ENABLEMENT",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "ENABLED"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement not met."
+}
+
+test_CAA_Incorrect_V3 if {
+ # Test no relevant events
+ PolicyId := "GWS.COMMONCONTROLS.2.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/commoncontrols/commoncontrols03_test.rego b/Testing/RegoTests/commoncontrols/commoncontrols03_test.rego
new file mode 100644
index 00000000..71be89eb
--- /dev/null
+++ b/Testing/RegoTests/commoncontrols/commoncontrols03_test.rego
@@ -0,0 +1,292 @@
+package commoncontrols
+import future.keywords
+
+#
+# GWS.COMMONCONTROLS.3.1v0.1
+#--
+
+test_SSO_Correct_V1 if {
+ # Test 1 event
+ PolicyId := "GWS.COMMONCONTROLS.3.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "PERFORM_CHALLENGE_SELECTION"},
+ {"name": "SETTING_NAME", "value": "SsoPolicyProto challenge_selection_behavior"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SSO_Correct_V2 if {
+ # Test multiple events
+ PolicyId := "GWS.COMMONCONTROLS.3.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "PERFORM_CHALLENGE_SELECTION"},
+ {"name": "SETTING_NAME", "value": "SsoPolicyProto challenge_selection_behavior"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "BYPASS_ADDITIONAL_CHALLENGES"},
+ {"name": "SETTING_NAME", "value": "SsoPolicyProto challenge_selection_behavior"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SSO_Correct_V3 if {
+ # Test inheritance
+ PolicyId := "GWS.COMMONCONTROLS.3.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "PERFORM_CHALLENGE_SELECTION"},
+ {"name": "SETTING_NAME", "value": "SsoPolicyProto challenge_selection_behavior"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "BYPASS_ADDITIONAL_CHALLENGES"},
+ {"name": "SETTING_NAME", "value": "SsoPolicyProto challenge_selection_behavior"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2023-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SsoPolicyProto challenge_selection_behavior"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SSO_Incorrect_V1 if {
+ # Test 1 event
+ PolicyId := "GWS.COMMONCONTROLS.3.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "BYPASS_ADDITIONAL_CHALLENGES"},
+ {"name": "SETTING_NAME", "value": "SsoPolicyProto challenge_selection_behavior"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SSO_Incorrect_V2 if {
+ # Test multiple events
+ PolicyId := "GWS.COMMONCONTROLS.3.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "BYPASS_ADDITIONAL_CHALLENGES"},
+ {"name": "SETTING_NAME", "value": "SsoPolicyProto challenge_selection_behavior"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "PERFORM_CHALLENGE_SELECTION"},
+ {"name": "SETTING_NAME", "value": "SsoPolicyProto challenge_selection_behavior"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SSO_Incorrect_V3 if {
+ # Test no relevant events
+ PolicyId := "GWS.COMMONCONTROLS.3.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])}
+
+test_SSO_Incorrect_V4 if {
+ # Test no relevant events in the top-level OU
+ PolicyId := "GWS.COMMONCONTROLS.3.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "BYPASS_ADDITIONAL_CHALLENGES"},
+ {"name": "SETTING_NAME", "value": "SsoPolicyProto challenge_selection_behavior"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])}
+
+test_SSO_Incorrect_V4 if {
+ # Test multiple OUs
+ PolicyId := "GWS.COMMONCONTROLS.3.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "BYPASS_ADDITIONAL_CHALLENGES"},
+ {"name": "SETTING_NAME", "value": "SsoPolicyProto challenge_selection_behavior"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "BYPASS_ADDITIONAL_CHALLENGES"},
+ {"name": "SETTING_NAME", "value": "SsoPolicyProto challenge_selection_behavior"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Second-Level OU, Test Top-Level OU."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/commoncontrols/commoncontrols04_test.rego b/Testing/RegoTests/commoncontrols/commoncontrols04_test.rego
new file mode 100644
index 00000000..183a76f9
--- /dev/null
+++ b/Testing/RegoTests/commoncontrols/commoncontrols04_test.rego
@@ -0,0 +1,354 @@
+package commoncontrols
+import future.keywords
+
+#
+# GWS.COMMONCONTROLS.4.1v0.1
+#--
+test_Limit_Correct_V1 if {
+ # Test 1 event
+ PolicyId := "GWS.COMMONCONTROLS.4.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "43200"},
+ {"name": "SETTING_NAME", "value": "Session management settings - Session length in seconds"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Limit_Correct_V2 if {
+ # Test 1 event, smaller limit than needed
+ PolicyId := "GWS.COMMONCONTROLS.4.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "3600"},
+ {"name": "SETTING_NAME", "value": "Session management settings - Session length in seconds"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Limit_Correct_V3 if {
+ # Test multiple events
+ PolicyId := "GWS.COMMONCONTROLS.4.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "3600"},
+ {"name": "SETTING_NAME", "value": "Session management settings - Session length in seconds"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "86400"},
+ {"name": "SETTING_NAME", "value": "Session management settings - Session length in seconds"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Limit_Correct_V4 if {
+ # Test 1 event, tenant_info["topLevelOU"] empty
+ PolicyId := "GWS.COMMONCONTROLS.4.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "3600"},
+ {"name": "SETTING_NAME", "value": "Session management settings - Session length in seconds"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "" # The rego should needs to be able to infer the top-level OU if it's not provided here
+ # input.tenant_info.topLevelOU will be empty when
+ # no custom OUs have been created, as in this case
+ # the top-level OU cannot be determined via the API.
+ # Fortunately, in this case, we know there's literally
+ # only one OU, so we can grab the OU listed on any of
+ # the events and know that it is the top-level OU
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Limit_Correct_V5 if {
+ # Test inheritance
+ PolicyId := "GWS.COMMONCONTROLS.4.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2020-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "43200"},
+ {"name": "SETTING_NAME", "value": "Session management settings - Session length in seconds"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "4320000"},
+ {"name": "SETTING_NAME", "value": "Session management settings - Session length in seconds"},
+ {"name": "ORG_UNIT_NAME", "value": "Second OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Session management settings - Session length in seconds"},
+ {"name": "ORG_UNIT_NAME", "value": "Second OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Limit_Incorrect_V1 if {
+ # Test 1 event
+ PolicyId := "GWS.COMMONCONTROLS.4.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "86400"},
+ {"name": "SETTING_NAME", "value": "Session management settings - Session length in seconds"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Limit_Incorrect_V2 if {
+ # Test multiple events
+ PolicyId := "GWS.COMMONCONTROLS.4.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "86400"},
+ {"name": "SETTING_NAME", "value": "Session management settings - Session length in seconds"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "43200"},
+ {"name": "SETTING_NAME", "value": "Session management settings - Session length in seconds"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Limit_Incorrect_V3 if {
+ # Test multiple OUs
+ PolicyId := "GWS.COMMONCONTROLS.4.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "86400"},
+ {"name": "SETTING_NAME", "value": "Session management settings - Session length in seconds"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2023-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "43200"},
+ {"name": "SETTING_NAME", "value": "Session management settings - Session length in seconds"},
+ {"name": "ORG_UNIT_NAME", "value": "Custom OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Limit_Incorrect_V4 if {
+ # Test no relevant events
+ PolicyId := "GWS.COMMONCONTROLS.4.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])}
+
+test_Limit_Incorrect_V4 if {
+ # Test no relevant events in top-level OU
+ PolicyId := "GWS.COMMONCONTROLS.4.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2023-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "43200"},
+ {"name": "SETTING_NAME", "value": "Session management settings - Session length in seconds"},
+ {"name": "ORG_UNIT_NAME", "value": "Custom OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/commoncontrols/commoncontrols05_test.rego b/Testing/RegoTests/commoncontrols/commoncontrols05_test.rego
new file mode 100644
index 00000000..169231bd
--- /dev/null
+++ b/Testing/RegoTests/commoncontrols/commoncontrols05_test.rego
@@ -0,0 +1,1304 @@
+package commoncontrols
+import future.keywords
+
+#
+# GWS.COMMONCONTROLS.5.1v0.1
+#--
+
+test_Strength_Correct_V1 if {
+ # Test 1 event
+ PolicyId := "GWS.COMMONCONTROLS.5.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "on"},
+ {"name": "SETTING_NAME", "value": "Password Management - Enforce strong password"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Strength_Correct_V2 if {
+ # Test multiple events
+ PolicyId := "GWS.COMMONCONTROLS.5.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "on"},
+ {"name": "SETTING_NAME", "value": "Password Management - Enforce strong password"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "off"},
+ {"name": "SETTING_NAME", "value": "Password Management - Enforce strong password"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Strength_Correct_V3 if {
+ # Test inheritance
+ PolicyId := "GWS.COMMONCONTROLS.5.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2020-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "on"},
+ {"name": "SETTING_NAME", "value": "Password Management - Enforce strong password"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "off"},
+ {"name": "SETTING_NAME", "value": "Password Management - Enforce strong password"},
+ {"name": "ORG_UNIT_NAME", "value": "Second OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Password Management - Enforce strong password"},
+ {"name": "ORG_UNIT_NAME", "value": "Second OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Strength_Incorrect_V1 if {
+ # Test 1 event
+ PolicyId := "GWS.COMMONCONTROLS.5.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "off"},
+ {"name": "SETTING_NAME", "value": "Password Management - Enforce strong password"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Strength_Incorrect_V2 if {
+ # Test multiple events
+ PolicyId := "GWS.COMMONCONTROLS.5.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "off"},
+ {"name": "SETTING_NAME", "value": "Password Management - Enforce strong password"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "on"},
+ {"name": "SETTING_NAME", "value": "Password Management - Enforce strong password"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Strength_Incorrect_V3 if {
+ # Test no relevant events
+ PolicyId := "GWS.COMMONCONTROLS.5.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])}
+
+test_Strength_Incorrect_V4 if {
+ # Test no relevant events for top-level ou
+ PolicyId := "GWS.COMMONCONTROLS.5.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "on"},
+ {"name": "SETTING_NAME", "value": "Password Management - Enforce strong password"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])}
+
+test_Strength_Incorrect_V5 if {
+ # Test multiple OUs
+ PolicyId := "GWS.COMMONCONTROLS.5.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "off"},
+ {"name": "SETTING_NAME", "value": "Password Management - Enforce strong password"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "on"},
+ {"name": "SETTING_NAME", "value": "Password Management - Enforce strong password"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Second-Level OU."
+}
+#--
+
+
+#
+# GWS.COMMONCONTROLS.5.2v0.1
+#--
+test_Length_Correct_V1 if {
+ # Test 1 event
+ PolicyId := "GWS.COMMONCONTROLS.5.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "12"},
+ {"name": "SETTING_NAME", "value": "Password Management - Minimum password length"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Length_Correct_V2 if {
+ # Test multiple events
+ PolicyId := "GWS.COMMONCONTROLS.5.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "12"},
+ {"name": "SETTING_NAME", "value": "Password Management - Minimum password length"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "8"},
+ {"name": "SETTING_NAME", "value": "Password Management - Minimum password length"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Length_Correct_V3 if {
+ # Test longer than needed
+ PolicyId := "GWS.COMMONCONTROLS.5.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "15"},
+ {"name": "SETTING_NAME", "value": "Password Management - Minimum password length"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Length_Incorrect_V1 if {
+ # Test 1 event
+ PolicyId := "GWS.COMMONCONTROLS.5.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "8"},
+ {"name": "SETTING_NAME", "value": "Password Management - Minimum password length"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Length_Incorrect_V2 if {
+ # Test multiple events
+ PolicyId := "GWS.COMMONCONTROLS.5.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "8"},
+ {"name": "SETTING_NAME", "value": "Password Management - Minimum password length"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "12"},
+ {"name": "SETTING_NAME", "value": "Password Management - Minimum password length"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Length_Incorrect_V3 if {
+ # Test no relevant events
+ PolicyId := "GWS.COMMONCONTROLS.5.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])}
+
+test_Length_Incorrect_V4 if {
+ # Test no relevant events in top-level ou
+ PolicyId := "GWS.COMMONCONTROLS.5.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "12"},
+ {"name": "SETTING_NAME", "value": "Password Management - Minimum password length"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])}
+
+test_Length_Incorrect_V5 if {
+ # Test multiple OUs
+ PolicyId := "GWS.COMMONCONTROLS.5.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "12"},
+ {"name": "SETTING_NAME", "value": "Password Management - Minimum password length"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "10"},
+ {"name": "SETTING_NAME", "value": "Password Management - Minimum password length"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+#--
+
+
+#
+# GWS.COMMONCONTROLS.5.3v0.1
+#--
+test_Enforce_Correct_V1 if {
+ # Test 1 event
+ PolicyId := "GWS.COMMONCONTROLS.5.3v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "true"},
+ {
+ "name": "SETTING_NAME",
+ "value": "Password Management - Enforce password policy at next login"
+ },
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Enforce_Correct_V2 if {
+ # Test multiple events
+ PolicyId := "GWS.COMMONCONTROLS.5.3v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "true"},
+ {
+ "name": "SETTING_NAME",
+ "value": "Password Management - Enforce password policy at next login"
+ },
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {
+ "name": "SETTING_NAME",
+ "value": "Password Management - Enforce password policy at next login"
+ },
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Enforce_Incorrect_V1 if {
+ # Test 1 event
+ PolicyId := "GWS.COMMONCONTROLS.5.3v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {
+ "name": "SETTING_NAME",
+ "value": "Password Management - Enforce password policy at next login"
+ },
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Enforce_Incorrect_V2 if {
+ # Test multiple events
+ PolicyId := "GWS.COMMONCONTROLS.5.3v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {
+ "name": "SETTING_NAME",
+ "value": "Password Management - Enforce password policy at next login"
+ },
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "true"},
+ {
+ "name": "SETTING_NAME",
+ "value": "Password Management - Enforce password policy at next login"
+ },
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Enforce_Incorrect_V3 if {
+ # Test no relevant events
+ PolicyId := "GWS.COMMONCONTROLS.5.3v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])}
+
+test_Enforce_Incorrect_V4 if {
+ # Test no relevant events in top-level OU
+ PolicyId := "GWS.COMMONCONTROLS.5.3v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "true"},
+ {
+ "name": "SETTING_NAME",
+ "value": "Password Management - Enforce password policy at next login"
+ },
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])}
+
+test_Enforce_Incorrect_V5 if {
+ # Test multiple OUs
+ PolicyId := "GWS.COMMONCONTROLS.5.3v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {
+ "name": "SETTING_NAME",
+ "value": "Password Management - Enforce password policy at next login"
+ },
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {
+ "name": "SETTING_NAME",
+ "value": "Password Management - Enforce password policy at next login"
+ },
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Second-Level OU, Test Top-Level OU."
+}
+#--
+
+#
+# GWS.COMMONCONTROLS.5.4v0.1
+#--
+test_Reuse_Correct_V1 if {
+ # Test 1 event
+ PolicyId := "GWS.COMMONCONTROLS.5.4v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "SETTING_NAME", "value": "Password Management - Enable password reuse"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Reuse_Correct_V2 if {
+ # Test multiple events
+ PolicyId := "GWS.COMMONCONTROLS.5.4v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "SETTING_NAME", "value": "Password Management - Enable password reuse"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "SETTING_NAME", "value": "Password Management - Enable password reuse"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Reuse_Incorrect_V1 if {
+ # Test 1 event
+ PolicyId := "GWS.COMMONCONTROLS.5.4v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "SETTING_NAME", "value": "Password Management - Enable password reuse"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Reuse_Incorrect_V2 if {
+ # Test multiple events
+ PolicyId := "GWS.COMMONCONTROLS.5.4v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "SETTING_NAME", "value": "Password Management - Enable password reuse"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "SETTING_NAME", "value": "Password Management - Enable password reuse"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Reuse_Incorrect_V3 if {
+ # Test no relevant events
+ PolicyId := "GWS.COMMONCONTROLS.5.4v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])}
+
+test_Reuse_Incorrect_V4 if {
+ # Test no relevant events for top-level OU
+ PolicyId := "GWS.COMMONCONTROLS.5.4v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "SETTING_NAME", "value": "Password Management - Enable password reuse"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])}
+
+test_Reuse_Incorrect_V5 if {
+ # Test multiple OUs
+ PolicyId := "GWS.COMMONCONTROLS.5.4v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "SETTING_NAME", "value": "Password Management - Enable password reuse"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "SETTING_NAME", "value": "Password Management - Enable password reuse"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Second-Level OU."
+}
+#--
+
+#
+# GWS.COMMONCONTROLS.5.5v0.1
+#--
+
+test_Expire_Correct_V1 if {
+ # Test 1 event
+ PolicyId := "GWS.COMMONCONTROLS.5.5v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "0"},
+ {"name": "SETTING_NAME", "value": "Password Management - Password reset frequency"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Expire_Correct_V2 if {
+ # Test multiple events
+ PolicyId := "GWS.COMMONCONTROLS.5.5v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "0"},
+ {"name": "SETTING_NAME", "value": "Password Management - Password reset frequency"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "1"},
+ {"name": "SETTING_NAME", "value": "Password Management - Password reset frequency"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Expire_Incorrect_V1 if {
+ # Test 1 event
+ PolicyId := "GWS.COMMONCONTROLS.5.5v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "1"},
+ {"name": "SETTING_NAME", "value": "Password Management - Password reset frequency"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Expire_Incorrect_V2 if {
+ # Test multiple events
+ PolicyId := "GWS.COMMONCONTROLS.5.5v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "1"},
+ {"name": "SETTING_NAME", "value": "Password Management - Password reset frequency"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "0"},
+ {"name": "SETTING_NAME", "value": "Password Management - Password reset frequency"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Expire_Incorrect_V3 if {
+ # Test no relevant events
+ PolicyId := "GWS.COMMONCONTROLS.5.5v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])}
+
+test_Expire_Incorrect_V4 if {
+ # Test no relevant events in top-level OU
+ PolicyId := "GWS.COMMONCONTROLS.5.5v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "0"},
+ {"name": "SETTING_NAME", "value": "Password Management - Password reset frequency"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])}
+
+test_Expire_Incorrect_V5 if {
+ # Test multiple OUs
+ PolicyId := "GWS.COMMONCONTROLS.5.5v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "0"},
+ {"name": "SETTING_NAME", "value": "Password Management - Password reset frequency"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "1"},
+ {"name": "SETTING_NAME", "value": "Password Management - Password reset frequency"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+#--
+
diff --git a/Testing/RegoTests/commoncontrols/commoncontrols06_test.rego b/Testing/RegoTests/commoncontrols/commoncontrols06_test.rego
new file mode 100644
index 00000000..af1c5c70
--- /dev/null
+++ b/Testing/RegoTests/commoncontrols/commoncontrols06_test.rego
@@ -0,0 +1,49 @@
+package commoncontrols
+import future.keywords
+
+#
+# GWS.COMMONCONTROLS.6.1v0.1
+#--
+test_Separate_Correct_V1 if {
+ # Test not implemented
+ PolicyId := "GWS.COMMONCONTROLS.6.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Currently not able to be tested automatically; please manually check."
+}
+#--
+
+#
+# GWS.COMMONCONTROLS.6.2v0.1
+#--
+
+test_CloudOnly_Correct_V1 if {
+ # Test not implemented
+ PolicyId := "GWS.COMMONCONTROLS.6.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Currently not able to be tested automatically; please manually check."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/commoncontrols/commoncontrols07_test.rego b/Testing/RegoTests/commoncontrols/commoncontrols07_test.rego
new file mode 100644
index 00000000..f56c533d
--- /dev/null
+++ b/Testing/RegoTests/commoncontrols/commoncontrols07_test.rego
@@ -0,0 +1,170 @@
+package commoncontrols
+import future.keywords
+
+#
+# GWS.COMMONCONTROLS.7.1v0.1
+#--
+test_Count_Correct_V1 if {
+ # 2 super admins
+ PolicyId := "GWS.COMMONCONTROLS.7.1v0.1"
+ Output := tests with input as {
+ "super_admins": [
+ {
+ "primaryEmail": "admin1@example.org",
+ "orgUnitPath": ""
+ },
+ {
+ "primaryEmail": "admin2@example.org",
+ "orgUnitPath": ""
+ }
+ ]
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "The following super admins are configured: ",
+ "admin1@example.org, admin2@example.org. ",
+ "Note: Exceptions are ",
+ "allowed for \"break glass\" super admin accounts, ",
+ "though we are not able to account for this automatically."
+ ])
+}
+
+test_Count_Correct_V2 if {
+ # 3 super admins
+ PolicyId := "GWS.COMMONCONTROLS.7.1v0.1"
+ Output := tests with input as {
+ "super_admins": [
+ {
+ "primaryEmail": "admin1@example.org",
+ "orgUnitPath": ""
+ },
+ {
+ "primaryEmail": "admin2@example.org",
+ "orgUnitPath": ""
+ },
+ {
+ "primaryEmail": "admin3@example.org",
+ "orgUnitPath": ""
+ }
+ ]
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "The following super admins are configured: ",
+ "admin1@example.org, admin2@example.org, admin3@example.org. ",
+ "Note: Exceptions are ",
+ "allowed for \"break glass\" super admin accounts, ",
+ "though we are not able to account for this automatically."
+ ])
+}
+
+test_Count_Correct_V3 if {
+ # 4 super admins
+ PolicyId := "GWS.COMMONCONTROLS.7.1v0.1"
+ Output := tests with input as {
+ "super_admins": [
+ {
+ "primaryEmail": "admin1@example.org",
+ "orgUnitPath": ""
+ },
+ {
+ "primaryEmail": "admin2@example.org",
+ "orgUnitPath": ""
+ },
+ {
+ "primaryEmail": "admin3@example.org",
+ "orgUnitPath": ""
+ },
+ {
+ "primaryEmail": "admin4@example.org",
+ "orgUnitPath": ""
+ }
+ ]
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "The following super admins are configured: ",
+ "admin1@example.org, admin2@example.org, admin3@example.org, ",
+ "admin4@example.org. Note: Exceptions are ",
+ "allowed for \"break glass\" super admin accounts, ",
+ "though we are not able to account for this automatically."
+ ])
+}
+
+test_Count_Incorrect_V1 if {
+ # 5 super admins
+ PolicyId := "GWS.COMMONCONTROLS.7.1v0.1"
+ Output := tests with input as {
+ "super_admins": [
+ {
+ "primaryEmail": "admin1@example.org",
+ "orgUnitPath": ""
+ },
+ {
+ "primaryEmail": "admin2@example.org",
+ "orgUnitPath": ""
+ },
+ {
+ "primaryEmail": "admin3@example.org",
+ "orgUnitPath": ""
+ },
+ {
+ "primaryEmail": "admin4@example.org",
+ "orgUnitPath": ""
+ },
+ {
+ "primaryEmail": "admin5@example.org",
+ "orgUnitPath": ""
+ }
+ ]
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "The following super admins are configured: ",
+ "admin1@example.org, admin2@example.org, admin3@example.org, ",
+ "admin4@example.org, admin5@example.org. Note: Exceptions are ",
+ "allowed for \"break glass\" super admin accounts, ",
+ "though we are not able to account for this automatically."
+ ])
+}
+
+test_Count_Incorrect_V2 if {
+ # 1 super admins
+ PolicyId := "GWS.COMMONCONTROLS.7.1v0.1"
+ Output := tests with input as {
+ "super_admins": [
+ {
+ "primaryEmail": "admin1@example.org",
+ "orgUnitPath": ""
+ }
+ ]
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "The following super admins are configured: ",
+ "admin1@example.org. Note: Exceptions are ",
+ "allowed for \"break glass\" super admin accounts, ",
+ "though we are not able to account for this automatically."
+ ])
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/commoncontrols/commoncontrols08_test.rego b/Testing/RegoTests/commoncontrols/commoncontrols08_test.rego
new file mode 100644
index 00000000..bba8a7c3
--- /dev/null
+++ b/Testing/RegoTests/commoncontrols/commoncontrols08_test.rego
@@ -0,0 +1,25 @@
+package commoncontrols
+import future.keywords
+
+#
+# GWS.COMMONCONTROLS.8.1v0.1
+#--
+test_Conflicting_Correct_V1 if {
+ # Test not implemented
+ PolicyId := "GWS.COMMONCONTROLS.8.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Currently not able to be tested automatically; please manually check."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/commoncontrols/commoncontrols09_test.rego b/Testing/RegoTests/commoncontrols/commoncontrols09_test.rego
new file mode 100644
index 00000000..0397e23d
--- /dev/null
+++ b/Testing/RegoTests/commoncontrols/commoncontrols09_test.rego
@@ -0,0 +1,409 @@
+package commoncontrols
+import future.keywords
+
+#
+# GWS.COMMONCONTROLS.9.1v0.1
+#--
+test_Second_Correct_V1 if {
+ # Test not implemented
+ PolicyId := "GWS.COMMONCONTROLS.9.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Currently not able to be tested automatically; please manually check."
+}
+#--
+
+#
+# GWS.COMMONCONTROLS.9.2v0.1
+#--
+
+test_SelfRecovery_Correct_V1 if {
+ # Test 1 event
+ PolicyId := "GWS.COMMONCONTROLS.9.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {
+ "name": "SETTING_NAME",
+ "value": "AdminAccountRecoverySettingsProto Enable admin account recovery"
+ },
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SelfRecovery_Correct_V2 if {
+ # Test 1 event
+ PolicyId := "GWS.COMMONCONTROLS.9.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {
+ "name": "SETTING_NAME",
+ "value": "AdminAccountRecoverySettingsProto Enable admin account recovery"
+ },
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "true"},
+ {
+ "name": "SETTING_NAME",
+ "value": "AdminAccountRecoverySettingsProto Enable admin account recovery"
+ },
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SelfRecovery_Correct_V3 if {
+ # Test inheritance
+ PolicyId := "GWS.COMMONCONTROLS.9.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2020-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {
+ "name": "SETTING_NAME",
+ "value": "AdminAccountRecoverySettingsProto Enable admin account recovery"
+ },
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "true"},
+ {
+ "name": "SETTING_NAME",
+ "value": "AdminAccountRecoverySettingsProto Enable admin account recovery"
+ },
+ {"name": "ORG_UNIT_NAME", "value": "Second OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {
+ "name": "SETTING_NAME",
+ "value": "AdminAccountRecoverySettingsProto Enable admin account recovery"
+ },
+ {"name": "ORG_UNIT_NAME", "value": "Second OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SelfRecovery_Incorrect_V1 if {
+ # Test 1 event
+ PolicyId := "GWS.COMMONCONTROLS.9.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "true"},
+ {
+ "name": "SETTING_NAME",
+ "value": "AdminAccountRecoverySettingsProto Enable admin account recovery"
+ },
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SelfRecovery_Incorrect_V2 if {
+ # Test multiple events
+ PolicyId := "GWS.COMMONCONTROLS.9.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "true"},
+ {
+ "name": "SETTING_NAME",
+ "value": "AdminAccountRecoverySettingsProto Enable admin account recovery"
+ },
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {
+ "name": "SETTING_NAME",
+ "value": "AdminAccountRecoverySettingsProto Enable admin account recovery"
+ },
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SelfRecovery_Incorrect_V3 if {
+ # Test no relevant events
+ PolicyId := "GWS.COMMONCONTROLS.9.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])}
+
+test_SelfRecovery_Incorrect_V4 if {
+ # Test no relevant events in the top-level OU
+ PolicyId := "GWS.COMMONCONTROLS.9.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {
+ "name": "SETTING_NAME",
+ "value": "AdminAccountRecoverySettingsProto Enable admin account recovery"
+ },
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])}
+
+test_SelfRecovery_Incorrect_V5 if {
+ # Test multiple OUs
+ PolicyId := "GWS.COMMONCONTROLS.9.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "true"},
+ {
+ "name": "SETTING_NAME",
+ "value": "AdminAccountRecoverySettingsProto Enable admin account recovery"
+ },
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "true"},
+ {
+ "name": "SETTING_NAME",
+ "value": "AdminAccountRecoverySettingsProto Enable admin account recovery"
+ },
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ # We technically shouldn't make any assumptions about the order
+ # of the OUs in the output, as output from Rego rules are sets
+ # not lists, hence the startswith/contains checks below rather
+ # than a simple ==
+
+ # For this reason, we can't check for a period at the end of the phrase.
+
+ startswith(RuleOutput[0].ReportDetails, "Requirement failed in")
+ contains(RuleOutput[0].ReportDetails, "Test Top-Level OU")
+ contains(RuleOutput[0].ReportDetails, "Test Second-Level OU")
+
+}
+#--
+
+#
+# GWS.COMMONCONTROLS.9.3v0.1
+#--
+
+test_OnlyLost_Correct_V1 if {
+ # Test not implemented
+ PolicyId := "GWS.COMMONCONTROLS.9.3v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Currently not able to be tested automatically; please manually check."
+}
+#--
+
+#
+# GWS.COMMONCONTROLS.9.4v0.1
+#--
+
+test_Geography_Correct_V1 if {
+ # Test not implemented
+ PolicyId := "GWS.COMMONCONTROLS.9.4v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Currently not able to be tested automatically; please manually check."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/commoncontrols/commoncontrols10_test.rego b/Testing/RegoTests/commoncontrols/commoncontrols10_test.rego
new file mode 100644
index 00000000..6afa6bdf
--- /dev/null
+++ b/Testing/RegoTests/commoncontrols/commoncontrols10_test.rego
@@ -0,0 +1,49 @@
+package commoncontrols
+import future.keywords
+
+#
+# GWS.COMMONCONTROLS.10.1v0.1
+#--
+
+test_Enrolled_Correct_V1 if {
+ # Test not implemented
+ PolicyId := "GWS.COMMONCONTROLS.10.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Currently not able to be tested automatically; please manually check."
+}
+#--
+#
+# GWS.COMMONCONTROLS.10.2v0.1
+#--
+
+test_Sensitive_Correct_V1 if {
+ # Test not implemented
+ PolicyId := "GWS.COMMONCONTROLS.10.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Currently not able to be tested automatically; please manually check."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/commoncontrols/commoncontrols11_test.rego b/Testing/RegoTests/commoncontrols/commoncontrols11_test.rego
new file mode 100644
index 00000000..e85f6fb6
--- /dev/null
+++ b/Testing/RegoTests/commoncontrols/commoncontrols11_test.rego
@@ -0,0 +1,866 @@
+package commoncontrols
+import future.keywords
+
+#
+# GWS.COMMONCONTROLS.11.1v0.1
+#--
+
+test_AllowList_Correct_V1 if {
+ # Test not implemented
+ PolicyId := "GWS.COMMONCONTROLS.11.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Currently not able to be tested automatically; please manually check."
+}
+#--
+
+#
+# GWS.COMMONCONTROLS.11.2v0.1
+#--
+
+test_AccessControl_Correct_V1 if {
+ # Test restricted when there is no _HIGH_RISK event present
+ # (not all services have a risk version, just Drive and Gmail)
+ PolicyId := "GWS.COMMONCONTROLS.11.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DISALLOW_SERVICE_FOR_OAUTH2_ACCESS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "OAUTH2_SERVICE_NAME", "value": "CLASSROOM"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met."
+}
+
+test_AccessControl_Correct_V2 if {
+ # Test allowed with not high risk allowed
+ PolicyId := "GWS.COMMONCONTROLS.11.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "ALLOW_SERVICE_FOR_OAUTH2_ACCESS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "OAUTH2_SERVICE_NAME", "value": "DRIVE"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DISALLOW_SERVICE_FOR_OAUTH2_ACCESS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "OAUTH2_SERVICE_NAME", "value": "DRIVE_HIGH_RISK"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met."
+}
+
+test_AccessControl_Correct_V3 if {
+ # Test restricted with not high risk disallowed
+ PolicyId := "GWS.COMMONCONTROLS.11.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DISALLOW_SERVICE_FOR_OAUTH2_ACCESS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "OAUTH2_SERVICE_NAME", "value": "DRIVE"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "ALLOW_SERVICE_FOR_OAUTH2_ACCESS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "OAUTH2_SERVICE_NAME", "value": "DRIVE_HIGH_RISK"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met."
+}
+
+test_AccessControl_Correct_V4 if {
+ # Test multiple services
+ PolicyId := "GWS.COMMONCONTROLS.11.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DISALLOW_SERVICE_FOR_OAUTH2_ACCESS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "OAUTH2_SERVICE_NAME", "value": "DRIVE"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "ALLOW_SERVICE_FOR_OAUTH2_ACCESS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "OAUTH2_SERVICE_NAME", "value": "DRIVE_HIGH_RISK"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DISALLOW_SERVICE_FOR_OAUTH2_ACCESS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "OAUTH2_SERVICE_NAME", "value": "CLASSROOM"}
+ ]
+ }]
+ },
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met."
+}
+
+test_AccessControl_Correct_V5 if {
+ # Test multiple services, multiple events
+ PolicyId := "GWS.COMMONCONTROLS.11.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DISALLOW_SERVICE_FOR_OAUTH2_ACCESS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "OAUTH2_SERVICE_NAME", "value": "DRIVE"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "ALLOW_SERVICE_FOR_OAUTH2_ACCESS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "OAUTH2_SERVICE_NAME", "value": "DRIVE_HIGH_RISK"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "ALLOW_SERVICE_FOR_OAUTH2_ACCESS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "OAUTH2_SERVICE_NAME", "value": "DRIVE"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DISALLOW_SERVICE_FOR_OAUTH2_ACCESS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "OAUTH2_SERVICE_NAME", "value": "CLASSROOM"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "ALLOW_SERVICE_FOR_OAUTH2_ACCESS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "OAUTH2_SERVICE_NAME", "value": "CLASSROOM"}
+ ]
+ }]
+ },
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met."
+}
+
+test_AccessControl_Incorrect_V1 if {
+ # Test unrestricted when there is no _HIGH_RISK event present
+ # (not all services have a risk version, just Drive and Gmail)
+ PolicyId := "GWS.COMMONCONTROLS.11.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "ALLOW_SERVICE_FOR_OAUTH2_ACCESS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "OAUTH2_SERVICE_NAME", "value": "CLASSROOM"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "The following services allow access: CLASSROOM."
+}
+
+test_AccessControl_Incorrect_V2 if {
+ # Test unrestricted with not high risk disallowed
+ PolicyId := "GWS.COMMONCONTROLS.11.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "ALLOW_SERVICE_FOR_OAUTH2_ACCESS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "OAUTH2_SERVICE_NAME", "value": "DRIVE"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "ALLOW_SERVICE_FOR_OAUTH2_ACCESS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "OAUTH2_SERVICE_NAME", "value": "DRIVE_HIGH_RISK"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "The following services allow access: DRIVE."
+}
+
+test_AccessControl_Incorrect_V3 if {
+ # Test unrestricted with no high risk version
+ PolicyId := "GWS.COMMONCONTROLS.11.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "ALLOW_SERVICE_FOR_OAUTH2_ACCESS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "OAUTH2_SERVICE_NAME", "value": "CLASSROOM"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "The following services allow access: CLASSROOM."
+}
+
+test_AccessControl_Incorrect_V4 if {
+ # Test no events
+ PolicyId := "GWS.COMMONCONTROLS.11.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No API Access Allowed/Blocked events in the current logs. ",
+ "While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])}
+#--
+
+#
+# GWS.COMMONCONTROLS.11.3v0.1
+#--
+
+test_Consent_Correct_V1 if {
+ # Test disallow with no high risk version
+ PolicyId := "GWS.COMMONCONTROLS.11.3v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DISALLOW_SERVICE_FOR_OAUTH2_ACCESS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "OAUTH2_SERVICE_NAME", "value": "CLASSROOM"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met."
+}
+
+test_Consent_Correct_V2 if {
+ # Test disallow with high risk version
+ PolicyId := "GWS.COMMONCONTROLS.11.3v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DISALLOW_SERVICE_FOR_OAUTH2_ACCESS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "OAUTH2_SERVICE_NAME", "value": "DRIVE"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "ALLOW_SERVICE_FOR_OAUTH2_ACCESS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "OAUTH2_SERVICE_NAME", "value": "DRIVE_HIGH_RISK"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met."
+}
+
+test_Consent_Incorrect_V1 if {
+ # Test allow with no high risk version
+ PolicyId := "GWS.COMMONCONTROLS.11.3v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "ALLOW_SERVICE_FOR_OAUTH2_ACCESS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "OAUTH2_SERVICE_NAME", "value": "CLASSROOM"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "The following services allow access: CLASSROOM."
+}
+
+test_Consent_Incorrect_V2 if {
+ # Test allow with high risk version allowed
+ PolicyId := "GWS.COMMONCONTROLS.11.3v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "ALLOW_SERVICE_FOR_OAUTH2_ACCESS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "OAUTH2_SERVICE_NAME", "value": "DRIVE"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "ALLOW_SERVICE_FOR_OAUTH2_ACCESS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "OAUTH2_SERVICE_NAME", "value": "DRIVE_HIGH_RISK"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "The following services allow access: DRIVE."
+}
+
+test_Consent_Incorrect_V3 if {
+ # Test allow with high risk version blocked
+ PolicyId := "GWS.COMMONCONTROLS.11.3v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "ALLOW_SERVICE_FOR_OAUTH2_ACCESS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "OAUTH2_SERVICE_NAME", "value": "DRIVE"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DISALLOW_SERVICE_FOR_OAUTH2_ACCESS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "OAUTH2_SERVICE_NAME", "value": "DRIVE_HIGH_RISK"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "The following services allow access: DRIVE."
+}
+
+test_Consent_Incorrect_V4 if {
+ # Test no events
+ PolicyId := "GWS.COMMONCONTROLS.11.3v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No API Access Allowed/Blocked events in the current logs. ",
+ "While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])}
+#--
+
+#
+# GWS.COMMONCONTROLS.11.4v0.1
+#--
+test_Internal_Correct_V1 if {
+ # Test basic
+ PolicyId := "GWS.COMMONCONTROLS.11.4v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "UNTRUST_DOMAIN_OWNED_OAUTH2_APPS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Internal_Correct_V2 if {
+ # Test multiple events
+ PolicyId := "GWS.COMMONCONTROLS.11.4v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "UNTRUST_DOMAIN_OWNED_OAUTH2_APPS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "TRUST_DOMAIN_OWNED_OAUTH2_APPS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Internal_Incorrect_V1 if {
+ # Test basic
+ PolicyId := "GWS.COMMONCONTROLS.11.4v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "TRUST_DOMAIN_OWNED_OAUTH2_APPS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Internal_Incorrect_V2 if {
+ # Test multiple events
+ PolicyId := "GWS.COMMONCONTROLS.11.4v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "TRUST_DOMAIN_OWNED_OAUTH2_APPS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "UNTRUST_DOMAIN_OWNED_OAUTH2_APPS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Internal_Incorrect_V3 if {
+ # Test no events
+ PolicyId := "GWS.COMMONCONTROLS.11.4v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])}
+#--
+
+#
+# GWS.COMMONCONTROLS.11.5v0.1
+#--
+
+test_Unconfigured_Correct_V1 if {
+ # Test basic
+ PolicyId := "GWS.COMMONCONTROLS.11.5v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "BLOCK_ALL_THIRD_PARTY_API_ACCESS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Unconfigured_Correct_V2 if {
+ # Test basic multiple events
+ PolicyId := "GWS.COMMONCONTROLS.11.5v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "BLOCK_ALL_THIRD_PARTY_API_ACCESS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "UNBLOCK_ALL_THIRD_PARTY_API_ACCESS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Unconfigured_Incorrect_V1 if {
+ # Test unblock
+ PolicyId := "GWS.COMMONCONTROLS.11.5v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "UNBLOCK_ALL_THIRD_PARTY_API_ACCESS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Unconfigured_Incorrect_V2 if {
+ # Test signin only
+ PolicyId := "GWS.COMMONCONTROLS.11.5v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "SIGN_IN_ONLY_THIRD_PARTY_API_ACCESS",
+ "parameters": [
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Unconfigured_Incorrect_V3 if {
+ # Test no events
+ PolicyId := "GWS.COMMONCONTROLS.11.5v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/commoncontrols/commoncontrols12_test.rego b/Testing/RegoTests/commoncontrols/commoncontrols12_test.rego
new file mode 100644
index 00000000..50e7328c
--- /dev/null
+++ b/Testing/RegoTests/commoncontrols/commoncontrols12_test.rego
@@ -0,0 +1,453 @@
+package commoncontrols
+import future.keywords
+
+#
+# GWS.COMMONCONTROLS.12.1v0.1
+#--
+
+test_Policy_Correct_V1 if {
+ # Test not implemented
+ PolicyId := "GWS.COMMONCONTROLS.12.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Currently not able to be tested automatically; please manually check."
+}
+#--
+
+#
+# GWS.COMMONCONTROLS.12.2v0.1
+#--
+
+test_Installation_Correct_V1 if {
+ # Test 1 event
+ PolicyId := "GWS.COMMONCONTROLS.12.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-11-20T00:02:28.672Z"},
+ "events": [
+ {
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "ALLOW_SPECIFIED"},
+ {"name": "SETTING_NAME", "value": "Apps Access Setting Allowlist access"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ },
+ ]
+ },
+ {
+ "id": {"time": "2022-11-20T00:02:28.672Z"},
+ "events": [
+ {
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "SETTING_NAME", "value": "Apps Access Setting allow_all_internal_apps"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ },
+ ]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Installation_Correct_V2 if {
+ # Test multiple events
+ PolicyId := "GWS.COMMONCONTROLS.12.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-11-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "ALLOW_SPECIFIED"},
+ {"name": "SETTING_NAME", "value": "Apps Access Setting Allowlist access"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-11-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "SOMETHING_ELSE"},
+ {"name": "SETTING_NAME", "value": "Apps Access Setting Allowlist access"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-11-20T00:02:28.672Z"},
+ "events": [
+ {
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "SETTING_NAME", "value": "Apps Access Setting allow_all_internal_apps"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ },
+ ]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Installation_Correct_V3 if {
+ # Test inheritance
+ PolicyId := "GWS.COMMONCONTROLS.12.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2020-11-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "ALLOW_SPECIFIED"},
+ {"name": "SETTING_NAME", "value": "Apps Access Setting Allowlist access"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-11-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "ALLOW_ALL"},
+ {"name": "SETTING_NAME", "value": "Apps Access Setting Allowlist access"},
+ {"name": "ORG_UNIT_NAME", "value": "Second OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-11-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Apps Access Setting Allowlist access"},
+ {"name": "ORG_UNIT_NAME", "value": "Second OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-11-20T00:02:28.672Z"},
+ "events": [
+ {
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "SETTING_NAME", "value": "Apps Access Setting allow_all_internal_apps"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ },
+ ]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Installation_Incorrect_V1 if {
+ # Test 1 event
+ PolicyId := "GWS.COMMONCONTROLS.12.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-11-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "SOMETHING_ELSE"},
+ {"name": "SETTING_NAME", "value": "Apps Access Setting Allowlist access"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-11-20T00:02:28.672Z"},
+ "events": [
+ {
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "SETTING_NAME", "value": "Apps Access Setting allow_all_internal_apps"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ },
+ ]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Installation_Incorrect_V2 if {
+ # Test multiple events
+ PolicyId := "GWS.COMMONCONTROLS.12.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-11-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "SOMETHING_ELSE"},
+ {"name": "SETTING_NAME", "value": "Apps Access Setting Allowlist access"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-11-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "ALLOW_SPECIFIED"},
+ {"name": "SETTING_NAME", "value": "Apps Access Setting Allowlist access"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-11-20T00:02:28.672Z"},
+ "events": [
+ {
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "SETTING_NAME", "value": "Apps Access Setting allow_all_internal_apps"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ },
+ ]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Installation_Incorrect_V3 if {
+ # Test no relevant events
+ PolicyId := "GWS.COMMONCONTROLS.12.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])
+}
+
+test_Installation_Incorrect_V4 if {
+ # Test no relevant events in top-level OU
+ PolicyId := "GWS.COMMONCONTROLS.12.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2021-11-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "ALLOW_SPECIFIED"},
+ {"name": "SETTING_NAME", "value": "Apps Access Setting Allowlist access"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])
+}
+
+test_Installation_Incorrect_V5 if {
+ # Test multiple OUs
+ PolicyId := "GWS.COMMONCONTROLS.12.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2021-11-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "something else"},
+ {"name": "SETTING_NAME", "value": "Apps Access Setting Allowlist access"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-11-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "ALLOW_SPECIFIED"},
+ {"name": "SETTING_NAME", "value": "Apps Access Setting Allowlist access"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-11-20T00:02:28.672Z"},
+ "events": [
+ {
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "SETTING_NAME", "value": "Apps Access Setting allow_all_internal_apps"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ },
+ ]
+ },
+ {
+ "id": {"time": "2022-11-20T00:02:28.672Z"},
+ "events": [
+ {
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "SETTING_NAME", "value": "Apps Access Setting allow_all_internal_apps"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ },
+ ]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Second-Level OU."
+}
+
+test_Installation_Incorrect_V6 if {
+ # Test internal allowed
+ PolicyId := "GWS.COMMONCONTROLS.12.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-11-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "ALLOW_SPECIFIED"},
+ {"name": "SETTING_NAME", "value": "Apps Access Setting Allowlist access"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-11-20T00:02:28.672Z"},
+ "events": [
+ {
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "SETTING_NAME", "value": "Apps Access Setting allow_all_internal_apps"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ },
+ ]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/commoncontrols/commoncontrols13_test.rego b/Testing/RegoTests/commoncontrols/commoncontrols13_test.rego
new file mode 100644
index 00000000..40f607a5
--- /dev/null
+++ b/Testing/RegoTests/commoncontrols/commoncontrols13_test.rego
@@ -0,0 +1,232 @@
+package commoncontrols
+import future.keywords
+
+#
+# GWS.COMMONCONTROLS.13.1v0.1
+#--
+
+test_Access_Correct_V1 if {
+ # Test 1 event
+ PolicyId := "GWS.COMMONCONTROLS.13.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "DENIED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Access_Correct_V2 if {
+ # Test multiple events
+ PolicyId := "GWS.COMMONCONTROLS.13.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "DENIED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Access_Incorrect_V1 if {
+ # Test 1 event
+ PolicyId := "GWS.COMMONCONTROLS.13.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Access_Incorrect_V2 if {
+ # Test multiple events
+ PolicyId := "GWS.COMMONCONTROLS.13.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "DENIED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Access_Incorrect_V3 if {
+ # Test no relevant events
+ PolicyId := "GWS.COMMONCONTROLS.13.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])}
+
+test_Access_Incorrect_V4 if {
+ # Test no relevant events in top-level OU
+ PolicyId := "GWS.COMMONCONTROLS.13.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "DENIED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])}
+
+test_Access_Incorrect_V5 if {
+ # Test multiple OUs
+ PolicyId := "GWS.COMMONCONTROLS.13.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "DENIED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Second-Level OU."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/commoncontrols/commoncontrols14_test.rego b/Testing/RegoTests/commoncontrols/commoncontrols14_test.rego
new file mode 100644
index 00000000..95f0d03a
--- /dev/null
+++ b/Testing/RegoTests/commoncontrols/commoncontrols14_test.rego
@@ -0,0 +1,475 @@
+package commoncontrols
+import future.keywords
+
+#
+# GWS.COMMONCONTROLS.14.1v0.1
+#--
+test_Individual_Correct_V1 if {
+ # Test 1 app
+ PolicyId := "GWS.COMMONCONTROLS.14.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "Disabled"},
+ {"name": "SETTING_NAME", "value": "UserTakeoutSettingsProto User Takeout "},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Blogger"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output;
+ Result.PolicyId == PolicyId;
+ Result.Criticality == "Shall"]
+ # Note the additional filter: this is because
+ # there are actually two tests with the same requirement string for this one,
+ # as it has both a testable portion and a not-implementable portion
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "For apps with individual admin control: Requirement met in all OUs."
+}
+
+test_Individual_Correct_V2 if {
+ # Test 2 apps
+ PolicyId := "GWS.COMMONCONTROLS.14.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "Disabled"},
+ {"name": "SETTING_NAME", "value": "UserTakeoutSettingsProto User Takeout "},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Blogger"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "Disabled"},
+ {"name": "SETTING_NAME", "value": "UserTakeoutSettingsProto User Takeout "},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Google Pay"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output;
+ Result.PolicyId == PolicyId;
+ Result.Criticality == "Shall"]
+ # Note the additional filter: this is because
+ # there are actually two tests with the same requirement string for this one,
+ # as it has both a testable portion and a not-implementable portion
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "For apps with individual admin control: Requirement met in all OUs."
+}
+
+test_Individual_Correct_V3 if {
+ # Test 2 apps, 1 with multiple events
+ PolicyId := "GWS.COMMONCONTROLS.14.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "Disabled"},
+ {"name": "SETTING_NAME", "value": "UserTakeoutSettingsProto User Takeout "},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Blogger"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "Enabled"},
+ {"name": "SETTING_NAME", "value": "UserTakeoutSettingsProto User Takeout "},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Google Pay"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "Disabled"},
+ {"name": "SETTING_NAME", "value": "UserTakeoutSettingsProto User Takeout "},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Google Pay"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output;
+ Result.PolicyId == PolicyId;
+ Result.Criticality == "Shall"]
+ # Note the additional filter: this is because
+ # there are actually two tests with the same requirement string for this one,
+ # as it has both a testable portion and a not-implementable portion
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "For apps with individual admin control: Requirement met in all OUs."
+}
+
+test_Individual_Correct_V4 if {
+ # Test no events
+ PolicyId := "GWS.COMMONCONTROLS.14.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output;
+ Result.PolicyId == PolicyId;
+ Result.Criticality == "Shall"]
+ # Note the additional filter: this is because
+ # there are actually two tests with the same requirement string for this one,
+ # as it has both a testable portion and a not-implementable portion
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", ["For apps with individual admin control: ",
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable to determine the state ",
+ "from the logs, the default setting is compliant; manual check recommended."])
+}
+
+test_Individual_Correct_V5 if {
+ # Test inheritance
+ PolicyId := "GWS.COMMONCONTROLS.14.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2020-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "Disabled"},
+ {"name": "SETTING_NAME", "value": "UserTakeoutSettingsProto User Takeout "},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Blogger"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "Enabled"},
+ {"name": "SETTING_NAME", "value": "UserTakeoutSettingsProto User Takeout "},
+ {"name": "ORG_UNIT_NAME", "value": "Second OU"},
+ {"name": "APPLICATION_NAME", "value": "Blogger"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "UserTakeoutSettingsProto User Takeout "},
+ {"name": "ORG_UNIT_NAME", "value": "Second OU"},
+ {"name": "APPLICATION_NAME", "value": "Blogger"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output;
+ Result.PolicyId == PolicyId;
+ Result.Criticality == "Shall"]
+ # Note the additional filter: this is because
+ # there are actually two tests with the same requirement string for this one,
+ # as it has both a testable portion and a not-implementable portion
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "For apps with individual admin control: Requirement met in all OUs."
+}
+
+test_Individual_Incorrect_V1 if {
+ # Test 1 event
+ PolicyId := "GWS.COMMONCONTROLS.14.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "Enabled"},
+ {"name": "SETTING_NAME", "value": "UserTakeoutSettingsProto User Takeout "},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Blogger"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output;
+ Result.PolicyId == PolicyId;
+ Result.Criticality == "Shall"]
+
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "For apps with individual admin control: Requirement failed in Test Top-Level OU."
+}
+
+test_Individual_Incorrect_V2 if {
+ # Test 2 apps
+ PolicyId := "GWS.COMMONCONTROLS.14.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "Enabled"},
+ {"name": "SETTING_NAME", "value": "UserTakeoutSettingsProto User Takeout "},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Blogger"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "Enabled"},
+ {"name": "SETTING_NAME", "value": "UserTakeoutSettingsProto User Takeout "},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Google Pay"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output;
+ Result.PolicyId == PolicyId;
+ Result.Criticality == "Shall"]
+
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "For apps with individual admin control: Requirement failed in Test Top-Level OU."
+}
+
+test_Individual_Incorrect_V3 if {
+ # Test 3 apps, 1 is disabled
+ PolicyId := "GWS.COMMONCONTROLS.14.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "Enabled"},
+ {"name": "SETTING_NAME", "value": "UserTakeoutSettingsProto User Takeout "},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Blogger"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "Enabled"},
+ {"name": "SETTING_NAME", "value": "UserTakeoutSettingsProto User Takeout "},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Google Pay"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "Disabled"},
+ {"name": "SETTING_NAME", "value": "UserTakeoutSettingsProto User Takeout "},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Google Play"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output;
+ Result.PolicyId == PolicyId;
+ Result.Criticality == "Shall"]
+
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "For apps with individual admin control: Requirement failed in Test Top-Level OU."
+}
+
+test_Individual_Inorrect_V4 if {
+ # Test no events in top-level OU
+ PolicyId := "GWS.COMMONCONTROLS.14.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "Enabled"},
+ {"name": "SETTING_NAME", "value": "UserTakeoutSettingsProto User Takeout "},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Blogger"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output;
+ Result.PolicyId == PolicyId;
+ Result.Criticality == "Shall"]
+ # Note the additional filter: this is because
+ # there are actually two tests with the same requirement string for this one,
+ # as it has both a testable portion and a not-implementable portion
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", ["For apps with individual admin control: ",
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable to determine the state ",
+ "from the logs, the default setting is compliant; manual check recommended."])}
+
+test_Individual_Incorrect_V5 if {
+ # Test multiple OUs
+ PolicyId := "GWS.COMMONCONTROLS.14.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "Enabled"},
+ {"name": "SETTING_NAME", "value": "UserTakeoutSettingsProto User Takeout "},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Blogger"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "Enabled"},
+ {"name": "SETTING_NAME", "value": "UserTakeoutSettingsProto User Takeout "},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Google Pay"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "Disabled"},
+ {"name": "SETTING_NAME", "value": "UserTakeoutSettingsProto User Takeout "},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Google Play"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output;
+ Result.PolicyId == PolicyId;
+ Result.Criticality == "Shall"]
+
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "For apps with individual admin control: ",
+ "Requirement failed in Test Second-Level OU, Test Top-Level OU."
+ ])
+}
+#--
+
+#
+# GWS.COMMONCONTROLS.14.2v0.1 (not testable portion)
+#--
+
+test_Other_Correct_V1 if {
+ # Test not implemented
+ PolicyId := "GWS.COMMONCONTROLS.14.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output;
+ Result.PolicyId == PolicyId;
+ Result.Criticality == "Should/Not-Implemented"]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "Currently unable to check that Google takeout is disabled ",
+ "for services without an individual admin control; manual check recommended."
+ ])
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/commoncontrols/commoncontrols15_test.rego b/Testing/RegoTests/commoncontrols/commoncontrols15_test.rego
new file mode 100644
index 00000000..298d02fb
--- /dev/null
+++ b/Testing/RegoTests/commoncontrols/commoncontrols15_test.rego
@@ -0,0 +1,27 @@
+package commoncontrols
+import future.keywords
+
+#
+# GWS.COMMONCONTROLS.15.1v0.1
+#--
+test_Required_Correct_V1 if {
+ # Test not implemented
+ PolicyId := "GWS.COMMONCONTROLS.15.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "Results for GWS.COMMONCONTROLS.15 are listed in the ",
+ "Rules Report."])
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/commoncontrols/commoncontrols16_test.rego b/Testing/RegoTests/commoncontrols/commoncontrols16_test.rego
new file mode 100644
index 00000000..c880e0ad
--- /dev/null
+++ b/Testing/RegoTests/commoncontrols/commoncontrols16_test.rego
@@ -0,0 +1,209 @@
+package commoncontrols
+import future.keywords
+
+#
+# GWS.COMMONCONTROLS.16.1v0.1
+#--
+test_Logs_Correct_V1 if {
+ # Test 1 event
+ PolicyId := "GWS.COMMONCONTROLS.16.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "ENABLED"},
+ {
+ "name": "SETTING_NAME",
+ "value": "Data Sharing Settings between GCP and Google Workspace \"Sharing Options\""
+ },
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Logs_Correct_V2 if {
+ # Test multiple events
+ PolicyId := "GWS.COMMONCONTROLS.16.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "ENABLED"},
+ {
+ "name": "SETTING_NAME",
+ "value": "Data Sharing Settings between GCP and Google Workspace \"Sharing Options\""
+ },
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "DISABLED"},
+ {
+ "name": "SETTING_NAME",
+ "value": "Data Sharing Settings between GCP and Google Workspace \"Sharing Options\""
+ },
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Logs_Incorrect_V1 if {
+ # Test 1 event
+ PolicyId := "GWS.COMMONCONTROLS.16.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "DISABLED"},
+ {
+ "name": "SETTING_NAME",
+ "value": "Data Sharing Settings between GCP and Google Workspace \"Sharing Options\""
+ },
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Logs_Incorrect_V2 if {
+ # Test multiple events
+ PolicyId := "GWS.COMMONCONTROLS.16.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "DISABLED"},
+ {
+ "name": "SETTING_NAME",
+ "value": "Data Sharing Settings between GCP and Google Workspace \"Sharing Options\""
+ },
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "ENABLED"},
+ {
+ "name": "SETTING_NAME",
+ "value": "Data Sharing Settings between GCP and Google Workspace \"Sharing Options\""
+ },
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "APPLICATION_NAME", "value": "Security"}
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Logs_Incorrect_V3 if {
+ # Test no relevent events
+ PolicyId := "GWS.COMMONCONTROLS.16.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])
+}
+#--
+
+#
+# GWS.COMMONCONTROLS.16.2v0.1
+#--
+test_AccessControl_Correct_V1 if {
+ # Test not implemented
+ PolicyId := "GWS.COMMONCONTROLS.16.2v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Currently not able to be tested automatically; please manually check."
+}
+#--
diff --git a/Testing/RegoTests/commoncontrols/commoncontrols17_test.rego b/Testing/RegoTests/commoncontrols/commoncontrols17_test.rego
new file mode 100644
index 00000000..6649f777
--- /dev/null
+++ b/Testing/RegoTests/commoncontrols/commoncontrols17_test.rego
@@ -0,0 +1,25 @@
+package commoncontrols
+import future.keywords
+
+#
+# GWS.COMMONCONTROLS.17.1v0.1
+#--
+test_AccessControl_Correct_V1 if {
+ # Test not implemented
+ PolicyId := "GWS.COMMONCONTROLS.17.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Currently not able to be tested automatically; please manually check."
+}
+#--
diff --git a/Testing/RegoTests/commoncontrols/commoncontrols18_test.rego b/Testing/RegoTests/commoncontrols/commoncontrols18_test.rego
new file mode 100644
index 00000000..1be5c758
--- /dev/null
+++ b/Testing/RegoTests/commoncontrols/commoncontrols18_test.rego
@@ -0,0 +1,200 @@
+package commoncontrols
+import future.keywords
+
+#
+# GWS.COMMONCONTROLS.18.1v0.1
+#--
+test_Logs_Correct_V1 if {
+ # Test 1 event
+ PolicyId := "GWS.COMMONCONTROLS.18.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_DATA_LOCALIZATION_FOR_RUSSIA",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Logs_Correct_V2 if {
+ # Test multiple events
+ PolicyId := "GWS.COMMONCONTROLS.18.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_DATA_LOCALIZATION_FOR_RUSSIA",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2023-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_DATA_LOCALIZATION_FOR_RUSSIA",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Logs_Incorrect_V1 if {
+ # Test 1 event
+ PolicyId := "GWS.COMMONCONTROLS.18.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_DATA_LOCALIZATION_FOR_RUSSIA",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Logs_Incorrect_V2 if {
+ # Test multiple events
+ PolicyId := "GWS.COMMONCONTROLS.18.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_DATA_LOCALIZATION_FOR_RUSSIA",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2023-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_DATA_LOCALIZATION_FOR_RUSSIA",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Logs_Incorrect_V3 if {
+ # Test no relevent events
+ PolicyId := "GWS.COMMONCONTROLS.18.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == concat("", [
+ "No relevant event in the current logs for the top-level OU, ",
+ "Test Top-Level OU. While we are unable ",
+ "to determine the state from the logs, the default setting ",
+ "is non-compliant; manual check recommended."
+ ])
+}
+
+test_Logs_Incorrect_V4 if {
+ # Test multiple ous
+ PolicyId := "GWS.COMMONCONTROLS.18.1v0.1"
+ Output := tests with input as {
+ "commoncontrols_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_DATA_LOCALIZATION_FOR_RUSSIA",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2023-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "CHANGE_DATA_LOCALIZATION_FOR_RUSSIA",
+ "parameters": [
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Second OU."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/drive/drive01_test.rego b/Testing/RegoTests/drive/drive01_test.rego
new file mode 100644
index 00000000..10dac0c4
--- /dev/null
+++ b/Testing/RegoTests/drive/drive01_test.rego
@@ -0,0 +1,2156 @@
+package drive
+import future.keywords
+
+#
+# GWS.DRIVEDOCS.1.1v0.1
+#--
+test_Sharing_Correct_V1 if {
+ # Test sharing setting when there's only one event
+ PolicyId := "GWS.DRIVEDOCS.1.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput[0].ReportDetails)
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Sharing_Correct_V2 if {
+ # Test sharing setting when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.DRIVEDOCS.1.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Sharing_Correct_V3 if {
+ # Test sharing setting when there's multiple OUs
+ PolicyId := "GWS.DRIVEDOCS.1.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Sharing_Incorrect_V1 if {
+ # Test sharing setting when there are no relevant events
+ PolicyId := "GWS.DRIVEDOCS.1.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput)
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_Sharing_Incorrect_V2 if {
+ # Test sharing setting when there's only one event and it's wrong
+ PolicyId := "GWS.DRIVEDOCS.1.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput)
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Sharing_Incorrect_V3 if {
+ # Test sharing setting when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.DRIVEDOCS.1.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Sharing_Incorrect_V4 if {
+ # Test sharing setting when there are multiple OUs and secondary is wrong
+ PolicyId := "GWS.DRIVEDOCS.1.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Secondary OU."
+}
+
+test_Sharing_Incorrect_V5 if {
+ # Test sharing setting when the top OU is not present but there is another
+ PolicyId := "GWS.DRIVEDOCS.1.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput)
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+#
+# GWS.DRIVEDOCS.1.2v0.1
+#--
+test_SharingChecker_Correct_V1 if {
+ # Test sharing setting when there's only one event
+ PolicyId := "GWS.DRIVEDOCS.1.2v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput[0].ReportDetails)
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SharingChecker_Correct_V2 if {
+ # Test sharing setting when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.DRIVEDOCS.1.2v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SharingChecker_Correct_V3 if {
+ # Test sharing setting when there's multiple OUs
+ PolicyId := "GWS.DRIVEDOCS.1.2v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SharingChecker_Incorrect_V1 if {
+ # Test sharing setting when there are no relevant events
+ PolicyId := "GWS.DRIVEDOCS.1.2v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "SHARING_NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput)
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_SharingChecker_Incorrect_V2 if {
+ # Test sharing setting when there's only one event and it's wrong
+ PolicyId := "GWS.DRIVEDOCS.1.2v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SharingChecker_Incorrect_V3 if {
+ # Test sharing setting when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.DRIVEDOCS.1.2v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SharingChecker_Incorrect_V4 if {
+ # Test sharing setting when there are multiple OUs, top OU is compliant but secondary isn't
+ PolicyId := "GWS.DRIVEDOCS.1.2v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Secondary OU."
+}
+
+test_SharingChecker_Incorrect_V5 if {
+ # Test sharing setting when top level OU is not present
+ PolicyId := "GWS.DRIVEDOCS.1.2v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+#
+# GWS.DRIVEDOCS.1.3v0.1
+#--
+test_SharingChecker_Correct_V1 if {
+ # Test sharing setting when there's only one event
+ PolicyId := "GWS.DRIVEDOCS.1.3v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput[0].ReportDetails)
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SharingChecker_Correct_V2 if {
+ # Test sharing setting when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.DRIVEDOCS.1.3v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SharingChecker_Correct_V3 if {
+ # Test sharing setting when there's multiple OUs
+ PolicyId := "GWS.DRIVEDOCS.1.3v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SharingChecker_Incorrect_V1 if {
+ # Test sharing setting when there are no relevant events
+ PolicyId := "GWS.DRIVEDOCS.1.3v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "SHARING_NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput)
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_SharingChecker_Incorrect_V2 if {
+ # Test sharing setting when there's only one event and it's wrong
+ PolicyId := "GWS.DRIVEDOCS.1.3v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SharingChecker_Incorrect_V3 if {
+ # Test sharing setting when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.DRIVEDOCS.1.3v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SharingChecker_Incorrect_V4 if {
+ # Test sharing setting when Top OU is correct but not secondary OU
+ PolicyId := "GWS.DRIVEDOCS.1.3v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Secondary OU."
+}
+
+test_SharingChecker_Incorrect_V5 if {
+ # Test sharing setting when Top OU is not present
+ PolicyId := "GWS.DRIVEDOCS.1.3v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_OUTSIDE_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "SHARING_NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+#
+# GWS.DRIVEDOCS.1.4v0.1
+#--
+test_SharingChecker_Correct_V1 if {
+ # Test sharing setting when there's only one event
+ PolicyId := "GWS.DRIVEDOCS.1.4v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_INVITES_TO_NON_GOOGLE_ACCOUNTS"},
+ {"name": "NEW_VALUE", "value": "NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput[0].ReportDetails)
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SharingChecker_Correct_V2 if {
+ # Test sharing setting when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.DRIVEDOCS.1.4v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_INVITES_TO_NON_GOOGLE_ACCOUNTS"},
+ {"name": "NEW_VALUE", "value": "NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_INVITES_TO_NON_GOOGLE_ACCOUNTS"},
+ {"name": "NEW_VALUE", "value": "ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SharingChecker_Correct_V3 if {
+ # Test sharing setting when there's multiple OUs
+ PolicyId := "GWS.DRIVEDOCS.1.4v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_INVITES_TO_NON_GOOGLE_ACCOUNTS"},
+ {"name": "NEW_VALUE", "value": "NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_INVITES_TO_NON_GOOGLE_ACCOUNTS"},
+ {"name": "NEW_VALUE", "value": "NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SharingChecker_Incorrect_V1 if {
+ # Test sharing setting when there are no relevant events
+ PolicyId := "GWS.DRIVEDOCS.1.4v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput)
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_SharingChecker_Incorrect_V2 if {
+ # Test sharing setting when there's only one event and it's wrong
+ PolicyId := "GWS.DRIVEDOCS.1.4v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_INVITES_TO_NON_GOOGLE_ACCOUNTS"},
+ {"name": "NEW_VALUE", "value": "ANONYMOUS_PREVIEW"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SharingChecker_Incorrect_V3 if {
+ # Test sharing setting when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.DRIVEDOCS.1.4v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_INVITES_TO_NON_GOOGLE_ACCOUNTS"},
+ {"name": "NEW_VALUE", "value": "ANONYMOUS_PREVIEW"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_INVITES_TO_NON_GOOGLE_ACCOUNTS"},
+ {"name": "NEW_VALUE", "value": "NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SharingChecker_Incorrect_V4 if {
+ # Test sharing setting when Top OU is correct but not secondary OU
+ PolicyId := "GWS.DRIVEDOCS.1.4v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_INVITES_TO_NON_GOOGLE_ACCOUNTS"},
+ {"name": "NEW_VALUE", "value": "NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_INVITES_TO_NON_GOOGLE_ACCOUNTS"},
+ {"name": "NEW_VALUE", "value": "ANONYMOUS_PREVIEW"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Secondary OU."
+}
+
+test_SharingChecker_Incorrect_V5 if {
+ # Test sharing setting when Top OU is not present
+ PolicyId := "GWS.DRIVEDOCS.1.4v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_INVITES_TO_NON_GOOGLE_ACCOUNTS"},
+ {"name": "NEW_VALUE", "value": "NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+#
+# GWS.DRIVEDOCS.1.5v0.1
+#--
+test_SharingChecker_Correct_V1 if {
+ # Test sharing setting when there's only one event
+ PolicyId := "GWS.DRIVEDOCS.1.5v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "PUBLISHING_TO_WEB"},
+ {"name": "NEW_VALUE", "value": "NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput[0].ReportDetails)
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SharingChecker_Correct_V2 if {
+ # Test sharing setting when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.DRIVEDOCS.1.5v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "PUBLISHING_TO_WEB"},
+ {"name": "NEW_VALUE", "value": "NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "PUBLISHING_TO_WEB"},
+ {"name": "NEW_VALUE", "value": "ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SharingChecker_Correct_V3 if {
+ # Test sharing setting when there's multiple OUs
+ PolicyId := "GWS.DRIVEDOCS.1.5v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "PUBLISHING_TO_WEB"},
+ {"name": "NEW_VALUE", "value": "NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "PUBLISHING_TO_WEB"},
+ {"name": "NEW_VALUE", "value": "NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SharingChecker_Incorrect_V1 if {
+ # Test sharing setting when there are no relevant events
+ PolicyId := "GWS.DRIVEDOCS.1.5v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput)
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_SharingChecker_Incorrect_V2 if {
+ # Test sharing setting when there's only one event and it's wrong
+ PolicyId := "GWS.DRIVEDOCS.1.5v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "PUBLISHING_TO_WEB"},
+ {"name": "NEW_VALUE", "value": "ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SharingChecker_Incorrect_V3 if {
+ # Test sharing setting when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.DRIVEDOCS.1.5v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "PUBLISHING_TO_WEB"},
+ {"name": "NEW_VALUE", "value": "ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "PUBLISHING_TO_WEB"},
+ {"name": "NEW_VALUE", "value": "NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SharingChecker_Incorrect_V4 if {
+ # Test sharing setting when Top OU is correct but not secondary OU
+ PolicyId := "GWS.DRIVEDOCS.1.5v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "PUBLISHING_TO_WEB"},
+ {"name": "NEW_VALUE", "value": "NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "PUBLISHING_TO_WEB"},
+ {"name": "NEW_VALUE", "value": "ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Secondary OU."
+}
+
+test_SharingChecker_Incorrect_V5 if {
+ # Test sharing setting when Top OU is not present
+ PolicyId := "GWS.DRIVEDOCS.1.5v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "PUBLISHING_TO_WEB"},
+ {"name": "NEW_VALUE", "value": "NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+#
+# GWS.DRIVEDOCS.1.6v0.1
+#--
+
+test_SharingChecker_Correct_V1 if {
+ # Test sharing setting when there's only one event
+ PolicyId := "GWS.DRIVEDOCS.1.6v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_ACCESS_CHECKER_OPTIONS"},
+ {"name": "NEW_VALUE", "value": "NAMED_PARTIES_ONLY DOMAIN_OR_NAMED_PARTIES"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput[0].ReportDetails)
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SharingChecker_Correct_V2 if {
+ # Test setting when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.DRIVEDOCS.1.6v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_ACCESS_CHECKER_OPTIONS"},
+ {"name": "NEW_VALUE", "value": "NAMED_PARTIES_ONLY DOMAIN_OR_NAMED_PARTIES"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_ACCESS_CHECKER_OPTIONS"},
+ {"name": "NEW_VALUE", "value": "DOMAIN_OR_NAMED_PARTIES"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SharingChecker_Correct_V3 if {
+ # Test sharing setting when there's multiple OUs
+ PolicyId := "GWS.DRIVEDOCS.1.6v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_ACCESS_CHECKER_OPTIONS"},
+ {"name": "NEW_VALUE", "value": "NAMED_PARTIES_ONLY DOMAIN_OR_NAMED_PARTIES"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_ACCESS_CHECKER_OPTIONS"},
+ {"name": "NEW_VALUE", "value": "NAMED_PARTIES_ONLY DOMAIN_OR_NAMED_PARTIES"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SharingChecker_Incorrect_V1 if {
+ # Test sharing setting when there are no relevant events
+ PolicyId := "GWS.DRIVEDOCS.1.6v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput)
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_SharingChecker_Incorrect_V2 if {
+ # Test sharing setting when there's only one event and it's wrong
+ PolicyId := "GWS.DRIVEDOCS.1.6v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_ACCESS_CHECKER_OPTIONS"},
+ {"name": "NEW_VALUE", "value": "ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SharingChecker_Incorrect_V3 if {
+ # Test sharing setting when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.DRIVEDOCS.1.6v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_ACCESS_CHECKER_OPTIONS"},
+ {"name": "NEW_VALUE", "value": "ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_ACCESS_CHECKER_OPTIONS"},
+ {"name": "NEW_VALUE", "value": "NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SharingChecker_Incorrect_V4 if {
+ # Test sharing setting when Top OU is correct but not secondary OU
+ PolicyId := "GWS.DRIVEDOCS.1.6v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_ACCESS_CHECKER_OPTIONS"},
+ {"name": "NEW_VALUE", "value": "NAMED_PARTIES_ONLY DOMAIN_OR_NAMED_PARTIES"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_ACCESS_CHECKER_OPTIONS"},
+ {"name": "NEW_VALUE", "value": "ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Secondary OU."
+}
+
+test_SharingChecker_Incorrect_V5 if {
+ # Test sharing setting when Top OU is not present
+ PolicyId := "GWS.DRIVEDOCS.1.6v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_ACCESS_CHECKER_OPTIONS"},
+ {"name": "NEW_VALUE", "value": "NAMED_PARTIES_ONLY DOMAIN_OR_NAMED_PARTIE"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+#
+# GWS.DRIVEDOCS.1.7v0.1
+#--
+test_SharingChecker_Correct_V1 if {
+ # Test sharing setting when there's only one event
+ PolicyId := "GWS.DRIVEDOCS.1.7v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_TEAM_DRIVE_CROSS_DOMAIN_OPTIONS"},
+ {"name": "NEW_VALUE", "value": "CROSS_DOMAIN_MOVES_BLOCKED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput[0].ReportDetails)
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SharingChecker_Correct_V2 if {
+ # Test sharing setting when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.DRIVEDOCS.1.7v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_TEAM_DRIVE_CROSS_DOMAIN_OPTIONS"},
+ {"name": "NEW_VALUE", "value": "CROSS_DOMAIN_MOVES_BLOCKED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_TEAM_DRIVE_CROSS_DOMAIN_OPTIONS"},
+ {"name": "NEW_VALUE", "value": "CROSS_DOMAIN_FROM_INTERNAL_OR_EXTERNAL"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SharingChecker_Correct_V3 if {
+ # Test sharing setting when there's multiple OUs
+ PolicyId := "GWS.DRIVEDOCS.1.7v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_TEAM_DRIVE_CROSS_DOMAIN_OPTIONS"},
+ {"name": "NEW_VALUE", "value": "CROSS_DOMAIN_MOVES_BLOCKED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_TEAM_DRIVE_CROSS_DOMAIN_OPTIONS"},
+ {"name": "NEW_VALUE", "value": "CROSS_DOMAIN_MOVES_BLOCKED"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SharingChecker_Incorrect_V1 if {
+ # Test sharing setting when there are no relevant events
+ PolicyId := "GWS.DRIVEDOCS.1.7v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "CROSS_DOMAIN_MOVES_BLOCKED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput)
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_SharingChecker_Incorrect_V2 if {
+ # Test sharing setting when there's only one event and it's wrong
+ PolicyId := "GWS.DRIVEDOCS.1.7v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_TEAM_DRIVE_CROSS_DOMAIN_OPTIONS"},
+ {"name": "NEW_VALUE", "value": "CROSS_DOMAIN_FROM_INTERNAL_OR_EXTERNAL"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SharingChecker_Incorrect_V3 if {
+ # Test sharing setting when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.DRIVEDOCS.1.7v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_TEAM_DRIVE_CROSS_DOMAIN_OPTIONS"},
+ {"name": "NEW_VALUE", "value": "CROSS_DOMAIN_FROM_INTERNAL_OR_EXTERNAL"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_TEAM_DRIVE_CROSS_DOMAIN_OPTIONS"},
+ {"name": "NEW_VALUE", "value": "CROSS_DOMAIN_MOVES_BLOCKED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SharingChecker_Incorrect_V4 if {
+ # Test sharing setting when Top OU is correct but not secondary OU
+ PolicyId := "GWS.DRIVEDOCS.1.7v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_TEAM_DRIVE_CROSS_DOMAIN_OPTIONS"},
+ {"name": "NEW_VALUE", "value": "CROSS_DOMAIN_MOVES_BLOCKED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_TEAM_DRIVE_CROSS_DOMAIN_OPTIONS"},
+ {"name": "NEW_VALUE", "value": "CROSS_DOMAIN_FROM_INTERNAL_OR_EXTERNAL"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Secondary OU."
+}
+
+test_SharingChecker_Incorrect_V5 if {
+ # Test sharing setting when Top OU is not present
+ PolicyId := "GWS.DRIVEDOCS.1.7v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SHARING_TEAM_DRIVE_CROSS_DOMAIN_OPTIONS"},
+ {"name": "NEW_VALUE", "value": "CROSS_DOMAIN_MOVES_BLOCKED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+#
+# GWS.DRIVEDOCS.1.8v0.1
+#--
+test_SharingChecker_Correct_V1 if {
+ # Test sharing setting when there's only one event
+ PolicyId := "GWS.DRIVEDOCS.1.8v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DEFAULT_LINK_SHARING_FOR_NEW_DOCS"},
+ {"name": "NEW_VALUE", "value": "PRIVATE"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput[0].ReportDetails)
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SharingChecker_Correct_V2 if {
+ # Test sharing setting when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.DRIVEDOCS.1.8v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DEFAULT_LINK_SHARING_FOR_NEW_DOCS"},
+ {"name": "NEW_VALUE", "value": "PRIVATE"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DEFAULT_LINK_SHARING_FOR_NEW_DOCS"},
+ {"name": "NEW_VALUE", "value": "PUBLIC"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SharingChecker_Correct_V3 if {
+ # Test sharing setting when there's multiple OUs
+ PolicyId := "GWS.DRIVEDOCS.1.8v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DEFAULT_LINK_SHARING_FOR_NEW_DOCS"},
+ {"name": "NEW_VALUE", "value": "PRIVATE"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DEFAULT_LINK_SHARING_FOR_NEW_DOCS"},
+ {"name": "NEW_VALUE", "value": "PRIVATE"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SharingChecker_Incorrect_V1 if {
+ # Test sharing setting when there are no relevant events
+ PolicyId := "GWS.DRIVEDOCS.1.8v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "PRIVATE"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput)
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_SharingChecker_Incorrect_V2 if {
+ # Test sharing setting when there's only one event and it's wrong
+ PolicyId := "GWS.DRIVEDOCS.1.8v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DEFAULT_LINK_SHARING_FOR_NEW_DOCS"},
+ {"name": "NEW_VALUE", "value": "PUBLIC"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SharingChecker_Incorrect_V3 if {
+ # Test sharing setting when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.DRIVEDOCS.1.8v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DEFAULT_LINK_SHARING_FOR_NEW_DOCS"},
+ {"name": "NEW_VALUE", "value": "PUBLIC"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DEFAULT_LINK_SHARING_FOR_NEW_DOCS"},
+ {"name": "NEW_VALUE", "value": "PRIVATE"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SharingChecker_Incorrect_V4 if {
+ # Test sharing setting when Top OU is correct but not secondary OU
+ PolicyId := "GWS.DRIVEDOCS.1.8v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DEFAULT_LINK_SHARING_FOR_NEW_DOCS"},
+ {"name": "NEW_VALUE", "value": "PRIVATE"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DEFAULT_LINK_SHARING_FOR_NEW_DOCS"},
+ {"name": "NEW_VALUE", "value": "PUBLIC"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Secondary OU."
+}
+
+test_SharingChecker_Incorrect_V5 if {
+ # Test sharing setting when Top OU is not present
+ PolicyId := "GWS.DRIVEDOCS.1.8v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DEFAULT_LINK_SHARING_FOR_NEW_DOCS"},
+ {"name": "NEW_VALUE", "value": "PRIVATE"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
\ No newline at end of file
diff --git a/Testing/RegoTests/drive/drive02_test.rego b/Testing/RegoTests/drive/drive02_test.rego
new file mode 100644
index 00000000..7d482b00
--- /dev/null
+++ b/Testing/RegoTests/drive/drive02_test.rego
@@ -0,0 +1,1347 @@
+package drive
+import future.keywords
+
+#
+# GWS.DRIVEDOCS.2.1v0.1
+#--
+test_Sharing_Correct_V1 if {
+ # Test sharing setting when there's only one event
+ PolicyId := "GWS.DRIVEDOCS.2.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation CanCreateSharedDrives"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput[0].ReportDetails)
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Sharing_Correct_V2 if {
+ # Test sharing setting when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.DRIVEDOCS.2.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation CanCreateSharedDrives"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation CanCreateSharedDrives"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Sharing_Correct_V3 if {
+ # Test sharing setting when there's multiple OUs
+ PolicyId := "GWS.DRIVEDOCS.2.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation CanCreateSharedDrives"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation CanCreateSharedDrives"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Sharing_Incorrect_V1 if {
+ # Test sharing setting when there are no relevant events
+ PolicyId := "GWS.DRIVEDOCS.2.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput)
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_Sharing_Incorrect_V2 if {
+ # Test sharing setting when there's only one event and it's wrong
+ PolicyId := "GWS.DRIVEDOCS.2.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation CanCreateSharedDrives"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Sharing_Incorrect_V3 if {
+ # Test sharing setting when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.DRIVEDOCS.2.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation CanCreateSharedDrives"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation CanCreateSharedDrives"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Sharing_Incorrect_V4 if {
+ # Test sharing setting when top OU is correct but secondary isn't
+ PolicyId := "GWS.DRIVEDOCS.2.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation CanCreateSharedDrives"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation CanCreateSharedDrives"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Secondary OU."
+}
+
+test_Sharing_Incorrect_V5 if {
+ # Test sharing setting when top OU is missing
+ PolicyId := "GWS.DRIVEDOCS.2.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation CanCreateSharedDrives"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+#
+# Baseline 2.2 - Policy 2
+#--
+test_Sharing_Correct_V1 if {
+ # Test sharing setting when there's only one event
+ PolicyId := "GWS.DRIVEDOCS.2.2v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_admin_only"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput[0].ReportDetails)
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Sharing_Correct_V2 if {
+ # Test sharing setting when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.DRIVEDOCS.2.2v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_admin_only"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_admin_only"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Sharing_Correct_V3 if {
+ # Test sharing setting when there's multiple OUs
+ PolicyId := "GWS.DRIVEDOCS.2.2v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_admin_only"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_admin_only"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Sharing_Incorrect_V1 if {
+ # Test sharing setting when there are no relevant events
+ PolicyId := "GWS.DRIVEDOCS.2.2v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput)
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_Sharing_Incorrect_V2 if {
+ # Test sharing setting when there's only one event and it's wrong
+ PolicyId := "GWS.DRIVEDOCS.2.2v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_admin_only"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Sharing_Incorrect_V3 if {
+ # Test sharing setting when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.DRIVEDOCS.2.2v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_admin_only"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_admin_only"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Sharing_Incorrect_V4 if {
+ # Test sharing setting when top OU is correct but secondary isn't
+ PolicyId := "GWS.DRIVEDOCS.2.2v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_admin_only"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_admin_only"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Secondary OU."
+}
+
+test_Sharing_Incorrect_V5 if {
+ # Test sharing setting when top OU is missing
+ PolicyId := "GWS.DRIVEDOCS.2.2v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_admin_only"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+#
+# Baseline 2.2 - Policy 3
+#--
+test_Sharing_Correct_V1 if {
+ # Test sharing setting when there's only one event
+ PolicyId := "GWS.DRIVEDOCS.2.3v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_cross_domain_access"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput[0].ReportDetails)
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Sharing_Correct_V2 if {
+ # Test sharing setting when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.DRIVEDOCS.2.3v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_cross_domain_access"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_cross_domain_access"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Sharing_Correct_V3 if {
+ # Test sharing setting when there's multiple OUs
+ PolicyId := "GWS.DRIVEDOCS.2.3v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_cross_domain_access"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_cross_domain_access"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Sharing_Incorrect_V1 if {
+ # Test sharing setting when there are no relevant events
+ PolicyId := "GWS.DRIVEDOCS.2.3v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput)
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_Sharing_Incorrect_V2 if {
+ # Test sharing setting when there's only one event and it's wrong
+ PolicyId := "GWS.DRIVEDOCS.2.3v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_cross_domain_access"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Sharing_Incorrect_V3 if {
+ # Test sharing setting when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.DRIVEDOCS.2.3v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_cross_domain_access"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_cross_domain_access"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Sharing_Incorrect_V4 if {
+ # Test sharing setting when top OU is correct but secondary isn't
+ PolicyId := "GWS.DRIVEDOCS.2.3v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_cross_domain_access"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_cross_domain_access"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Secondary OU."
+}
+
+test_Sharing_Incorrect_V5 if {
+ # Test sharing setting when top OU is missing
+ PolicyId := "GWS.DRIVEDOCS.2.3v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_cross_domain_access"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+#
+# Baseline 2.2 - Policy 4
+#--
+test_Sharing_Correct_V1 if {
+ # Test sharing setting when there's only one event
+ PolicyId := "GWS.DRIVEDOCS.2.4v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_direct_access"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput[0].ReportDetails)
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Sharing_Correct_V2 if {
+ # Test sharing setting when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.DRIVEDOCS.2.4v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_direct_access"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_direct_access"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Sharing_Correct_V3 if {
+ # Test sharing setting when there's multiple OUs
+ PolicyId := "GWS.DRIVEDOCS.2.4v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_direct_access"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_direct_access"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Sharing_Incorrect_V1 if {
+ # Test sharing setting when there are no relevant events
+ PolicyId := "GWS.DRIVEDOCS.2.4v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput)
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_Sharing_Incorrect_V2 if {
+ # Test sharing setting when there's only one event and it's wrong
+ PolicyId := "GWS.DRIVEDOCS.2.4v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_direct_access"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Sharing_Incorrect_V3 if {
+ # Test sharing setting when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.DRIVEDOCS.2.4v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_direct_access"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_direct_access"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Sharing_Incorrect_V4 if {
+ # Test sharing setting when top OU is correct but secondary isn't
+ PolicyId := "GWS.DRIVEDOCS.2.4v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_direct_access"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_direct_access"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Secondary OU."
+}
+
+test_Sharing_Incorrect_V5 if {
+ # Test sharing setting when top OU is missing
+ PolicyId := "GWS.DRIVEDOCS.2.4v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_direct_access"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+#
+# Baseline 2.2 - Policy 5
+#--
+test_Sharing_Correct_V1 if {
+ # Test sharing setting when there's only one event
+ PolicyId := "GWS.DRIVEDOCS.2.5v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_download"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput[0].ReportDetails)
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Sharing_Correct_V2 if {
+ # Test sharing setting when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.DRIVEDOCS.2.5v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_download"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_download"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Sharing_Correct_V3 if {
+ # Test sharing setting when there's multiple OUs
+ PolicyId := "GWS.DRIVEDOCS.2.5v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_download"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_download"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Sharing_Incorrect_V1 if {
+ # Test sharing setting when there are no relevant events
+ PolicyId := "GWS.DRIVEDOCS.2.5v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput)
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_Sharing_Incorrect_V2 if {
+ # Test sharing setting when there's only one event and it's wrong
+ PolicyId := "GWS.DRIVEDOCS.2.5v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_download"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Sharing_Incorrect_V3 if {
+ # Test sharing setting when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.DRIVEDOCS.2.5v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_download"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_download"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Sharing_Incorrect_V4 if {
+ # Test sharing setting when top OU is correct but secondary isn't
+ PolicyId := "GWS.DRIVEDOCS.2.5v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_download"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_download"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Secondary OU."
+}
+
+test_Sharing_Incorrect_V5 if {
+ # Test sharing setting when top OU is missing
+ PolicyId := "GWS.DRIVEDOCS.2.5v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Shared Drive Creation new_team_drive_restricts_download"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
\ No newline at end of file
diff --git a/Testing/RegoTests/drive/drive03_test.rego b/Testing/RegoTests/drive/drive03_test.rego
new file mode 100644
index 00000000..94f00c01
--- /dev/null
+++ b/Testing/RegoTests/drive/drive03_test.rego
@@ -0,0 +1,363 @@
+package drive
+import future.keywords
+
+#
+# GWS.DRIVEDOCS.3.1v0.1
+#--
+test_Sharing_Correct_V1 if {
+ # Test sharing setting when there's only one event
+ PolicyId := "GWS.DRIVEDOCS.3.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Link Security Update Settings allow_less_secure_link_user_restore"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:27.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Link Security Update Settings less_secure_link_option"},
+ {"name": "NEW_VALUE", "value": "REMOVE_LESS_SECURE_LINKS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput[0])
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Sharing_Correct_V2 if {
+ # Test sharing setting when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.DRIVEDOCS.3.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Link Security Update Settings allow_less_secure_link_user_restore"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:27.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Link Security Update Settings less_secure_link_option"},
+ {"name": "NEW_VALUE", "value": "REMOVE_LESS_SECURE_LINKS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Link Security Update Settings allow_less_secure_link_user_restore"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Sharing_Correct_V3 if {
+ # Test sharing setting when there's multiple OUs
+ PolicyId := "GWS.DRIVEDOCS.3.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Link Security Update Settings allow_less_secure_link_user_restore"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:27.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Link Security Update Settings less_secure_link_option"},
+ {"name": "NEW_VALUE", "value": "REMOVE_LESS_SECURE_LINKS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Link Security Update Settings allow_less_secure_link_user_restore"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:27.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Link Security Update Settings less_secure_link_option"},
+ {"name": "NEW_VALUE", "value": "REMOVE_LESS_SECURE_LINKS"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Sharing_Incorrect_V1 if {
+ # Test sharing setting when there are no relevant events
+ PolicyId := "GWS.DRIVEDOCS.3.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput)
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_Sharing_Incorrect_V2 if {
+ # Test sharing setting when there's only one event and it's wrong
+ PolicyId := "GWS.DRIVEDOCS.3.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Link Security Update Settings allow_less_secure_link_user_restore"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:27.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Link Security Update Settings less_secure_link_option"},
+ {"name": "NEW_VALUE", "value": "LESS_SECURE_LINKS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Sharing_Incorrect_V3 if {
+ # Test sharing setting when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.DRIVEDOCS.3.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Link Security Update Settings allow_less_secure_link_user_restore"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:27.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Link Security Update Settings less_secure_link_option"},
+ {"name": "NEW_VALUE", "value": "LESS_SECURE_LINKS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:27.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Link Security Update Settings allow_less_secure_link_user_restore"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Sharing_Incorrect_V4 if {
+ # Test sharing setting when top level ou is correct but secondary isn't
+ PolicyId := "GWS.DRIVEDOCS.3.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Link Security Update Settings allow_less_secure_link_user_restore"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:27.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Link Security Update Settings less_secure_link_option"},
+ {"name": "NEW_VALUE", "value": "REMOVE_LESS_SECURE_LINKS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:27.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Link Security Update Settings less_secure_link_option"},
+ {"name": "NEW_VALUE", "value": "LESS_SECURE_LINKS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:27.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Link Security Update Settings allow_less_secure_link_user_restore"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput)
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Secondary OU."
+}
+
+test_Sharing_Incorrect_V5 if {
+ # Test sharing setting when top level ou is missing
+ PolicyId := "GWS.DRIVEDOCS.3.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Link Security Update Settings allow_less_secure_link_user_restore"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Link Security Update Settings less_secure_link_option"},
+ {"name": "NEW_VALUE", "value": "REMOVE_LESS_SECURE_LINKS"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
diff --git a/Testing/RegoTests/drive/drive04_test.rego b/Testing/RegoTests/drive/drive04_test.rego
new file mode 100644
index 00000000..d4790df9
--- /dev/null
+++ b/Testing/RegoTests/drive/drive04_test.rego
@@ -0,0 +1,271 @@
+package drive
+import future.keywords
+
+#
+# GWS.DRIVEDOCS.4.1v0.1
+#--
+test_Security_Correct_V1 if {
+ # Test security setting when there's only one event
+ PolicyId := "GWS.DRIVEDOCS.4.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_DRIVE_APPS"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput[0].ReportDetails)
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Security_Correct_V2 if {
+ # Test security setting when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.DRIVEDOCS.4.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_DRIVE_APPS"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_DRIVE_APPS"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Security_Correct_V3 if {
+ # Test security setting when there's multiple OUs
+ PolicyId := "GWS.DRIVEDOCS.4.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_DRIVE_APPS"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_DRIVE_APPS"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Security_Incorrect_V1 if {
+ # Test security setting when there are no relevant events
+ PolicyId := "GWS.DRIVEDOCS.4.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput)
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_Security_Incorrect_V2 if {
+ # Test security setting when there's only one event and it's wrong
+ PolicyId := "GWS.DRIVEDOCS.4.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_DRIVE_APPS"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Security_Incorrect_V3 if {
+ # Test security setting when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.DRIVEDOCS.4.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_DRIVE_APPS"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_DRIVE_APPS"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Security_Incorrect_V4 if {
+ # Test security setting when top level OU is right but secondary isn't
+ PolicyId := "GWS.DRIVEDOCS.4.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_DRIVE_APPS"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_DRIVE_APPS"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Secondary OU."
+}
+
+test_Security_Incorrect_V5 if {
+ # Test security setting when top level OU is missing
+ PolicyId := "GWS.DRIVEDOCS.4.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_DRIVE_APPS"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
\ No newline at end of file
diff --git a/Testing/RegoTests/drive/drive05_test.rego b/Testing/RegoTests/drive/drive05_test.rego
new file mode 100644
index 00000000..452325ad
--- /dev/null
+++ b/Testing/RegoTests/drive/drive05_test.rego
@@ -0,0 +1,271 @@
+package drive
+import future.keywords
+
+#
+# GWS.DRIVEDOCS.5.1v0.1
+#--
+test_Sharing_Correct_V1 if {
+ # Test sharing setting when there's only one event
+ PolicyId := "GWS.DRIVEDOCS.5.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_DOCS_ADD_ONS"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput[0].ReportDetails)
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Sharing_Correct_V2 if {
+ # Test sharing setting when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.DRIVEDOCS.5.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_DOCS_ADD_ONS"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_DOCS_ADD_ONS"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Sharing_Correct_V3 if {
+ # Test sharing setting when there's multiple OUs
+ PolicyId := "GWS.DRIVEDOCS.5.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_DOCS_ADD_ONS"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_DOCS_ADD_ONS"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Sharing_Incorrect_V1 if {
+ # Test sharing setting when there are no relevant events
+ PolicyId := "GWS.DRIVEDOCS.5.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput)
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_Sharing_Incorrect_V2 if {
+ # Test sharing setting when there's only one event and it's wrong
+ PolicyId := "GWS.DRIVEDOCS.5.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_DOCS_ADD_ONS"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Sharing_Incorrect_V3 if {
+ # Test sharing setting when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.DRIVEDOCS.5.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_DOCS_ADD_ONS"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_DOCS_ADD_ONS"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Sharing_Incorrect_V4 if {
+ # Test sharing setting when top level OU is right but secondary isn't
+ PolicyId := "GWS.DRIVEDOCS.5.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_DOCS_ADD_ONS"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_DOCS_ADD_ONS"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Secondary OU."
+}
+
+test_Sharing_Incorrect_V4 if {
+ # Test sharing setting when top level OU is missing
+ PolicyId := "GWS.DRIVEDOCS.5.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_DOCS_ADD_ONS"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
\ No newline at end of file
diff --git a/Testing/RegoTests/drive/drive06_test.rego b/Testing/RegoTests/drive/drive06_test.rego
new file mode 100644
index 00000000..65ca4837
--- /dev/null
+++ b/Testing/RegoTests/drive/drive06_test.rego
@@ -0,0 +1,391 @@
+package drive
+import future.keywords
+
+#
+# GWS.DRIVE.6.1v0.1
+#--
+test_DriveFs_Setting_Correct_V1 if {
+ # Test Drive setting when there's OU inhertitence setting
+ PolicyId := "GWS.DRIVEDOCS.6.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:22.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DriveFsSettingsProto drive_fs_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-13-20T00:02:23.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DriveFsSettingsProto company_owned_only_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-14-20T00:02:24.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DriveFsSettingsProto company_owned_only_enabled"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-15-20T00:02:25.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DriveFsSettingsProto drive_fs_enabled"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"}
+ ]
+ }]
+ },
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_DriveFs_Setting_Correct_V2 if {
+ # Test Drive setting when there's multiple events
+ PolicyId := "GWS.DRIVEDOCS.6.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:22.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DriveFsSettingsProto drive_fs_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-13-20T00:02:23.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DriveFsSettingsProto company_owned_only_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-14-20T00:02:22.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DriveFsSettingsProto drive_fs_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"}
+ ]
+ }]
+ },
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_DriveFs_Setting_Correct_V3 if {
+ # Test Drive setting when there's multiple events and inherited OU setting
+ PolicyId := "GWS.DRIVEDOCS.6.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:22.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DriveFsSettingsProto drive_fs_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-13-20T00:02:23.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DriveFsSettingsProto company_owned_only_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-17-20T00:02:24.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DriveFsSettingsProto company_owned_only_enabled"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-18-20T00:02:25.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DriveFsSettingsProto drive_fs_enabled"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-14-20T00:02:22.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DriveFsSettingsProto drive_fs_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"}
+ ]
+ }]
+ },
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_DriveFs_Setting_Correct_V4 if {
+ # Test Drive setting when there's multiple events
+ PolicyId := "GWS.DRIVEDOCS.6.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:22.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DriveFsSettingsProto drive_fs_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-13-20T00:02:23.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DriveFsSettingsProto company_owned_only_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"}
+ ]
+ }]
+ },
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_DriveFs_Setting_InCorrect_V1 if {
+ # Test Drive setting when there's only one event
+ PolicyId := "GWS.DRIVEDOCS.6.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:24.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DriveFsSettingsProto company_owned_only_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:25.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DriveFsSettingsProto drive_fs_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_DriveFs_Setting_InCorrect_V2 if {
+ # Test Drive setting when there's multiple events
+ PolicyId := "GWS.DRIVEDOCS.6.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:24.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DriveFsSettingsProto company_owned_only_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:25.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DriveFsSettingsProto drive_fs_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-22-20T00:02:24.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DriveFsSettingsProto company_owned_only_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-21-20T00:02:25.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DriveFsSettingsProto drive_fs_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_DriveFs_Setting_InCorrect_V3 if {
+ # Test Drive setting when there's multiple events
+ PolicyId := "GWS.DRIVEDOCS.6.1v0.1"
+ Output := tests with input as {
+ "drive_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:24.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DriveFsSettingsProto company_owned_only_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:25.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DriveFsSettingsProto drive_fs_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-22-20T00:02:24.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DriveFsSettingsProto company_owned_only_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-21-20T00:02:25.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DriveFsSettingsProto drive_fs_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-17-20T00:02:24.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DriveFsSettingsProto company_owned_only_enabled"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"}
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-18-20T00:02:25.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DriveFsSettingsProto drive_fs_enabled"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"}
+ ]
+ }]
+ },
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
\ No newline at end of file
diff --git a/Testing/RegoTests/drive/drive07_test.rego b/Testing/RegoTests/drive/drive07_test.rego
new file mode 100644
index 00000000..ec573a71
--- /dev/null
+++ b/Testing/RegoTests/drive/drive07_test.rego
@@ -0,0 +1,24 @@
+package drive
+import future.keywords
+
+#
+# GWS.DRIVEDOCS.7.1v0.1
+#--
+test_Rule_Correct_V1 if {
+ # Test Attachment Compliance Filtering when there's only one event
+ PolicyId := "GWS.DRIVEDOCS.7.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Currently not able to be tested automatically; please manually check."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/gmail/gmail01_test.rego b/Testing/RegoTests/gmail/gmail01_test.rego
new file mode 100644
index 00000000..ab80eea8
--- /dev/null
+++ b/Testing/RegoTests/gmail/gmail01_test.rego
@@ -0,0 +1,271 @@
+package gmail
+import future.keywords
+
+
+#
+# GWS.GMAIL.1.1v0.1
+#--
+test_MailDelegation_Correct_V1 if {
+ # Test mail delegation when there's only one event
+ PolicyId := "GWS.GMAIL.1.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_MAIL_DELEGATION_WITHIN_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_MailDelegation_Correct_V2 if {
+ # Test mail delegation when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.1.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_MAIL_DELEGATION_WITHIN_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_MAIL_DELEGATION_WITHIN_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_MailDelegation_Correct_V3 if {
+ # Test mail delegation when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.1.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_MAIL_DELEGATION_WITHIN_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_MAIL_DELEGATION_WITHIN_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_MailDelegation_Incorrect_V1 if {
+ # Test mail delegation when there are no relevant events
+ PolicyId := "GWS.GMAIL.1.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is compliant; manual check recommended."
+}
+
+test_MailDelegation_Incorrect_V2 if {
+ # Test mail delegation when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.1.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_MAIL_DELEGATION_WITHIN_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_MailDelegation_Incorrect_V3 if {
+ # Test mail delegation when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.1.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_MAIL_DELEGATION_WITHIN_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_MAIL_DELEGATION_WITHIN_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_MailDelegation_Incorrect_V4 if {
+ # Test mail delegation when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.1.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_MAIL_DELEGATION_WITHIN_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+test_MailDelegation_Incorrect_V5 if {
+ # Test mail delegation when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.1.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_MAIL_DELEGATION_WITHIN_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_MAIL_DELEGATION_WITHIN_DOMAIN"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/gmail/gmail02_test.rego b/Testing/RegoTests/gmail/gmail02_test.rego
new file mode 100644
index 00000000..3e412d41
--- /dev/null
+++ b/Testing/RegoTests/gmail/gmail02_test.rego
@@ -0,0 +1,91 @@
+package gmail
+import future.keywords
+
+
+#
+# GWS.GMAIL.2.1v0.1
+#--
+test_DKIM_Correct_V1 if {
+ # Test DKIM when there's only one domain
+ PolicyId := "GWS.GMAIL.2.1v0.1"
+ Output := tests with input as {
+ "dkim_records": [
+ {
+ "domain": "test.name",
+ "rdata": ["v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlaknWsKvtbTLAxtWSF5sDt+zvQhTXhT7V2QTnhPGlVXotXxL4VscG5cSnWus8rS4itN9ItxtzompUVRZ14b6hO1C+pxYAcl8Zaj6wsjE2vmEAmLHeXjj9EHMzrhfay2A02MJHReszokyLKBm+OZ7F4SNWP4SCazXkouOeATNrcIPUZxBV769ewx6ClumvOeHA\" \"qC77VxJieBg+7LaORrm23DMtWqdkMUWB/wmfCHO333/u6bY21eCMgiP/f+jSiylKDdY5kERpRU0NiIxlTGUhqROJESnxNUTqbK69CTAOYR6qhwJeT4OCsuE1zu6gxANmZMClIMiM2SuntXwNswb4QIDAQAB"]
+ }
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met."
+}
+
+test_DKIM_Correct_V2 if {
+ # Test DKIM when there's multiple domains
+ PolicyId := "GWS.GMAIL.2.1v0.1"
+ Output := tests with input as {
+ "dkim_records": [
+ {
+ "domain": "test1.name",
+ "rdata": ["v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlaknWsKvtbTLAxtWSF5sDt+zvQhTXhT7V2QTnhPGlVXotXxL4VscG5cSnWus8rS4itN9ItxtzompUVRZ14b6hO1C+pxYAcl8Zaj6wsjE2vmEAmLHeXjj9EHMzrhfay2A02MJHReszokyLKBm+OZ7F4SNWP4SCazXkouOeATNrcIPUZxBV769ewx6ClumvOeHA\" \"qC77VxJieBg+7LaORrm23DMtWqdkMUWB/wmfCHO333/u6bY21eCMgiP/f+jSiylKDdY5kERpRU0NiIxlTGUhqROJESnxNUTqbK69CTAOYR6qhwJeT4OCsuE1zu6gxANmZMClIMiM2SuntXwNswb4QIDAQAB"]
+ },
+ {
+ "domain": "test2.name",
+ "rdata": ["v=DKIM1;"]
+ }
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met."
+}
+
+test_DKIM_Incorrect_V1 if {
+ # Test DKIM when there's multiple domains and only one is correct
+ PolicyId := "GWS.GMAIL.2.1v0.1"
+ Output := tests with input as {
+ "dkim_records": [
+ {
+ "domain": "test1.name",
+ "rdata": ["v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlaknWsKvtbTLAxtWSF5sDt+zvQhTXhT7V2QTnhPGlVXotXxL4VscG5cSnWus8rS4itN9ItxtzompUVRZ14b6hO1C+pxYAcl8Zaj6wsjE2vmEAmLHeXjj9EHMzrhfay2A02MJHReszokyLKBm+OZ7F4SNWP4SCazXkouOeATNrcIPUZxBV769ewx6ClumvOeHA\" \"qC77VxJieBg+7LaORrm23DMtWqdkMUWB/wmfCHO333/u6bY21eCMgiP/f+jSiylKDdY5kERpRU0NiIxlTGUhqROJESnxNUTqbK69CTAOYR6qhwJeT4OCsuE1zu6gxANmZMClIMiM2SuntXwNswb4QIDAQAB"]
+ },
+ {
+ "domain": "test2.name",
+ "rdata": []
+ }
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "1 of 2 agency domain(s) found in violation: test2.name."
+}
+
+test_DKIM_Incorrect_V2 if {
+ # Test DKIM when there's only one domain and it's wrong
+ PolicyId := "GWS.GMAIL.2.1v0.1"
+ Output := tests with input as {
+ "dkim_records": [
+ {
+ "domain": "test.name",
+ "rdata": []
+ }
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "1 of 1 agency domain(s) found in violation: test.name."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/gmail/gmail03_test.rego b/Testing/RegoTests/gmail/gmail03_test.rego
new file mode 100644
index 00000000..cb172e36
--- /dev/null
+++ b/Testing/RegoTests/gmail/gmail03_test.rego
@@ -0,0 +1,123 @@
+package gmail
+import future.keywords
+
+
+#
+# GWS.GMAIL.3.1v0.1
+#--
+test_SPF_Correct_V1 if {
+ # Test SPF when there's only one domain
+ PolicyId := "GWS.GMAIL.3.1v0.1"
+ Output := tests with input as {
+ "dkim_records": [
+ {
+ "domain": "test.name",
+ "rdata": ["v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlaknWsKvtbTLAxtWSF5sDt+zvQhTXhT7V2QTnhPGlVXotXxL4VscG5cSnWus8rS4itN9ItxtzompUVRZ14b6hO1C+pxYAcl8Zaj6wsjE2vmEAmLHeXjj9EHMzrhfay2A02MJHReszokyLKBm+OZ7F4SNWP4SCazXkouOeATNrcIPUZxBV769ewx6ClumvOeHA\" \"qC77VxJieBg+7LaORrm23DMtWqdkMUWB/wmfCHO333/u6bY21eCMgiP/f+jSiylKDdY5kERpRU0NiIxlTGUhqROJESnxNUTqbK69CTAOYR6qhwJeT4OCsuE1zu6gxANmZMClIMiM2SuntXwNswb4QIDAQAB"]
+ }
+ ],
+ "spf_records": [
+ {
+ "domain": "test.name",
+ "rdata": ["v=spf1 include:_spf.google.com ~all"]
+ }
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met."
+}
+
+test_SPF_Correct_V2 if {
+ # Test SPF when there's multiple domains
+ PolicyId := "GWS.GMAIL.3.1v0.1"
+ Output := tests with input as {
+ "dkim_records": [
+ {
+ "domain": "test1.name",
+ "rdata": ["v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlaknWsKvtbTLAxtWSF5sDt+zvQhTXhT7V2QTnhPGlVXotXxL4VscG5cSnWus8rS4itN9ItxtzompUVRZ14b6hO1C+pxYAcl8Zaj6wsjE2vmEAmLHeXjj9EHMzrhfay2A02MJHReszokyLKBm+OZ7F4SNWP4SCazXkouOeATNrcIPUZxBV769ewx6ClumvOeHA\" \"qC77VxJieBg+7LaORrm23DMtWqdkMUWB/wmfCHO333/u6bY21eCMgiP/f+jSiylKDdY5kERpRU0NiIxlTGUhqROJESnxNUTqbK69CTAOYR6qhwJeT4OCsuE1zu6gxANmZMClIMiM2SuntXwNswb4QIDAQAB"]
+ },
+ {
+ "domain": "test2.name",
+ "rdata": ["v=DKIM1;"]
+ }
+ ],
+ "spf_records": [
+ {
+ "domain": "test1.name",
+ "rdata": ["v=spf1 include:_spf.google.com ~all"]
+ },
+ {
+ "domain": "test2.name",
+ "rdata": ["v=spf1 "]
+ }
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met."
+}
+
+test_SPF_Incorrect_V1 if {
+ # Test SPF when there's multiple domains and only one is correct
+ PolicyId := "GWS.GMAIL.3.1v0.1"
+ Output := tests with input as {
+ "dkim_records": [
+ {
+ "domain": "test1.name",
+ "rdata": ["v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlaknWsKvtbTLAxtWSF5sDt+zvQhTXhT7V2QTnhPGlVXotXxL4VscG5cSnWus8rS4itN9ItxtzompUVRZ14b6hO1C+pxYAcl8Zaj6wsjE2vmEAmLHeXjj9EHMzrhfay2A02MJHReszokyLKBm+OZ7F4SNWP4SCazXkouOeATNrcIPUZxBV769ewx6ClumvOeHA\" \"qC77VxJieBg+7LaORrm23DMtWqdkMUWB/wmfCHO333/u6bY21eCMgiP/f+jSiylKDdY5kERpRU0NiIxlTGUhqROJESnxNUTqbK69CTAOYR6qhwJeT4OCsuE1zu6gxANmZMClIMiM2SuntXwNswb4QIDAQAB"]
+ },
+ {
+ "domain": "test2.name",
+ "rdata": ["v=DKIM1;"]
+ }
+ ],
+ "spf_records": [
+ {
+ "domain": "test1.name",
+ "rdata": ["v=spf1 include:_spf.google.com ~all"]
+ },
+ {
+ "domain": "test2.name",
+ "rdata": []
+ }
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "1 of 2 agency domain(s) found in violation: test2.name."
+}
+
+test_SPF_Incorrect_V2 if {
+ # Test SPF when there's only one domain and it's wrong
+ PolicyId := "GWS.GMAIL.3.1v0.1"
+ Output := tests with input as {
+ "dkim_records": [
+ {
+ "domain": "test.name",
+ "rdata": ["v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlaknWsKvtbTLAxtWSF5sDt+zvQhTXhT7V2QTnhPGlVXotXxL4VscG5cSnWus8rS4itN9ItxtzompUVRZ14b6hO1C+pxYAcl8Zaj6wsjE2vmEAmLHeXjj9EHMzrhfay2A02MJHReszokyLKBm+OZ7F4SNWP4SCazXkouOeATNrcIPUZxBV769ewx6ClumvOeHA\" \"qC77VxJieBg+7LaORrm23DMtWqdkMUWB/wmfCHO333/u6bY21eCMgiP/f+jSiylKDdY5kERpRU0NiIxlTGUhqROJESnxNUTqbK69CTAOYR6qhwJeT4OCsuE1zu6gxANmZMClIMiM2SuntXwNswb4QIDAQAB"]
+ }
+ ],
+ "spf_records": [
+ {
+ "domain": "test.name",
+ "rdata": []
+ }
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "1 of 1 agency domain(s) found in violation: test.name."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/gmail/gmail04_test.rego b/Testing/RegoTests/gmail/gmail04_test.rego
new file mode 100644
index 00000000..5ec0d2db
--- /dev/null
+++ b/Testing/RegoTests/gmail/gmail04_test.rego
@@ -0,0 +1,483 @@
+package gmail
+import future.keywords
+
+
+#
+# GWS.GMAIL.4.1v0.1
+#--
+test_DMARC_Correct_V1 if {
+ # Test DMARC when there's only one domain
+ PolicyId := "GWS.GMAIL.4.1v0.1"
+ Output := tests with input as {
+ "dkim_records": [
+ {
+ "domain": "test.name",
+ "rdata": ["v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlaknWsKvtbTLAxtWSF5sDt+zvQhTXhT7V2QTnhPGlVXotXxL4VscG5cSnWus8rS4itN9ItxtzompUVRZ14b6hO1C+pxYAcl8Zaj6wsjE2vmEAmLHeXjj9EHMzrhfay2A02MJHReszokyLKBm+OZ7F4SNWP4SCazXkouOeATNrcIPUZxBV769ewx6ClumvOeHA\" \"qC77VxJieBg+7LaORrm23DMtWqdkMUWB/wmfCHO333/u6bY21eCMgiP/f+jSiylKDdY5kERpRU0NiIxlTGUhqROJESnxNUTqbK69CTAOYR6qhwJeT4OCsuE1zu6gxANmZMClIMiM2SuntXwNswb4QIDAQAB"]
+ }
+ ],
+ "dmarc_records": [
+ {
+ "domain": "test.name",
+ "rdata": ["v=DMARC1; p=reject; pct=100; rua=mailto:DMARC@hq.dhs.gov, mailto:reports@dmarc.cyber.dhs.gov"]
+ }
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met."
+}
+
+test_DMARC_Correct_V2 if {
+ # Test DMARC when there's multiple domains
+ PolicyId := "GWS.GMAIL.4.1v0.1"
+ Output := tests with input as {
+ "dkim_records": [
+ {
+ "domain": "test1.name",
+ "rdata": ["v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlaknWsKvtbTLAxtWSF5sDt+zvQhTXhT7V2QTnhPGlVXotXxL4VscG5cSnWus8rS4itN9ItxtzompUVRZ14b6hO1C+pxYAcl8Zaj6wsjE2vmEAmLHeXjj9EHMzrhfay2A02MJHReszokyLKBm+OZ7F4SNWP4SCazXkouOeATNrcIPUZxBV769ewx6ClumvOeHA\" \"qC77VxJieBg+7LaORrm23DMtWqdkMUWB/wmfCHO333/u6bY21eCMgiP/f+jSiylKDdY5kERpRU0NiIxlTGUhqROJESnxNUTqbK69CTAOYR6qhwJeT4OCsuE1zu6gxANmZMClIMiM2SuntXwNswb4QIDAQAB"]
+ },
+ {
+ "domain": "test2.name",
+ "rdata": ["v=DKIM1;"]
+ }
+ ],
+ "dmarc_records": [
+ {
+ "domain": "test1.name",
+ "rdata": ["v=DMARC1; p=reject; pct=100; rua=mailto:DMARC@hq.dhs.gov, mailto:reports@dmarc.cyber.dhs.gov"]
+ },
+ {
+ "domain": "test2.name",
+ "rdata": ["v=DMARC1; p=reject; pct=100; rua=mailto:DMARC@hq.dhs.gov, mailto:reports@dmarc.cyber.dhs.gov"]
+ }
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met."
+}
+
+test_DMARC_Incorrect_V1 if {
+ # Test DMARC when there's multiple domains and only one is correct
+ PolicyId := "GWS.GMAIL.4.1v0.1"
+ Output := tests with input as {
+ "dkim_records": [
+ {
+ "domain": "test1.name",
+ "rdata": ["v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlaknWsKvtbTLAxtWSF5sDt+zvQhTXhT7V2QTnhPGlVXotXxL4VscG5cSnWus8rS4itN9ItxtzompUVRZ14b6hO1C+pxYAcl8Zaj6wsjE2vmEAmLHeXjj9EHMzrhfay2A02MJHReszokyLKBm+OZ7F4SNWP4SCazXkouOeATNrcIPUZxBV769ewx6ClumvOeHA\" \"qC77VxJieBg+7LaORrm23DMtWqdkMUWB/wmfCHO333/u6bY21eCMgiP/f+jSiylKDdY5kERpRU0NiIxlTGUhqROJESnxNUTqbK69CTAOYR6qhwJeT4OCsuE1zu6gxANmZMClIMiM2SuntXwNswb4QIDAQAB"]
+ },
+ {
+ "domain": "test2.name",
+ "rdata": ["v=DKIM1;"]
+ }
+ ],
+ "dmarc_records": [
+ {
+ "domain": "test1.name",
+ "rdata": ["v=DMARC1; p=reject; pct=100; rua=mailto:DMARC@hq.dhs.gov, mailto:reports@dmarc.cyber.dhs.gov"]
+ },
+ {
+ "domain": "test2.name",
+ "rdata": []
+ }
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "1 of 2 agency domain(s) found in violation: test2.name."
+}
+
+test_DMARC_Incorrect_V2 if {
+ # Test DMARC when there's only one domain and it's wrong
+ PolicyId := "GWS.GMAIL.4.1v0.1"
+ Output := tests with input as {
+ "dkim_records": [
+ {
+ "domain": "test.name",
+ "rdata": ["v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlaknWsKvtbTLAxtWSF5sDt+zvQhTXhT7V2QTnhPGlVXotXxL4VscG5cSnWus8rS4itN9ItxtzompUVRZ14b6hO1C+pxYAcl8Zaj6wsjE2vmEAmLHeXjj9EHMzrhfay2A02MJHReszokyLKBm+OZ7F4SNWP4SCazXkouOeATNrcIPUZxBV769ewx6ClumvOeHA\" \"qC77VxJieBg+7LaORrm23DMtWqdkMUWB/wmfCHO333/u6bY21eCMgiP/f+jSiylKDdY5kERpRU0NiIxlTGUhqROJESnxNUTqbK69CTAOYR6qhwJeT4OCsuE1zu6gxANmZMClIMiM2SuntXwNswb4QIDAQAB"]
+ }
+ ],
+ "dmarc_records": [
+ {
+ "domain": "test.name",
+ "rdata": []
+ }
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "1 of 1 agency domain(s) found in violation: test.name."
+}
+
+#
+# GWS.GMAIL.4.2v0.1
+#--
+
+test_DMARCMessageReject_Correct_V1 if {
+ # Test DMARC when there's only one domain
+ PolicyId := "GWS.GMAIL.4.2v0.1"
+ Output := tests with input as {
+ "dkim_records": [
+ {
+ "domain": "test.name",
+ "rdata": ["v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlaknWsKvtbTLAxtWSF5sDt+zvQhTXhT7V2QTnhPGlVXotXxL4VscG5cSnWus8rS4itN9ItxtzompUVRZ14b6hO1C+pxYAcl8Zaj6wsjE2vmEAmLHeXjj9EHMzrhfay2A02MJHReszokyLKBm+OZ7F4SNWP4SCazXkouOeATNrcIPUZxBV769ewx6ClumvOeHA\" \"qC77VxJieBg+7LaORrm23DMtWqdkMUWB/wmfCHO333/u6bY21eCMgiP/f+jSiylKDdY5kERpRU0NiIxlTGUhqROJESnxNUTqbK69CTAOYR6qhwJeT4OCsuE1zu6gxANmZMClIMiM2SuntXwNswb4QIDAQAB"]
+ }
+ ],
+ "dmarc_records": [
+ {
+ "domain": "test.name",
+ "rdata": ["v=DMARC1; p=reject; pct=100; rua=mailto:DMARC@hq.dhs.gov, mailto:reports@dmarc.cyber.dhs.gov"]
+ }
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met."
+}
+
+test_DMARCMessageReject_Correct_V2 if {
+ # Test DMARC when there's multiple domains
+ PolicyId := "GWS.GMAIL.4.2v0.1"
+ Output := tests with input as {
+ "dkim_records": [
+ {
+ "domain": "test1.name",
+ "rdata": ["v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlaknWsKvtbTLAxtWSF5sDt+zvQhTXhT7V2QTnhPGlVXotXxL4VscG5cSnWus8rS4itN9ItxtzompUVRZ14b6hO1C+pxYAcl8Zaj6wsjE2vmEAmLHeXjj9EHMzrhfay2A02MJHReszokyLKBm+OZ7F4SNWP4SCazXkouOeATNrcIPUZxBV769ewx6ClumvOeHA\" \"qC77VxJieBg+7LaORrm23DMtWqdkMUWB/wmfCHO333/u6bY21eCMgiP/f+jSiylKDdY5kERpRU0NiIxlTGUhqROJESnxNUTqbK69CTAOYR6qhwJeT4OCsuE1zu6gxANmZMClIMiM2SuntXwNswb4QIDAQAB"]
+ },
+ {
+ "domain": "test2.name",
+ "rdata": ["v=DKIM1;"]
+ }
+ ],
+ "dmarc_records": [
+ {
+ "domain": "test1.name",
+ "rdata": ["v=DMARC1; p=reject; pct=100; rua=mailto:DMARC@hq.dhs.gov, mailto:reports@dmarc.cyber.dhs.gov"]
+ },
+ {
+ "domain": "test2.name",
+ "rdata": ["v=DMARC1; p=reject; pct=100; rua=mailto:DMARC@hq.dhs.gov, mailto:reports@dmarc.cyber.dhs.gov"]
+ }
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met."
+}
+
+test_DMARCMessageReject_Incorrect_V1 if {
+ # Test DMARC when there's multiple domains and only one is correct
+ PolicyId := "GWS.GMAIL.4.2v0.1"
+ Output := tests with input as {
+ "dkim_records": [
+ {
+ "domain": "test1.name",
+ "rdata": ["v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlaknWsKvtbTLAxtWSF5sDt+zvQhTXhT7V2QTnhPGlVXotXxL4VscG5cSnWus8rS4itN9ItxtzompUVRZ14b6hO1C+pxYAcl8Zaj6wsjE2vmEAmLHeXjj9EHMzrhfay2A02MJHReszokyLKBm+OZ7F4SNWP4SCazXkouOeATNrcIPUZxBV769ewx6ClumvOeHA\" \"qC77VxJieBg+7LaORrm23DMtWqdkMUWB/wmfCHO333/u6bY21eCMgiP/f+jSiylKDdY5kERpRU0NiIxlTGUhqROJESnxNUTqbK69CTAOYR6qhwJeT4OCsuE1zu6gxANmZMClIMiM2SuntXwNswb4QIDAQAB"]
+ },
+ {
+ "domain": "test2.name",
+ "rdata": ["v=DKIM1;"]
+ }
+ ],
+ "dmarc_records": [
+ {
+ "domain": "test1.name",
+ "rdata": ["v=DMARC1; p=reject; pct=100; rua=mailto:DMARC@hq.dhs.gov, mailto:reports@dmarc.cyber.dhs.gov"]
+ },
+ {
+ "domain": "test2.name",
+ "rdata": ["v=DMARC1; pct=100; rua=mailto:DMARC@hq.dhs.gov, mailto:reports@dmarc.cyber.dhs.gov"]
+ }
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "1 of 2 agency domain(s) found in violation: test2.name."
+}
+
+test_DMARCMessageReject_Incorrect_V2 if {
+ # Test DMARC when there's only one domain and it's wrong
+ PolicyId := "GWS.GMAIL.4.2v0.1"
+ Output := tests with input as {
+ "dkim_records": [
+ {
+ "domain": "test.name",
+ "rdata": ["v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlaknWsKvtbTLAxtWSF5sDt+zvQhTXhT7V2QTnhPGlVXotXxL4VscG5cSnWus8rS4itN9ItxtzompUVRZ14b6hO1C+pxYAcl8Zaj6wsjE2vmEAmLHeXjj9EHMzrhfay2A02MJHReszokyLKBm+OZ7F4SNWP4SCazXkouOeATNrcIPUZxBV769ewx6ClumvOeHA\" \"qC77VxJieBg+7LaORrm23DMtWqdkMUWB/wmfCHO333/u6bY21eCMgiP/f+jSiylKDdY5kERpRU0NiIxlTGUhqROJESnxNUTqbK69CTAOYR6qhwJeT4OCsuE1zu6gxANmZMClIMiM2SuntXwNswb4QIDAQAB"]
+ }
+ ],
+ "dmarc_records": [
+ {
+ "domain": "test.name",
+ "rdata": ["v=DMARC1; pct=100; rua=mailto:DMARC@hq.dhs.gov, mailto:reports@dmarc.cyber.dhs.gov"]
+ }
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "1 of 1 agency domain(s) found in violation: test.name."
+}
+
+#
+# GWS.GMAIL.4.3v0.1
+#--
+
+test_DMARCAggregateReports_Correct_V1 if {
+ # Test DMARC when there's only one domain
+ PolicyId := "GWS.GMAIL.4.3v0.1"
+ Output := tests with input as {
+ "dkim_records": [
+ {
+ "domain": "test.name",
+ "rdata": ["v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlaknWsKvtbTLAxtWSF5sDt+zvQhTXhT7V2QTnhPGlVXotXxL4VscG5cSnWus8rS4itN9ItxtzompUVRZ14b6hO1C+pxYAcl8Zaj6wsjE2vmEAmLHeXjj9EHMzrhfay2A02MJHReszokyLKBm+OZ7F4SNWP4SCazXkouOeATNrcIPUZxBV769ewx6ClumvOeHA\" \"qC77VxJieBg+7LaORrm23DMtWqdkMUWB/wmfCHO333/u6bY21eCMgiP/f+jSiylKDdY5kERpRU0NiIxlTGUhqROJESnxNUTqbK69CTAOYR6qhwJeT4OCsuE1zu6gxANmZMClIMiM2SuntXwNswb4QIDAQAB"]
+ }
+ ],
+ "dmarc_records": [
+ {
+ "domain": "test.name",
+ "rdata": ["v=DMARC1; p=reject; pct=100; rua=mailto:DMARC@hq.dhs.gov, mailto:reports@dmarc.cyber.dhs.gov"]
+ }
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met."
+}
+
+test_DMARCAggregateReports_Correct_V2 if {
+ # Test DMARC when there's multiple domains
+ PolicyId := "GWS.GMAIL.4.3v0.1"
+ Output := tests with input as {
+ "dkim_records": [
+ {
+ "domain": "test1.name",
+ "rdata": ["v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlaknWsKvtbTLAxtWSF5sDt+zvQhTXhT7V2QTnhPGlVXotXxL4VscG5cSnWus8rS4itN9ItxtzompUVRZ14b6hO1C+pxYAcl8Zaj6wsjE2vmEAmLHeXjj9EHMzrhfay2A02MJHReszokyLKBm+OZ7F4SNWP4SCazXkouOeATNrcIPUZxBV769ewx6ClumvOeHA\" \"qC77VxJieBg+7LaORrm23DMtWqdkMUWB/wmfCHO333/u6bY21eCMgiP/f+jSiylKDdY5kERpRU0NiIxlTGUhqROJESnxNUTqbK69CTAOYR6qhwJeT4OCsuE1zu6gxANmZMClIMiM2SuntXwNswb4QIDAQAB"]
+ },
+ {
+ "domain": "test2.name",
+ "rdata": ["v=DKIM1;"]
+ }
+ ],
+ "dmarc_records": [
+ {
+ "domain": "test1.name",
+ "rdata": ["v=DMARC1; p=reject; pct=100; rua=mailto:DMARC@hq.dhs.gov, mailto:reports@dmarc.cyber.dhs.gov"]
+ },
+ {
+ "domain": "test2.name",
+ "rdata": ["v=DMARC1; p=reject; pct=100; rua=mailto:DMARC@hq.dhs.gov, mailto:reports@dmarc.cyber.dhs.gov"]
+ }
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met."
+}
+
+test_DMARCAggregateReports_Incorrect_V1 if {
+ # Test DMARC when there's multiple domains and only one is correct
+ PolicyId := "GWS.GMAIL.4.3v0.1"
+ Output := tests with input as {
+ "dkim_records": [
+ {
+ "domain": "test1.name",
+ "rdata": ["v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlaknWsKvtbTLAxtWSF5sDt+zvQhTXhT7V2QTnhPGlVXotXxL4VscG5cSnWus8rS4itN9ItxtzompUVRZ14b6hO1C+pxYAcl8Zaj6wsjE2vmEAmLHeXjj9EHMzrhfay2A02MJHReszokyLKBm+OZ7F4SNWP4SCazXkouOeATNrcIPUZxBV769ewx6ClumvOeHA\" \"qC77VxJieBg+7LaORrm23DMtWqdkMUWB/wmfCHO333/u6bY21eCMgiP/f+jSiylKDdY5kERpRU0NiIxlTGUhqROJESnxNUTqbK69CTAOYR6qhwJeT4OCsuE1zu6gxANmZMClIMiM2SuntXwNswb4QIDAQAB"]
+ },
+ {
+ "domain": "test2.name",
+ "rdata": ["v=DKIM1;"]
+ }
+ ],
+ "dmarc_records": [
+ {
+ "domain": "test1.name",
+ "rdata": ["v=DMARC1; p=reject; pct=100; rua=mailto:DMARC@hq.dhs.gov, mailto:reports@dmarc.cyber.dhs.gov"]
+ },
+ {
+ "domain": "test2.name",
+ "rdata": ["v=DMARC1; p=reject; pct=100; rua=mailto:DMARC@hq.dhs.gov"]
+ }
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "1 of 2 agency domain(s) found in violation: test2.name."
+}
+
+test_DMARCAggregateReports_Incorrect_V2 if {
+ # Test DMARC when there's only one domain and it's wrong
+ PolicyId := "GWS.GMAIL.4.3v0.1"
+ Output := tests with input as {
+ "dkim_records": [
+ {
+ "domain": "test.name",
+ "rdata": ["v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlaknWsKvtbTLAxtWSF5sDt+zvQhTXhT7V2QTnhPGlVXotXxL4VscG5cSnWus8rS4itN9ItxtzompUVRZ14b6hO1C+pxYAcl8Zaj6wsjE2vmEAmLHeXjj9EHMzrhfay2A02MJHReszokyLKBm+OZ7F4SNWP4SCazXkouOeATNrcIPUZxBV769ewx6ClumvOeHA\" \"qC77VxJieBg+7LaORrm23DMtWqdkMUWB/wmfCHO333/u6bY21eCMgiP/f+jSiylKDdY5kERpRU0NiIxlTGUhqROJESnxNUTqbK69CTAOYR6qhwJeT4OCsuE1zu6gxANmZMClIMiM2SuntXwNswb4QIDAQAB"]
+ }
+ ],
+ "dmarc_records": [
+ {
+ "domain": "test.name",
+ "rdata": ["v=DMARC1; p=reject; pct=100; rua=mailto:DMARC@hq.dhs.gov"]
+ }
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "1 of 1 agency domain(s) found in violation: test.name."
+}
+
+#
+# GWS.GMAIL.4.4v0.1
+#--
+
+test_DMARCAgencyPOC_Correct_V1 if {
+ # Test DMARC when there's only one domain
+ PolicyId := "GWS.GMAIL.4.4v0.1"
+ Output := tests with input as {
+ "dkim_records": [
+ {
+ "domain": "test.name",
+ "rdata": ["v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlaknWsKvtbTLAxtWSF5sDt+zvQhTXhT7V2QTnhPGlVXotXxL4VscG5cSnWus8rS4itN9ItxtzompUVRZ14b6hO1C+pxYAcl8Zaj6wsjE2vmEAmLHeXjj9EHMzrhfay2A02MJHReszokyLKBm+OZ7F4SNWP4SCazXkouOeATNrcIPUZxBV769ewx6ClumvOeHA\" \"qC77VxJieBg+7LaORrm23DMtWqdkMUWB/wmfCHO333/u6bY21eCMgiP/f+jSiylKDdY5kERpRU0NiIxlTGUhqROJESnxNUTqbK69CTAOYR6qhwJeT4OCsuE1zu6gxANmZMClIMiM2SuntXwNswb4QIDAQAB"]
+ }
+ ],
+ "dmarc_records": [
+ {
+ "domain": "test.name",
+ "rdata": ["v=DMARC1; p=reject; pct=100; rua=mailto:DMARC@hq.dhs.gov, mailto:reports@dmarc.cyber.dhs.gov"]
+ }
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met."
+}
+
+test_DMARCAgencyPOC_Correct_V2 if {
+ # Test DMARC when there's multiple domains
+ PolicyId := "GWS.GMAIL.4.4v0.1"
+ Output := tests with input as {
+ "dkim_records": [
+ {
+ "domain": "test1.name",
+ "rdata": ["v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlaknWsKvtbTLAxtWSF5sDt+zvQhTXhT7V2QTnhPGlVXotXxL4VscG5cSnWus8rS4itN9ItxtzompUVRZ14b6hO1C+pxYAcl8Zaj6wsjE2vmEAmLHeXjj9EHMzrhfay2A02MJHReszokyLKBm+OZ7F4SNWP4SCazXkouOeATNrcIPUZxBV769ewx6ClumvOeHA\" \"qC77VxJieBg+7LaORrm23DMtWqdkMUWB/wmfCHO333/u6bY21eCMgiP/f+jSiylKDdY5kERpRU0NiIxlTGUhqROJESnxNUTqbK69CTAOYR6qhwJeT4OCsuE1zu6gxANmZMClIMiM2SuntXwNswb4QIDAQAB"]
+ },
+ {
+ "domain": "test2.name",
+ "rdata": ["v=DKIM1;"]
+ }
+ ],
+ "dmarc_records": [
+ {
+ "domain": "test1.name",
+ "rdata": ["v=DMARC1; p=reject; pct=100; rua=mailto:DMARC@hq.dhs.gov, mailto:reports@dmarc.cyber.dhs.gov"]
+ },
+ {
+ "domain": "test2.name",
+ "rdata": ["v=DMARC1; p=reject; pct=100; rua=mailto:DMARC@hq.dhs.gov, mailto:reports@dmarc.cyber.dhs.gov"]
+ }
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met."
+}
+
+test_DMARCAgencyPOC_Incorrect_V1 if {
+ # Test DMARC when there's multiple domains and only one is correct
+ PolicyId := "GWS.GMAIL.4.4v0.1"
+ Output := tests with input as {
+ "dkim_records": [
+ {
+ "domain": "test1.name",
+ "rdata": ["v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlaknWsKvtbTLAxtWSF5sDt+zvQhTXhT7V2QTnhPGlVXotXxL4VscG5cSnWus8rS4itN9ItxtzompUVRZ14b6hO1C+pxYAcl8Zaj6wsjE2vmEAmLHeXjj9EHMzrhfay2A02MJHReszokyLKBm+OZ7F4SNWP4SCazXkouOeATNrcIPUZxBV769ewx6ClumvOeHA\" \"qC77VxJieBg+7LaORrm23DMtWqdkMUWB/wmfCHO333/u6bY21eCMgiP/f+jSiylKDdY5kERpRU0NiIxlTGUhqROJESnxNUTqbK69CTAOYR6qhwJeT4OCsuE1zu6gxANmZMClIMiM2SuntXwNswb4QIDAQAB"]
+ },
+ {
+ "domain": "test2.name",
+ "rdata": ["v=DKIM1;"]
+ }
+ ],
+ "dmarc_records": [
+ {
+ "domain": "test1.name",
+ "rdata": ["v=DMARC1; p=reject; pct=100; rua=mailto:DMARC@hq.dhs.gov, mailto:reports@dmarc.cyber.dhs.gov"]
+ },
+ {
+ "domain": "test2.name",
+ "rdata": ["v=DMARC1; p=reject; pct=100; mailto:reports@dmarc.cyber.dhs.gov"]
+ }
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "1 of 2 agency domain(s) found in violation: test2.name."
+}
+
+test_DMARCAgencyPOC_Incorrect_V2 if {
+ # Test DMARC when there's only one domain and it's wrong
+ PolicyId := "GWS.GMAIL.4.4v0.1"
+ Output := tests with input as {
+ "dkim_records": [
+ {
+ "domain": "test.name",
+ "rdata": ["v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlaknWsKvtbTLAxtWSF5sDt+zvQhTXhT7V2QTnhPGlVXotXxL4VscG5cSnWus8rS4itN9ItxtzompUVRZ14b6hO1C+pxYAcl8Zaj6wsjE2vmEAmLHeXjj9EHMzrhfay2A02MJHReszokyLKBm+OZ7F4SNWP4SCazXkouOeATNrcIPUZxBV769ewx6ClumvOeHA\" \"qC77VxJieBg+7LaORrm23DMtWqdkMUWB/wmfCHO333/u6bY21eCMgiP/f+jSiylKDdY5kERpRU0NiIxlTGUhqROJESnxNUTqbK69CTAOYR6qhwJeT4OCsuE1zu6gxANmZMClIMiM2SuntXwNswb4QIDAQAB"]
+ }
+ ],
+ "dmarc_records": [
+ {
+ "domain": "test.name",
+ "rdata": ["v=DMARC1; p=reject; pct=100; mailto:reports@dmarc.cyber.dhs.gov"]
+ }
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "1 of 1 agency domain(s) found in violation: test.name."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/gmail/gmail05_test.rego b/Testing/RegoTests/gmail/gmail05_test.rego
new file mode 100644
index 00000000..f3e2a913
--- /dev/null
+++ b/Testing/RegoTests/gmail/gmail05_test.rego
@@ -0,0 +1,1385 @@
+package gmail
+import future.keywords
+
+#
+# GWS.GMAIL.5.2v0.1
+#--
+test_AttachmentProtectionAttachmentsScriptsUntrustedSenders_Correct_V1 if {
+ # Test Attachment Protections when there's only one event
+ PolicyId := "GWS.GMAIL.5.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: protect against attachments with scripts from untrusted senders"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_AttachmentProetectionAttachmentsScriptsUntrustedSenders_Correct_V2 if {
+ # Test Attachment Protections when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.5.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: protect against attachments with scripts from untrusted senders"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: protect against attachments with scripts from untrusted senders"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_AttachmentProetectionAttachmentsScriptsUntrustedSenders_Correct_V3 if {
+ # Test Attachment Protections when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.5.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: protect against attachments with scripts from untrusted senders"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: protect against attachments with scripts from untrusted senders"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_AttachmentProtectionEncryptedAttachmentsUntrustedSenders_Correct_V4 if {
+ # Test inheritance
+ PolicyId := "GWS.GMAIL.5.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2020-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: protect against encrypted attachments from untrusted senders"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: protect against encrypted attachments from untrusted senders"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Second OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: protect against encrypted attachments from untrusted senders"},
+ {"name": "ORG_UNIT_NAME", "value": "Second OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_AttachmentProtectionAttachmentsScriptsUntrustedSenders_Incorrect_V1 if {
+ # Test Attachment Protections when there are no relevant events
+ PolicyId := "GWS.GMAIL.5.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_AttachmentProtectionAttachmentsScriptsUntrustedSenders_Incorrect_V2 if {
+ # Test Attachment Protections when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.5.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: protect against attachments with scripts from untrusted senders"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_AttachmentProtectionAttachmentsScriptsUntrustedSenders_Incorrect_V3 if {
+ # Test Attachment Protections when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.5.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: protect against attachments with scripts from untrusted senders"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: protect against attachments with scripts from untrusted senders"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_AttachmentProtectionEncryptedAttachmentsUntrustedSenders_Incorrect_V4 if {
+ # Test Attachment Protections when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.5.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: protect against encrypted attachments from untrusted senders"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+test_AttachmentProtectionEncryptedAttachmentsUntrustedSenders_Incorrect_V5 if {
+ # Test Attachment Protections when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.5.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: protect against encrypted attachments from untrusted senders"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: protect against encrypted attachments from untrusted senders"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+#--
+
+
+#
+# GWS.GMAIL.5.2v0.1
+#--
+test_AttachmentProtectionAttachmentsScriptsUntrustedSenders_Correct_V1 if {
+ # Test Attachment Protections when there's only one event
+ PolicyId := "GWS.GMAIL.5.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: protect against attachments with scripts from untrusted senders"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_AttachmentProetectionAttachmentsScriptsUntrustedSenders_Correct_V2 if {
+ # Test Attachment Protections when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.5.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: protect against attachments with scripts from untrusted senders"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: protect against attachments with scripts from untrusted senders"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_AttachmentProetectionAttachmentsScriptsUntrustedSenders_Correct_V3 if {
+ # Test Attachment Protections when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.5.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: protect against attachments with scripts from untrusted senders"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: protect against attachments with scripts from untrusted senders"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_AttachmentProetectionAttachmentsScriptsUntrustedSenders_Correct_V4 if {
+ # Test Attachment Protections when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.5.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: protect against attachments with scripts from untrusted senders"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: protect against attachments with scripts from untrusted senders"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_AttachmentProtectionAttachmentsScriptsUntrustedSenders_Incorrect_V1 if {
+ # Test Attachment Protections when there are no relevant events
+ PolicyId := "GWS.GMAIL.5.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_AttachmentProtectionAttachmentsScriptsUntrustedSenders_Incorrect_V2 if {
+ # Test Attachment Protections when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.5.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: protect against attachments with scripts from untrusted senders"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_AttachmentProtectionAttachmentsScriptsUntrustedSenders_Incorrect_V3 if {
+ # Test Attachment Protections when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.5.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: protect against attachments with scripts from untrusted senders"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: protect against attachments with scripts from untrusted senders"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_AttachmentProtectionAttachmentsScriptsUntrustedSenders_Incorrect_V4 if {
+ # Test Attachment Protections when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.5.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: protect against attachments with scripts from untrusted senders"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+test_AttachmentProtectionAttachmentsScriptsUntrustedSenders_Incorrect_V5 if {
+ # Test Attachment Protections when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.5.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: protect against attachments with scripts from untrusted senders"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: protect against attachments with scripts from untrusted senders"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+
+#
+# GWS.GMAIL.5.3v0.1
+#--
+
+test_AttachmentProtectionAnomalousAttachment_Correct_V1 if {
+ # Test Attachment Protections when there's only one event
+ PolicyId := "GWS.GMAIL.5.3v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: Protect against anomalous attachment types in emails"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_AttachmentProtectionAnomalousAttachment_Correct_V2 if {
+ # Test Attachment Protections when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.5.3v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: Protect against anomalous attachment types in emails"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: Protect against anomalous attachment types in emails"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_AttachmentProtectionAnomalousAttachment_Correct_V3 if {
+ # Test Attachment Protections when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.5.3v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: Protect against anomalous attachment types in emails"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: Protect against anomalous attachment types in emails"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_AttachmentProtectionAnomalousAttachment_Correct_V4 if {
+ # Test Attachment Protections when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.5.3v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: Protect against anomalous attachment types in emails"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: Protect against anomalous attachment types in emails"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_AttachmentProtectionAnomalousAttachment_Incorrect_V1 if {
+ # Test Attachment Protections when there are no relevant events
+ PolicyId := "GWS.GMAIL.5.3v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_AttachmentProtectionAnomalousAttachment_Incorrect_V2 if {
+ # Test Attachment Protections when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.5.3v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: Protect against anomalous attachment types in emails"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_AttachmentProtectionAnomalousAttachment_Incorrect_V3 if {
+ # Test Attachment Protections when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.5.3v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: Protect against anomalous attachment types in emails"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: Protect against anomalous attachment types in emails"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_AttachmentProtectionAnomalousAttachment_Incorrect_V4 if {
+ # Test Attachment Protections when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.5.3v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: Protect against anomalous attachment types in emails"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+test_AttachmentProtectionAnomalousAttachment_Incorrect_V5 if {
+ # Test Attachment Protections when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.5.3v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: Protect against anomalous attachment types in emails"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: Protect against anomalous attachment types in emails"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+
+#
+# GWS.GMAIL.5.4v0.1
+#--
+test_AttachmentProtectionFutureRecommendedSettings_Correct_V1 if {
+ # Test Attachment Protections when there's only one event
+ PolicyId := "GWS.GMAIL.5.4v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_AttachmentProtectionFutureRecommendedSettings_Correct_V2 if {
+ # Test Attachment Protections when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.5.4v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_AttachmentProtectionFutureRecommendedSettings_Correct_V3 if {
+ # Test Attachment Protections when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.5.4v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_AttachmentProtectionFutureRecommendedSettings_Correct_V4 if {
+ # Test Attachment Protections when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.5.4v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: automatically enables all future added settings"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_AttachmentProtectionFutureRecommendedSettings_Incorrect_V1 if {
+ # Test Attachment Protections when there are no relevant events
+ PolicyId := "GWS.GMAIL.5.4v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_AttachmentProtectionFutureRecommendedSettings_Incorrect_V2 if {
+ # Test Attachment Protections when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.5.4v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_AttachmentProtectionFutureRecommendedSettings_Incorrect_V3 if {
+ # Test Attachment Protections when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.5.4v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_AttachmentProtectionFutureRecommendedSettings_Incorrect_V4 if {
+ # Test Attachment Protections when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.5.4v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+test_AttachmentProtectionFutureRecommendedSettings_Incorrect_V5 if {
+ # Test Attachment Protections when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.5.4v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+#
+# GWS.GMAIL.5.5v0.1
+#--
+test_AttachmentSafety_Correct_V1 if {
+ # Test Spoofing and Authentication Protections when there's only one event
+ PolicyId := "GWS.GMAIL.5.5v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:24.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Encrypted attachment protection setting action"},
+ {"name": "NEW_VALUE", "value": "Quarantine"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:25.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Attachment with scripts protection action"},
+ {"name": "NEW_VALUE", "value": "Move to spam"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:26.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Anomalous attachment protection setting action"},
+ {"name": "NEW_VALUE", "value": "Move to spam"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_AttachmentSafety_InCorrect_V1 if {
+ # Test Spoofing and Authentication Protections when there's only one event
+ PolicyId := "GWS.GMAIL.5.5v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:24.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Encrypted attachment protection setting action"},
+ {"name": "NEW_VALUE", "value": "Quarantine"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:25.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Attachment with scripts protection action"},
+ {"name": "NEW_VALUE", "value": "Show warning"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:26.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Anomalous attachment protection setting action"},
+ {"name": "NEW_VALUE", "value": "Move to spam"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_AttachmentSafety_InCorrect_V2 if {
+ # Test Spoofing and Authentication Protections when there's only one event
+ PolicyId := "GWS.GMAIL.5.5v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:24.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Encrypted attachment protection setting action"},
+ {"name": "NEW_VALUE", "value": "Show warning"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:25.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Attachment with scripts protection action"},
+ {"name": "NEW_VALUE", "value": "Move to spam"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:26.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Attachment safety Anomalous attachment protection setting action"},
+ {"name": "NEW_VALUE", "value": "Move to spam"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
diff --git a/Testing/RegoTests/gmail/gmail06_test.rego b/Testing/RegoTests/gmail/gmail06_test.rego
new file mode 100644
index 00000000..1cc6feb9
--- /dev/null
+++ b/Testing/RegoTests/gmail/gmail06_test.rego
@@ -0,0 +1,1125 @@
+package gmail
+import future.keywords
+
+
+#
+# GWS.GMAIL.6.1v0.1
+#--
+test_LinksExternalImagesProtectionIdentifyLinksURL_Correct_V1 if {
+ # Test Links and External Images Protections when there's only one event
+ PolicyId := "GWS.GMAIL.6.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: identify links behind shortened URLs"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_LinksExternalImagesProtectionIdentifyLinksURL_Correct_V2 if {
+ # Test Links and External Images Protections when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.6.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: identify links behind shortened URLs"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: identify links behind shortened URLs"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_LinksExternalImagesProtectionIdentifyLinksURL_Correct_V3 if {
+ # Test Links and External Images Protections when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.6.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:03:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: identify links behind shortened URLs"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:04:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: identify links behind shortened URLs"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_LinksExternalImagesProtectionIdentifyLinksURL_Correct_V4 if {
+ # Test Links and External Images Protections when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.6.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: identify links behind shortened URLs"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: identify links behind shortened URLs"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_LinksExternalImagesProtectionIdentifyLinksURL_Incorrect_V1 if {
+ # Test Links and External Images Protections when there are no relevant events
+ PolicyId := "GWS.GMAIL.6.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_LinksExternalImagesProtectionIdentifyLinksURL_Incorrect_V2 if {
+ # Test Links and External Images Protections when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.6.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: identify links behind shortened URLs"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_LinksExternalImagesProtectionIdentifyLinksURL_Incorrect_V3 if {
+ # Test Links and External Images Protections when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.6.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: identify links behind shortened URLs"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: identify links behind shortened URLs"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_LinksExternalImagesProtectionIdentifyLinksURL_Incorrect_V4 if {
+ # Test Links and External Images Protections when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.6.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: identify links behind shortened URLs"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+test_LinksExternalImagesProtectionIdentifyLinksURL_Incorrect_V5 if {
+ # Test Links and External Images Protections when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.6.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: identify links behind shortened URLs"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: identify links behind shortened URLs"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+#--
+
+#
+# GWS.GMAIL.6.2v0.1
+#--
+
+test_LinksExternalImagesProtectionScanLinkedImages_Correct_V1 if {
+ # Test Links and External Images Protections when there's only one event and it's correct
+ PolicyId := "GWS.GMAIL.6.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: scan linked images"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_LinksExternalImagesProtectionScanLinkedImages_Correct_V2 if {
+ # Test Links and External Images Protections when there are multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.6.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: scan linked images"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: scan linked images"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_LinksExternalImagesProtectionScanLinkedImages_Correct_V3 if {
+ # Test Links and External Images Protections when there are multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.6.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: scan linked images"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: scan linked images"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_LinksExternalImagesProtectionScanLinkedImages_Correct_V4 if {
+ # Test Links and External Images Protections when there are multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.6.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: scan linked images"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: scan linked images"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_LinksExternalImagesProtectionScanLinkedImages_Incorrect_V1 if {
+ # Test Links and External Images Protections when there are no relevant events
+ PolicyId := "GWS.GMAIL.6.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_LinksExternalImagesProtectionScanLinkedImages_Incorrect_V2 if {
+ # Test Links and External Images Protections when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.6.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: scan linked images"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_LinksExternalImagesProtectionScanLinkedImages_Incorrect_V3 if {
+ # Test Links and External Images Protections when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.6.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: scan linked images"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: scan linked images"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+#
+# GWS.GMAIL.6.3v0.1
+#--
+
+test_LinksExternalImagesProtectionWarningLinksUntrustedDomains_Correct_V1 if {
+ # Test Links and External Images Protections when there's only one event
+ PolicyId := "GWS.GMAIL.6.3v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: show warning prompt for click on links to unstrusted domains"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_LinksExternalImagesProtectionWarningLinksUntrustedDomains_Correct_V2 if {
+ # Test Links and External Images Protections when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.6.3v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: show warning prompt for click on links to unstrusted domains"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: show warning prompt for click on links to unstrusted domains"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_LinksExternalImagesProtectionWarningLinksUntrustedDomains_Correct_V2 if {
+ # Test Links and External Images Protections when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.6.3v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: show warning prompt for click on links to unstrusted domains"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: show warning prompt for click on links to unstrusted domains"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+
+test_LinksExternalImagesProtectionWarningLinksUntrustedDomains_Correct_V3 if {
+ # Test Links and External Images Protections when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.6.3v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: show warning prompt for click on links to unstrusted domains"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: show warning prompt for click on links to unstrusted domains"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_LinksExternalImagesProtectionWarningLinksUntrustedDomains_Incorrect_V1 if {
+ # Test Links and External Images Protections when there are no relevant events
+ PolicyId := "GWS.GMAIL.6.3v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_LinksExternalImagesProtectionWarningLinksUntrustedDomains_Incorrect_V2 if {
+ # Test Links and External Images Protections when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.6.3v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: show warning prompt for click on links to unstrusted domains"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_LinksExternalImagesProtectionWarningLinksUntrustedDomains_Incorrect_V3 if {
+ # Test Links and External Images Protections when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.6.3v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: show warning prompt for click on links to unstrusted domains"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: show warning prompt for click on links to unstrusted domains"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_LinksExternalImagesProtectionWarningLinksUntrustedDomains_Incorrect_V4 if {
+ # Test Links and External Images Protections when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.6.3v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: show warning prompt for click on links to unstrusted domains"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+test_LinksExternalImagesProtectionWarningLinksUntrustedDomains_Incorrect_V5 if {
+ # Test Links and External Images Protections when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.6.3v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: show warning prompt for click on links to unstrusted domains"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: show warning prompt for click on links to unstrusted domains"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+#
+# GWS.GMAIL.6.4v0.1
+#--
+
+test_LinksExternalImagesProtectionFutureRecommendedSettings_Correct_V1 if {
+ # Test Links and External Images Protections when there's only one event
+ PolicyId := "GWS.GMAIL.6.4v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_LinksExternalImagesProtectionFutureRecommendedSettings_Correct_V2 if {
+ # Test Links and External Images Protections when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.6.4v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_LinksExternalImagesProtectionFutureRecommendedSettings_Correct_V3 if {
+ # Test Links and External Images Protections when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.6.4v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_LinksExternalImagesProtectionFutureRecommendedSettings_Correct_V4 if {
+ # Test Links and External Images Protections when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.6.4v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: automatically enables all future added settings"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_LinksExternalImagesProtectionFutureRecommendedSettings_Incorrect_V1 if {
+ # Test Links and External Images Protections when there are no relevant events
+ PolicyId := "GWS.GMAIL.6.4v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_LinksExternalImagesProtectionFutureRecommendedSettings_Incorrect_V2 if {
+ # Test Links and External Images Protections when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.6.4v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_LinksExternalImagesProtectionFutureRecommendedSettings_Incorrect_V3 if {
+ # Test Links and External Images Protections when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.6.4v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+test_LinksExternalImagesProtectionFutureRecommendedSettings_Incorrect_V4 if {
+ # Test Links and External Images Protections when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.6.4v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Links and external images safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
\ No newline at end of file
diff --git a/Testing/RegoTests/gmail/gmail07_test.rego b/Testing/RegoTests/gmail/gmail07_test.rego
new file mode 100644
index 00000000..e1dbed85
--- /dev/null
+++ b/Testing/RegoTests/gmail/gmail07_test.rego
@@ -0,0 +1,2049 @@
+package gmail
+import future.keywords
+
+
+#
+# GWS.GMAIL.7.1v0.1
+#--
+test_SpoofingAuthenticationProtectionSimilarDomainNameSpoofing_Correct_V1 if {
+ # Test Spoofing and Authentication Protections when there's only one event
+ PolicyId := "GWS.GMAIL.7.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against domain spoofing using similar domain names"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SpoofingAuthenticationProtectionSimilarDomainNameSpoofing_Correct_V2 if {
+ # Test Spoofing and Authentication Protections when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.7.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against domain spoofing using similar domain names"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against domain spoofing using similar domain names"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SpoofingAuthenticationProtectionSimilarDomainNameSpoofing_Correct_V3 if {
+ # Test Spoofing and Authentication Protections when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.7.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against domain spoofing using similar domain names"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against domain spoofing using similar domain names"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SpoofingAuthenticationProtectionSimilarDomainNameSpoofing_Correct_V4 if {
+ # Test Spoofing and Authentication Protections when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.7.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against domain spoofing using similar domain names"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against domain spoofing using similar domain names"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SpoofingAuthenticationProtectionSimilarDomainNameSpoofing_Incorrect_V1 if {
+ # Test Spoofing and Authentication Protections when there are no relevant events
+ PolicyId := "GWS.GMAIL.7.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_SpoofingAuthenticationProtectionSimilarDomainNameSpoofing_Incorrect_V2 if {
+ # Test Spoofing and Authentication Protections when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.7.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against domain spoofing using similar domain names"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SpoofingAuthenticationProtectionSimilarDomainNameSpoofing_Incorrect_V3 if {
+ # Test Spoofing and Authentication Protections when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.7.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against domain spoofing using similar domain names"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against domain spoofing using similar domain names"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SpoofingAuthenticationProtectionSimilarDomainNameSpoofing_Incorrect_V4 if {
+ # Test Spoofing and Authentication Protections when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.7.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against domain spoofing using similar domain names"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+test_SpoofingAuthenticationProtectionSimilarDomainNameSpoofing_Incorrect_V5 if {
+ # Test Spoofing and Authentication Protections when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.7.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against domain spoofing using similar domain names"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against domain spoofing using similar domain names"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+#--
+
+
+#
+# GWS.GMAIL.7.2v0.1
+#--
+
+test_SpoofingAuthenticationProtectionEmployeeNameSpoofing_Correct_V1 if {
+ # Test Spoofing and Authentication Protections when there's only one event
+ PolicyId := "GWS.GMAIL.7.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against spoofing of employee names"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SpoofingAuthenticationProtectionEmployeeNameSpoofing_Correct_V2 if {
+ # Test Spoofing and Authentication Protections when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.7.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against spoofing of employee names"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against spoofing of employee names"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SpoofingAuthenticationProtectionEmployeeNameSpoofing_Correct_V3 if {
+ # Test Spoofing and Authentication Protections when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.7.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against spoofing of employee names"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against spoofing of employee names"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SpoofingAuthenticationProtectionEmployeeNameSpoofing_Correct_V4 if {
+ # Test Spoofing and Authentication Protections when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.7.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against spoofing of employee names"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against spoofing of employee names"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SpoofingAuthenticationProtectionEmployeeNameSpoofing_Incorrect_V1 if {
+ # Test Spoofing and Authentication Protections when there are no relevant events
+ PolicyId := "GWS.GMAIL.7.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_SpoofingAuthenticationProtectionEmployeeNameSpoofing_Incorrect_V2 if {
+ # Test Spoofing and Authentication Protections when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.7.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against spoofing of employee names"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SpoofingAuthenticationProtectionEmployeeNameSpoofing_Incorrect_V3 if {
+ # Test Spoofing and Authentication Protections when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.7.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against spoofing of employee names"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against spoofing of employee names"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SpoofingAuthenticationProtectionEmployeeNameSpoofing_Incorrect_V4 if {
+ # Test Spoofing and Authentication Protections when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.7.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against spoofing of employee names"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+test_SpoofingAuthenticationProtectionEmployeeNameSpoofing_Incorrect_V5 if {
+ # Test Spoofing and Authentication Protections when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.7.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against spoofing of employee names"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against spoofing of employee names"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+
+#
+# GWS.GMAIL.7.3v0.1
+#--
+test_SpoofingAuthenticationProtectionInboundEmailDomainSpoofing_Correct_V1 if {
+ # Test Spoofing and Authentication Protections when there's only one event
+ PolicyId := "GWS.GMAIL.7.3v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against inbound emails spoofing your domain"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SpoofingAuthenticationProtectionInboundEmailDomainSpoofing_Correct_V2 if {
+ # Test Spoofing and Authentication Protections when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.7.3v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against inbound emails spoofing your domain"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against inbound emails spoofing your domain"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SpoofingAuthenticationProtectionInboundEmailDomainSpoofing_Correct_V3 if {
+ # Test Spoofing and Authentication Protections when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.7.3v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against inbound emails spoofing your domain"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against inbound emails spoofing your domain"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SpoofingAuthenticationProtectionInboundEmailDomainSpoofing_Correct_V4 if {
+ # Test Spoofing and Authentication Protections when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.7.3v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against inbound emails spoofing your domain"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against inbound emails spoofing your domain"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SpoofingAuthenticationProtectionInboundEmailDomainSpoofing_Incorrect_V1 if {
+ # Test Spoofing and Authentication Protections when there are no relevant events
+ PolicyId := "GWS.GMAIL.7.3v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_SpoofingAuthenticationProtectionInboundEmailDomainSpoofing_Incorrect_V2 if {
+ # Test Spoofing and Authentication Protections when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.7.3v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against inbound emails spoofing your domain"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SpoofingAuthenticationProtectionInboundEmailDomainSpoofing_Incorrect_V3 if {
+ # Test Spoofing and Authentication Protections when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.7.3v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against inbound emails spoofing your domain"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against inbound emails spoofing your domain"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SpoofingAuthenticationProtectionInboundEmailDomainSpoofing_Incorrect_V4 if {
+ # Test Spoofing and Authentication Protections when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.7.3v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against inbound emails spoofing your domain"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+test_SpoofingAuthenticationProtectionInboundEmailDomainSpoofing_Incorrect_V5 if {
+ # Test Spoofing and Authentication Protections when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.7.3v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against inbound emails spoofing your domain"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against inbound emails spoofing your domain"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+
+#
+# GWS.GMAIL.7.4v0.1
+#--
+
+test_SpoofingAuthenticationProtectionUnauthenticatedEmail_Correct_V1 if {
+ # Test Spoofing and Authentication Protections when there's only one event
+ PolicyId := "GWS.GMAIL.7.4v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against any unauthenticated emails"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SpoofingAuthenticationProtectionUnauthenticatedEmail_Correct_V2 if {
+ # Test Spoofing and Authentication Protections when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.7.4v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against any unauthenticated emails"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against any unauthenticated emails"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SpoofingAuthenticationProtectionUnauthenticatedEmail_Correct_V3 if {
+ # Test Spoofing and Authentication Protections when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.7.4v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against any unauthenticated emails"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against any unauthenticated emails"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SpoofingAuthenticationProtectionUnauthenticatedEmail_Correct_V3 if {
+ # Test Spoofing and Authentication Protections when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.7.4v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against any unauthenticated emails"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against any unauthenticated emails"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+
+test_SpoofingAuthenticationProtectionUnauthenticatedEmail_Incorrect_V1 if {
+ # Test Spoofing and Authentication Protections when there are no relevant events
+ PolicyId := "GWS.GMAIL.7.4v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_SpoofingAuthenticationProtectionUnauthenticatedEmail_Incorrect_V2 if {
+ # Test Spoofing and Authentication Protections when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.7.4v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against any unauthenticated emails"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SpoofingAuthenticationProtectionUnauthenticatedEmail_Incorrect_V3 if {
+ # Test Spoofing and Authentication Protections when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.7.4v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against any unauthenticated emails"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against any unauthenticated emails"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SpoofingAuthenticationProtectionUnauthenticatedEmail_Incorrect_V4 if {
+ # Test Spoofing and Authentication Protections when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.7.4v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against any unauthenticated emails"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+test_SpoofingAuthenticationProtectionUnauthenticatedEmail_Incorrect_V5 if {
+ # Test Spoofing and Authentication Protections when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.7.4v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against any unauthenticated emails"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect against any unauthenticated emails"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+
+#
+# GWS.GMAIL.7.5v0.1
+#--
+test_SpoofingAuthenticationProtectionInboundEmailDomainSpoofingGroups_Correct_V1 if {
+ # Test Spoofing and Authentication Protections when there's only one event
+ PolicyId := "GWS.GMAIL.7.5v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect your Groups from inbound emails spoofing your domain"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SpoofingAuthenticationProtectionInboundEmailDomainSpoofingGroups_Correct_V2 if {
+ # Test Spoofing and Authentication Protections when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.7.5v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect your Groups from inbound emails spoofing your domain"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect your Groups from inbound emails spoofing your domain"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SpoofingAuthenticationProtectionInboundEmailDomainSpoofingGroups_Correct_V3 if {
+ # Test Spoofing and Authentication Protections when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.7.5v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect your Groups from inbound emails spoofing your domain"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect your Groups from inbound emails spoofing your domain"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SpoofingAuthenticationProtectionInboundEmailDomainSpoofingGroups_Correct_V4 if {
+ # Test Spoofing and Authentication Protections when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.7.5v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect your Groups from inbound emails spoofing your domain"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect your Groups from inbound emails spoofing your domain"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SpoofingAuthenticationProtectionInboundEmailDomainSpoofingGroups_Incorrect_V1 if {
+ # Test Spoofing and Authentication Protections when there are no relevant events
+ PolicyId := "GWS.GMAIL.7.5v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_SpoofingAuthenticationProtectionInboundEmailDomainSpoofingGroups_Incorrect_V2 if {
+ # Test Spoofing and Authentication Protections when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.7.5v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect your Groups from inbound emails spoofing your domain"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SpoofingAuthenticationProtectionInboundEmailDomainSpoofingGroups_Incorrect_V3 if {
+ # Test Spoofing and Authentication Protections when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.7.5v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect your Groups from inbound emails spoofing your domain"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect your Groups from inbound emails spoofing your domain"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SpoofingAuthenticationProtectionInboundEmailDomainSpoofingGroups_Incorrect_V4 if {
+ # Test Spoofing and Authentication Protections when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.7.5v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect your Groups from inbound emails spoofing your domain"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+test_SpoofingAuthenticationProtectionInboundEmailDomainSpoofingGroups_Incorrect_V5 if {
+ # Test Spoofing and Authentication Protections when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.7.5v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect your Groups from inbound emails spoofing your domain"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: protect your Groups from inbound emails spoofing your domain"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+#
+# GWS.GMAIL.7.6v0.1
+#--
+test_SpoofingAuthenticationProtection_Correct_V1 if {
+ # Test Spoofing and Authentication Protections when there's only one event
+ PolicyId := "GWS.GMAIL.7.6v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:24.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Protect against domain spoofing based on similar domain names action"},
+ {"name": "NEW_VALUE", "value": "Quarantine"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:25.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Protect against spoofing of employee names action"},
+ {"name": "NEW_VALUE", "value": "Move to spam"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:26.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Protect against inbound emails spoofing your domain action"},
+ {"name": "NEW_VALUE", "value": "Move to spam"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:27.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Protect against any unauthenticated emails action"},
+ {"name": "NEW_VALUE", "value": "Move to spam"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Protect your Groups from inbound emails spoofing your domain action"},
+ {"name": "NEW_VALUE", "value": "Move to spam"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SpoofingAuthenticationProtection_InCorrect_V1 if {
+ # Test Spoofing and Authentication Protections when there's only one event
+ PolicyId := "GWS.GMAIL.7.6v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:24.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Protect against domain spoofing based on similar domain names action"},
+ {"name": "NEW_VALUE", "value": "Show warning"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:25.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Protect against spoofing of employee names action"},
+ {"name": "NEW_VALUE", "value": "Move to spam"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:26.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Protect against inbound emails spoofing your domain action"},
+ {"name": "NEW_VALUE", "value": "Move to spam"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:27.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Protect against any unauthenticated emails action"},
+ {"name": "NEW_VALUE", "value": "Move to spam"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Protect your Groups from inbound emails spoofing your domain action"},
+ {"name": "NEW_VALUE", "value": "Show warning"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SpoofingAuthenticationProtection_InCorrect_V2 if {
+ # Test Spoofing and Authentication Protections when there's only one event
+ PolicyId := "GWS.GMAIL.7.6v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:24.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Protect against domain spoofing based on similar domain names action"},
+ {"name": "NEW_VALUE", "value": "Show warning"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:25.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Protect against spoofing of employee names action"},
+ {"name": "NEW_VALUE", "value": "Move to spam"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:26.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Protect against inbound emails spoofing your domain action"},
+ {"name": "NEW_VALUE", "value": "Move to spam"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:27.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Protect against any unauthenticated emails action"},
+ {"name": "NEW_VALUE", "value": "Move to spam"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Protect your Groups from inbound emails spoofing your domain action"},
+ {"name": "NEW_VALUE", "value": "Show warning"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+
+#
+# GWS.GMAIL.7.7v0.1
+#--
+test_SpoofingAuthenticationProtectionFutureRecommendedSettings_Correct_V1 if {
+ # Test Spoofing and Authentication Protections when there's only one event
+ PolicyId := "GWS.GMAIL.7.7v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SpoofingAuthenticationProtectionFutureRecommendedSettings_Correct_V2 if {
+ # Test Spoofing and Authentication Protections when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.7.7v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SpoofingAuthenticationProtectionFutureRecommendedSettings_Correct_V3 if {
+ # Test Spoofing and Authentication Protections when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.7.7v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SpoofingAuthenticationProtectionFutureRecommendedSettings_Correct_V4 if {
+ # Test Spoofing and Authentication Protections when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.7.7v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: automatically enables all future added settings"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SpoofingAuthenticationProtectionFutureRecommendedSettings_Incorrect_V1 if {
+ # Test Spoofing and Authentication Protections when there are no relevant events
+ PolicyId := "GWS.GMAIL.7.7v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_SpoofingAuthenticationProtectionFutureRecommendedSettings_Incorrect_V2 if {
+ # Test Spoofing and Authentication Protections when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.7.7v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SpoofingAuthenticationProtectionFutureRecommendedSettings_Incorrect_V3 if {
+ # Test Spoofing and Authentication Protections when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.7.7v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SpoofingAuthenticationProtectionFutureRecommendedSettings_Incorrect_V4 if {
+ # Test Spoofing and Authentication Protections when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.7.7v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+test_SpoofingAuthenticationProtectionFutureRecommendedSettings_Incorrect_V5 if {
+ # Test Spoofing and Authentication Protections when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.7.7v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Spoofing and authentication safety Enable: automatically enables all future added settings"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
diff --git a/Testing/RegoTests/gmail/gmail08_test.rego b/Testing/RegoTests/gmail/gmail08_test.rego
new file mode 100644
index 00000000..b78b7eeb
--- /dev/null
+++ b/Testing/RegoTests/gmail/gmail08_test.rego
@@ -0,0 +1,271 @@
+package gmail
+import future.keywords
+
+
+#
+# GWS.GMAIL.8.1v0.1
+#--
+test_UserEmailUploads_Correct_V1 if {
+ # Test User Email Uploads when there's only one event
+ PolicyId := "GWS.GMAIL.8.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EMAIL_USER_IMPORT"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_UserEmailUploads_Correct_V2 if {
+ # Test User Email Uploads when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.8.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EMAIL_USER_IMPORT"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EMAIL_USER_IMPORT"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_UserEmailUploads_Correct_V3 if {
+ # Test User Email Uploads when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.8.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EMAIL_USER_IMPORT"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EMAIL_USER_IMPORT"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_UserEmailUploads_Incorrect_V1 if {
+ # Test User Email Uploads when there are no relevant events
+ PolicyId := "GWS.GMAIL.8.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_UserEmailUploads_Incorrect_V2 if {
+ # Test User Email Uploads when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.8.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EMAIL_USER_IMPORT"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_UserEmailUploads_Incorrect_V3 if {
+ # Test Spoofing and Authentication Protections when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.8.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EMAIL_USER_IMPORT"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EMAIL_USER_IMPORT"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_UserEmailUploads_Incorrect_V4 if {
+ # Test User Email Uploads when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.8.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EMAIL_USER_IMPORT"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+test_UserEmailUploads_Incorrect_V5 if {
+ # Test Spoofing and Authentication Protections when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.8.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EMAIL_USER_IMPORT"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EMAIL_USER_IMPORT"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/gmail/gmail09_test.rego b/Testing/RegoTests/gmail/gmail09_test.rego
new file mode 100644
index 00000000..bf724c11
--- /dev/null
+++ b/Testing/RegoTests/gmail/gmail09_test.rego
@@ -0,0 +1,614 @@
+package gmail
+import future.keywords
+
+
+#
+# GWS.GMAIL.9.1v0.1
+#--
+
+test_ImapAccess_Correct_V1 if {
+ # Test IMAP Access when there's only one event
+ PolicyId := "GWS.GMAIL.9.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "IMAP_ACCESS"},
+ {"name": "NEW_VALUE", "value": "DISABLED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_ImapAccess_Correct_V2 if {
+ # Test IMAP Access when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.9.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "IMAP_ACCESS"},
+ {"name": "NEW_VALUE", "value": "DISABLED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "IMAP_ACCESS"},
+ {"name": "NEW_VALUE", "value": "ENABLED_FOR_ALL_MAIL_CLIENTS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_ImapAccess_Correct_V3 if {
+ # Test IMAP Access when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.9.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "IMAP_ACCESS"},
+ {"name": "NEW_VALUE", "value": "DISABLED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "IMAP_ACCESS"},
+ {"name": "NEW_VALUE", "value": "DISABLED"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_ImapAccess_Correct_V4 if {
+ # Test IMAP Access when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.9.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "IMAP_ACCESS"},
+ {"name": "NEW_VALUE", "value": "DISABLED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "IMAP_ACCESS"},
+ {"name": "NEW_VALUE", "value": "INHERIT_FROM_PARENT"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_ImapAccess_Incorrect_V1 if {
+ # Test IMAP Access when there are no relevant events
+ PolicyId := "GWS.GMAIL.9.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "DISABLED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_ImapAccess_Incorrect_V2 if {
+ # Test IMAP Access when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.9.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "IMAP_ACCESS"},
+ {"name": "NEW_VALUE", "value": "ENABLED_FOR_ALL_MAIL_CLIENTS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_ImapAccess_Incorrect_V3 if {
+ # Test IMAP Access when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.9.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "IMAP_ACCESS"},
+ {"name": "NEW_VALUE", "value": "ENABLED_FOR_ALL_MAIL_CLIENTS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "IMAP_ACCESS"},
+ {"name": "NEW_VALUE", "value": "DISABLED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+test_ImapAccess_Incorrect_V4 if {
+ # Test IMAP Access when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.9.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "IMAP_ACCESS"},
+ {"name": "NEW_VALUE", "value": "ENABLED_FOR_ALL_MAIL_CLIENTS"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+test_ImapAccess_Incorrect_V5 if {
+ # Test IMAP Access when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.9.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "IMAP_ACCESS"},
+ {"name": "NEW_VALUE", "value": "ENABLED_FOR_ALL_MAIL_CLIENTS"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "IMAP_ACCESS"},
+ {"name": "NEW_VALUE", "value": "DISABLED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+#--
+
+#
+# GWS.GMAIL.9.2v0.1
+#--
+test_PopAccess_Correct_V1 if {
+ # Test POP Access when there's only one event
+ PolicyId := "GWS.GMAIL.9.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_POP_ACCESS"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_PopAccess_Correct_V2 if {
+ # Test POP Access when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.9.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_POP_ACCESS"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_POP_ACCESS"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_PopAccess_Correct_V3 if {
+ # Test POP Access when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.9.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_POP_ACCESS"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_POP_ACCESS"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_PopAccess_Correct_V3 if {
+ # Test POP Access when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.9.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_POP_ACCESS"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_POP_ACCESS"},
+ {"name": "NEW_VALUE", "value": "INHERIT_FROM_PARENT"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_PopAccess_Incorrect_V1 if {
+ # Test POP Access when there are no relevant events
+ PolicyId := "GWS.GMAIL.9.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_PopAccess_Incorrect_V2 if {
+ # Test POP Access when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.9.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_POP_ACCESS"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_PopAccess_Incorrect_V3 if {
+ # Test POP Access when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.9.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_POP_ACCESS"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_POP_ACCESS"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_PopAccess_Incorrect_V4 if {
+ # Test POP Access when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.9.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_POP_ACCESS"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+test_PopAccess_Incorrect_V5 if {
+ # Test POP Access when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.9.2v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_POP_ACCESS"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_POP_ACCESS"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
\ No newline at end of file
diff --git a/Testing/RegoTests/gmail/gmail10_test.rego b/Testing/RegoTests/gmail/gmail10_test.rego
new file mode 100644
index 00000000..886963f4
--- /dev/null
+++ b/Testing/RegoTests/gmail/gmail10_test.rego
@@ -0,0 +1,310 @@
+package gmail
+import future.keywords
+
+
+#
+# GWS.GMAIL.10.1v0.1
+#--
+test_GoogleWorkspaceSync_Correct_V1 if {
+ # Test Google Workspace Sync for Microsoft Outlook when there's only one event
+ PolicyId := "GWS.GMAIL.10.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_OUTLOOK_SYNC"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_GoogleWorkspaceSync_Correct_V2 if {
+ # Test Google Workspace Sync for Microsoft Outlook when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.10.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_OUTLOOK_SYNC"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_OUTLOOK_SYNC"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_GoogleWorkspaceSync_Correct_V3 if {
+ # Test Google Workspace Sync for Microsoft Outlook when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.10.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_OUTLOOK_SYNC"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_OUTLOOK_SYNC"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_GoogleWorkspaceSync_Correct_V4 if {
+ # Test Google Workspace Sync for Microsoft Outlook when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.10.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_OUTLOOK_SYNC"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_OUTLOOK_SYNC"},
+ {"name": "NEW_VALUE", "value": "INHERIT_FROM_PARENT"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_GoogleWorkspaceSync_Incorrect_V1 if {
+ # Test Google Workspace Sync for Microsoft Outlook when there are no relevant events
+ PolicyId := "GWS.GMAIL.10.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_GoogleWorkspaceSync_Incorrect_V2 if {
+ # Test Google Workspace Sync for Microsoft Outlook when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.10.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_OUTLOOK_SYNC"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_GoogleWorkspaceSync_Incorrect_V3 if {
+ # Test Google Workspace Sync for Microsoft Outlook when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.10.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_OUTLOOK_SYNC"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_OUTLOOK_SYNC"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_GoogleWorkspaceSync_Incorrect_V4 if {
+ # Test Google Workspace Sync for Microsoft Outlook when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.10.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_OUTLOOK_SYNC"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+test_GoogleWorkspaceSync_Incorrect_V5 if {
+ # Test Google Workspace Sync for Microsoft Outlook when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.10.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_OUTLOOK_SYNC"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_OUTLOOK_SYNC"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/gmail/gmail11_test.rego b/Testing/RegoTests/gmail/gmail11_test.rego
new file mode 100644
index 00000000..775086bf
--- /dev/null
+++ b/Testing/RegoTests/gmail/gmail11_test.rego
@@ -0,0 +1,310 @@
+package gmail
+import future.keywords
+
+
+#
+# GWS.GMAIL.11.1v0.1
+#--
+test_AutomaticForwarding_Correct_V1 if {
+ # Test Automatic Forwarding when there's only one event
+ PolicyId := "GWS.GMAIL.11.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EMAIL_AUTOFORWARDING"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_AutomaticForwarding_Correct_V2 if {
+ # Test Automatic Forwarding when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.11.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EMAIL_AUTOFORWARDING"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EMAIL_AUTOFORWARDING"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_AutomaticForwarding_Correct_V3 if {
+ # Test Automatic Forwarding when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.11.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EMAIL_AUTOFORWARDING"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EMAIL_AUTOFORWARDING"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_AutomaticForwarding_Correct_V4 if {
+ # Test Automatic Forwarding when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.11.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EMAIL_AUTOFORWARDING"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EMAIL_AUTOFORWARDING"},
+ {"name": "NEW_VALUE", "value": "INHERIT_FROM_PARENT"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_AutomaticForwarding_Incorrect_V1 if {
+ # Test Automatic Forwarding when there are no relevant events
+ PolicyId := "GWS.GMAIL.11.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_AutomaticForwarding_Incorrect_V2 if {
+ # Test Automatic Forwarding when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.11.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EMAIL_AUTOFORWARDING"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_AutomaticForwarding_Incorrect_V3 if {
+ # Test Automatic Forwarding when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.11.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EMAIL_AUTOFORWARDING"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EMAIL_AUTOFORWARDING"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_AutomaticForwarding_Incorrect_V4 if {
+ # Test Automatic Forwarding when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.11.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EMAIL_AUTOFORWARDING"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+test_AutomaticForwarding_Incorrect_V5 if {
+ # Test Automatic Forwarding when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.11.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EMAIL_AUTOFORWARDING"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "ENABLE_EMAIL_AUTOFORWARDING"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/gmail/gmail12_test.rego b/Testing/RegoTests/gmail/gmail12_test.rego
new file mode 100644
index 00000000..321015d1
--- /dev/null
+++ b/Testing/RegoTests/gmail/gmail12_test.rego
@@ -0,0 +1,271 @@
+package gmail
+import future.keywords
+
+
+#
+# GWS.GMAIL.12.1v0.1
+#--
+test_ImageUrlProxyWhitelist_Correct_V1 if {
+ # Test Image URL Proxy Allowlist when there's only one event
+ PolicyId := "GWS.GMAIL.12.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "NUMBER_OF_EMAIL_IMAGE_URL_WHITELIST_PATTERNS"},
+ {"name": "NEW_VALUE", "value": "1"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_ImageUrlProxyWhitelist_Correct_V2 if {
+ # Test Image URL Proxy Allowlist when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.12.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "NUMBER_OF_EMAIL_IMAGE_URL_WHITELIST_PATTERNS"},
+ {"name": "NEW_VALUE", "value": "1"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "NUMBER_OF_EMAIL_IMAGE_URL_WHITELIST_PATTERNS"},
+ {"name": "NEW_VALUE", "value": "DEFAULT"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_ImageUrlProxyWhitelist_Correct_V3 if {
+ # Test Image URL Proxy Allowlist when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.12.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "NUMBER_OF_EMAIL_IMAGE_URL_WHITELIST_PATTERNS"},
+ {"name": "NEW_VALUE", "value": "1"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "NUMBER_OF_EMAIL_IMAGE_URL_WHITELIST_PATTERNS"},
+ {"name": "NEW_VALUE", "value": "1"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_ImageUrlProxyWhitelist_Incorrect_V1 if {
+ # Test Image URL Proxy Allowlist when there are no relevant events
+ PolicyId := "GWS.GMAIL.12.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "1"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_ImageUrlProxyWhitelist_Incorrect_V2 if {
+ # Test Image URL Proxy Allowlist when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.12.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "NUMBER_OF_EMAIL_IMAGE_URL_WHITELIST_PATTERNS"},
+ {"name": "NEW_VALUE", "value": "DEFAULT"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_ImageUrlProxyWhitelist_Incorrect_V3 if {
+ # Test Image URL Proxy Allowlist when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.12.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "NUMBER_OF_EMAIL_IMAGE_URL_WHITELIST_PATTERNS"},
+ {"name": "NEW_VALUE", "value": "DEFAULT"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "NUMBER_OF_EMAIL_IMAGE_URL_WHITELIST_PATTERNS"},
+ {"name": "NEW_VALUE", "value": "1"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_ImageUrlProxyWhitelist_Incorrect_V4 if {
+ # Test Image URL Proxy Allowlist when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.12.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "NUMBER_OF_EMAIL_IMAGE_URL_WHITELIST_PATTERNS"},
+ {"name": "NEW_VALUE", "value": "DEFAULT"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+test_ImageUrlProxyWhitelist_Incorrect_V5 if {
+ # Test Image URL Proxy Allowlist when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.12.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "NUMBER_OF_EMAIL_IMAGE_URL_WHITELIST_PATTERNS"},
+ {"name": "NEW_VALUE", "value": "DEFAULT"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "NUMBER_OF_EMAIL_IMAGE_URL_WHITELIST_PATTERNS"},
+ {"name": "NEW_VALUE", "value": "1"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/gmail/gmail13_test.rego b/Testing/RegoTests/gmail/gmail13_test.rego
new file mode 100644
index 00000000..a5c39d33
--- /dev/null
+++ b/Testing/RegoTests/gmail/gmail13_test.rego
@@ -0,0 +1,271 @@
+package gmail
+import future.keywords
+
+
+#
+# GWS.GMAIL.13.1v0.1
+#--
+test_PerUserOutboundGateway_Correct_V1 if {
+ # Test Per-User Outbound Gateway when there's only one event
+ PolicyId := "GWS.GMAIL.13.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "OUTBOUND_RELAY_ENABLED"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_PerUserOutboundGateway_Correct_V2 if {
+ # Test Per-User Outbound Gateway when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.13.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "OUTBOUND_RELAY_ENABLED"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "OUTBOUND_RELAY_ENABLED"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_PerUserOutboundGateway_Correct_V3 if {
+ # Test Per-User Outbound Gateway when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.13.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "OUTBOUND_RELAY_ENABLED"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "OUTBOUND_RELAY_ENABLED"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_PerUserOutboundGateway_Incorrect_V1 if {
+ # Test Per-User Outbound Gateway when there are no relevant events
+ PolicyId := "GWS.GMAIL.13.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_PerUserOutboundGateway_Incorrect_V2 if {
+ # Test Per-User Outbound Gateway when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.13.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "OUTBOUND_RELAY_ENABLED"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_PerUserOutboundGateway_Incorrect_V3 if {
+ # Test Per-User Outbound Gateway when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.13.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "OUTBOUND_RELAY_ENABLED"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "OUTBOUND_RELAY_ENABLED"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_PerUserOutboundGateway_Incorrect_V4 if {
+ # Test Per-User Outbound Gateway when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.13.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "OUTBOUND_RELAY_ENABLED"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+test_PerUserOutboundGateway_Incorrect_V5 if {
+ # Test Per-User Outbound Gateway when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.13.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "OUTBOUND_RELAY_ENABLED"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "OUTBOUND_RELAY_ENABLED"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/gmail/gmail14_test.rego b/Testing/RegoTests/gmail/gmail14_test.rego
new file mode 100644
index 00000000..5a26c890
--- /dev/null
+++ b/Testing/RegoTests/gmail/gmail14_test.rego
@@ -0,0 +1,309 @@
+package gmail
+import future.keywords
+
+
+#
+# GWS.GMAIL.14.1v0.1
+#--
+test_ExternalReplyWarning_Correct_V1 if {
+ # Test Unintended External Reply Warning when there's only one event
+ PolicyId := "GWS.GMAIL.14.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "OutOfDomainWarningProto disable_untrusted_recipient_warning"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_ExternalReplyWarning_Correct_V2 if {
+ # Test Unintended External Reply Warning when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.14.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "OutOfDomainWarningProto disable_untrusted_recipient_warning"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "OutOfDomainWarningProto disable_untrusted_recipient_warning"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_ExternalReplyWarning_Correct_V3 if {
+ # Test Unintended External Reply Warning when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.14.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "OutOfDomainWarningProto disable_untrusted_recipient_warning"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "OutOfDomainWarningProto disable_untrusted_recipient_warning"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_ExternalReplyWarning_Correct_V4 if {
+ # Test Unintended External Reply Warning when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.14.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "OutOfDomainWarningProto disable_untrusted_recipient_warning"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "OutOfDomainWarningProto disable_untrusted_recipient_warning"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_ExternalReplyWarning_Incorrect_V1 if {
+ # Test Unintended External Reply Warning when there are no relevant events
+ PolicyId := "GWS.GMAIL.14.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_ExternalReplyWarning_Incorrect_V2 if {
+ # Test Unintended External Reply Warning when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.14.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "OutOfDomainWarningProto disable_untrusted_recipient_warning"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_ExternalReplyWarning_Incorrect_V3 if {
+ # Test Unintended External Reply Warning when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.14.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "OutOfDomainWarningProto disable_untrusted_recipient_warning"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "OutOfDomainWarningProto disable_untrusted_recipient_warning"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_ExternalReplyWarning_Incorrect_V4 if {
+ # Test Unintended External Reply Warning when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.14.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "OutOfDomainWarningProto disable_untrusted_recipient_warning"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+test_ExternalReplyWarning_Incorrect_V5 if {
+ # Test Unintended External Reply Warning when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.14.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "OutOfDomainWarningProto disable_untrusted_recipient_warning"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "OutOfDomainWarningProto disable_untrusted_recipient_warning"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/gmail/gmail15_test.rego b/Testing/RegoTests/gmail/gmail15_test.rego
new file mode 100644
index 00000000..df485dce
--- /dev/null
+++ b/Testing/RegoTests/gmail/gmail15_test.rego
@@ -0,0 +1,167 @@
+package gmail
+import future.keywords
+
+
+#
+# GWS.GMAIL.15.1v0.1
+#--
+test_EmailAllowlist_Correct_V1 if {
+ # Test Email Allowlists when there's only one event
+ PolicyId := "GWS.GMAIL.15.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "EMAIL_SPAM_ALLOWLIST"},
+ {"name": "NEW_VALUE", "value": "[]"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Email allowlists are not enabled in Test Top-Level Domain."
+}
+
+test_EmailAllowlist_Correct_V2 if {
+ # Test Email Allowlists when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.15.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "EMAIL_SPAM_ALLOWLIST"},
+ {"name": "NEW_VALUE", "value": "[]"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "EMAIL_SPAM_ALLOWLIST"},
+ {"name": "NEW_VALUE", "value": "[123.456.7.89]"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Email allowlists are not enabled in Test Top-Level Domain."
+}
+
+test_EmailAllowlist_Incorrect_V1 if {
+ # Test Email Allowlists when there are no relevant events
+ PolicyId := "GWS.GMAIL.15.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "[]"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Email Allowlist is set to default value."
+}
+
+test_EmailAllowlist_Incorrect_V2 if {
+ # Test Email Allowlists when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.15.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "EMAIL_SPAM_ALLOWLIST"},
+ {"name": "NEW_VALUE", "value": "[123.456.7.89]"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Email allowlists are enabled in Test Top-Level Domain."
+}
+
+test_EmailAllowlist_Incorrect_V3 if {
+ # Test Email Allowlists when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.15.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "EMAIL_SPAM_ALLOWLIST"},
+ {"name": "NEW_VALUE", "value": "[123.456.7.89]"},
+ {"name": "DOMAIN_NAME", "value": "Test Top-Level Domain"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "EMAIL_SPAM_ALLOWLIST"},
+ {"name": "NEW_VALUE", "value": "[]"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Email allowlists are enabled in Test Top-Level Domain."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/gmail/gmail16_test.rego b/Testing/RegoTests/gmail/gmail16_test.rego
new file mode 100644
index 00000000..8881887f
--- /dev/null
+++ b/Testing/RegoTests/gmail/gmail16_test.rego
@@ -0,0 +1,309 @@
+package gmail
+import future.keywords
+
+
+#
+# GWS.GMAIL.16.1v0.1
+#--
+test_EnhancedPreDeliveryMessageScanning_Correct_V1 if {
+ # Test Enhanced Pre-Delivery Message Scanning when there's only one event
+ PolicyId := "GWS.GMAIL.16.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DelayedDeliverySettingsProto disable_delayed_delivery_for_suspicious_email"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_EnhancedPreDeliveryMessageScanning_Correct_V2 if {
+ # Test Enhanced Pre-Delivery Message Scanning when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.16.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DelayedDeliverySettingsProto disable_delayed_delivery_for_suspicious_email"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DelayedDeliverySettingsProto disable_delayed_delivery_for_suspicious_email"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_EnhancedPreDeliveryMessageScanning_Correct_V3 if {
+ # Test Enhanced Pre-Delivery Message Scanning when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.16.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DelayedDeliverySettingsProto disable_delayed_delivery_for_suspicious_email"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DelayedDeliverySettingsProto disable_delayed_delivery_for_suspicious_email"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_EnhancedPreDeliveryMessageScanning_Correct_V4 if {
+ # Test Enhanced Pre-Delivery Message Scanning when there's correct events in multiple OUs and inherited setting
+ PolicyId := "GWS.GMAIL.16.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DelayedDeliverySettingsProto disable_delayed_delivery_for_suspicious_email"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DelayedDeliverySettingsProto disable_delayed_delivery_for_suspicious_email"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_EnhancedPreDeliveryMessageScanning_Incorrect_V1 if {
+ # Test Enhanced Pre-Delivery Message Scanning when there are no relevant events
+ PolicyId := "GWS.GMAIL.16.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_EnhancedPreDeliveryMessageScanning_Incorrect_V2 if {
+ # Test Enhanced Pre-Delivery Message Scanning when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.16.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DelayedDeliverySettingsProto disable_delayed_delivery_for_suspicious_email"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_EnhancedPreDeliveryMessageScanning_Incorrect_V3 if {
+ # Test Enhanced Pre-Delivery Message Scanning when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.16.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DelayedDeliverySettingsProto disable_delayed_delivery_for_suspicious_email"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DelayedDeliverySettingsProto disable_delayed_delivery_for_suspicious_email"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_EnhancedPreDeliveryMessageScanning_Incorrect_V4 if {
+ # Test Enhanced Pre-Delivery Message Scanning when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.16.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DelayedDeliverySettingsProto disable_delayed_delivery_for_suspicious_email"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+test_EnhancedPreDeliveryMessageScanning_Incorrect_V5 if {
+ # Test Enhanced Pre-Delivery Message Scanning when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.16.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DelayedDeliverySettingsProto disable_delayed_delivery_for_suspicious_email"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "DelayedDeliverySettingsProto disable_delayed_delivery_for_suspicious_email"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/gmail/gmail17_test.rego b/Testing/RegoTests/gmail/gmail17_test.rego
new file mode 100644
index 00000000..4a1a704e
--- /dev/null
+++ b/Testing/RegoTests/gmail/gmail17_test.rego
@@ -0,0 +1,309 @@
+package gmail
+import future.keywords
+
+
+#
+# GWS.GMAIL.17.1v0.1
+#--
+test_SecuritySandbox_Correct_V1 if {
+ # Test Security Sandbox when there's only one event
+ PolicyId := "GWS.GMAIL.17.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "AttachmentDeepScanningSettingsProto deep_scanning_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SecuritySandbox_Correct_V2 if {
+ # Test Security Sandbox when there's multiple events and the most recent is correct
+ PolicyId := "GWS.GMAIL.17.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "AttachmentDeepScanningSettingsProto deep_scanning_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "AttachmentDeepScanningSettingsProto deep_scanning_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SecuritySandbox_Correct_V3 if {
+ # Test Security Sandbox when there's correct events in multiple OUs
+ PolicyId := "GWS.GMAIL.17.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "AttachmentDeepScanningSettingsProto deep_scanning_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "AttachmentDeepScanningSettingsProto deep_scanning_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+ test_SecuritySandbox_Correct_V4 if {
+ # Test Security Sandbox when there's correct events in multiple OUs and setting is inherited
+ PolicyId := "GWS.GMAIL.17.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "AttachmentDeepScanningSettingsProto deep_scanning_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-21T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "AttachmentDeepScanningSettingsProto deep_scanning_enabled"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_SecuritySandbox_Incorrect_V1 if {
+ # Test Security Sandbox when there are no relevant events
+ PolicyId := "GWS.GMAIL.17.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_SecuritySandbox_Incorrect_V2 if {
+ # Test Security Sandbox when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.17.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "AttachmentDeepScanningSettingsProto deep_scanning_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SecuritySandbox_Incorrect_V3 if {
+ # Test Security Sandbox when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.17.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "AttachmentDeepScanningSettingsProto deep_scanning_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "AttachmentDeepScanningSettingsProto deep_scanning_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_SecuritySandbox_Incorrect_V4 if {
+ # Test Security Sandbox when there's only one event and it's wrong
+ PolicyId := "GWS.GMAIL.17.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "AttachmentDeepScanningSettingsProto deep_scanning_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+test_SecuritySandbox_Incorrect_V5 if {
+ # Test Security Sandbox when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GMAIL.17.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "AttachmentDeepScanningSettingsProto deep_scanning_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "AttachmentDeepScanningSettingsProto deep_scanning_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/gmail/gmail18_test.rego b/Testing/RegoTests/gmail/gmail18_test.rego
new file mode 100644
index 00000000..cbb6a3bf
--- /dev/null
+++ b/Testing/RegoTests/gmail/gmail18_test.rego
@@ -0,0 +1,25 @@
+package gmail
+import future.keywords
+
+
+#
+# GWS.GMAIL.18.1v0.1
+#--
+test_SpamApprovedSendersList_Correct_V1 if {
+ # Test Spam Approved Senders List when there's only one event
+ PolicyId := "GWS.GMAIL.18.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Currently not able to be tested automatically; please manually check."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/gmail/gmail19_test.rego b/Testing/RegoTests/gmail/gmail19_test.rego
new file mode 100644
index 00000000..e4fd162b
--- /dev/null
+++ b/Testing/RegoTests/gmail/gmail19_test.rego
@@ -0,0 +1,25 @@
+package gmail
+import future.keywords
+
+
+#
+# GWS.GMAIL.19.1v0.1
+#--
+test_BlockedSendersList_Correct_V1 if {
+ # Test Blocked Senders List when there's only one event
+ PolicyId := "GWS.GMAIL.19.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Currently not able to be tested automatically; please manually check."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/gmail/gmail20_test.rego b/Testing/RegoTests/gmail/gmail20_test.rego
new file mode 100644
index 00000000..4bd06dd3
--- /dev/null
+++ b/Testing/RegoTests/gmail/gmail20_test.rego
@@ -0,0 +1,25 @@
+package gmail
+import future.keywords
+
+
+#
+# GWS.GMAIL.20.1v0.1
+#--
+test_ComprehensiveMailStorage_Correct_V1 if {
+ # Test Comprehensive Mail Storage when there's only one event
+ PolicyId := "GWS.GMAIL.20.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Currently not able to be tested automatically; please manually check."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/gmail/gmail21_test.rego b/Testing/RegoTests/gmail/gmail21_test.rego
new file mode 100644
index 00000000..bf9b1a60
--- /dev/null
+++ b/Testing/RegoTests/gmail/gmail21_test.rego
@@ -0,0 +1,25 @@
+package gmail
+import future.keywords
+
+
+#
+# GWS.GMAIL.21.1v0.1
+#--
+test_AdvanvedEmailContentFitlering_Correct_V1 if {
+ # Test Advanced Email Content Filtering when there's only one event
+ PolicyId := "GWS.GMAIL.21.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Currently not able to be tested automatically; please manually check."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/gmail/gmail22_test.rego b/Testing/RegoTests/gmail/gmail22_test.rego
new file mode 100644
index 00000000..4d795ec6
--- /dev/null
+++ b/Testing/RegoTests/gmail/gmail22_test.rego
@@ -0,0 +1,25 @@
+package gmail
+import future.keywords
+
+
+#
+# GWS.GMAIL.22.1v0.1
+#--
+test_ObjectionableContentFiltering_Correct_V1 if {
+ # Test Objectionable Content Filtering when there's only one event
+ PolicyId := "GWS.GMAIL.22.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Currently not able to be tested automatically; please manually check."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/gmail/gmail23_test.rego b/Testing/RegoTests/gmail/gmail23_test.rego
new file mode 100644
index 00000000..1d4db674
--- /dev/null
+++ b/Testing/RegoTests/gmail/gmail23_test.rego
@@ -0,0 +1,25 @@
+package gmail
+import future.keywords
+
+
+#
+# GWS.GMAIL.23.1v0.1
+#--
+test_AttachmentComplianceFiltering_Correct_V1 if {
+ # Test Attachment Compliance Filtering when there's only one event
+ PolicyId := "GWS.GMAIL.23.1v0.1"
+ Output := tests with input as {
+ "gmail_logs": {"items": [
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Currently not able to be tested automatically; please manually check."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/groups/groups01_test.rego b/Testing/RegoTests/groups/groups01_test.rego
new file mode 100644
index 00000000..75c91156
--- /dev/null
+++ b/Testing/RegoTests/groups/groups01_test.rego
@@ -0,0 +1,168 @@
+package groups
+import future.keywords
+
+
+#
+# Policy 1
+#--
+test_GroupAccess_Correct_V1 if {
+ # Test group access when there's only one event
+ PolicyId := "GWS.GROUPS.1.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto collaboration_policy"},
+ {"name": "NEW_VALUE", "value": "CLOSED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_GroupAccess_Correct_V2 if {
+ # Test group access when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.GROUPS.1.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto collaboration_policy"},
+ {"name": "NEW_VALUE", "value": "CLOSED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto collaboration_policy"},
+ {"name": "NEW_VALUE", "value": "OPEN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_GroupsAccess_Incorrect_V1 if {
+ # Test group access when there are no relevant events
+ PolicyId := "GWS.GROUPS.1.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "CLOSED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+#TODO
+test_GroupAccess_Incorrect_V2 if {
+ # Test group access when there's only one event and it's wrong
+ PolicyId := "GWS.GROUPS.1.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto collaboration_policy"},
+ {"name": "NEW_VALUE", "value": "OPEN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+#TODO
+test_GroupAccess_Incorrect_V3 if {
+ # Test group access when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GROUPS.1.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto collaboration_policy"},
+ {"name": "NEW_VALUE", "value": "OPEN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto collaboration_policy"},
+ {"name": "NEW_VALUE", "value": "CLOSED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/groups/groups02_test.rego b/Testing/RegoTests/groups/groups02_test.rego
new file mode 100644
index 00000000..518ff033
--- /dev/null
+++ b/Testing/RegoTests/groups/groups02_test.rego
@@ -0,0 +1,167 @@
+package groups
+import future.keywords
+
+
+#
+# Policy 1
+#--
+test_GroupAddExternal_Correct_V1 if {
+ # Test group owners' ability to add external memebers when there's only one event
+ PolicyId := "GWS.GROUPS.2.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto owners_can_allow_external_members"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_GroupAddExternal_Correct_V2 if {
+ # Test group owners' ability to add external memebers when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.GROUPS.2.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto owners_can_allow_external_members"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto owners_can_allow_external_members"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_GroupAddExternal_Incorrect_V1 if {
+ # Test group owners' ability to add external memebers when there are no relevant events
+ PolicyId := "GWS.GROUPS.2.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_GroupAddExternal_Incorrect_V2 if {
+ # Test group owners' ability to add external memebers when there's only one event and it's wrong
+ PolicyId := "GWS.GROUPS.2.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto owners_can_allow_external_members"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_GroupAddExternal_Incorrect_V3 if {
+ # Test group owners' ability to add external memebers when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GROUPS.2.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto owners_can_allow_external_members"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto owners_can_allow_external_members"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/groups/groups03_test.rego b/Testing/RegoTests/groups/groups03_test.rego
new file mode 100644
index 00000000..b463fb28
--- /dev/null
+++ b/Testing/RegoTests/groups/groups03_test.rego
@@ -0,0 +1,167 @@
+package groups
+import future.keywords
+
+
+#
+# Policy 1
+#--
+test_GroupIncomingMailPosting_Correct_V1 if {
+ # Test group owners' ability to allow incoming mail for posting group messages when there's only one event
+ PolicyId := "GWS.GROUPS.3.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto owners_can_allow_incoming_mail_from_public"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_GroupIncomingMailPosting_Correct_V2 if {
+ # Test group owners' ability to allow incoming mail for posting group messages when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.GROUPS.3.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto owners_can_allow_incoming_mail_from_public"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto owners_can_allow_incoming_mail_from_public"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_GroupIncomingMailPosting_Incorrect_V1 if {
+ # Test group owners' ability to allow incoming mail for posting group messages when there are no relevant events
+ PolicyId := "GWS.GROUPS.3.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_GroupIncomingMailPosting_Incorrect_V2 if {
+ # Test group owners' ability to allow incoming mail for posting group messages when there's only one event and it's wrong
+ PolicyId := "GWS.GROUPS.3.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto owners_can_allow_incoming_mail_from_public"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_GroupIncomingMailPosting_Incorrect_V3 if {
+ # Test group owners' ability to allow incoming mail for posting group messages when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GROUPS.3.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto owners_can_allow_incoming_mail_from_public"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto owners_can_allow_incoming_mail_from_public"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/groups/groups04_test.rego b/Testing/RegoTests/groups/groups04_test.rego
new file mode 100644
index 00000000..9da869a4
--- /dev/null
+++ b/Testing/RegoTests/groups/groups04_test.rego
@@ -0,0 +1,166 @@
+package groups
+import future.keywords
+
+
+#
+# Policy 1
+#--
+test_GroupCreation_Correct_V1 if {
+ # Test group creation restrictions when there's only one event
+ PolicyId := "GWS.GROUPS.4.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto who_can_create_groups"},
+ {"name": "NEW_VALUE", "value": "ADMIN_ONLY"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+test_GroupCreation_Correct_V2 if {
+ # Test group creation restrictions when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.GROUPS.4.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto who_can_create_groups"},
+ {"name": "NEW_VALUE", "value": "ADMIN_ONLY"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto who_can_create_groups"},
+ {"name": "NEW_VALUE", "value": "USERS_IN_DOMAIN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_GroupCreation_Incorrect_V1 if {
+ # Test group creation restrictions when there are no relevant events
+ PolicyId := "GWS.GROUPS.4.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "ADMIN_ONLY"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_GroupCreation_Incorrect_V2 if {
+ # Test group creation restrictions when there's only one event and it's wrong
+ PolicyId := "GWS.GROUPS.4.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto who_can_create_groups"},
+ {"name": "NEW_VALUE", "value": "USERS_IN_DOMAIN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails =="Requirement failed in Test Top-Level OU."
+}
+
+test_GroupCreation_Incorrect_V3 if {
+ # Test group creation restrictions when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GROUPS.4.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto who_can_create_groups"},
+ {"name": "NEW_VALUE", "value": "USERS_IN_DOMAIN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto who_can_create_groups"},
+ {"name": "NEW_VALUE", "value": "ADMIN_ONLY"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/groups/groups05_test.rego b/Testing/RegoTests/groups/groups05_test.rego
new file mode 100644
index 00000000..7b86c85f
--- /dev/null
+++ b/Testing/RegoTests/groups/groups05_test.rego
@@ -0,0 +1,299 @@
+package groups
+import future.keywords
+
+
+#
+# Policy 1
+#--
+test_GroupConservationViewPermission_Correct_V1 if {
+ # Test group conversation view permissions when there's only one event
+ PolicyId := "GWS.GROUPS.5.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto default_view_topics_access_level"},
+ {"name": "NEW_VALUE", "value": "MEMBERS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_GroupConservationViewPermission_Correct_V2 if {
+ # Test group conversation view permissions when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.GROUPS.5.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto default_view_topics_access_level"},
+ {"name": "NEW_VALUE", "value": "MEMBERS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto default_view_topics_access_level"},
+ {"name": "NEW_VALUE", "value": "DOMAIN_USERS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails =="Requirement met in all OUs."
+}
+
+test_GroupConservationViewPermission_Incorrect_V1 if {
+ # Test group conversation view permissions when there are no relevant events
+ PolicyId := "GWS.GROUPS.5.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "MEMBERS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_GroupConservationViewPermission_Incorrect_V2 if {
+ # Test group conversation view permissions when there's only one event and it's wrong
+ PolicyId := "GWS.GROUPS.5.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto default_view_topics_access_level"},
+ {"name": "NEW_VALUE", "value": "DOMAIN_USERS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_GroupConservationViewPermission_Incorrect_V3 if {
+ # Test group conversation view permissions when there's only one event and it's wrong
+ PolicyId := "GWS.GROUPS.5.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto default_view_topics_access_level"},
+ {"name": "NEW_VALUE", "value": "MANAGERS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_GroupConservationViewPermission_Incorrect_V4 if {
+ # Test group conversation view permissions when there's only one event and it's wrong
+ PolicyId := "GWS.GROUPS.5.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto default_view_topics_access_level"},
+ {"name": "NEW_VALUE", "value": "OWNERS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_GroupConservationViewPermission_Incorrect_V5 if {
+ # Test group conversation view permissions when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GROUPS.5.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto default_view_topics_access_level"},
+ {"name": "NEW_VALUE", "value": "DOMAIN_USERS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto default_view_topics_access_level"},
+ {"name": "NEW_VALUE", "value": "MEMBERS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_GroupConservationViewPermission_Incorrect_V6 if {
+ # Test group conversation view permissions when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GROUPS.5.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto default_view_topics_access_level"},
+ {"name": "NEW_VALUE", "value": "MANAGERS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto default_view_topics_access_level"},
+ {"name": "NEW_VALUE", "value": "MEMBERS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_GroupConservationViewPermission_Incorrect_V7 if {
+ # Test group conversation view permissions when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GROUPS.5.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto default_view_topics_access_level"},
+ {"name": "NEW_VALUE", "value": "OWNERS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto default_view_topics_access_level"},
+ {"name": "NEW_VALUE", "value": "MEMBERS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/groups/groups06_test.rego b/Testing/RegoTests/groups/groups06_test.rego
new file mode 100644
index 00000000..f9413dd6
--- /dev/null
+++ b/Testing/RegoTests/groups/groups06_test.rego
@@ -0,0 +1,204 @@
+package groups
+import future.keywords
+
+
+#
+# Policy 1
+#--
+test_GroupOwnersHideGroups_Correct_V1 if {
+ # Test group owners' ability to hide groups when there's only one event
+ PolicyId := "GWS.GROUPS.6.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto allow_unlisted_groups"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_GroupOwnersHideGroups_Correct_V2 if {
+ # Test group owners' ability to hide groups when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.GROUPS.6.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto allow_unlisted_groups"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto allow_unlisted_groups"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_GroupOwnersHideGroups_Incorrect_V1 if {
+ # Test group owners' ability to hide groups when there are no relevant events
+ PolicyId := "GWS.GROUPS.6.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_GroupOwnersHideGroups_Incorrect_V2 if {
+ # Test group owners' ability to hide groups when there's only one event and it's wrong
+ PolicyId := "GWS.GROUPS.6.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto allow_unlisted_groups"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_GroupOwnersHideGroups_Incorrect_V3 if {
+ # Test group owners' ability to hide groups when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.GROUPS.6.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto allow_unlisted_groups"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto allow_unlisted_groups"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_GroupOwnersHideGroups_Incorrect_V4 if {
+ PolicyId := "GWS.GROUPS.6.1v0.1"
+ Output := tests with input as {
+ "groups_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto allow_unlisted_groups"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "GroupsSharingSettingsProto allow_unlisted_groups"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/groups/groups07_test.rego b/Testing/RegoTests/groups/groups07_test.rego
new file mode 100644
index 00000000..44c5b6de
--- /dev/null
+++ b/Testing/RegoTests/groups/groups07_test.rego
@@ -0,0 +1,223 @@
+package groups
+import future.keywords
+
+
+#
+# Policy 1
+#--
+test_Group_Correct_V1 if {
+ # Test one group that is correct
+ PolicyId := "GWS.GROUPS.7.1v0.1"
+ Output := tests with input as {
+ "group_settings": [
+ {
+ "email": "admin1@example.org",
+ "name": "Group 1",
+ "whoCanJoin": "CAN_REQUEST_TO_JOIN",
+ "whoCanViewMembership": "ALL_MEMBERS_CAN_VIEW",
+ "whoCanViewGroup": "ALL_MEMBERS_CAN_VIEW",
+ "whoCanModerateMembers": "OWNERS_AND_MANAGERS",
+ "allowExternalMembers": "false",
+ "whoCanPostMessage": "ALL_MEMBERS_CAN_POST",
+ "whoCanContactOwner": "ANYONE_CAN_CONTACT"
+ },
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all Groups."
+}
+
+test_Group_Correct_V2 if {
+ # Test multiple groups that are correct
+ PolicyId := "GWS.GROUPS.7.1v0.1"
+ Output := tests with input as {
+ "group_settings": [
+ {
+ "email": "admin1@example.org",
+ "name": "Group 1",
+ "whoCanJoin": "CAN_REQUEST_TO_JOIN",
+ "whoCanViewMembership": "ALL_MEMBERS_CAN_VIEW",
+ "whoCanViewGroup": "ALL_MEMBERS_CAN_VIEW",
+ "whoCanModerateMembers": "OWNERS_AND_MANAGERS",
+ "allowExternalMembers": "false",
+ "whoCanPostMessage": "ALL_MEMBERS_CAN_POST",
+ "whoCanContactOwner": "ANYONE_CAN_CONTACT"
+ },
+ {
+ "email": "admin2@example.org",
+ "name": "Group 2",
+ "whoCanJoin": "CAN_REQUEST_TO_JOIN",
+ "whoCanViewMembership": "ALL_MEMBERS_CAN_VIEW",
+ "whoCanViewGroup": "ALL_MEMBERS_CAN_VIEW",
+ "whoCanModerateMembers": "OWNERS_AND_MANAGERS",
+ "allowExternalMembers": "false",
+ "whoCanPostMessage": "ALL_MEMBERS_CAN_POST",
+ "whoCanContactOwner": "ANYONE_CAN_CONTACT"
+ },
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all Groups."
+}
+
+test_Group_Correct_V3 if {
+ # Test no groups
+ PolicyId := "GWS.GROUPS.7.1v0.1"
+ Output := tests with input as {
+ "group_settings": [
+
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No Groups found in Organization."
+}
+
+test_Group_Incorrect_V1 if {
+ # Test one group that is incorrect
+ PolicyId := "GWS.GROUPS.7.1v0.1"
+ Output := tests with input as {
+ "group_settings": [
+ {
+ "email": "admin1@example.org",
+ "name": "Group 1",
+ "whoCanJoin": "CAN_REQUEST_TO_JOIN",
+ "whoCanViewMembership": "ALL_MEMBERS_CAN_VIEW",
+ "whoCanViewGroup": "ALL_MEMBERS_CAN_VIEW",
+ "whoCanModerateMembers": "OWNERS_AND_MANAGERS",
+ "allowExternalMembers": "true",
+ "whoCanPostMessage": "ALL_MEMBERS_CAN_POST",
+ "whoCanContactOwner": "ANYONE_CAN_CONTACT"
+ },
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ print(RuleOutput)
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Group 1."
+}
+
+test_Group_Correct_V2 if {
+ # Test multiple groups where 1 is incorrect
+ PolicyId := "GWS.GROUPS.7.1v0.1"
+ Output := tests with input as {
+ "group_settings": [
+ {
+ "email": "admin1@example.org",
+ "name": "Group 1",
+ "whoCanJoin": "CAN_REQUEST_TO_JOIN",
+ "whoCanViewMembership": "ALL_MEMBERS_CAN_VIEW",
+ "whoCanViewGroup": "ALL_MEMBERS_CAN_VIEW",
+ "whoCanModerateMembers": "OWNERS_AND_MANAGERS",
+ "allowExternalMembers": "false",
+ "whoCanPostMessage": "ALL_MEMBERS_CAN_POST",
+ "whoCanContactOwner": "ANYONE_CAN_CONTACT"
+ },
+ {
+ "email": "admin2@example.org",
+ "name": "Group 2",
+ "whoCanJoin": "CAN_REQUEST_TO_JOIN",
+ "whoCanViewMembership": "ALL_MEMBERS_CAN_VIEW",
+ "whoCanViewGroup": "ALL_MEMBERS_CAN_VIEW",
+ "whoCanModerateMembers": "OWNERS_AND_MANAGERS",
+ "allowExternalMembers": "false",
+ "whoCanPostMessage": "ALL_MEMBERS_CAN_POST",
+ "whoCanContactOwner": "ALL_MEMBERS_CAN_CONTACT"
+ },
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Group 2."
+}
+
+test_Group_Correct_V3 if {
+ # Test multiple groups where both are incorrect
+ PolicyId := "GWS.GROUPS.7.1v0.1"
+ Output := tests with input as {
+ "group_settings": [
+ {
+ "email": "admin1@example.org",
+ "name": "Group 1",
+ "whoCanJoin": "ANYONE_CAN_JOIN",
+ "whoCanViewMembership": "ALL_MEMBERS_CAN_VIEW",
+ "whoCanViewGroup": "ALL_MEMBERS_CAN_VIEW",
+ "whoCanModerateMembers": "OWNERS_AND_MANAGERS",
+ "allowExternalMembers": "false",
+ "whoCanPostMessage": "ALL_MEMBERS_CAN_POST",
+ "whoCanContactOwner": "ANYONE_CAN_CONTACT"
+ },
+ {
+ "email": "admin2@example.org",
+ "name": "Group 2",
+ "whoCanJoin": "CAN_REQUEST_TO_JOIN",
+ "whoCanViewMembership": "ALL_MANAGERS_CAN_VIEW",
+ "whoCanViewGroup": "ALL_MEMBERS_CAN_VIEW",
+ "whoCanModerateMembers": "OWNERS_AND_MANAGERS",
+ "allowExternalMembers": "false",
+ "whoCanPostMessage": "ALL_MEMBERS_CAN_POST",
+ "whoCanContactOwner": "ALL_MEMBERS_CAN_CONTACT"
+ },
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Group 1, Group 2."
+}
+
+test_Group_Correct_V3 if {
+ # Test multiple groups where both are incorrect in multiple ways
+ PolicyId := "GWS.GROUPS.7.1v0.1"
+ Output := tests with input as {
+ "group_settings": [
+ {
+ "email": "admin1@example.org",
+ "name": "Group 1",
+ "whoCanJoin": "CAN_REQUEST_TO_JOIN",
+ "whoCanViewMembership": "ALL_MEMBERS_CAN_VIEW",
+ "whoCanViewGroup": "ALL_OWNERS_CAN_VIEW",
+ "whoCanModerateMembers": "NONE",
+ "allowExternalMembers": "false",
+ "whoCanPostMessage": "ALL_MEMBERS_CAN_POST",
+ "whoCanContactOwner": "ANYONE_CAN_CONTACT"
+ },
+ {
+ "email": "admin2@example.org",
+ "name": "Group 2",
+ "whoCanJoin": "CAN_REQUEST_TO_JOIN",
+ "whoCanViewMembership": "ALL_MEMBERS_CAN_VIEW",
+ "whoCanViewGroup": "ALL_MEMBERS_CAN_VIEW",
+ "whoCanModerateMembers": "OWNERS_AND_MANAGERS",
+ "allowExternalMembers": "false",
+ "whoCanPostMessage": "NONE_CAN_POST",
+ "whoCanContactOwner": "ALL_IN_DOMAIN_CAN_CONTACT"
+ },
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Group 1, Group 2."
+}
\ No newline at end of file
diff --git a/Testing/RegoTests/meet/meet01_test.rego b/Testing/RegoTests/meet/meet01_test.rego
new file mode 100644
index 00000000..36ea5e4a
--- /dev/null
+++ b/Testing/RegoTests/meet/meet01_test.rego
@@ -0,0 +1,453 @@
+package meet
+import future.keywords
+
+
+#
+# GWS.MEET.1.1v0.1
+#--
+test_Access_Correct_V1 if {
+ # Test meeting access when there's only one event
+ PolicyId := "GWS.MEET.1.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyDomainLockProto users_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "LOGGED_IN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Access_Correct_V2 if {
+ # Test meeting access when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.MEET.1.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyDomainLockProto users_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "LOGGED_IN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyDomainLockProto users_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "ALL"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Access_Correct_V3 if {
+ # Test meeting access when there are events in multiple OUs
+ PolicyId := "GWS.MEET.1.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyDomainLockProto users_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "LOGGED_IN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyDomainLockProto users_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "LOGGED_IN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Access_Correct_V4 if {
+ # Test history setting when set to inherit from parent
+ PolicyId := "GWS.MEET.1.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2020-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyDomainLockProto users_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "LOGGED_IN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyDomainLockProto users_allowed_to_join"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyDomainLockProto users_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "ALL"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Access_Incorrect_V1 if {
+ # Test meeting access when there are no relevant events
+ PolicyId := "GWS.MEET.1.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "LOGGED_IN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_Access_Incorrect_V2 if {
+ # Test meeting access when there's only one event and it's wrong
+ PolicyId := "GWS.MEET.1.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyDomainLockProto users_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "ALL"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Access_Incorrect_V3 if {
+ # Test meeting access when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.MEET.1.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyDomainLockProto users_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "ALL"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyDomainLockProto users_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "LOGGED_IN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Access_Incorrect_V4 if {
+ # Test allow user to change history setting when there are multiple OU and a secondary OU is wrong
+ PolicyId := "GWS.MEET.1.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyDomainLockProto users_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "LOGGED_IN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyDomainLockProto users_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "ALL"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Secondary OU."
+}
+#--
+
+test_Access_Incorrect_V5 if {
+ # Test allow user to change history setting when the primary OU is missing but a different one is present
+ PolicyId := "GWS.MEET.1.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyDomainLockProto users_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "ALL"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_Access_Incorrect_V6 if {
+ # Test meeting access when there's only one event and it's wrong
+ PolicyId := "GWS.MEET.1.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyDomainLockProto users_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "ALL"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Access_Incorrect_V7 if {
+ # Test meeting access when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.MEET.1.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyDomainLockProto users_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "ALL"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyDomainLockProto users_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "LOGGED_IN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Access_Incorrect_V8 if {
+ # Test allow user to change history setting when there are multiple OU and a secondary OU is wrong
+ PolicyId := "GWS.MEET.1.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyDomainLockProto users_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "SAME_DOMAIN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyDomainLockProto users_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "ALL"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Secondary OU."
+}
+#--
+
+test_Access_Incorrect_V9 if {
+ # Test allow user to change history setting when the primary OU is missing but a different one is present
+ PolicyId := "GWS.MEET.1.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyDomainLockProto users_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "SAME_DOMAIN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/meet/meet02_test.rego b/Testing/RegoTests/meet/meet02_test.rego
new file mode 100644
index 00000000..acfef483
--- /dev/null
+++ b/Testing/RegoTests/meet/meet02_test.rego
@@ -0,0 +1,607 @@
+package meet
+import future.keywords
+
+
+#
+# Baseline 2 - Policy 1
+#--
+test_JoinExternalPers_Correct_V1 if {
+ # Test meeting access when there's only one event
+ PolicyId := "GWS.MEET.2.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyAccessLockProto meetings_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "WORKSPACE_DOMAINS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_JoinExternalPers_Correct_V2 if {
+ # Test meeting access when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.MEET.2.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyAccessLockProto meetings_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "WORKSPACE_DOMAINS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyAccessLockProto meetings_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "ALL"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_JoinExternalPers_Correct_V3 if {
+ # Test meeting access when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.MEET.2.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyAccessLockProto meetings_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "WORKSPACE_DOMAINS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyAccessLockProto meetings_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "WORKSPACE_DOMAINS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_History_Correct_V4 if {
+ # Test history setting when set to inherit from parent
+ PolicyId := "GWS.MEET.2.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2020-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyAccessLockProto meetings_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "WORKSPACE_DOMAINS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyAccessLockProto meetings_allowed_to_join"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyAccessLockProto meetings_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "ALL"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_JoinExternalPers_Correct_V5 if {
+ # Test meeting access when there's only one event
+ PolicyId := "GWS.MEET.2.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyAccessLockProto meetings_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "SAME_DOMAIN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_JoinExternalPers_Correct_V6 if {
+ # Test meeting access when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.MEET.2.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyAccessLockProto meetings_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "SAME_DOMAIN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyAccessLockProto meetings_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "ALL"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_JoinExternalPers_Correct_V7 if {
+ # Test meeting access when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.MEET.2.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyAccessLockProto meetings_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "SAME_DOMAIN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyAccessLockProto meetings_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "SAME_DOMAIN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_History_Correct_V8 if {
+ # Test history setting when set to inherit from parent
+ PolicyId := "GWS.MEET.2.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2020-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyAccessLockProto meetings_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "SAME_DOMAIN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyAccessLockProto meetings_allowed_to_join"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyAccessLockProto meetings_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "ALL"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_JoinExternalPers_Incorrect_V1 if {
+ # Test meeting access when there are no relevant events
+ PolicyId := "GWS.MEET.2.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "ALL"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_JoinExternalPers_Incorrect_V2 if {
+ # Test meeting access when there's only one event and it's wrong
+ PolicyId := "GWS.MEET.2.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyAccessLockProto meetings_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "ALL"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].Criticality == "Shall"
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_JoinExternalPers_Incorrect_V3 if {
+ # Test meeting access when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.MEET.2.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyAccessLockProto meetings_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "ALL"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyAccessLockProto meetings_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "WORKSPACE_DOMAINS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_JoinExternalPers_Incorrect_V4 if {
+ # Test allow user to change history setting when there are multiple OU and a secondary OU is wrong
+ PolicyId := "GWS.MEET.2.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyAccessLockProto meetings_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "SAME_DOMAIN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyAccessLockProto meetings_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "ALL"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Secondary OU."
+}
+#--
+
+test_JoinExternalPers_Incorrect_V5 if {
+ # Test allow user to change history setting when the primary OU is missing but a different one is present
+ PolicyId := "GWS.MEET.2.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyAccessLockProto meetings_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "SAME_DOMAIN"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_JoinExternalPers_Incorrect_V6 if {
+ # Test meeting access when there's only one event and it's wrong
+ PolicyId := "GWS.MEET.2.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyAccessLockProto meetings_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "ALL"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].Criticality == "Shall"
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+test_JoinExternalPers_Incorrect_V7 if {
+ # Test meeting access when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.MEET.2.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyAccessLockProto meetings_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "ALL"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyAccessLockProto meetings_allowed_to_join"},
+ {"name": "NEW_VALUE", "value": "WORKSPACE_DOMAINS"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+# test_JoinExternalPers_Incorrect_V4 if {
+# # Test allow user to change history setting when there are multiple OU and a secondary OU is wrong
+# PolicyId := "GWS.MEET.2.1v0.1"
+# Output := tests with input as {
+# "meet_logs": {"items": [
+# {
+# "id": {"time": "2021-12-20T00:02:28.672Z"},
+# "events": [{
+# "parameters": [
+# {"name": "SETTING_NAME", "value": "SafetyAccessLockProto meetings_allowed_to_join"},
+# {"name": "NEW_VALUE", "value": "WORKSPACE_DOMAINS"},
+# {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+# ]
+# }]
+# },
+# {
+# "id": {"time": "2022-12-20T00:02:28.672Z"},
+# "events": [{
+# "parameters": [
+# {"name": "SETTING_NAME", "value": "SafetyAccessLockProto meetings_allowed_to_join"},
+# {"name": "NEW_VALUE", "value": "ALL"},
+# {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+# ]
+# }]
+# }
+# ]},
+# "tenant_info": {
+# "topLevelOU": ""
+# },
+# }
+
+# RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+# count(RuleOutput) == 1
+# not RuleOutput[0].RequirementMet
+# not RuleOutput[0].NoSuchEvent
+# RuleOutput[0].ReportDetails == "Requirement failed in Test Secondary OU."
+# }
+#--
+
+# test_JoinExternalPers_Incorrect_V5 if {
+# # Test allow user to change history setting when the primary OU is missing but a different one is present
+# PolicyId := "GWS.MEET.2.1v0.1"
+# Output := tests with input as {
+# "meet_logs": {"items": [
+# {
+# "id": {"time": "2022-12-20T00:02:28.672Z"},
+# "events": [{
+# "parameters": [
+# {"name": "SETTING_NAME", "value": "SafetyAccessLockProto meetings_allowed_to_join"},
+# {"name": "NEW_VALUE", "value": "ALL"},
+# {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+# ]
+# }]
+# }
+# ]},
+# "tenant_info": {
+# "topLevelOU": "Test Top-Level OU"
+# },
+# }
+
+# RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+# count(RuleOutput) == 1
+# not RuleOutput[0].RequirementMet
+# RuleOutput[0].NoSuchEvent
+# RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+# }
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/meet/meet03_test.rego b/Testing/RegoTests/meet/meet03_test.rego
new file mode 100644
index 00000000..1e721e7c
--- /dev/null
+++ b/Testing/RegoTests/meet/meet03_test.rego
@@ -0,0 +1,319 @@
+package meet
+import future.keywords
+
+#
+# GWS.MEET.3.1v0.1
+#--
+test_HostMan_Correct_V1 if {
+ # Test meeting access when there's only one event
+ PolicyId := "GWS.MEET.3.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyModerationLockProto host_management_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_HostMan_Correct_V2 if {
+ # Test meeting access when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.MEET.3.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyModerationLockProto host_management_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyModerationLockProto host_management_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_HostMan_Correct_V3 if {
+ # Test meeting access when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.MEET.3.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyModerationLockProto host_management_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyModerationLockProto host_management_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Access_Correct_V4 if {
+ # Test history setting when set to inherit from parent
+ PolicyId := "GWS.MEET.3.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2020-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyModerationLockProto host_management_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyModerationLockProto host_management_enabled"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyModerationLockProto host_management_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_HostMan_Incorrect_V1 if {
+ # Test meeting access when there are no relevant events
+ PolicyId := "GWS.MEET.3.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_HostMan_Incorrect_V2 if {
+ # Test meeting access when there's only one event and it's wrong
+ PolicyId := "GWS.MEET.3.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyModerationLockProto host_management_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_HostMan_Incorrect_V3 if {
+ # Test meeting access when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.MEET.3.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyModerationLockProto host_management_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyModerationLockProto host_management_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_HostMan_Incorrect_V4 if {
+ # Test allow user to change history setting when there are multiple OU and a secondary OU is wrong
+ PolicyId := "GWS.MEET.3.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyModerationLockProto host_management_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyModerationLockProto host_management_enabled"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Secondary OU."
+}
+#--
+
+test_HostMan_Incorrect_V5 if {
+ # Test allow user to change history setting when the primary OU is missing but a different one is present
+ PolicyId := "GWS.MEET.3.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "SafetyModerationLockProto host_management_enabled"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/meet/meet04_test.rego b/Testing/RegoTests/meet/meet04_test.rego
new file mode 100644
index 00000000..d8f07886
--- /dev/null
+++ b/Testing/RegoTests/meet/meet04_test.rego
@@ -0,0 +1,319 @@
+package meet
+import future.keywords
+
+#
+# GWS.MEET.4.1v0.1
+#--
+test_HostMan_Correct_V1 if {
+ # Test meeting access when there's only one event
+ PolicyId := "GWS.MEET.4.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Warn for external participants External or unidentified participants in a meeting are given a label"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_HostMan_Correct_V2 if {
+ # Test meeting access when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.MEET.4.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Warn for external participants External or unidentified participants in a meeting are given a label"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Warn for external participants External or unidentified participants in a meeting are given a label"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_HostMan_Correct_V3 if {
+ # Test meeting access when there's multiple events and the most most recent is correct
+ PolicyId := "GWS.MEET.4.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Warn for external participants External or unidentified participants in a meeting are given a label"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Warn for external participants External or unidentified participants in a meeting are given a label"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Access_Correct_V4 if {
+ # Test history setting when set to inherit from parent
+ PolicyId := "GWS.MEET.4.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2020-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Warn for external participants External or unidentified participants in a meeting are given a label"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "name": "DELETE_APPLICATION_SETTING",
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Warn for external participants External or unidentified participants in a meeting are given a label"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Warn for external participants External or unidentified participants in a meeting are given a label"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Second-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_HostMan_Incorrect_V1 if {
+ # Test meeting access when there are no relevant events
+ PolicyId := "GWS.MEET.4.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_HostMan_Incorrect_V2 if {
+ # Test meeting access when there's only one event and it's wrong
+ PolicyId := "GWS.MEET.4.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Warn for external participants External or unidentified participants in a meeting are given a label"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_HostMan_Incorrect_V3 if {
+ # Test meeting access when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.MEET.4.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Warn for external participants External or unidentified participants in a meeting are given a label"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Warn for external participants External or unidentified participants in a meeting are given a label"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_HostMan_Incorrect_V4 if {
+ # Test allow user to change history setting when there are multiple OU and a secondary OU is wrong
+ PolicyId := "GWS.MEET.4.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Warn for external participants External or unidentified participants in a meeting are given a label"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Warn for external participants External or unidentified participants in a meeting are given a label"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Secondary OU."
+}
+#--
+
+test_HostMan_Incorrect_V5 if {
+ # Test allow user to change history setting when the primary OU is missing but a different one is present
+ PolicyId := "GWS.MEET.4.1v0.1"
+ Output := tests with input as {
+ "meet_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SETTING_NAME", "value": "Warn for external participants External or unidentified participants in a meeting are given a label"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+#--
\ No newline at end of file
diff --git a/Testing/RegoTests/rules/rules01_test.rego b/Testing/RegoTests/rules/rules01_test.rego
new file mode 100644
index 00000000..d1fd9b24
--- /dev/null
+++ b/Testing/RegoTests/rules/rules01_test.rego
@@ -0,0 +1,633 @@
+package rules
+import future.keywords
+
+test_Alert_Correct_V1 if {
+ # 1 event
+ PolicyId := "GWS.COMMONCONTROLS.15.1v0.1"
+ Requirement := "Government-backed attacks"
+ Output := tests with input as {
+ "rules_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [
+ {
+ "parameters": [
+ {
+ "name": "SYSTEM_DEFINED_RULE_NAME",
+ "value": "Government-backed attacks"
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_STATUS_CHANGE",
+ "value": "Status changed from OFF to ON."
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_RECEIVERS_CHANGE",
+ "value": "Email notification status unchanged, receivers unchanged."
+ }
+ ]
+ }
+ ]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId; Result.Requirement == Requirement]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Warnings about potential government-backed attacks."
+}
+
+test_Alert_Correct_V2 if {
+ # Just a status unchanged event, but rule is default-on
+ PolicyId := "GWS.COMMONCONTROLS.15.1v0.1"
+ Requirement := "User-reported phishing"
+ Output := tests with input as {
+ "rules_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [
+ {
+ "parameters": [
+ {
+ "name": "SYSTEM_DEFINED_RULE_NAME",
+ "value": "User-reported phishing"
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_STATUS_CHANGE",
+ "value": "Status unchanged."
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_RECEIVERS_CHANGE",
+ "value": concat("", [
+ "Email notification status unchanged, receivers ",
+ "changed from NULL to Super Admins."
+ ])
+ }
+ ]
+ }
+ ]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId; Result.Requirement == Requirement]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "A sender has sent messages to your domain that users have classified as phishings."
+}
+
+test_Alert_Correct_V3 if {
+ # Multiple events, but one is a "Status unchanged." event
+ PolicyId := "GWS.COMMONCONTROLS.15.1v0.1"
+ Requirement := "Government-backed attacks"
+ Output := tests with input as {
+ "rules_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [
+ {
+ "parameters": [
+ {
+ "name": "SYSTEM_DEFINED_RULE_NAME",
+ "value": "Government-backed attacks"
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_STATUS_CHANGE",
+ "value": "Status unchanged."
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_RECEIVERS_CHANGE",
+ "value": "Email notification status changed from ON to OFF."
+ }
+ ]
+ }
+ ]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [
+ {
+ "parameters": [
+ {
+ "name": "SYSTEM_DEFINED_RULE_NAME",
+ "value": "Government-backed attacks"
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_STATUS_CHANGE",
+ "value": "Status changed from OFF to ON."
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_RECEIVERS_CHANGE",
+ "value": "Email notification status unchanged, receivers unchanged."
+ }
+ ]
+ }
+ ]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId; Result.Requirement == Requirement]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Warnings about potential government-backed attacks."
+}
+
+test_Alert_Correct_V4 if {
+ # Multiple events
+ PolicyId := "GWS.COMMONCONTROLS.15.1v0.1"
+ Requirement := "Government-backed attacks"
+ Output := tests with input as {
+ "rules_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [
+ {
+ "parameters": [
+ {
+ "name": "SYSTEM_DEFINED_RULE_NAME",
+ "value": "Government-backed attacks"
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_STATUS_CHANGE",
+ "value": "Status changed from OFF to ON."
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_RECEIVERS_CHANGE",
+ "value": "Email notification status changed from ON to OFF."
+ }
+ ]
+ }
+ ]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [
+ {
+ "parameters": [
+ {
+ "name": "SYSTEM_DEFINED_RULE_NAME",
+ "value": "Government-backed attacks"
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_STATUS_CHANGE",
+ "value": "Status changed from ON to OFF."
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_RECEIVERS_CHANGE",
+ "value": "Email notification status unchanged, receivers unchanged."
+ }
+ ]
+ }
+ ]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId; Result.Requirement == Requirement]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Warnings about potential government-backed attacks."
+}
+
+test_Alert_Correct_V5 if {
+ # no events, but default on
+ PolicyId := "GWS.COMMONCONTROLS.15.1v0.1"
+ Requirement := "User-reported phishing"
+ Output := tests with input as {
+ "rules_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId; Result.Requirement == Requirement]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "A sender has sent messages to your domain that users have classified as phishings."
+}
+
+test_Alert_Incorrect_V1 if {
+ # 1 event
+ PolicyId := "GWS.COMMONCONTROLS.15.1v0.1"
+ Requirement := "Government-backed attacks"
+ Output := tests with input as {
+ "rules_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [
+ {
+ "parameters": [
+ {
+ "name": "SYSTEM_DEFINED_RULE_NAME",
+ "value": "Government-backed attacks"
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_STATUS_CHANGE",
+ "value": "Status changed from ON to OFF."
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_RECEIVERS_CHANGE",
+ "value": "Email notification status unchanged, receivers unchanged."
+ }
+ ]
+ }
+ ]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId; Result.Requirement == Requirement]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Warnings about potential government-backed attacks."
+}
+
+test_Alert_Incorrect_V2 if {
+ # 1 status unchanged event, default is off
+ PolicyId := "GWS.COMMONCONTROLS.15.1v0.1"
+ Requirement := "Government-backed attacks"
+ Output := tests with input as {
+ "rules_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [
+ {
+ "parameters": [
+ {
+ "name": "SYSTEM_DEFINED_RULE_NAME",
+ "value": "Government-backed attacks"
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_STATUS_CHANGE",
+ "value": "Status unchanged."
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_RECEIVERS_CHANGE",
+ "value": "Email notification status changed from OFF to ON."
+ }
+ ]
+ }
+ ]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId; Result.Requirement == Requirement]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Warnings about potential government-backed attacks."
+}
+
+test_Alert_Incorrect_V3 if {
+ # No events, default is off
+ PolicyId := "GWS.COMMONCONTROLS.15.1v0.1"
+ Requirement := "Government-backed attacks"
+ Output := tests with input as {
+ "rules_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId; Result.Requirement == Requirement]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Warnings about potential government-backed attacks."
+}
+
+test_Email_Correct_V1 if {
+ # 1 event
+ PolicyId := "GWS.COMMONCONTROLS.15.1v0.1"
+ Requirement := "TLS failure"
+ Output := tests with input as {
+ "rules_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [
+ {
+ "parameters": [
+ {
+ "name": "SYSTEM_DEFINED_RULE_NAME",
+ "value": "TLS failure"
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_STATUS_CHANGE",
+ "value": "Status unchanged."
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_RECEIVERS_CHANGE",
+ "value": "Email notification status changed from OFF to ON, receivers unchanged."
+ }
+ ]
+ }
+ ]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId; Result.Requirement == Requirement]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Messages requiring Transport Layer Security (TLS) can't be delivered."
+}
+
+test_Email_Correct_V2 if {
+ # Multiple events, but one is a "Status unchanged." event
+ PolicyId := "GWS.COMMONCONTROLS.15.1v0.1"
+ Requirement := "TLS failure"
+ Output := tests with input as {
+ "rules_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [
+ {
+ "parameters": [
+ {
+ "name": "SYSTEM_DEFINED_RULE_NAME",
+ "value": "TLS failure"
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_STATUS_CHANGE",
+ "value": "Status unchanged."
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_RECEIVERS_CHANGE",
+ "value": "Email notification status unchanged, receivers unchanged."
+ }
+ ]
+ }
+ ]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [
+ {
+ "parameters": [
+ {
+ "name": "SYSTEM_DEFINED_RULE_NAME",
+ "value": "TLS failure"
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_STATUS_CHANGE",
+ "value": "Status changed from OFF to ON."
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_RECEIVERS_CHANGE",
+ "value": "Email notification status changed from OFF to ON, receivers unchanged."
+ }
+ ]
+ }
+ ]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId; Result.Requirement == Requirement]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Messages requiring Transport Layer Security (TLS) can't be delivered."
+}
+
+test_Email_Correct_V3 if {
+ # Multiple events
+ PolicyId := "GWS.COMMONCONTROLS.15.1v0.1"
+ Requirement := "TLS failure"
+ Output := tests with input as {
+ "rules_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [
+ {
+ "parameters": [
+ {
+ "name": "SYSTEM_DEFINED_RULE_NAME",
+ "value": "TLS failure"
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_STATUS_CHANGE",
+ "value": "Status changed from OFF to ON."
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_RECEIVERS_CHANGE",
+ "value": "Email notification status changed from OFF to ON."
+ }
+ ]
+ }
+ ]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [
+ {
+ "parameters": [
+ {
+ "name": "SYSTEM_DEFINED_RULE_NAME",
+ "value": "TLS failure"
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_STATUS_CHANGE",
+ "value": "Status changed from ON to OFF."
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_RECEIVERS_CHANGE",
+ "value": "Email notification status changed from ON to OFF."
+ }
+ ]
+ }
+ ]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId; Result.Requirement == Requirement]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Messages requiring Transport Layer Security (TLS) can't be delivered."
+}
+
+test_Email_Correct_V4 if {
+ # 1 event, receiver changed
+ PolicyId := "GWS.COMMONCONTROLS.15.1v0.1"
+ Requirement := "TLS failure"
+ Output := tests with input as {
+ "rules_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [
+ {
+ "parameters": [
+ {
+ "name": "SYSTEM_DEFINED_RULE_NAME",
+ "value": "TLS failure"
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_STATUS_CHANGE",
+ "value": "Status unchanged."
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_RECEIVERS_CHANGE",
+ "value": concat("", [
+ "Email notification status unchanged, receivers ",
+ "changed from NULL to Super Admins."
+ ])
+ }
+ ]
+ }
+ ]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId; Result.Requirement == Requirement]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Messages requiring Transport Layer Security (TLS) can't be delivered."
+}
+
+test_Email_Incorrect_V1 if {
+ # 1 event
+ PolicyId := "GWS.COMMONCONTROLS.15.1v0.1"
+ Requirement := "TLS failure"
+ Output := tests with input as {
+ "rules_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [
+ {
+ "parameters": [
+ {
+ "name": "SYSTEM_DEFINED_RULE_NAME",
+ "value": "TLS failure"
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_STATUS_CHANGE",
+ "value": "Status changed from ON to OFF."
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_RECEIVERS_CHANGE",
+ "value": "Email notification status changed from ON to OFF"
+ }
+ ]
+ }
+ ]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId; Result.Requirement == Requirement]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Messages requiring Transport Layer Security (TLS) can't be delivered."
+}
+
+test_Email_Incorrect_V2 if {
+ # 1 status unchanged event, default is off
+ PolicyId := "GWS.COMMONCONTROLS.15.1v0.1"
+ Requirement := "TLS failure"
+ Output := tests with input as {
+ "rules_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [
+ {
+ "parameters": [
+ {
+ "name": "SYSTEM_DEFINED_RULE_NAME",
+ "value": "TLS failure"
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_STATUS_CHANGE",
+ "value": "Status unchanged."
+ },
+ {
+ "name": "SYSTEM_DEFINED_RULE_ACTION_RECEIVERS_CHANGE",
+ "value": "Email notification status unchanged, receivers unchanged."
+ }
+ ]
+ }
+ ]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId; Result.Requirement == Requirement]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Messages requiring Transport Layer Security (TLS) can't be delivered."
+}
+
+test_Email_Incorrect_V3 if {
+ # No events, default is off
+ PolicyId := "GWS.COMMONCONTROLS.15.1v0.1"
+ Requirement := "TLS failure"
+ Output := tests with input as {
+ "rules_logs": {"items": [
+
+ ]},
+ "tenant_info": {
+ "topLevelOU": "Test Top-Level OU"
+ }
+ }
+
+ RuleOutput := [Result | some Result in Output; Result.PolicyId == PolicyId; Result.Requirement == Requirement]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Messages requiring Transport Layer Security (TLS) can't be delivered."
+}
+
diff --git a/Testing/RegoTests/sites/sites01_test.rego b/Testing/RegoTests/sites/sites01_test.rego
new file mode 100644
index 00000000..e4473703
--- /dev/null
+++ b/Testing/RegoTests/sites/sites01_test.rego
@@ -0,0 +1,396 @@
+package sites
+import future.keywords
+
+#
+# Baseline GWS.SITES.1.1v0.1
+#--
+
+test_Sites_Disabled_Correct_V1 if {
+ # Test ensure Sites is disabled
+ PolicyId := "GWS.SITES.1.1v0.1"
+ Output := tests with input as {
+ "sites_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SERVICE_NAME", "value": "Sites"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Sites_Disabled_Correct_V2 if {
+ # Test ensure sites is disabled when there's multiple events and the most recent is correct
+ PolicyId := "GWS.SITES.1.1v0.1"
+ Output := tests with input as {
+ "sites_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SERVICE_NAME", "value": "Sites"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SERVICE_NAME", "value": "Sites"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Sites_Disabled_Correct_V3 if {
+ # Test ensure sites is disabled when there are multiple OU's
+ PolicyId := "GWS.SITES.1.1v0.1"
+ Output := tests with input as {
+ "sites_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SERVICE_NAME", "value": "Sites"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SERVICE_NAME", "value": "Sites"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Sites_Disabled_Correct_V4 if {
+ # Test sites is disabled when there are multiple OU's and an older event is non-complaint
+ PolicyId := "GWS.SITES.1.1v0.1"
+ Output := tests with input as {
+ "sites_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SERVICE_NAME", "value": "Sites"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SERVICE_NAME", "value": "Sites"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SERVICE_NAME", "value": "Sites"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+#--------TO FIX
+test_Sites_Disabled_Correct_V5 if {
+ # Test Sites inheritance
+ PolicyId := "GWS.SITES.1.1v0.1"
+ Output := tests with input as {
+ "sites_logs": {"items": [
+ {
+ "id": {"time": "2022-12-10T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SERVICE_NAME", "value": "Sites"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:29.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SERVICE_NAME", "value": "Sites"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Second OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SERVICE_NAME", "value": "Sites"},
+ {"name": "NEW_VALUE", "value": "INHERIT_FROM_PARENT"},
+ {"name": "ORG_UNIT_NAME", "value": "Second OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement met in all OUs."
+}
+
+test_Sites_Disabled_Incorrect_V1 if {
+ # Test sites is disabled when there are no relevant events
+ PolicyId := "GWS.SITES.1.1v0.1"
+ Output := tests with input as {
+ "sites_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SERVICE_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "SHARING_NOT_ALLOWED"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+
+test_Sites_Disabled_Incorrect_V2 if {
+ # Test Sites is disabled when there's only one event and it's wrong
+ PolicyId := "GWS.SITES.1.1v0.1"
+ Output := tests with input as {
+ "sites_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SERVICE_NAME", "value": "Sites"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Sites_Disabled_Incorrect_V3 if {
+ # Test sites is disabled when there are multiple events and the most recent is wrong
+ PolicyId := "GWS.SITES.1.1v0.1"
+ Output := tests with input as {
+ "sites_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SERVICE_NAME", "value": "Sites"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SERVICE_NAME", "value": "Sites"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Sites_Disabled_Incorrect_V4 if {
+ # Test sites is disabled when the Top-level OU is compliant but a secondary OU is non-compliant
+ PolicyId := "GWS.SITES.1.1v0.1"
+ Output := tests with input as {
+ "sites_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SERVICE_NAME", "value": "Sites"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ },
+ {
+ "id": {"time": "2021-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SERVICE_NAME", "value": "Sites"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Secondary OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ },
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Secondary OU."
+}
+
+test_Sites_Disabled_Incorrect_V5 if {
+ # Test sites is disabled when there's only one event and it's wrong
+ PolicyId := "GWS.SITES.1.1v0.1"
+ Output := tests with input as {
+ "sites_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SERVICE_NAME", "value": "Sites"},
+ {"name": "NEW_VALUE", "value": "true"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ not RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "Requirement failed in Test Top-Level OU."
+}
+
+test_Sites_Disabled_Incorrect_V6 if {
+ # Test sites is disabled when there are no relevant events for Sites, but there is an event for a different service
+ PolicyId := "GWS.SITES.1.1v0.1"
+ Output := tests with input as {
+ "sites_logs": {"items": [
+ {
+ "id": {"time": "2022-12-20T00:02:28.672Z"},
+ "events": [{
+ "parameters": [
+ {"name": "SERVICE_NAME", "value": "Something else"},
+ {"name": "NEW_VALUE", "value": "false"},
+ {"name": "ORG_UNIT_NAME", "value": "Test Top-Level OU"},
+ ]
+ }]
+ }
+ ]},
+ "tenant_info": {
+ "topLevelOU": ""
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.PolicyId == PolicyId]
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].NoSuchEvent
+ RuleOutput[0].ReportDetails == "No relevant event in the current logs for the top-level OU, Test Top-Level OU. While we are unable to determine the state from the logs, the default setting is non-compliant; manual check recommended."
+}
+# #--
\ No newline at end of file
diff --git a/Testing/run_unit_tests.py b/Testing/run_unit_tests.py
new file mode 100644
index 00000000..da063748
--- /dev/null
+++ b/Testing/run_unit_tests.py
@@ -0,0 +1,91 @@
+"""
+run_unit_tests.py runs the rego unit tests
+
+Currently runs non-verbosely
+"""
+import subprocess
+import argparse
+from sys import platform
+
+# to_do move items from the commented out list below as the tests
+# are implemented so they will be run by default
+
+gws_baselines = [
+ "gmail",
+ "calendar",
+ "groups",
+ "chat",
+ "drive",
+ "meet",
+ "sites",
+ "commoncontrols",
+ "sites",
+ "commoncontrols",
+ "rules",
+ 'classroom'
+]
+
+EXAMPLE_TEXT = '''example:
+
+ python RunUnitTests.py
+ python RunUnitTests.py -b gmail calendar
+ python RunUnitTests.py -b gmail -c 1 2
+ python RunUnitTests.py -b gmail -c 1 2 -v'''
+
+# parser arguments
+parser = argparse.ArgumentParser(epilog=EXAMPLE_TEXT,
+formatter_class=argparse.RawDescriptionHelpFormatter)
+
+parser.add_argument('-b', '--baselines', type = str, nargs="+",
+default=gws_baselines, help="Space-separated list of baselines to test. By default all are run.")
+
+parser.add_argument('-c', '--controls', type = str, nargs="+",
+default=[], help="Space-separated list of controls to test within a specific baseline."
+"Can only be used when a single baseline is specified. By default all are run.")
+
+parser.add_argument('-o', '--opapath', type=str, default='../', metavar='',
+help='The relative path to the directory containing the OPA executable. ' +
+ 'Defaults to "../" the current executing directory.')
+
+parser.add_argument('-v', action='store_true',
+help='Verbose flag, passed to opa, increases output.')
+args = parser.parse_args()
+
+
+
+if len(args.baselines) > 1 and len(args.controls) > 0:
+ print('WARNING: "--controls" specified, '
+ 'but multiple products are being tested. Ignoring "--controls" option.')
+ args.controls = []
+
+# These aren't constants but the linter is complaining
+V_FLAG = ""
+if args.v:
+ V_FLAG = "-v"
+
+#Get OPA Path from command line args
+opa_path = args.opapath
+OPA_EXE = ""
+command = []
+if platform == 'win32':
+ OPA_EXE = f"{opa_path}opa_windows_amd64.exe"
+elif platform == 'darwin':
+ OPA_EXE = f"sudo {opa_path}opa_darwin_amd64"
+elif platform in ('linux', 'linux2'):
+ OPA_EXE = f"sudo {opa_path}opa_linux_amd64_static"
+else:
+ OPA_EXE = f"sudo {opa_path}opa"
+for b in args.baselines:
+ b = b.lower()
+ if len(args.controls) > 0:
+ for c in args.controls:
+ print(f"\n==== Testing {b} Control 2.{c} ====")
+ c = c.zfill(2)
+ command = f"{OPA_EXE} test ../Rego/ ./RegoTests/{b}/{b}{c}_test.rego {V_FLAG}"
+ print(command)
+ subprocess.run(command.split(), check=True)
+ else:
+ print(f"\n==== Testing {b} ====")
+ command = f"{OPA_EXE} test ../Rego/ ./RegoTests/{b} {V_FLAG}"
+ print(command)
+ subprocess.run(command.split(), check=False)
diff --git a/baselines/Common Controls Minimum Viable Secure Configuration Baseline v0.1.md b/baselines/Common Controls Minimum Viable Secure Configuration Baseline v0.1.md
new file mode 100644
index 00000000..40e4f4b4
--- /dev/null
+++ b/baselines/Common Controls Minimum Viable Secure Configuration Baseline v0.1.md
@@ -0,0 +1,1323 @@
+# CISA Google Workspace Security Configuration Baseline for Common Controls
+
+The Google Workspace (GWS) Admin console is the primary configuration hub for configuring and setting up the subscription. The scope of this document is to provide recommendations for setting up the subscription's security controls. This Secure Configuration Baseline (SCB) provides specific policies to strengthen the security of a GWS tenant.
+
+The Secure Cloud Business Applications (SCuBA) project provides guidance and capabilities to secure agencies' cloud business application environments and protect federal information that is created, accessed, shared, and stored in those environments. The SCuBA Secure Configuration Baselines (SCB) for Google Workspace (GWS) will help secure federal civilian executive branch (FCEB) information assets stored within GWS cloud environments through consistent, effective, modern, and manageable security configurations.
+
+The CISA SCuBA SCBs for GWS help secure federal information assets stored within GWS cloud business application environments through consistent, effective, and manageable security configurations. CISA created baselines tailored to the federal government's threats and risk tolerance with the knowledge that every organization has different threat models and risk tolerance. Non-governmental organizations may also find value in applying these baselines to reduce risks.
+
+The information in this document is being provided "as is" for INFORMATIONAL PURPOSES ONLY. CISA does not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial entities or commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoritism by CISA.
+
+This baseline is based on Google documentation and addresses the following:
+- [Phishing-Resistant Multi-Factor Authentication](#1-phishing-resistant-multi-factor-authentication)
+- [Context Aware Access](#2-context-aware-access)
+- [Login Challenges](#3-login-challenges)
+- [User Session Duration](#4-user-session-duration)
+- [Secure Passwords](#5-secure-passwords)
+- [Highly Privileged Accounts](#6-highly-privileged-accounts)
+- [Super Admin Accounts](#7-super-admin-accounts)
+- [Conflicting Account Management](#8-conflicting-account-management)
+- [Catastrophic Recovery Options](#9-catastrophic-recovery-options-for-super-admins)
+- [GWS Advanced Protection Program](#10-gws-advanced-protection-program)
+- [App Access to Google APIs](#11-app-access-to-google-apis)
+- [Authorized Marketplace Apps](#12-authorized-google-marketplace-apps)
+- [Less Secure Apps](#13-less-secure-apps)
+- [Google Takeout Service](#14-google-takeout-services-for-users)
+- [System-Defined Rules](#15-system-defined-rules)
+- [Google Workspace Logs](#16-google-workspace-logs)
+- [Data Regions](#17-data-regions)
+- [Supplemental Data Storage](#18-supplemental-data-storage)
+
+## Assumptions
+
+This document assumes the organization is using GWS Enterprise Plus. The Google Workspace (GWS) Common Controls Secure Configuration Baseline is unique among the GWS configuration baseline documents released by CISA in that it does not align to one specific GWS app. Implementers should be aware of this when cross-referencing the baseline statements to the live GWS admin console. Therefore, this document serves an enterprise-level compendium of implementable and testable configuration settings across the entire GWS admin console. The configurations specified herein correlate to the Security, Account, Directory, Rules, and Marketplace apps sections of the GWS admin console.
+
+This document does not address, ensure compliance with, or supersede any law, regulation, or other authority. Entities are responsible for complying with any recordkeeping, privacy, and other laws that may apply to the use of technology. This document is not intended to, and does not, create any right or benefit for anyone against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person.
+
+This Common Controls baseline document:
+
+- Assumes users are familiar with overarching Federal cyber guidance and cloud security fundamentals such as the shared responsibility model;
+- Accounts for recent direction from Executive Order 14028, the Federal Zero Trust Strategy (published as Office of Management & Budget Memo M-22-09 *Moving the U.S. Government Toward Zero Trust Cybersecurity Principles*), CISA's Zero Trust Maturity Model, and the Federal Cloud Security Technical Reference Architecture;
+- Observes industry guidance such as the Center for Internet Security's Google Workspace Foundations benchmark and Google official documentation and white papers; and
+- Was developed with input from both the Office of Management & Budget (OMB) and Google product managers and security engineers.
+
+## Key Terminology
+
+The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.
+
+# Baseline Policies
+
+## 1. Phishing-Resistant Multi-Factor Authentication
+
+Multi-factor authentication (MFA), particularly phishing-resistant MFA, is a critical security control against attacks such as password spraying, password theft, and phishing. Adopting phishing-resistant MFA may take time, especially on mobile devices. Organizations must upgrade to a phishing-resistant MFA method as soon as possible to be compliant with OMB M-22-09 and this policy to address the critical security threat posed by modern phishing attacks. In the intermediate period before phishing-resistant MFA is fully adopted, organizations should adopt an MFA method from the list in GWS.COMMONCONTROLS.1.4v0.1 below.
+
+This control recognizes federation as a viable option for phishing-resistant MFA and includes architectural considerations around on-premises and cloud-native identity federation in established Federal Civilian Executive Branch (FCEB) environments. Federation for GWS can be implemented via a cloud-native identity provider (IdP). Google's documentation acknowledges that on-premises Active Directory implementations may be predominant in environments that adopt GWS and provides guidance on the use of Google Cloud Directory Sync (GCDS) to synchronize Google Account data with an established Microsoft Active Directory or LDAP server.
+
+The following graphic illustrates the spectrum of MFA options and their relative strength, with phishing resistant MFA (per OMB Memo 22-09) being the mandated method.
+Please note there is a distinction between Google 2 Step Verification (2SV) and MFA as a general term. While FIDO Security Key and Phone as a Security Key are acceptable forms of Phishing-Resistant MFA which rely on Google 2SV as the underlying mechanism, the other forms listed in the "strongest" column do not use Google
+2SV but are still acceptable forms of Phishing-Resistant MFA.
+
+
+
+### Policies
+
+#### GWS.COMMONCONTROLS.1.1v0.1
+Phishing-Resistant MFA SHALL be required for all users.
+
+
+ > Phishing-resistant methods:
+
+ - FIDO2 Security Key (directly in Google Workspace)
+
+ - Phone as Security Key
+
+ - FIDO2 Security Key (Federated from Identity Provider)
+
+ - Federal Personal Identity Verification (PIV) card (Federated from agency Active Directory or other identity provider).
+
+ - Google Passkeys
+
+- Rationale
+ - Required by Office of Management and Budget Memo M-22-09.
+ - Add an extra layer of security to user accounts by asking users to verify their identity when they enter a username and password. MFA (including methods using 2-Step Verification) requires an individual to present a minimum of two separate forms of authentication before access is granted. MFA provides additional assurance that the individual attempting to gain access is who they claim to be. With MFA, an attacker would need to compromise at least two different authentication mechanisms, increasing the difficulty of compromise and thus reducing the risk.
+- Last Modified: August 17, 2023
+- Notes
+ - Policy 1.1 applies if Phishing-Resistant MFA is available. Otherwise, Policy 1.4 applies.
+
+- MITRE ATT&CK TTP Mapping
+ - [T1621: MFA Request Generation](https://attack.mitre.org/techniques/T1621/)
+ - [T1110: Brute Force](https://attack.mitre.org/techniques/T1110/)
+ - [T1110:001: Brute Force: Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
+ - [T1110:002: Brute Force: Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
+ - [T1110:003: Brute Force: Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
+ - [T1556: Modifying Authentication Process](https://attack.mitre.org/techniques/T1556/)
+ - [T1556:006: Modifying Authentication Process: Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+
+#### GWS.COMMONCONTROLS.1.2v0.1
+Google 2SV new user enrollment period SHALL be set to 1 week.
+
+- Rationale
+ - This allows enough time for new personnel to log into their account and configure MFA prior to getting locked out of their account. However, does not give an excessive amount of time in order to limit security risks.
+- Last Modified: August 17, 2023
+- Notes
+ - This setting and policy only applies when the means of Phishing-Resistant MFA in use relies
+ on Google 2SV.
+
+- MITRE ATT&CK TTP Mapping
+ - [T1621: MFA Request Generation](https://attack.mitre.org/techniques/T1621/)
+ - [T1110: Brute Force](https://attack.mitre.org/techniques/T1110/)
+ - [T1110:001: Brute Force: Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
+ - [T1110:002: Brute Force: Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
+ - [T1110:003: Brute Force: Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
+ - [T1556: Modifying Authentication Process](https://attack.mitre.org/techniques/T1556/)
+ - [T1556:006: Modifying Authentication Process: Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+
+#### GWS.COMMONCONTROLS.1.3v0.1
+Allow users to trust the device SHALL be disabled.
+
+- Rationale
+ - This ensures that Google 2SV must be used each time to prevent unauthorized access to accounts.
+- Last Modified: August 17, 2023
+- Notes
+ - This setting and policy only applies when the means of Phishing-Resistant MFA in use relies
+ on Google 2SV.
+
+- MITRE ATT&CK TTP Mapping
+ - [T1621: MFA Request Generation](https://attack.mitre.org/techniques/T1621/)
+ - [T1110: Brute Force](https://attack.mitre.org/techniques/T1110/)
+ - [T1110:001: Brute Force: Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
+ - [T1110:002: Brute Force: Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
+ - [T1110:003: Brute Force: Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
+ - [T1556: Modifying Authentication Process](https://attack.mitre.org/techniques/T1556/)
+ - [T1556:006: Modifying Authentication Process: Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+
+#### GWS.COMMONCONTROLS.1.4v0.1
+If phishing-resistant MFA is not yet tenable, an MFA method from the following list SHALL be used in the interim.
+
+> Google prompt
+
+> Google Authenticator
+
+> Backup Codes
+
+> Software Tokens One-Time Password (OTP): This option is commonly implemented using mobile phone authenticator apps
+
+> Hardware Tokens OTP
+
+- Rationale
+ - Some agencies do not have capability for phishing-resistant MFA at this time, therefore an
+ alternative is provided.
+- Last Modified: August 17, 2023
+- Notes
+ - ONLY to be enforced if Policy 1.1 is not possible for the agency.
+ - SMS or Voice as the MFA method SHALL NOT be used.
+
+- MITRE ATT&CK TTP Mapping
+ - [T1621: MFA Request Generation](https://attack.mitre.org/techniques/T1621/)
+ - [T1110: Brute Force](https://attack.mitre.org/techniques/T1110/)
+ - [T1110:001: Brute Force: Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
+ - [T1110:002: Brute Force: Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
+ - [T1110:003: Brute Force: Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
+ - [T1556: Modifying Authentication Process](https://attack.mitre.org/techniques/T1556/)
+ - [T1556:006: Modifying Authentication Process: Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+
+### Resources
+
+- [GWS Admin Help \| Set up 2-Step Verification (Deploy)](https://support.google.com/a/answer/9176657?hl=en&ref_topic=2759193&fl=1#zippy=%2Cchoose-a--step-verification-method-to-enforce%2Cturn-on-enforcement)
+- [GWS Admin Help \| Set up 2-Step Verification (Protect your business)](https://support.google.com/a/answer/175197#zippy=%2Csecurity-keys%2Cconsider-using-security-keys-in-your-business)
+- [GWS Admin Help \| Set up SSO via a third-party Identity provider](https://support.google.com/a/topic/7579248?hl=en&ref_topic=7556686)
+- [Google Cloud Architecture Center \| Federating Google Cloud with Active Directory](https://cloud.google.com/architecture/identity/federating-gcp-with-active-directory-introduction)
+- [Google Cloud Architecture Center \| Federating Google Cloud with Azure Active Directory](https://cloud.google.com/architecture/identity/federating-gcp-with-azure-active-directory)
+- [Google Workspace Updates /| Simplify and Strengthen Sign-In by Enabling Passkeys for Your Users](https://workspaceupdates.googleblog.com/2023/06/passkey-open-beta.html)
+- [Google Security Blog /| So Long Passwords, Thanks for all the Phish](https://security.googleblog.com/2023/05/so-long-passwords-thanks-for-all-phish.html)
+- [Allow Users to Skip Passwords at Sign-In (Beta)](https://support.google.com/a/answer/13529161)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- FIDO2-compliant security keys
+
+### Implementation
+
+Note: If using a third-party IdP with GWS, refer to Google documentation on [setting up third-party single sign-on](https://support.google.com/a/topic/7579248?hl=en&ref_topic=7556686) (SSO). If using GWS as the IdP, refer to [Google documentation on setting up SSO](https://support.google.com/a/answer/12032922?hl=en).
+
+To enforce Phishing-Resistant 2-Step Verification (MFA) for all users, use the Google Workspace Admin Console:
+
+#### Policy 1 common Instructions
+1. Sign in to [Google Admin console](https://admin.google.com/) as an administrator.
+2. Select **Security** -\> **Authentication.**
+3. Select **2-Step Verification.**
+
+#### GWS.COMMONCONTROLS.1.1v0.1 Instructions
+1. Under **Authentication**, ensure that **Allow users to turn on 2-Step Verification** is checked.
+2. Set **Enforcement** to **On.**
+3. Under **Methods** select **Only security key.**
+4. Under **Security codes** select **Don't allow users to select security codes.**
+5. Select **Save**
+
+#### GWS.COMMONCONTROLS.1.2v0.1 Instructions
+1. Set **New user enrollment** period to **1 Week**.
+2. Select **Save**
+
+#### GWS.COMMONCONTROLS.1.3v0.1 Instructions
+1. Under Frequency, deselect the **Allow user to trust device** checkbox.
+2. Select **Save**
+
+#### GWS.COMMONCONTROLS.1.4v0.1 Instructions
+
+If using security keys:
+1. Under **Methods**, select **Only security Key**. Next, select **Don't allow users to select security codes**.
+2. Select **Save**
+
+If security keys are not yet available for your organization:
+1. Under **Methods**, select **Any except verification codes via text, phone call**.
+2. Select **Save**
+
+If using Passkeys, use the Google Workspace Admin Console:
+1. Sign in to [Google Admin console](https://admin.google.com/) as an administrator.
+2. Select **Security** -\> **Authentication** -\> **Passwordless.**
+3. Select **Skip passwords.**
+4. Select the **Allow users to skip passwords at sign-in by using passkeys** box.
+5. Select **Save.**
+
+## 2. Context-aware Access
+
+Device-based context-aware access provides access control policies based on device disposition attributes such as compliance with organizational secure configuration policies for devices (e.g., managed by Unified Endpoint Management). GWS also provides other context-aware access policies based on authentication and network information. These can be used to implement more targeted access policies. For advanced use cases, custom context aware access rules can be authored using the Common Expressions Language (CEL).
+
+Device-based context-aware access can be used in several ways depending on agency business requirements. The following options are all acceptable approaches:
+
+- Properties of the device as reported by Google (encryption, screen lock, OS version, etc.)
+- Device inventory status (corporate-issued versus BYOD)
+- Use of Managed Chrome Browser
+- Data based on integration with certain third-party device management tools
+
+It is extremely important to know how context-aware access policies affect one another, for example:
+
+- At a given scope (e.g., Organizational Unit [OU] or Group), each context aware access rule is evaluated separately. If any rule grants access, then access is allowed to the given application.
+- If rules are applied to OUs and Groups, which allow an action that may be denied after evaluating a policy at a higher level, then access will be allowed.
+
+To enforce a device policy that requires company-owned devices, Google needs a list of serial numbers for company-owned devices.
+
+### Policies
+
+#### GWS.COMMONCONTROLS.2.1v0.1
+Policies restricting access to GWS based on signals about enterprise devices SHOULD be implemented.
+
+- Rationale
+ - Granular device access control afforded by context-aware access is in alignment with Federal zero trust strategy and principles. Context-aware access can help to increase the security of your GWS data by allowing you to restrict access to certain applications or services based on the user's context.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1098: Account Manipulation](https://attack.mitre.org/techniques/T1098/)
+ - [T1098:005: Account Manipulation: Device Registration](https://attack.mitre.org/techniques/T1098/005/)
+
+#### GWS.COMMONCONTROLS.2.2v0.1
+Use of context-aware access for more granular controls, including using Advanced Mode (CEL), MAY be maximized and tailored if necessary.
+
+- Rationale
+ - Granular device access control afforded by context-aware access is in alignment with Federal zero trust strategy and principles. Context-aware access can help to increase the security of your GWS data by allowing you to restrict access to certain applications or services based on the user and/or device context. Advanced Mode's Common Expressions Language (CEL) gives administrators the ability to tailor access policies for devices, time-based use cases, authentication, and to combine multiple conditions into tailored controls.
+- Last Modified: July 11, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1098: Account Manipulation](https://attack.mitre.org/techniques/T1098/)
+ - [T1098:005: Account Manipulation: Device Registration](https://attack.mitre.org/techniques/T1098/005/)
+
+### Resources
+
+- [GWS Admin Help \| Context-Aware Access overview](https://support.google.com/a/answer/9275380)
+- [GWS Admin Help \| Context-Aware Access examples for Basic mode](https://support.google.com/a/answer/9587667)
+- [GWS Admin Help \| Context-Aware Access examples for Advanced mode](https://support.google.com/a/answer/11368990)
+- [GWS Admin Help \| Device management security checklist](https://support.google.com/a/answer/7422256)
+- [GWS Admin Help \| Set up guide: Deploy company-owned devices in Google endpoint management](https://support.google.com/a/answer/10287358)
+- [GWS Admin Help \| Turn endpoint verification on or off](https://support.google.com/a/answer/9007320)
+- [GWS Admin Help \| Set up guide: Deploy company-owned devices in Google endpoint management—Steps 1 and 2](https://support.google.com/a/answer/10287358#zippy=%2Cstep-sign-up-for-enterprise-management-services%2Cstep-source-devices)
+- [GitHub \| Google \| Google Common Expressions Language (CEL)](https://github.com/google/cel-spec)
+- [Google Cloud Access Context Manager \| Macros for CEL expressions](https://cloud.google.com/access-context-manager/docs/custom-access-level-spec#macros_for_cel_expressions)
+- [Google Cloud Access Context Manager \| Custom access level specification](https://cloud.google.com/access-context-manager/docs/custom-access-level-spec)
+- [GWS Blog \| Enable advanced context-aware access to Google Workspace in the Admin console](https://workspaceupdates.googleblog.com/2021/11/enable-advanced-context-aware-access-to.html)
+- [GWS Admin Help \| Google Workspace Device management security checklist](https://support.google.com/a/answer/7422256)
+- [GWS Admin Help \| Deploy Context-Aware Access](https://support.google.com/a/answer/12643733)
+
+### Prerequisites
+
+- One or more of the following user roles should have been configured to set context-aware policies:
+
+ > Super admin
+
+ > Delegated admin with each of these privileges:
+
+ - Data Security -\> Access level management
+
+ - Data Security -\> Rule management
+
+ - Admin API Privileges -\> Groups\>Read
+
+ - Admin API Privileges -\> Users\>Read
+
+- Serial numbers may be required to enforce a policy for company-owned devices. Refer to [Google documentation](https://support.google.com/a/answer/10287358) on device management for additional guidance.
+
+### Implementation
+
+#### GWS.COMMONCONTROLS.2.1v0.1 Instructions
+To turn on Context-Aware Access:
+
+1. Access the [Google Admin console](https://admin.google.com/).
+2. From the menu, go to **Security** -\> **Access and data control** -\> **Context-Aware Access**.
+3. Verify **Context-Aware Access** is **ON for everyone**. If not, click **Turn On**.
+
+#### GWS.COMMONCONTROLS.2.2v0.1 Instructions
+Note that the implementation details of context-aware access use cases will vary per agency. Refer to [Google's documentation](https://support.google.com/a/answer/12643733) on implementing context-aware access for your specific use cases. Common use cases include:
+
+- Require company-owned on desktop but not on mobile device
+- Require basic device security
+- Allow access to contractors only through the corporate network
+- Block access from known hijacker IP addresses
+- Allow or disallow access from specific locations
+- Use nested access levels instead of selecting multiple access levels during assignment
+
+## 3. Login Challenges
+
+Login challenges are additional security measures used to verify a user's identity. For example, Google might ask the user to confirm their recovery email before logging in as part of a challenge.
+
+### Policies
+
+#### GWS.COMMONCONTROLS.3.1v0.1
+Login Challenges SHALL be enabled when third party SAML SSO is in use.
+
+- Rationale
+ - Many organizations use third-party identity providers (IdPs) to authenticate users who use single sign on (SSO) through SAML. The third-party IdP authenticates users and no additional risk-based challenges are presented to them. Any Google 2-Step Verification (2SV) configuration is ignored. This is the default behavior. You can set a policy to allow additional risk-based authentication challenges and 2SV if it's configured. If Google receives a valid SAML assertion (authentication information about the user) from the IdP during user sign-in, Google can present additional challenges to the user.
+ - Login challenges requires users have a recovery phone number or email account associated with their organizational account. If not previously configured, users will be prompted to enter this information periodically until provided.
+ - One login challenge option prompts users to enter their employee ID. This method is susceptible to information gathering attacks, should a list of employee IDs ever be leaked.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1110: Brute Force](https://attack.mitre.org/techniques/T1110/)
+ - [T1110:001: Brute Force: Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
+ - [T1110:002: Brute Force: Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
+ - [T1110:003: Brute Force: Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
+
+### Resources
+
+- [GWS Admin Help \| Protect Google Workspace accounts with security challenges](https://support.google.com/a/answer/6002699)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- When using Employee ID challenge, the Employee ID must be uploaded to Google Workspace through the Agency's Identity Management infrastructure (e.g., via GCDS).
+
+### Implementation
+
+#### GWS.COMMONCONTROLS.3.1v0.1 Instructions
+1. Sign in to [Google Admin console](https://admin.google.com) as an administrator.
+2. Select **Security**-\>**Authentication**-\>**Login challenges.**
+3. Under **Organizational units**, ensure that the name for the entire organization is selected.
+4. Click **Post-SSO verification**, then select **Ask users for additional verifications from Google if a sign-in looks suspicious, and always apply 2-Step Verification policies (if configured)**. Click **SAVE**.
+5. Optionally, if employee IDs are known to agency employees (or accessible to the employee outside of Google Workspace), they may be used.
+6. Click **Login challenges**.
+7. Select the **Use employee ID to keep my users more secure** checkbox.
+8. Click **SAVE**.
+
+## 4. User Session Duration
+
+This control allows configuring of limits on how long a GWS session can be active before being prompted for authentication credentials.
+
+Note: If using a third-party IdP, and agency-set web session lengths for its users, then there will be a need to set the IdP session length parameter to expire before the Google session expires to ensure users are forced to sign in again. See [GWS documentation](https://support.google.com/a/answer/7576830) for additional details.
+
+### Policies
+
+#### GWS.COMMONCONTROLS.4.1v0.1
+Users SHALL be forced to re-authenticate after an established 12-hour GWS login session has expired.
+
+- Rationale
+ - This is to ensure that a session is not active without needing to reauthenticate for a longer period of time as this creates a higher potential for unauthorized access.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1550: Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550/)
+ - [T1550:004: Use Alternate Authentication Material: Web Session Cookie](https://attack.mitre.org/techniques/T1550/004/)
+ - [T1078: Valid Accounts](https://attack.mitre.org/techniques/T1078/)
+ - [T1078:004: Valid Accounts: Cloud Accounts](https://attack.mitre.org/techniques/T1078/004/)
+
+### Resources
+
+- [GWS Admin Help \| Set session length for Google services](https://support.google.com/a/answer/7576830?hl=en)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.COMMONCONTROLS.4.1v0.1 Instructions
+To configure Google session control:
+
+1. Sign in to the [Google Admin console](https://admin.google.com) as an administrator.
+2. Select **Security.**
+3. Select **Access and data control** -\> **Google session control.**
+4. Look for the **Web session duration** heading.
+5. Set the duration to **12 hours.**
+
+## 5. Secure Passwords
+
+Per NIST 800-63 and OMB M-22-09, ensure that user passwords do not expire and that long passwords are chosen. Research indicates that frequent password rotation breeds poor password choice and encourages password reuse. Ensure that passwords are strong to defend against brute-force attacks. Ensure that passwords are not reused to defend against credential theft.
+
+### Policies
+
+#### GWS.COMMONCONTROLS.5.1v0.1
+User password strength SHALL be enforced.
+
+- Rationale
+ - Strong password policies protect an organization by prohibiting the use of weak passwords.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1110: Brute Force](https://attack.mitre.org/techniques/T1110/)
+ - [T1110:001: Brute Force: Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
+ - [T1110:002: Brute Force: Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
+ - [T1110:003: Brute Force: Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
+
+#### GWS.COMMONCONTROLS.5.2v0.1
+User password length SHALL be at least 12 characters.
+
+- Rationale
+ - Strong password policies protect an organization by prohibiting the use of weak passwords.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1110: Brute Force](https://attack.mitre.org/techniques/T1110/)
+ - [T1110:001: Brute Force: Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
+ - [T1110:002: Brute Force: Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
+ - [T1110:003: Brute Force: Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
+
+#### GWS.COMMONCONTROLS.5.3v0.1
+Password policy SHALL be enforced at next sign-in.
+
+- Rationale
+ - Strong password policies protect an organization by prohibiting the use of weak passwords.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1110: Brute Force](https://attack.mitre.org/techniques/T1110/)
+ - [T1110:001: Brute Force: Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
+ - [T1110:002: Brute Force: Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
+ - [T1110:003: Brute Force: Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
+
+#### GWS.COMMONCONTROLS.5.4v0.1
+User passwords SHALL NOT be reused.
+
+- Rationale
+ - Strong password policies protect an organization by prohibiting the use of weak passwords.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1110: Brute Force](https://attack.mitre.org/techniques/T1110/)
+ - [T1110:001: Brute Force: Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
+ - [T1110:002: Brute Force: Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
+ - [T1110:003: Brute Force: Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
+
+#### GWS.COMMONCONTROLS.5.5v0.1
+User passwords SHALL NOT expire.
+
+- Rationale
+ - Strong password policies protect an organization by prohibiting the use of weak passwords.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1110: Brute Force](https://attack.mitre.org/techniques/T1110/)
+ - [T1110:001: Brute Force: Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
+ - [T1110:002: Brute Force: Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
+ - [T1110:003: Brute Force: Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
+
+### Resources
+
+- [GWS Admin Help \| Enforce and monitor password requirements for users](https://support.google.com/a/answer/139399?hl=en#zippy=%2Cwhat-makes-a-password-strong)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To configure a strong password policy is configured, use the Google Workspace Admin Console:
+
+#### Policy Group 5 common Instructions
+1. Sign in to the [Google Admin console](https://admin.google.com) as an administrator.
+2. Select **Security** -\> **Authentication.**
+3. Locate **Password management.**
+4. Follow implementation for each individual policy.
+5. Select **Save**.
+
+#### GWS.COMMONCONTROLS.5.1v0.1 Instructions
+1. Under **Strength**, select the **Enforce strong password** checkbox.
+
+#### GWS.COMMONCONTROLS.5.2v0.1 Instructions
+1. Under **Length**, set **Minimum Length** to 12+.
+
+#### GWS.COMMONCONTROLS.5.3v0.1 Instructions
+1. Under **Strength and Length enforcement**, select the **Enforce password policy at next sign-in** checkbox.
+
+#### GWS.COMMONCONTROLS.5.4v0.1 Instructions
+1. Under **Reuse**, deselect the **Allow password reuse** checkbox.
+
+#### GWS.COMMONCONTROLS.5.5v0.1 Instructions
+1. Under **Expiration**, select **Never Expires.**
+
+## 6. Highly Privileged Accounts
+
+Highly privileged accounts represent significant risk to an agency if compromised or if insiders use them in an unauthorized way. Highly privileged accounts share the same risk factors related to the catastrophic impacts on GWS services, user community and agency data, if compromised. This section supports the definition of highly privileged accounts and the controls necessary to protect them.
+
+Pre-Built GWS Admin Roles considered highly privileged:
+
+- Super Admin: This role possesses critical control over the entire GWS structure. It has access to all features in the Admin Console and Admin API and can manage every aspect of agency GWS accounts.
+- User Management Admin: This account has rights to add, remove, and delete normal users in addition to managing all user passwords, security settings, and other management tasks that make it potentially crucial if compromised.
+- Services Admin: This admin has full rights to turn on or off GWS services and security settings for these services (Gmail, Drive, Voice, etc.). Given that most GWS features are premised on these services being secure, compromise of this account would be critical.
+- Mobile Admin: This admin has full rights to manage all the agency mobile devices including authorizing their use and controlling the apps that can be downloaded and used on them. This admin can also set the security policies on all agency mobile devices connected to GWS.
+- Groups Admin: This admin has full rights to view profiles in the organizational and OU structures and can manage all rights for those members in the group.
+
+### Policies
+
+#### GWS.COMMONCONTROLS.6.1v0.1
+Agencies SHALL ensure that all accounts with highly privileged roles are separate administrative accounts, distinct from the ordinary day to day accounts of those personnel.
+
+- Rationale
+ - This helps ensure that the accounts with admin privileges are only used when performing admin tasks and that for ordinary tasks personnel use a lower-privileged account.
+- Last Modified: July 11, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1110: Brute Force](https://attack.mitre.org/techniques/T1110/)
+ - [T1110:001: Brute Force: Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
+ - [T1110:002: Brute Force: Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
+ - [T1110:003: Brute Force: Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
+ - [T1556: Modifying Authentication Process](https://attack.mitre.org/techniques/T1556/)
+ - [T1556:006: Modifying Authentication Process: Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006/)
+
+#### GWS.COMMONCONTROLS.6.2v0.1
+All highly privileged accounts SHALL leverage Google Account authentication with phishing-resistant MFA and not the agency's authoritative on-premises or federated identity system.
+
+- Rationale
+ - Provides a stronger and more centralized form of authentication which provides stronger protections against compromises.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1110: Brute Force](https://attack.mitre.org/techniques/T1110/)
+ - [T1110:001: Brute Force: Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
+ - [T1110:002: Brute Force: Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
+ - [T1110:003: Brute Force: Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
+ - [T1556: Modifying Authentication Process](https://attack.mitre.org/techniques/T1556/)
+ - [T1556:006: Modifying Authentication Process: Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006/)
+
+### Resources
+
+- [Google Cloud Architecture Center \| Best practices for planning accounts and organizations](https://cloud.google.com/architecture/identity/best-practices-for-planning)
+- [GWS Admin Help \| Create, edit, and delete custom admin roles](https://support.google.com/a/answer/2406043)
+- [GWA Admin Help \| Assign Specific Admin Roles](https://support.google.com/a/answer/9807615?hl=en)
+- [GWA Admin Help \| Pre-Built Admin Roles](https://support.google.com/a/answer/2405986?hl=en)
+
+### Prerequisites
+
+- Super admin users cannot log in to admin.google.com with a 3rd party IdP when using Super Admin level accounts—they must use Google Login as the authentication mechanism. This policy extends this rule to other Admin types.
+- Delegated accounts, including the ones defined as highly privileged above, can by default, use a third-party IdP to access admin.google.com: however, this policy prohibits that practice. All highly privileged accounts must use phishing resistant Google Authentication.
+
+### Implementation
+
+#### GWS.COMMONCONTROLS.6.1v0.1 Instructions
+1. The implementation process for this can be located [here](https://support.google.com/a/answer/9807615).
+
+#### GWS.COMMONCONTROLS.6.2v0.1 Instructions
+1. The implementation process for this can be located [here](https://support.google.com/a/answer/9807615).
+
+## 7. Super Admin Accounts
+
+Super Admin is the highest privileged role in GWS because it provides unfettered access to the organization. Therefore, if a user's credential with these permissions were to be compromised, it would present significant risks to the security of the organization. Limit the number of users that are assigned the role of Super Administrator. Assign users to finer-grained administrative roles that they need to perform their duties instead of being assigned the Super Administrator role.
+
+### Policies
+
+#### GWS.COMMONCONTROLS.7.1v0.1
+A minimum of **two** and maximum of **four** separate and distinct Super Admin users SHALL be configured.
+
+- Rationale
+ - Having only a single Super Admin Account can be problematic if this user were unavailable for an extended period of time. Also, Super Admin accounts should not be shared amongst multiple users.
+ - In addition, having too many super admins could be problematic as then there are many users with those privileges which creates a larger security risk
+- Last Modified: July 10, 2023
+- Note: Admin count does not include "break-glass" Super Admin accounts.
+
+
+- MITRE ATT&CK TTP Mapping
+ - [T1136: Create Account](https://attack.mitre.org/techniques/T1136/)
+ - [T1136:003: Create Account: Cloud Account](https://attack.mitre.org/techniques/T1136/003/)
+ - [T1098: Account Manipulation](https://attack.mitre.org/techniques/T1098/)
+ - [T1098:003: Account Manipulation: Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003/)
+
+### Resources
+
+- [Google Cloud Architecture Center \| Best practices for planning accounts and organizations](https://cloud.google.com/architecture/identity/best-practices-for-planning)
+- [GWS Admin Help \| Create, edit, and delete custom admin roles](https://support.google.com/a/answer/2406043)
+- [GWS Admin Help \| Assign Specific Admin Roles](https://support.google.com/a/answer/9807615?hl=en)
+- [GWS Admin Help \| Pre-Built Admin Roles](https://support.google.com/a/answer/2405986?hl=en)
+- [GWS Admin SDK Documentation \| Make User Super Admin](https://developers.google.com/admin-sdk/directory/reference/rest/v1/users/makeAdmin)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.COMMONCONTROLS.7.1v0.1 Instructions
+To obtain a list of all GWS Super Admins:
+
+1. Sign in to the [Google Admin console](https://admin.google.com) as an administrator.
+2. Navigate to **Account** -\> **Admin Roles**.
+3. Click the **Super Admin** role in the list of roles
+4. The subsequent dialog provides a list of Super Admins.
+
+## 8. Conflicting Account Management
+
+It is possible for employees of an organization to create conflicting, unmanaged accounts that are unmanaged by an enterprise's Google Workspace tenant. Unmanaged accounts are defined as users who independently created a Google account using the organization's domain. For example, a user with an enterprise/corporate email of user@company.com could create a personal, unmanaged Google account using that email address. This would create an account conflict in a GWS tenant licensed to company.com since email addresses are unique.
+
+Creating a conflicting account can also happen unintentionally. After signing up for Google Cloud Identity or Google Workspace, admins might decide to set up single sign-on with an external identity provider (IdP) such as Azure Active Directory (AD) or Active Directory. When configured, the external IdP might automatically create accounts in Cloud Identity or Google Workspace for all users for which single sign-on was enabled, inadvertently creating conflicting accounts.
+
+Unmanaged accounts carry significant risk, as they cannot be managed by admins, rendering them outside of the scope of protection admins can apply to keep work data secure. Significantly, two-step verification (2SV) cannot be enforced. Even if access is revoked, these accounts can carry a social engineering risk. Further, reconciling conflicting accounts creates churn for admins and adds to the workload of onboarding users to Google Workspace & Google Cloud.
+
+The GWS admin console provides several administrative options for handling conflicting, unmanaged accounts:
+ - Automatically invite users to transfer unmanaged accounts.
+ - Replace unmanaged accounts with managed ones.
+ - Don't create new accounts if unmanaged accounts exist.
+
+This policy requires replacing unmanaged accounts with managed ones. When this option is configured, data owned by the account will not be imported; the user will receive a temporary account address, which they'll need to manually replace with a @gmail.com address of their choice; the user will receive an email notification of this and are informed they cannot use the original email any longer.
+
+By changing the email address, the user resolves the conflict by ensuring that the managed account and consumer account have different identities. The result remains that they have one consumer account that has all their original data, and one managed account that doesn't have access to the original data.
+
+### Policies
+
+#### GWS.COMMONCONTROLS.8.1v0.1
+Account conflict management SHALL be configured to replace conflicting unmanaged accounts with managed ones.
+
+- Rationale
+ - As per Google, if employees of an organization use unmanaged accounts, then the premise of having a single place to manage user identities is compromised. Unmanaged accounts aren't managed by Google Workspace or Cloud Identity. Therefore, the ideal security course of action for government agencies is to replace conflicting unmanaged accounts with managed ones, rather than allowing a grace period or doing nothing with such accounts.
+ - Per Google, unmanaged personal accounts that use a business email address carry multiple risks, including the following:
+ - You can't control the lifecycle of an unmanaged user account. An employee who leaves the company might continue to use the unmanaged account to access corporate resources or to generate corporate expenses.
+ - Even if you revoke access to all resources, the unmanaged account might still pose a social engineering risk. Because the user account uses a seemingly trustworthy identity with your company's domain name, the former employee might be able to convince current employees or business partners to grant access to resources again—for example, a sensitive Drive file.
+ - A former employee with an unmanaged account might use the user account to perform activities that aren't in line with your organization's policies, which could put your company's reputation at risk.
+ - You can't enforce security policies like 2-step verification or password complexity rules.
+ - You can't restrict which geographic location Docs and Drive data is stored in, which might be a compliance risk.
+ - You can't restrict which Google services can be accessed by an unmanaged user account.
+ - Reconciling conflicting accounts creates churn for admins and adds to the workload of onboarding users to Google Workspace & Google Cloud.
+ - Note that if unmanaged accounts are used for official federal government business, they may be subject to record-keeping requirements under the Federal Records Act, 44 U.S.C. Chapter 31 et seq.
+- Last Modified: September 14, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1136: Create Account](https://attack.mitre.org/techniques/T1136/)
+ - [T1136:003: Create Account: Cloud Account](https://attack.mitre.org/techniques/T1136/003/)
+ - [T1098: Account Manipulation](https://attack.mitre.org/techniques/T1098/)
+ - [T1098:003: Account Manipulation: Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003/)
+ - [T1078: Valid Accounts](https://attack.mitre.org/techniques/T1078/)
+
+### Resources
+
+- [GWS Admin Help | Use the transfer tool to migrate unmanaged users](https://support.google.com/a/answer/6178640)
+- [GWS Admin Help | Find and add unmanaged users](https://support.google.com/a/answer/11112794)
+- [Google Workspace Updates Blog | Resolve conflict accounts faster with the new Conflict Accounts Management tool](https://workspaceupdates.googleblog.com/2023/08/conflict-accounts-management-tool.html)
+- [Google Cloud Architecture Center | Migrating consumer accounts](https://cloud.google.com/architecture/identity/migrating-consumer-accounts#using_a_conflicting_account)
+- [Google Cloud Architecture Center | Best practices for planning accounts and organizations](https://cloud.google.com/architecture/identity/best-practices-for-planning)
+
+### Prerequisites
+
+- Super Admin privileges
+
+### Implementation
+#### GWS.COMMONCONTROLS.8.1v0.1 Instructions
+
+To configure account conflict management per the policy:
+1. Sign in to the [Google Admin console](https://admin.google.com) as an administrator.
+2. Navigate to **Account** -\> **Account settings.**
+3. Click the **Conflicting accounts management** card.
+4. Select the radio button option: **"Replace conflicting unmanaged accounts with managed ones."**
+5. Click **Save.**
+
+## 9. Catastrophic Recovery Options for Super Admins
+
+If a catastrophic event occurs in which the GWS Super Admin credentials are lost or stolen, this control is in place to require "break-glass" Super Admin accounts. These accounts are to be physically secured in a highly secure location as a recovery option, with the account self-recovery feature disabled in GWS.
+
+### Policies
+
+#### GWS.COMMONCONTROLS.9.1v0.1
+A second, "break-glass" Super Admin account SHALL be created and physically secured for each individual Super Admin user to mitigate account access issues resulting from catastrophic credential loss or compromise.
+
+- Rationale
+ - Having a "break-glass" account for each super admin is important in case the super admin loses access to their account and needs to recover it.
+ - Only using this account for recovery provides a benefit of being able to track when they recover their account as the access to the "break-glass" account would indicate a recovery.
+ - Keeping it physically secure ensures there is no unauthorized access to the account.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1556: Modifying Authentication Process](https://attack.mitre.org/techniques/T1556/)
+ - [T1556:006: Modifying Authentication Process: Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006/)
+
+#### GWS.COMMONCONTROLS.9.2v0.1
+Account self-recovery for Super Admins SHALL be disabled, forcing Super Admin users who have lost their login credentials to contact another Super Admin to recover their account.
+
+- Rationale
+ - This makes it more difficult for a potential adversary from being able to attempt to gain access to a super admin account through the method of account recovery.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1556: Modifying Authentication Process](https://attack.mitre.org/techniques/T1556/)
+ - [T1556:006: Modifying Authentication Process: Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006/)
+
+#### GWS.COMMONCONTROLS.9.3v0.1
+"Break-glass" account credentials SHALL be used only if all Super Admins have lost their credentials.
+
+- Rationale
+ - This helps ensure that their is limited access to the "break-glass" account keeping the credentials to those accounts secure and not exposing them to potentially being leaked.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1556: Modifying Authentication Process](https://attack.mitre.org/techniques/T1556/)
+ - [T1556:006: Modifying Authentication Process: Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006/)
+
+#### GWS.COMMONCONTROLS.9.4v0.1
+A geographically separate and secure location SHOULD be planned and implemented to store "break-glass" account credentials for Super Admins.
+
+- Rationale
+ - Keeping break glass credentials in a separate and secure location helps prevent against losing the credentials if something happens to the primary location.
+ - In addition, provides extra security as the credentials are kept separate from where an attacker would most likely look.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1556: Modifying Authentication Process](https://attack.mitre.org/techniques/T1556/)
+ - [T1556:006: Modifying Authentication Process: Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006/)
+
+### Resources
+
+- [GWS Admin Help \| Allow super administrators to recover their password](https://support.google.com/a/answer/9436964?fl=1)
+- [GWS Admin Help \| Recover an account protected by 2-Step Verification](https://support.google.com/a/answer/9176734?hl=en)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.COMMONCONTROLS.9.1v0.1 Instructions
+To configure break glass Super Admin account:
+
+1. Follow standard instructions for setting up a GWS normal user
+2. Follow these instructions for upgrading user to a Super Admin
+3. Link: [https://support.google.com/a/answer/172176](https://support.google.com/a/answer/172176?hl=en&fl=1)
+4. Follow the guidance in this document for setting up phishing resistant MFA for the Super Admin
+5. Store the MFA credentials for this account in a highly protected safe or secured room
+6. Set up multi-factor and/or multi-person access to the secured area
+
+#### GWS.COMMONCONTROLS.9.2v0.1 Instructions
+To disable Super Admin account self-recovery:
+
+1. Sign in to https://admin.google.com as an administrator.
+2. Select **Security** -\> **Authentication.**
+3. Select **Account Recovery**.
+4. Click **Super admin account recovery**.
+5. To apply the setting to all your Super Admins, leave the top OU selected. Otherwise, select a child OU or a configuration group.
+6. Deselect the **Allow Super Admins to recover their account** checkbox.
+7. Click **Save**.
+8. Ask your Super Admins to set up a recovery phone number or email address for receiving password recovery instructions.
+
+#### GWS.COMMONCONTROLS.9.3v0.1 Instructions
+1. There are no implementation steps for this policy.
+
+#### GWS.COMMONCONTROLS.9.4v0.1 Instructions
+1. There are no implementation steps for this policy.
+
+## 10. GWS Advanced Protection Program
+
+This control enforces more secure protection of highly privileged, senior executive and sensitive users accounts from targeted attacks. It enforces optional GWS user security features like:
+
+- Strong authentication with security keys
+- Use of security codes with security keys
+- Restrictions on third-party access to account data
+- Deep Gmail scans
+- Google Safe Browsing protections in Chrome
+- Account recovery through admin
+
+### Policies
+
+#### GWS.COMMONCONTROLS.10.1v0.1
+Highly privileged accounts SHALL be enrolled in the GWS Advanced Protection Program.
+
+- Rationale
+ - Sophisticated phishing tactics can trick even the most savvy users into giving their sign-in credentials to attackers. Advanced Protection requires you to use a security key, which is a hardware device or special software on your phone used to verify your identity, to sign in to your Google Account. Unauthorized users won't be able to sign in without your security key, even if they have your username and password.
+ - The Advanced Protection Program includes a curated group of high-security policies that are applied to enrolled accounts. Additional policies may be added to the Advanced Protection Program to ensure the protections are current.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1110: Brute Force](https://attack.mitre.org/techniques/T1110/)
+ - [T1110:001: Brute Force: Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
+ - [T1110:002: Brute Force: Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
+ - [T1110:003: Brute Force: Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
+ - [T1556: Modifying Authentication Process](https://attack.mitre.org/techniques/T1556/)
+ - [T1556:006: Modifying Authentication Process: Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006/)
+
+#### GWS.COMMONCONTROLS.10.2v0.1
+All sensitive user accounts SHOULD be enrolled into the GWS Advanced Protection Program. This control enforces more secure protection of sensitive user accounts from targeted attacks. Sensitive user accounts include political appointees, Senior Executive Service (SES) officials, or other senior officials whose account compromise would pose a level of risk prohibitive to agency mission fulfillment.
+
+- Rationale
+ - Sophisticated phishing tactics can trick even the most savvy users into giving their sign-in credentials to attackers. Advanced Protection requires you to use a security key, which is a hardware device or special software on your phone used to verify your identity, to sign in to your Google Account. Unauthorized users won't be able to sign in without your security key, even if they have your username and password.
+ - The Advanced Protection Program includes a curated group of high-security policies that are applied to enrolled accounts. Additional policies may be added to the Advanced Protection Program to ensure the protections are current.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1110: Brute Force](https://attack.mitre.org/techniques/T1110/)
+ - [T1110:001: Brute Force: Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
+ - [T1110:002: Brute Force: Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
+ - [T1110:003: Brute Force: Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
+ - [T1556: Modifying Authentication Process](https://attack.mitre.org/techniques/T1556/)
+ - [T1556:006: Modifying Authentication Process: Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006/)
+
+### Resources
+
+- [GWS Admin Help \| Protect users with the Advanced Protection Program](https://support.google.com/a/answer/9378686)
+- [GWS Admin Help \| Advanced Protection Program FAQ](https://support.google.com/a/answer/9503534?hl=en)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- Two security keys are required for added assurance. If one key is lost or damaged, users can use the second key to regain account access.
+
+### Implementation
+
+#### Policy Group 10 Instructions
+To allow all users to enroll:
+
+1. Sign in to the [Google Admin console](https://admin.google.com) as an administrator.
+2. Select **Security -**\> **Authentication** -\> **Advanced Protection Program.**
+3. On the right, locate the **Advanced Protection** header.
+4. Locate the **Allow users to enroll in the Advanced Protection Program** header.
+5. Select **Enable user enrollment.**
+6. Click **SAVE.**
+
+## 11. App Access to Google APIs
+
+Agencies need to have a process in place to manage and control application access to GWS data. This control enables the ability to restrict access to Google Workspace APIs from other applications and is aimed at mitigating the significant cybersecurity risk posed by the potential compromise of OAuth tokens. The baseline policy statements are written to allow implementers to balance operational need with risk posed by granting app access.
+
+### Policies
+
+#### GWS.COMMONCONTROLS.11.1v0.1
+Agencies SHALL develop and implement a process to explicitly allow-list (trust) third-party app access to GWS services.
+
+- Rationale
+ - Prevents unauthorized access to GWS through the GWS API which provides additional protection against cyber attacks.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1550: Use Alternate Authentication Materials](https://attack.mitre.org/techniques/T1550/)
+ - [T1550:001: Use Alternate Authentication Materials: Application Access Token](https://attack.mitre.org/techniques/T1550/001/)
+ - [T1195: Supply Chain Compromise](https://attack.mitre.org/techniques/T1195/)
+ - [T1195:002: Supply Chain Compromise: Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)
+ - [T1059: Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059/)
+ - [T1059:009: Command and Scripting Interpreter: Cloud API](https://attack.mitre.org/techniques/T1059/009/)
+
+#### GWS.COMMONCONTROLS.11.2v0.1
+Agencies SHALL use GWS application access control policies to restrict access to all GWS services by third party apps.
+
+- Rationale
+ - You can restrict (or leave unrestricted) access to most Workspace services, including Google Cloud Platform services such as Machine Learning. For Gmail and Google Drive, you can specifically restrict access to high-risk scopes (for example, sending Gmail or deleting files in Drive). While users are prompted to consent to apps, if an app uses restricted scopes and you haven't specifically trusted it, users can't add it.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1550: Use Alternate Authentication Materials](https://attack.mitre.org/techniques/T1550/)
+ - [T1550:001: Use Alternate Authentication Materials: Application Access Token](https://attack.mitre.org/techniques/T1550/001/)
+ - [T1195: Supply Chain Compromise](https://attack.mitre.org/techniques/T1195/)
+ - [T1195:002: Supply Chain Compromise: Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)
+ - [T1059: Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059/)
+ - [T1059:009: Command and Scripting Interpreter: Cloud API](https://attack.mitre.org/techniques/T1059/009/)
+
+#### GWS.COMMONCONTROLS.11.3v0.1
+Agencies SHALL NOT allow users to consent to access to low-risk scopes.
+
+- Rationale
+ - Allowing users to give access to OAuth scopes that aren't classified as high-risk could still allow for apps that are not trusted to be granted access by non-administrator personnel and without having to be allowlisted in accordance with 11.1.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1550: Use Alternate Authentication Materials](https://attack.mitre.org/techniques/T1550/)
+ - [T1550:001: Use Alternate Authentication Materials: Application Access Token](https://attack.mitre.org/techniques/T1550/001/)
+ - [T1195: Supply Chain Compromise](https://attack.mitre.org/techniques/T1195/)
+ - [T1195:002: Supply Chain Compromise: Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)
+ - [T1059: Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059/)
+ - [T1059:009: Command and Scripting Interpreter: Cloud API](https://attack.mitre.org/techniques/T1059/009/)
+
+#### GWS.COMMONCONTROLS.11.4v0.1
+Agencies SHALL NOT trust unconfigured internal apps.
+
+- Rationale
+ - By not trusting unconfigured apps it is ensuring the platform remains secure as unconfigured apps could be unsecure and create vulnerabilities within the whole system.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1550: Use Alternate Authentication Materials](https://attack.mitre.org/techniques/T1550/)
+ - [T1550:001: Use Alternate Authentication Materials: Application Access Token](https://attack.mitre.org/techniques/T1550/001/)
+ - [T1195: Supply Chain Compromise](https://attack.mitre.org/techniques/T1195/)
+ - [T1195:002: Supply Chain Compromise: Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)
+ - [T1059: Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059/)
+ - [T1059:009: Command and Scripting Interpreter: Cloud API](https://attack.mitre.org/techniques/T1059/009/)
+
+#### GWS.COMMONCONTROLS.11.5v0.1
+Agencies SHALL NOT allow users to access unconfigured third-party apps.
+
+- Rationale
+ - Not allowing access to unconfigured apps helps ensure the platform remains secure as unconfigured apps could be unsecure and create vulnerabilities within the whole system.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1550: Use Alternate Authentication Materials](https://attack.mitre.org/techniques/T1550/)
+ - [T1550:001: Use Alternate Authentication Materials: Application Access Token](https://attack.mitre.org/techniques/T1550/001/)
+ - [T1195: Supply Chain Compromise](https://attack.mitre.org/techniques/T1195/)
+ - [T1195:002: Supply Chain Compromise: Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)
+ - [T1059: Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059/)
+ - [T1059:009: Command and Scripting Interpreter: Cloud API](https://attack.mitre.org/techniques/T1059/009/)
+
+
+### Resources
+
+- [RFC 6819](https://datatracker.ietf.org/doc/html/rfc6819)
+- [RFC 6749](https://datatracker.ietf.org/doc/html/rfc6749)
+- [OMB M-22-09](https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf)
+- [GWS Admin Help \| Control which third-party & internal apps access GWS data](https://support.google.com/a/answer/7281227#zippy=%2Cstep-control-api-access%2Cstep-restrict-or-unrestrict-google-services%2Cbefore-you-begin-review-authorized-third-party-apps%2Cstep-manage-third-party-app-access-to-google-services-add-apps)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### Policy Group 11 Instructions
+1. Sign in to [Google Admin console](https://admin.google.com).
+2. Go to **Security** -\> **Access and Data Control** -\> **API controls.**
+
+#### GWS.COMMONCONTROLS.11.1v0.1 instructions:
+1. There are no implementation steps for this policy
+
+#### GWS.COMMONCONTROLS.11.2v0.1 instructions:
+1. Select **Manage Google Services.**
+2. Select the **Services box** to check all services boxes.
+3. Once this box is selected, then the **Change access** link at the top of console will be available; select it.
+4. Select **Restricted: Only trusted apps can access a service.**
+5. Select **Change** then **confirm** if prompted.
+
+#### GWS.COMMONCONTROLS.11.3v0.1 instructions:
+1. Select **Manage Google Services.**
+2. Select the **Services box** to check all services boxes.
+3. Once this box is selected, then the **Change access** link at the top of console will be available; select it.
+4. Ensure to uncheck the check box next to **For apps that are not trusted, allow users to give access to OAuth scopes that aren't classified as high-risk.**
+5. Select **Change** then **confirm** if prompted.
+
+#### GWS.COMMONCONTROLS.11.4v0.1 Instructions
+1. Select **Settings.**
+2. Select **Unconfigured third-party apps** and select **Don't allow users to access any third-party apps**
+3. Select **SAVE.**
+
+#### GWS.COMMONCONTROLS.11.5v0.1 Instructions
+1. Select **Settings.**
+2. Select **Internal apps** and uncheck the box next to **Trust internal apps.**
+3. Select **SAVE.**
+
+It should be noted that admins will have to manually approve each trusted app. The implementation steps for this activity are outlined in Google's [documentation on controlling which third-party & internal apps access GWS data](https://support.google.com/a/answer/7281227) (also listed under Resources).
+
+## 12. Authorized Google Marketplace Apps
+
+This section enables the ability to restrict the installation of Google Workspace Marketplace apps to a defined list provided and configured in the app allowlist. This guidance includes and applies to internally developed applications.
+
+### Policies
+
+#### GWS.COMMONCONTROLS.12.1v0.1
+Policy SHOULD be established dictating the app review and approval process.
+
+- Rationale
+ - Helps ensures a standardized procedure for approving apps for marketplace and ensures it is documented.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1195: Supply Chain Compromise](https://attack.mitre.org/techniques/T1195/)
+ - [T1195:002: Supply Chain Compromise: Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)
+
+#### GWS.COMMONCONTROLS.12.2v0.1
+Only approved Google Workspace Marketplace applications SHOULD be allowed for installation.
+
+- Rationale
+ - Users should only be allowed to install approved and vetted apps. This includes internally developed applications which being allowed without proper vetting poses a significant insider risk. This will help limit the overall attack surface for the organization.
+- Last Modified: October 24, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1195: Supply Chain Compromise](https://attack.mitre.org/techniques/T1195/)
+ - [T1195:002: Supply Chain Compromise: Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)
+
+### Resources
+
+- [GWS Admin Help \| Manage Google Workspace Marketplace apps on your allowlist](https://support.google.com/a/answer/6089179?fl=1)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.COMMONCONTROLS.12.1v0.1 Instructions
+1. There are no implementation steps for this policy
+
+#### GWS.COMMONCONTROLS.12.2v0.1 Instructions
+1. Sign in to the [Google Admin console](https://admin.google.com) as an administrator.
+2. Select **Apps** -\> **Google Workspace Marketplace apps** -\> **Settings.**
+3. Select **Allow users to install and run allowlisted apps from the Marketplace.**
+4. Ensure that the **Allow exception for internal apps. Users can install and run any internal app, even if it is not allowlisted.** checkbox is unchecked.
+5. Click **Save.**
+
+To add an app to the allowlist:
+1. On the left-hand side above **Setting,** click **Apps lists.**
+2. Click the **ALLOWLIST APP** to add an app to the allow list.
+
+ or
+
+3. Click **Allowlisted Apps** to manage the allow list.
+
+## 13. Less Secure Apps
+
+This control disables legacy authentication and requires the use of modern authentication protocols based on federation for access from applications.
+
+Some older versions of common software may break when this control is implemented. Examples of these apps include:
+
+- Mails configured with POP3
+- Older versions of Outlook
+
+### Policies
+
+#### GWS.COMMONCONTROLS.13.1v0.1
+Access to Google Workspace applications by less secure apps that do not meet security standards for authentication SHALL be prevented.
+
+- Rationale
+ - You can block sign-in attempts from some apps or devices that are less secure. Apps that are less secure don't use modern security standards, such as OAuth. Using apps and devices that don't use modern security standards increases the risk of accounts being compromised. Blocking these apps and devices helps keep your users and data safe.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1110: Brute Force](https://attack.mitre.org/techniques/T1110/)
+ - [T1110:001: Brute Force: Password Guessing](https://attack.mitre.org/techniques/T1110/001/)
+ - [T1110:002: Brute Force: Password Cracking](https://attack.mitre.org/techniques/T1110/002/)
+ - [T1110:003: Brute Force: Password Spraying](https://attack.mitre.org/techniques/T1110/003/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+
+### Resources
+
+- [GWS Admin Help \| Control access to less secure apps](https://support.google.com/a/answer/6260879?hl=en)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.COMMONCONTROLS.13.1v0.1 Instructions
+1. Sign in to the [Google Admin console](https://admin.google.com) as an administrator.
+2. Select **Security.**
+3. Select **Access and data control** -\> **Less secure apps.**
+4. Select **Disable access to less secure apps (Recommended).**
+5. Click **Save** to commit this configuration change.
+
+## 14. Google Takeout Services for Users
+
+This section prevents users from downloading a copy of the Google Takeout service's data to their user accounts. Services include Google Blogger, Books, Maps, Pay, Photos, Play, Play Console, Location History and YouTube, among numerous others.
+
+### Policies
+
+#### GWS.COMMONCONTROLS.14.1v0.1
+Google Takeout services SHALL be disabled for users.
+
+- Rationale
+ - Google Takeout is a service that allows you to download a copy of your data stored within 40+ Google products and services. This includes data from Gmail, Drive, Photos, Calendar, and many others. You can download your data in a variety of formats, including ZIP, TAR, and XML. While there may be a valid use case for individuals to backup their data in non-enterprise settings, this feature represents considerable attack surface as a mass data exfiltration mechanism, particularly in enterprise settings where other backup mechanisms are likely in use.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+### Resources
+
+- [GWS Admin Help \| Security checklist for medium and large businesses](https://support.google.com/a/answer/7587183?hl=en#zippy=%2Caccounts%2Capps-google-workspace-only%2Csites-google-workspace-only%2Cdrive%2Cgoogle-groups)
+- [GWS Admin Help \| Allow or block Google Takeout](https://support.google.com/a/answer/6396995#managing&zippy=)
+
+### Prerequisites
+
+- Determine which OU or access group will be affected by this policy and confirm that the right user and system accounts are in that OU or access group.
+
+### Implementation
+
+#### GWS.COMMONCONTROLS.14.1v0.1 Instructions
+1. Sign in to https://admin.google.com as an administrator.
+2. Select **Account** then **Google Takeout.**
+3. Select **User access to Takeout for Google services**.
+4. For services without an individual admin control, select **Services without an individual admin control** then **Edit.**
+5. Select **Don't allow for everyone**.
+6. Click **Save**.
+7. For services with an individual admin control, under **apps** select the checkbox next to **Service name** and select **Don't allow**.
+8. Click **Save.**
+
+## 15. System-defined Rules
+
+GWS includes system-defined alerting rules that provide situational awareness into risky events and actions. A security best practice is to enable the following list of rules. Please note that some, but not all, of these rules may be set to "on" by default. Rules that are not listed may be useful but not security relevant. Review all system-defined rules to implement the appropriate configuration based on individual requirements.
+
+- Google security checklist for medium and large businesses
+- Government-backed attacks
+- User-reported phishing
+- User's Admin privilege revoked
+- User suspended for spamming through relay
+- User suspended for spamming
+- User suspended due to suspicious activity
+- User suspended (Google identity alert)
+- User suspended (by admin)
+- User granted Admin privilege
+- User deleted
+- Suspicious programmatic login
+- Suspicious message reported
+- Suspicious login
+- Suspicious device activity
+- Suspended user made active
+- Spike in user-reported spam
+- Rate limited recipient
+- Phishing message detected post-delivery
+- Phishing in inboxes due to bad allowlist
+- New user added
+- Mobile settings changed
+- Malware message detected post-delivery
+- Leaked password
+- Google Operations
+- Gmail potential employee spoofing
+- Email settings changed
+- Drive settings changed
+- Domain data export initiated
+- Device compromised
+- Calendar settings changed
+- Account suspension warning
+- Client-side encryption service unavailable
+
+### Policies
+
+#### GWS.COMMONCONTROLS.15.1v0.1
+Required system-defined alerting rules, as listed in the Policy section, SHALL be active, with alerts enabled when available. Any system-defined rules not are considered optional but ought to be reviewed for consideration.
+
+- Rationale
+ - System-defined rules can allow an administrator to be notified of specific activity within a domain—such as a suspicious sign-in attempt, a compromised mobile device, or when another administrator changes settings.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1562: Impair Defenses](https://attack.mitre.org/techniques/T1562/)
+ - [T1562:001: Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)
+
+### Resources
+
+- [GWS Admin Help \| Data sources for the security investigation tool](https://support.google.com/a/answer/11482175)
+- [GWS Admin Help \| View and edit system-defined rules](https://support.google.com/a/answer/3230421)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.COMMONCONTROLS.15.1v0.1 Instructions
+1. Sign in to [Google Admin console](https://admin.google.com).
+2. On the left navigation pane, click the hamburger menu above **Home**-\>**Show more**.
+3. Click **Rules**.
+4. From the Rules page, click **Add a filter**.
+5. From the drop-down menu, select **Type**.
+6. Select the **System defined** check box.
+7. Click **Apply**.
+8. A list of system defined rules displays. Select one of the rules from the list by clicking the table row for that rule—for example, the Device compromised rule.
+9. From the Rule details page, you can view the conditions and actions for the rule—for example, to confirm if email notifications are turned on, and to confirm the recipients for those email notifications.
+10. Click **Edit Rule**.
+11. Click **Next: View Conditions**.
+12. Click **Next: Add Actions**.
+13. From the Actions page, you can change the severity for the alert to High, Medium, or Low, send an alert to the alert center if the rule's conditions are met, set up admin email notifications, and specify recipients for those notifications.
+14. Click **Next: Review**.
+15. Review the updated rule details, and then click **Update Rule**.
+
+## 16. Google Workspace Logs
+
+Configure GWS to send critical logs to the agency's centralized SIEM so that they can be audited and queried. Configure GWS to send logs to a storage account and retain them for when incident response is needed.
+
+### Policy
+
+#### GWS.COMMONCONTROLS.16.1v0.1
+The following critical logs SHALL be sent at a minimum.
+
+ > Admin Audit logs
+
+ > Enterprise Groups Audit logs
+
+ > Login Audit logs
+
+ > OAuth Token Audit logs
+
+ > SAML Audit log
+
+ > Context Aware Access logs
+
+- Rationale
+ - OMB M-21-31, Improving the Federal Government's Investigative and Remediation Capabilities Related to Cybersecurity Incidents, provides guidance on log retention for federal agencies. The memorandum defines the types of logs that must be retained at each maturity level for log retention.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1562: Impair Defenses](https://attack.mitre.org/techniques/T1562/)
+ - [T1562:008: Impair Defenses: Disable Cloud Logs](https://attack.mitre.org/techniques/T1562/008/)
+
+#### GWS.COMMONCONTROLS.16.2v0.1
+Audit logs SHALL be maintained for at least 6 months in active storage and an additional 18 months in cold storage, as dictated by OMB M-21-31. The logs SHALL be sent to the agency's Security Operations Center (SOC) for monitoring.
+
+- Rationale
+ - OMB M-21-31, Improving the Federal Government's Investigative and Remediation Capabilities Related to Cybersecurity Incidents, provides guidance on log retention for federal agencies. The memorandum defines three maturity levels for log retention, with each level requiring different minimum retention periods.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1562: Impair Defenses](https://attack.mitre.org/techniques/T1562/)
+ - [T1562:008: Impair Defenses: Disable Cloud Logs](https://attack.mitre.org/techniques/T1562/008/)
+
+### Resources
+
+- [GWS Admin Help \| Share data with Google Cloud Platform services](https://support.google.com/a/answer/9320190)
+- [Google Cloud Operations Suite \| Audit logs for Google Workspace](https://cloud.google.com/logging/docs/audit/gsuite-audit-logging)
+- [Google Cloud Operations Suite \| View and manage audit logs for Google Workspace](https://cloud.google.com/logging/docs/audit/configure-gsuite-audit-logs)
+- [Google Cloud Operations Suite \| Aggregate and store your organization's logs](https://cloud.google.com/logging/docs/central-log-storage)
+- [Google Cloud Architecture Center \| Google Logging export scenarios](https://cloud.google.com/architecture/design-patterns-for-exporting-stackdriver-logging?hl=en#logging_export_scenarios)
+- [GWS Admin Help \| Data sources for GWS Audit and investigation page](https://support.google.com/a/answer/9725452)
+- [Google Cloud Operations Suite \| Configure and Manage sinks – Google Cloud](https://cloud.google.com/logging/docs/export/configure_export_v2)
+- [OMB M-21-31 \| Office of Management and Budget](https://www.whitehouse.gov/wp-content/uploads/2021/08/M-21-31-Improving-the-Federal-Governments-Investigative-and-Remediation-Capabilities-Related-to-Cybersecurity-Incidents.pdf)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.COMMONCONTROLS.16.1v0.1 Instructions
+1. Sign in to the [Google Admin console](https://admin.google.com) as an administrator.
+2. Go to Menu [Account \> Account settings \> Legal and compliance](https://admin.google.com/ac/companyprofile/legal).
+3. Click **Sharing options.**
+4. Select **Enabled.**
+5. Click **Save**.
+
+#### GWS.COMMONCONTROLS.16.2v0.1 Instructions
+1. There is no implementation for this policy.
+
+## 17. Data Regions
+
+Google Workspace administrators can choose to store data in a specific geographic region (currently the United States or Europe) by using a data region policy. The policy can be applied to a specific organizational unit (OU) in a tenant or at the parent OU. For the interests of Federal agencies, the best practice is to restrict stored data for all users to the U.S. This means applying this setting at the parent OU. Data region storage covers the primary data-at-rest (including backups) for Google Workspace core services (see resources section for services in scope).
+
+At the time of writing, data region policies cannot be applied to data types not specifically listed in documentation linked in the resources section. Notably, this includes logs and cached content.
+
+### Policy
+
+#### GWS.COMMONCONTROLS.17.1v0.1
+The data storage region SHALL be set to be the United States for all users in the agency's GWS environment.
+
+- Rationale
+ - This policy is aligned with the concept of data sovereignty. Ensuring that data is stored in a specific region (in this case, the U.S. for FCEB agencies) affords the administrator of the GWS environment a degree of control and governance over their cloud data.
+ - FCEB agencies may need to meet specific regulations for various data classifications including data governance, security controls, privacy, and data residency. Being able to establish data sovereignty and identify residency regions can aid in these efforts.
+- Last Modified: October 30, 2023
+
+### Resources
+- [GWS Admin Help \| Data regions: Choose a geographic location for your data](https://support.google.com/a/answer/7630496)
+- [GWS Admin Help \| What data is covered by a data region policy?](https://support.google.com/a/answer/9223653)
+
+### Prerequisites
+
+- Super Admin role
+
+### Implementation
+
+#### GWS.COMMONCONTROLS.17.1v0.1 Instructions
+To configure Data Regions per the policy:
+1. Sign in to the [Google Admin console](https://admin.google.com) as an administrator.
+2. Navigate to **Account** -> **Account settings**.
+3. Click the **Data Regions** card.
+4. Click the **Data Regions** policy card.
+5. Select the radio button option: "**United States**"
+6. Click **Save**.
+
+## 18. Supplemental Data Storage
+
+Google Workspace administrators have the option to store a copy of users’ data in a specific country. This is accomplished by enabling Supplemental Data Storage in the Google Admin console. You can do this for some or all of your users. Google will then store those users’ data on servers based in the country you select, in addition to Google’s existing data centers. The following Google Workspace core services are included in this feature: Gmail, Google Calendar, Google Groups for Business, Google Drive, and Google Contacts.
+
+Google will periodically backup users’ data to servers located in the country specified.
+
+### Policy
+
+#### GWS.COMMONCONTROLS.18.1v0.1
+The supplemental data storage region SHALL NOT be set to 'Russian Federation'.
+
+- Rationale
+ - This policy is aligned with the concept of data sovereignty. Ensuring that data is not stored in a specific region affords the administrator of the GWS environment a degree of control and governance over their cloud data. This policy takes into account geopolitical and USG national security concerns.
+- Last Modified: November 30, 2023
+
+### Resources
+- [GWS Admin Help \| Set up Supplemental Data Storage](https://support.google.com/a/answer/6281927)
+
+### Prerequisites
+- Super Admin role
+
+### Implementation
+
+#### GWS.COMMONCONTROLS.18.1v0.1 Instructions
+To configure Supplemental Data Storage per the policy:
+1. Sign in to the [Google Admin console](https://admin.google.com) as an administrator.
+2. Navigate to **Account** -> **Account settings**.
+3. Click the **Supplemental Data Storage** card.
+4. Ensure the checkbox for "**Russian Federation**" is unchecked.
+6. Click **Save**.
diff --git a/baselines/Gmail Minimum Viable Secure Configuration Baseline v0.1.md b/baselines/Gmail Minimum Viable Secure Configuration Baseline v0.1.md
new file mode 100644
index 00000000..7a9795e9
--- /dev/null
+++ b/baselines/Gmail Minimum Viable Secure Configuration Baseline v0.1.md
@@ -0,0 +1,1592 @@
+# CISA Google Workspace Security Configuration Baseline for Gmail
+
+Gmail is the Google Workspace offering for sending and receiving email. Users can upload attachments to emails and send them to a given email address. Additional Gmail features include integrating with other Google applications, such as Meet and Chat. This Secure Configuration Baseline (SCB) provides specific policies to strengthen Gmail security.
+
+The Secure Cloud Business Applications (SCuBA) project provides guidance and capabilities to secure agencies' cloud business application environments and protect federal information that is created, accessed, shared, and stored in those environments. The SCuBA Secure Configuration Baselines (SCB) for Google Workspace (GWS) will help secure federal civilian executive branch (FCEB) information assets stored within GWS cloud environments through consistent, effective, modern, and manageable security configurations.
+
+The CISA SCuBA SCBs for GWS help secure federal information assets stored within GWS cloud business application environments through consistent, effective, and manageable security configurations. CISA created baselines tailored to the federal government's threats and risk tolerance with the knowledge that every organization has different threat models and risk tolerance. Non-governmental organizations may also find value in applying these baselines to reduce risks.
+
+The information in this document is being provided "as is" for INFORMATIONAL PURPOSES ONLY. CISA does not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial entities or commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoritism by CISA.
+
+This baseline is based on Google documentation available at the [Gmail Google Workspace Admin Help Center](https://support.google.com/a/topic/9202?hl=en&ref_topic=9197) and addresses the following:.
+
+- [Mail Delegation](#1-mail-delegation)
+- [Domain Keys Identified Mail](#2-domainkeys-identified-mail)
+- [Sender Policy Framework](#3-sender-policy-framework)
+- [Domain Based Message Authentication, Reporting, and Conformance](#4-domain-based-message-authentication-reporting-and-conformance)
+- [Attachment Protections](#5-attachment-protections)
+- [Links and External Images Protections](#6-links-and-external-images-protection)
+- [Spoofing and Authentication Protection](#7-spoofing-and-authentication-protection)
+- [User Email Uploads](#8-user-email-uploads)
+- [POP and IMAP Access](#9-pop-and-imap-access-for-users)
+- [Workspace Sync](#10-google-workspace-sync)
+- [Automatic Forwarding](#11-automatic-forwarding)
+- [Image URL Proxy Allowlists](#12-image-url-proxy-allowlists)
+- [Per User Outbound Gateways](#13-per-user-outbound-gateways)
+- [Unintended External Reply Warning](#14-unintended-external-reply-warning)
+- [Email Allowlist](#15-email-allowlist)
+- [Enhanced Pre-Delivery Message Scanning](#16-enhanced-pre-delivery-message-scanning)
+- [Security Sandbox](#17-security-sandbox)
+- [Approved Senders List](#18-approved-senders-list)
+- [Blocked Senders List](#19-blocked-senders-list)
+- [Comprehensive Mail Storage](#20-comprehensive-mail-storage)
+- [Content Compliance Filtering](#21-content-compliance-filtering)
+- [Objective Content Filtering](#22-objectionable-content-filtering)
+- [Attachment Compliance Filtering](#23-attachment-compliance-filtering)
+
+
+Within Google Workspace, settings can be assigned to users through organizational units, configuration groups, or individually. Before changing a setting, the user can select the organizational unit, configuration group, or individual users to which they want to apply changes.
+
+## Assumptions
+
+This document assumes the organization is using GWS Enterprise Plus.
+
+This document does not address, ensure compliance with, or supersede any law, regulation, or other authority. Entities are responsible for complying with any recordkeeping, privacy, and other laws that may apply to the use of technology. This document is not intended to, and does not, create any right or benefit for anyone against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person.
+
+## Key Terminology
+
+The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.
+
+# Baseline Policies
+
+## 1. Mail Delegation
+
+This section determines whether users can delegate access to their mailbox to others within the same domain. This delegation includes access to read, send, and delete messages on the account owner's behalf. This delegation can be done via a command line tool (GAM) if enabled in the admin console.
+
+### Policies
+
+#### GWS.GMAIL.1.1v0.1
+Mail Delegation SHOULD be disabled.
+
+- Rationale
+ - Mail delegation can be a useful tool for delegating email management tasks to trusted individuals. However, it does pose the potential for risks such as unintentional disclosure of sensitive information, impersonation of delegated accounts, and malicious deletion or modification of emails.
+- Last Modified: October 4, 2023
+- Notes
+ - Exceptions should be limited to individuals authorized by existing Agency policy, such as SES or Politically Appointed staff. Other considerations include ensuring that delegated accounts require Phishing-Resistant Multi-Factor Authentication (MFA), limiting delegated account permissions (ex. allowing view/reply but not delete), monitoring delegated accounts regularly, and disabling them if no longer required.
+
+- MITRE ATT&CK TTP Mapping
+ - [T098: Account Manipulation](https://attack.mitre.org/techniques/T1098/)
+ - [T098:002: Account Manipulation: Additional Email Delegate Permissions](https://attack.mitre.org/techniques/T1098/002/)
+
+### Resources
+
+- [Google Workspace Admin Help: Turn Gmail delegation on or off](https://support.google.com/a/answer/7223765?hl=en)
+- [GAM: Example Email Settings - Creating a Gmail delegate](https://github.com/GAM-team/GAM/wiki/ExamplesEmailSettings#creating-a-gmail-delegate)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.GMAIL.1.1v0.1 Instructions
+To configure the settings for Mail Delegation:
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **User Settings -\> Mail delegation**.
+4. Ensure that the **Let users delegate access to their mailbox to other users in the domain** checkbox is unchecked.
+5. Select **Save**.
+
+
+## 2. DomainKeys Identified Mail
+
+This section enables DomainKeys Identified Mail (DKIM) to help prevent spoofing on outgoing messages sent from a specific domain. DKIM allows digital signatures to be added to email messages in the message header, providing a layer of both authenticity and integrity to emails. Without DKIM, messages that are sent from a specific domain are more likely to be marked as spam by receiving mail servers. DKIM relies on Domain Name System (DNS) records, thus, its deployment depends on how an agency manages its DNS.
+
+### Policies
+
+#### GWS.GMAIL.2.1v0.1
+DKIM SHOULD be enabled for all domains.
+
+- Rationale
+ - An adversary may modify the `FROM` field of an email such that it appears to be a legitimate email sent by an agency, facilitating phishing attacks. Enabling DKIM is a means for recipients to detect spoofed emails and verify the integrity of email content.
+- Last Modified: November 13, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1434: Internal Spear Phishing](https://attack.mitre.org/techniques/T1434/)
+
+### Resources
+
+- [Binding Operational Directive 18-01 - Enhance Email and Web Security \| DHS](https://cyber.dhs.gov/bod/18-01/)
+- [Trustworthy Email \| NIST 800-177 Rev. 1](https://csrc.nist.gov/publications/detail/sp/800-177/rev-1/final)
+- [Google Workspace Admin Help: Help prevent spoofing and spam with DKIM](https://support.google.com/a/answer/174124)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.GMAIL.2.1v0.1 Instructions
+To configure the settings for DKIM:
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **Authenticate email -\> DKIM authentication**.
+4. Select a domain listed in the **Selected** domain drop-down menu.
+5. Select **START AUTHENTICATION**.
+6. Select **Save**.
+7. Add the DNS TXT record listed in Admin Console to the domain, via the domain provider's DNS settings page. Note that it can take up to 48 hours for DNS changes to fully propagate.
+
+Note that step 7 requires action taken outside of the Google Admin Console, dependent on the agency's domain provider. Thus, the exact final step needed to set up DKIM varies from agency to agency. See [Turn on DKIM for your domain](https://support.google.com/a/answer/180504) for more details.
+
+To test your DKIM configuration, consider using a web-based tool, such as the [Google Admin Toolbox](https://toolbox.googleapps.com/apps/checkmx/).
+
+## 3. Sender Policy Framework
+
+The Sender Policy Framework (SPF) is a mechanism that allows domain administrators to specify which IP addresses are explicitly approved to send email on behalf of the domain, facilitating detection of spoofed emails. SPF isn't configured through the Google Admin Console, but rather via DNS records hosted by the agency's domain. Thus, the exact steps needed to set up SPF varies from agency to agency, but Google's documentation provides some helpful starting points.
+
+### Policies
+
+#### GWS.GMAIL.3.1v0.1
+A list of approved IP addresses for sending mail SHALL be maintained.
+
+- Rationale
+- Failing to maintain an accurate list of authorized IP addresses may result in spoofed email messages or failure to deliver legitimate messages when SPF is enabled. Maintaining such a list helps ensure that unauthorized servers sending spoofed messages can be detected, and permits message delivery from legitimate senders.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1078: Valid Accounts](https://attack.mitre.org/techniques/T1078/)
+ - [T1078:004: Valid Accounts: Cloud Accounts](https://attack.mitre.org/techniques/T1078/004/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1566:003: Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
+
+#### GWS.GMAIL.3.2v0.1
+An SPF policy SHALL be published for each domain, designating only these addresses as approved senders.
+
+- Rationale
+ - An adversary may modify the `FROM` field of an email such that it appears to be a legitimate email sent by an agency, facilitating phishing attacks. Publishing an SPF policy for each agency domain mitigates forged `FROM` fields by providing a means for recipients to detect emails spoofed in this way. SPF is required for federal, executive branch, departments and agencies by Binding Operational Directive 18-01, "Enhance Email and Web Security."
+- Last Modified: November 13, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1078: Valid Accounts](https://attack.mitre.org/techniques/T1078/)
+ - [T1078:004: Valid Accounts: Cloud Accounts](https://attack.mitre.org/techniques/T1078/004/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1566:003: Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
+
+### Resources
+
+- [Binding Operational Directive 18-01 - Enhance Email and Web Security \| DHS](https://cyber.dhs.gov/bod/18-01/)
+- [Trustworthy Email \| NIST 800-177 Rev. 1](https://csrc.nist.gov/publications/detail/sp/800-177/rev-1/final)
+- [Google Workspace Admin Help: Help prevent spoofing and spam with SPF](https://support.google.com/a/answer/33786#to-do)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.GMAIL.3.1v0.1 Instructions
+Identify any approved senders specific to your agency (see [Identify all email senders for your organization](https://support.google.com/a/answer/10686639#senders) for tips). Additionally, see [Define your SPF record—Basic setup](https://support.google.com/a/answer/10685031) for inclusions required for Google to send email on behalf of your domain.
+
+#### GWS.GMAIL.3.2v0.1 Instructions
+SPF is not configured through the Google Workspace admin center, but rather via DNS records hosted by the agency's domain. Thus, the exact steps needed to set up SPF varies from agency to agency. See [Add your SPF record at your domain provider](https://support.google.com/a/answer/10684623) for more details.
+
+To test your SPF configuration, consider using a web-based tool, such as the [Google Admin Toolbox](https://toolbox.googleapps.com/apps/checkmx/). Additionally, SPF records can be requested using the command line tool `dig`. For example:
+```
+dig example.com txt
+```
+If SPF is configured, a response resembling `v=spf1 include:_spf.google.com -all` will be returned; though by necessity, the contents of the SPF policy may vary by agency. In this example, the SPF policy indicates the IP addresses listed by the policy for "_spf.google.com" are the only approved senders for "example.com." These IPs can be determined via additional SPF lookups, starting with "_spf.google.com." Ensure the IP addresses listed as approved senders for your domain are those identified for GWS.GMAIL.3.1v0.1. See [Define your SPF record—Advanced setup](https://support.google.com/a/answer/10683907) for a more in-depth discussion of SPF record syntax.
+
+## 4. Domain-based Message Authentication, Reporting, and Conformance
+
+
+Domain-based Message Authentication, Reporting, and Conformance (DMARC) works with SPF and DKIM to authenticate mail senders and ensure that destination email systems can validate messages sent from your domain. DMARC helps receiving mail systems determine what to do with messages sent from your domain that fail SPF or DKIM checks.
+
+### Policies
+
+#### GWS.GMAIL.4.1v0.1
+A DMARC policy SHALL be published for every second-level domain.
+
+- Rationale
+ - Without a DMARC policy available for each domain, recipients may improperly handle SPF and DKIM failures, possibly enabling spoofed emails to reach end users' mailboxes. By publishing DMARC records at the second-level domain, the second-level domains and all subdomains will be protected.
+- Last Modified: November 13, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - None
+
+#### GWS.GMAIL.4.2v0.1
+The DMARC message rejection option SHALL be p=reject.
+
+- Rationale
+ - Of the three policy options (i.e., none, quarantine, and reject), reject provides the strongest protection. Reject is the level of protection required by BOD 18-01 for federal, executive branch, departments and agencies.
+- Last Modified: November 13, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1566:003: Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
+ - [T1586:002: Compromise Accounts](https://attack.mitre.org/techniques/T1586/)
+ - [T1586:002: Compromise Accounts: Email Accounts](https://attack.mitre.org/techniques/T1586/002/)
+
+#### GWS.GMAIL.4.3v0.1
+The DMARC point of contact for aggregate reports SHALL include `reports@dmarc.cyber.dhs.gov`.
+
+- Rationale
+ - Email spoofing attempts are not inherently visible to domain owners. DMARC provides a mechanism to receive reports of spoofing attempts. Including reports@dmarc.cyber.dhs.gov as a point of contact for these reports gives CISA insight into spoofing attempts and is required by Binding Operational Directive 18-01, "Enhance Email and Web Security" for federal, executive branch, departments and agencies.
+- Last Modified: November 13, 2023
+- Note: Only federal, executive branch, departments and agencies should include this email address in their DMARC record.
+
+- MITRE ATT&CK TTP Mapping
+ - None
+
+#### GWS.GMAIL.4.4v0.1
+An agency point of contact SHOULD be included for aggregate and failure reports.
+
+- Rationale
+ - Email spoofing attempts are not inherently visible to domain owners. DMARC provides a mechanism to receive reports of spoofing attempts. Including an agency point of contact gives the agency insight into attempts to spoof their domains.
+- Last Modified: November 13, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - None
+
+### Resources
+
+- [Binding Operational Directive 18-01 - Enhance Email and Web Security \| DHS](https://cyber.dhs.gov/bod/18-01/)
+- [Trustworthy Email \| NIST 800-177 Rev. 1](https://csrc.nist.gov/publications/detail/sp/800-177/rev-1/final)
+- [Domain-based Message Authentication, Reporting, and Conformance (DMARC) \| RFC 7489](https://datatracker.ietf.org/doc/html/rfc7489)
+- [Google Workspace Admin Help: Help prevent spoofing and spam with DMARC](https://support.google.com/a/answer/2466580)
+
+### Prerequisites
+
+- DKIM or SPF must be enabled
+
+### Implementation
+
+#### GWS.GMAIL.4.1v0.1 Instructions
+DMARC is not configured through the Google Admin Console, but rather via DNS records hosted by the agency's domain(s). As such, implementation varies depending on how an agency manages its DNS records. See [Add your DMARC record](https://support.google.com/a/answer/2466563) for Google guidance.
+
+Note, a DMARC record published at the second-level domain will protect all subdomains. In other words, a DMARC record published for `example.com` will protect both `a.example.com` and `b.example.com`, but a separate record would need to be published for `c.example.gov`.
+
+To test your DMARC configuration, consider using one of many publicly available web-based tools, such as the [Google Admin Toolbox](https://toolbox.googleapps.com/apps/checkmx/). Additionally, DMARC records can be requested using the command line tool `dig`. For example:
+
+```
+dig _dmarc.example.com txt
+```
+
+If DMARC is configured, a response resembling `v=DMARC1; p=reject; pct=100; rua=mailto:reports@dmarc.cyber.dhs.gov, mailto:reports@example.com; ruf=mailto:reports@example.com` will be returned, though by necessity, the contents of the record will vary by agency. In this example, the policy indicates all emails failing the SPF/DKIM checks are to be rejected and aggregate reports sent to reports@dmarc.cyber.dhs.gov and reports@example.com. Failure reports will be sent to reports@example.com.
+
+#### GWS.GMAIL.4.2v0.1 Instructions
+See [GWS.GMAIL.4.1v1](#gwsgmail41v01-instructions) instructions for an overview of how to publish and check a DMARC record. Ensure the record published includes `p=reject`.
+
+#### GWS.GMAIL.4.3v0.1 Instructions
+See [GWS.GMAIL.4.1v1](#gwsgmail41v01-instructions) instructions for an overview of how to publish and check a DMARC record. Ensure the record published includes reports@dmarc.cyber.dhs.gov as one of the emails for the `rua` field.
+
+#### GWS.GMAIL.4.4v0.1 Instructions
+See [GWS.GMAIL.4.1v1](#gwsgmail41v01-instructions) instructions for an overview of how to publish and check a DMARC record. Ensure the record published includes a point of contact specific to your agency, in addition to reports@dmarc.cyber.dhs.gov, as one of the emails for the `rua` field and one or more agency-defined points of contact for the `ruf` field.
+
+## 5. Attachment Protections
+
+This section enables protections against suspicious attachments and scripts from untrusted senders, to include encrypted attachments, documents with malicious scripts, and attachment file types that are uncommon and/or archaic. Through these attachments malware can be spread. These messages can be kept in the inbox with a warning label (default), moved to spam, or quarantined.
+
+A Google Workspace solution is not strictly required to satisfy this baseline control, but the solution selected by an agency should offer services comparable to those offered by Google.
+
+### Policies
+
+#### GWS.GMAIL.5.1v0.1
+Protect against encrypted attachments from untrusted senders SHALL be enabled.
+
+- Rationale
+ - Protect users from potentially malicious attachments that are employing obfuscation tactics for payload delivery.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1566:003: Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
+ - [T1204: User Execution](https://attack.mitre.org/techniques/T1204/)
+ - [T1204:001: User Execution: Malicious Link](https://attack.mitre.org/techniques/T1204/001/)
+ - [T1204:002: User Execution: Malicious File](https://attack.mitre.org/techniques/T1204/002/)
+ - [T1204:003: User Execution: Malicious Image](https://attack.mitre.org/techniques/T1204/003/)
+
+#### GWS.GMAIL.5.2v0.1
+Protect against attachments with scripts from untrusted senders SHALL be enabled.
+
+- Rationale
+ - Protect users from downloading and executing potentially malicious attached scripts.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1566:003: Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
+ - [T1204: User Execution](https://attack.mitre.org/techniques/T1204/)
+ - [T1204:001: User Execution: Malicious Link](https://attack.mitre.org/techniques/T1204/001/)
+ - [T1204:002: User Execution: Malicious File](https://attack.mitre.org/techniques/T1204/002/)
+ - [T1204:003: User Execution: Malicious Image](https://attack.mitre.org/techniques/T1204/003/)
+
+#### GWS.GMAIL.5.3v0.1
+Protect against anomalous attachment types in emails SHALL be enabled.
+
+- Rationale
+ - Protect users from attachments identified as anomalous by this control.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1566:003: Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
+ - [T1204: User Execution](https://attack.mitre.org/techniques/T1204/)
+ - [T1204:001: User Execution: Malicious Link](https://attack.mitre.org/techniques/T1204/001/)
+ - [T1204:002: User Execution: Malicious File](https://attack.mitre.org/techniques/T1204/002/)
+ - [T1204:003: User Execution: Malicious Image](https://attack.mitre.org/techniques/T1204/003/)
+
+#### GWS.GMAIL.5.4v0.1
+Google SHOULD be allowed to automatically apply future recommended settings.
+
+- Rationale
+ - Apply the latest recommended attachment protection settings from Google to limit the need for manual configuration.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - None
+
+#### GWS.GMAIL.5.5v0.1
+Emails flagged by the above attachment protection controls SHALL NOT be kept in inbox.
+
+- Rationale
+ - Helps warn users about the risks of opening a suspicious attachment.
+- Last Modified: September 8, 2023
+- Notes
+ - Agencies and Organizations can choose whether to send email to spam or quarantine
+ - Applies to Policies 5.1 - 5.3
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1566:003: Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
+ - [T1204: User Execution](https://attack.mitre.org/techniques/T1204/)
+ - [T1204:001: User Execution: Malicious Link](https://attack.mitre.org/techniques/T1204/001/)
+ - [T1204:002: User Execution: Malicious File](https://attack.mitre.org/techniques/T1204/002/)
+ - [T1204:003: User Execution: Malicious Image](https://attack.mitre.org/techniques/T1204/003/)
+
+
+#### GWS.GMAIL.5.6v0.1
+Any third-party or outside application selected for attachment protection SHOULD offer services comparable to those offered by Google Workspace.
+
+- Rationale
+ - A third-party system should provide the same minimum attachment protection functionality provided by Google to maintain a baseline security posture.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - None
+
+
+### Resources
+
+- [Google Workspace Admin Help: Advanced phishing and malware protection](https://support.google.com/a/answer/9157861?product_name=UnuFlow&hl=en&visit_id=637831282628458101-2078141803&rd=1&src=supportwidget0&hl=en#zippy=%2Cturn-on-attachment-protection)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for Attachment Protections:
+
+#### Policies Group 5 common Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **Safety -\> Attachments**.
+4. Follow implementation for each individual policy
+5. Select **Save**.
+
+#### GWS.GMAIL.5.1v0.1 Instructions
+1. Check the **Protect against encrypted attachments from untrusted senders** checkbox.
+
+#### GWS.GMAIL.5.2v0.1 Instructions
+1. Check the **Protect against attachments with scripts from untrusted senders** checkbox.
+
+#### GWS.GMAIL.5.3v0.1 Instructions
+1Ok. Check the **Protect against anomalous attachment types in emails** checkbox
+
+#### GWS.GMAIL.5.4v0.1 Instructions
+1. Check the **Apply future recommended settings automatically** checkbox.
+
+#### GWS.GMAIL.5.5v0.1 Instructions
+1. Under the setting for Policy 5.1 through Policy 5.3, ensure either "Move email to spam" or "Quarantine" is selected.
+
+
+
+#### GWS.GMAIL.5.6v0.1 Instructions
+1. No implementation steps for this policy
+
+
+## 6. Links and External Images Protection
+
+This section enables extra protections to prevent email phishing due to links and external images. Specific settings for this control include identifying hidden malicious links behind shortened URLs, scanning linked images to find hidden malicious content, showing a warning prompt when clicking links to untrusted domains, and applying future recommended settings automatically.
+
+A Google Workspace solution is not strictly required to satisfy this baseline control, but the solution selected by an agency should offer services comparable to those offered by Google.
+
+### Policies
+
+#### GWS.GMAIL.6.1v0.1
+Identify links behind shortened URLs SHALL be enabled.
+
+- Rationale
+ - Phishing links are often obfuscated with URL shorteners. By allowing the identification of links that are behind shortened URLs, this control helps users identify malicious links.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1434: Internal Spearphishing](https://attack.mitre.org/techniques/T1434/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1204: User Execution](https://attack.mitre.org/techniques/T1204/)
+ - [T1204:001: User Execution: Malicious Link](https://attack.mitre.org/techniques/T1204/001/)
+
+#### GWS.GMAIL.6.2v0.1
+Scan linked images SHALL be enabled.
+
+- Rationale
+ - Scanning linked images provides additional protections for potential malware that may be sent via email through an image.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1434: Internal Spearphishing](https://attack.mitre.org/techniques/T1434/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1204: User Execution](https://attack.mitre.org/techniques/T1204/)
+ - [T1204:002: User Execution: Malicious File](https://attack.mitre.org/techniques/T1204/002/)
+
+#### GWS.GMAIL.6.3v0.1
+Show warning prompt for any click on links to untrusted domains SHALL be enabled.
+
+- Rationale
+ - This will provide awareness to users about the risks associated with clicking an unknown link
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1434: Internal Spearphishing](https://attack.mitre.org/techniques/T1434/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1204: User Execution](https://attack.mitre.org/techniques/T1204/)
+ - [T1204:001: User Execution: Malicious Link](https://attack.mitre.org/techniques/T1204/001/)
+
+#### GWS.GMAIL.6.4v0.1
+Google SHALL be allowed to automatically apply future recommended settings.
+
+- Rationale
+ - Apply the latest recommended link and image protection settings from Google to limit the need for manual configuration.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - None
+
+#### GWS.GMAIL.6.5v0.1
+Any third-party or outside application selected for links and external images protection SHOULD offer services comparable to those offered by Google Workspace.
+
+- Rationale
+ - A third-party system should provide the same minimum functionality provided by Google to maintain a baseline security posture.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - None
+
+
+### Resources
+
+- [Google Workspace Admin Help: Advanced phishing and malware protection](https://support.google.com/a/answer/9157861?product_name=UnuFlow&hl=en&visit_id=637831282628458101-2078141803&rd=1&src=supportwidget0&hl=en#zippy=%2Cturn-on-attachment-protection)
+- [Google Workspace Admin Help: Set up rules to detect harmful attachments](https://support.google.com/a/answer/7676854?product_name=UnuFlow&hl=en&visit_id=637831464632988595-2408633144&rd=1&src=supportwidget0&hl=en)
+- [Google Workspace Admin Help: Monitor the health of your Gmail settings](https://support.google.com/a/answer/7490901?product_name=UnuFlow&hl=en&visit_id=637831464698491311-452219641&rd=1&src=supportwidget0&hl=en)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for Links and External Images Protection:
+
+#### Policies Group 6 common Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **Safety -\> Links and external images**.
+4. Follow implementation for each individual policy.
+5. Select **Save**
+
+#### GWS.GMAIL.6.1v0.1 Instructions
+1. Check the **Identify links behind shortened URLs** checkbox.
+
+#### GWS.GMAIL.6.2v0.1 Instructions
+1. Check the **Scan linked images** checkbox.
+
+#### GWS.GMAIL.6.3v0.1 Instructions
+1. Check the **Show warning prompt for any click on links to untrusted domains** checkbox.
+
+#### GWS.GMAIL.6.4v0.1 Instructions
+1. Check the **Apply future recommended settings automatically** checkbox.
+
+#### GWS.GMAIL.6.5v0.1 Instructions
+1. No implementation steps for this policy
+
+
+## 7. Spoofing and Authentication Protection
+
+This control enables extra protections to prevent spoofing of a domain name, employee names, email pretending to be from a specific domain, and unauthenticated email from any domain. These messages can be kept in the inbox with a warning label (default), moved to spam, or quarantined.
+
+A Google Workspace solution is not strictly required to satisfy this baseline control, but the solution selected by an agency should offer services comparable to those offered by Google.
+
+### Policies
+
+#### GWS.GMAIL.7.1v0.1
+Protect against domain spoofing based on similar domain names SHALL be enabled.
+
+- Rationale
+ - Attackers commonly try to trick users into going to a malicious site by using similar domain names. This policy helps protect the organization and users from this type of attempted compromise.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1434: Internal Spearphishing](https://attack.mitre.org/techniques/T1434/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+
+#### GWS.GMAIL.7.2v0.1
+Protect against spoofing of employee names SHALL be enabled.
+
+- Rationale
+ - Attackers will try to phish individuals by spoofing the email/identity of another employee (e.g., CEO and IT staff). Therefore, this provides additional protection against this type of attempted compromise.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1434: Internal Spearphishing](https://attack.mitre.org/techniques/T1434/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+
+#### GWS.GMAIL.7.3v0.1
+Protect against inbound emails spoofing your domain SHALL be enabled.
+
+- Rationale
+ - Attackers will try to phish individuals by spoofing the domain name of your organization. This policy provides additional protection against this type of attempted compromise.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1434: Internal Spearphishing](https://attack.mitre.org/techniques/T1434/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+
+#### GWS.GMAIL.7.4v0.1
+Protect against any unauthenticated emails SHALL be enabled.
+
+- Rationale
+ - This policy provides extra protection from potentially malicious emails, helping safeguard the organization from data leakage and other malware.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1434: Internal Spearphishing](https://attack.mitre.org/techniques/T1434/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+
+#### GWS.GMAIL.7.5v0.1
+Protect your Groups from inbound emails spoofing your domain SHALL be enabled.
+
+- Rationale
+ - This provides protections against phishing attacks using an email address within your domain.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1434: Internal Spearphishing](https://attack.mitre.org/techniques/T1434/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+
+#### GWS.GMAIL.7.6v0.1
+Emails flagged by the above spoofing and authentication controls SHALL NOT be kept in inbox.
+
+- Rationale
+ - Emails that fail Gmail's spoofing and authentication checks may pose a significant risk to users. By moving these emails to either spam or quarantine, the risk of a user inadvertently interacting with these emails is reduced.
+- Last Modified: September 8, 2023
+- Notes
+ - Agencies and organizations can choose whether to send to spam or quarantine
+ - This policy applies to Policy 7.1 - Policy 7.5
+
+- MITRE ATT&CK TTP Mapping
+ - [T1434: Internal Spearphishing](https://attack.mitre.org/techniques/T1434/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+
+
+#### GWS.GMAIL.7.7v0.1
+Google SHALL be allowed to automatically apply future recommended settings.
+
+- Rationale
+ - This allows automatic application of recommended settings from Google.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1434: Internal Spearphishing](https://attack.mitre.org/techniques/T1434/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+
+#### GWS.GMAIL.7.8v0.1
+Any third-party or outside application selected for spoofing and authentication protection SHOULD offer services comparable to those offered by Google Workspace.
+
+- Rationale
+ - A third-party system should provide the same minimum functionality provided by Google.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1434: Internal Spearphishing](https://attack.mitre.org/techniques/T1434/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+
+### Resources
+
+- [Google Workspace Admin Help: Advanced phishing and malware protection](https://support.google.com/a/answer/9157861?product_name=UnuFlow&hl=en&visit_id=637831282628458101-2078141803&rd=1&src=supportwidget0&hl=en#zippy=%2Cturn-on-attachment-protection)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for Spoofing and Authentication Protection:
+
+#### Policies Group 7 common Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **Safety -\> Spoofing and authentication**.
+4. Follow steps for individual policies below.
+5. Select **Save**
+
+#### GWS.GMAIL.7.1v0.1 Instructions
+1. Check the **Protect against domain spoofing based on similar domain names** checkbox.
+
+#### GWS.GMAIL.7.2v0.1 Instructions
+1. Check the **Protect against spoofing of employee names** checkbox.
+
+#### GWS.GMAIL.7.3v0.1 Instructions
+1. Check the **Protect against inbound emails spoofing your domain** checkbox.
+
+#### GWS.GMAIL.7.4v0.1 Instructions
+1. Check the **Protect against any unauthenticated emails** checkbox.
+
+#### GWS.GMAIL.7.5v0.1 Instructions
+1. Check the **Protect your groups from inbound emails spoofing your domain** checkbox.
+
+#### GWS.GMAIL.7.6v0.1 Instructions
+1. Under each setting from Policy 7.1 through Policy 7.5, make sure either "Move email to spam" or "Quarantine" is selected.
+
+
+#### GWS.GMAIL.7.7v0.1 Instructions
+1. Check the **Apply future recommended settings automatically** checkbox.
+
+#### GWS.GMAIL.7.8v0.1 Instructions
+1. There is no implementation for this policy.
+
+
+## 8. User Email Uploads
+
+This section enables users to import their email and contacts from non-Google webmail accounts such as Yahoo!, Hotmail, or AOL.
+
+### Policies
+
+#### GWS.GMAIL.8.1v0.1
+User email uploads SHALL be disabled to protect against unauthorized files being introduced into the secured environment.
+
+- Rationale
+ - This helps ensure that unauthorized files from other webmail providers are not introduced into the secure Gmail environment.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1199: Trusted Relationship](https://attack.mitre.org/techniques/T1199/)
+ - [T1204: User Execution](https://attack.mitre.org/techniques/T1204/)
+ - [T1204:001: User Execution: Malicious Link](https://attack.mitre.org/techniques/T1204/001/)
+ - [T1204:002: User Execution: Malicious File](https://attack.mitre.org/techniques/T1204/002/)
+ - [T1204:003: User Execution: Malicious Image](https://attack.mitre.org/techniques/T1204/003/)
+
+### Resources
+
+- [Google Workspace Admin Help: Advanced Gmail settings reference for admins](https://support.google.com/a/answer/2786758#zippy=%2Csetup-settings)
+- [Google Workspace Admin Help: Turn imports from webmail hosts on or off](https://support.google.com/a/answer/2525613?product_name=UnuFlow&hl=en&visit_id=637832286168108072-385761693&rd=1&src=supportwidget0&hl=en)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for User Email Uploads:
+
+#### GWS.GMAIL.8.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **Setup -\> User email uploads**.
+4. Uncheck the **Show users the option to import mail and contacts from Yahoo!, Hotmail, AOL, or other webmail or POP3 accounts from the Gmail settings page** checkbox.
+5. Select **Save**.
+
+
+## 9. POP and IMAP Access for Users
+
+This section determines whether users have POP3 and IMAP access. Doing so allows the user to access Gmail emails from outside the context of protected/hardened environments and from older versions of Gmail applications or other third-party mail applications.
+
+### Policies
+
+#### GWS.GMAIL.9.1v0.1
+POP and IMAP access SHALL be disabled to protect sensitive agency or organization emails from being accessed through legacy applications or other third-party mail clients.
+
+- Rationale
+ - Disabling POP and IMAP helps prevent use of legacy and unapproved email clients with weaker authentication mechanisms that would increase the risk of email account credential compromise.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1048: Exfilitration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048/)
+ - [T1048:002: Exfilitration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/002/)
+
+#### GWS.GMAIL.9.2v0.1
+POP and IMAP access MAY be enabled on a per-user and per-application basis as needed.
+
+- Rationale
+ - Depending on organizational needs, there are instances where users and applications may need to use these protocols.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1048: Exfilitration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048/)
+ - [T1048:001: Exfilitration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/001/)
+ - [T1048:002: Exfilitration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/002/)
+
+### Resources
+
+- [Google Workspace Admin Help: Turn POP and IMAP on and off for users](https://support.google.com/a/answer/105694?hl=en)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for POP and IMAP access:
+
+#### Policies Group 9 common Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **End User Access -\> POP and IMAP access**.
+4. Follow the implementation for each policy.
+5. Select **Save**.
+
+#### GWS.GMAIL.9.1v0.1 Instructions
+1. Uncheck the **Enable IMAP access for all users** checkbox.
+
+#### GWS.GMAIL.9.2v0.1 Instructions
+1. Uncheck the **Enable POP access for all users** checkbox.
+
+
+## 10. Google Workspace Sync
+
+This section determines whether Google Workspace Sync allows data synchronization between Google Workspace and Microsoft Outlook. The data includes email, calendar, and contacts. Data synchronizes each time users start Outlook. This is an additional plugin that must be downloaded.
+
+### Policies
+
+#### GWS.GMAIL.10.1v0.1
+Google Workspace Sync SHOULD be disabled.
+
+- Rationale
+ - Google Workspace Sync could be used as a data exfiltration mechanism if enabled.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1048: Exfilitration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048/)
+ - [T1048:001: Exfilitration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/001/)
+ - [T1048:002: Exfilitration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/002/)
+ - [T1048:003: Exfilitration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/003/)
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1199: Trusted Relationship](https://attack.mitre.org/techniques/T1199/)
+
+#### GWS.GMAIL.10.2v0.1
+Google Workspace Sync MAY be enabled on a per-user basis as needed.
+
+- Rationale
+ - Users may need access to this feature for organizational needs/tasks.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1048: Exfilitration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048/)
+ - [T1048:001: Exfilitration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/001/)
+ - [T1048:002: Exfilitration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/002/)
+ - [T1048:003: Exfilitration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/003/)
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1199: Trusted Relationship](https://attack.mitre.org/techniques/T1199/)
+
+### Resources
+
+- [Google Workspace Sync for Microsoft Outlook](https://tools.google.com/dlpage/gssmo)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for Google Workspace Sync:
+
+#### Policy Group 10 Common Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **End User Access -\> Google Workspace Sync**.
+
+#### GWS.GMAIL.10.1v0.1 Instructions
+1. Uncheck the **Enable Google Workspace Sync for Microsoft Outlook for my users** checkbox.
+2. Select **Save**.
+
+#### GWS.GMAIL.10.2v0.1 Instructions
+1. There is no implementation steps for this policy.
+2. Select **Save**.
+
+
+## 11. Automatic Forwarding
+
+This section determines whether emails can be automatically forwarded from a user's inbox to another of their choosing, possibly to external domains.
+
+### Policies
+
+#### GWS.GMAIL.11.1v0.1
+Automatic forwarding SHOULD be disabled, especially to external domains.
+
+- Rationale
+ - In the event that an attacker gains control of an end-user account, they could create automatic forwarding rules to exfiltrate data from your environment.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1114: Email Collection](https://attack.mitre.org/techniques/T1114/)
+ - [T1114:003: Email Collection: Email Forwarding Rule](https://attack.mitre.org/techniques/T1114/003/)
+
+### Resources
+- [Google Workspace Admin Help: Disable automatic forwarding](https://support.google.com/a/answer/2491924?hl=en)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for Automatic Forwarding:
+
+#### GWS.GMAIL.11.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **End User Access -\> Automatic forwarding**.
+4. Uncheck the **Allow users to automatically forward incoming email to another address** checkbox.
+5. Select **Save**.
+
+
+## 12. Image URL Proxy Allowlists
+
+This section determines whether image URL proxy allowlists can be used within a domain. These lists allow for a set of domains and a path prefix to be specified for a large group of URLs. In doing so, those URLs will be able to bypass proxy protection to keep links to images intact while protecting users and the domain against image-based security vulnerabilities.
+
+### Policies
+
+#### GWS.GMAIL.12.1v0.1
+Image URL proxy allowlists SHOULD be enabled to avoid broken links to images that are dependent on internal IP addresses within an organization's domain.
+
+- Rationale
+ - To avoid attacks based on image-based vulnerabilities as well as preventing broken image links.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1204: User Execution](https://attack.mitre.org/techniques/T1204/)
+ - [T1204:001: User Execution: Malicious Link](https://attack.mitre.org/techniques/T1204/001/)
+
+### Resources
+
+- [Google Workspace Admin Help: Set up an image URL proxy whitelist](https://support.google.com/a/answer/3299041?amp;ref_topic=9981578&product_name=UnuFlow&hl=en&ref_topic=9981578&visit_id=637832334308346620-2267967707&rd=1&src=supportwidget0&hl=en)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for Image URL Proxy Whitelists:
+
+#### GWS.GMAIL.12.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **End User Access -\> Image URL proxy allowlist**.
+4. In the **Enter image URL patterns** field, enter **image URL proxy whitelist patterns**.
+ 1. A pattern can contain the scheme, the domain, and a path.
+ 2. The pattern must always have a forward slash (/) between the domain and path.
+ 3. If the URL pattern specifies a scheme, then the scheme and the domain must fully match. Otherwise, the domain can partially match the URL suffix.
+ 4. For example, the pattern /google.com matches www.google.com, but not gle.com. The URL pattern can specify a path that's matched against the path prefix.
+5. Select **Save**.
+
+
+## 13. Per-user Outbound Gateways
+
+This section determines whether outgoing mail is delivered only through the Google Workspace mail servers or another specified external SMTP server. With this setting, a user can choose which email address displays in the "From" field.
+
+### Policies
+
+#### GWS.GMAIL.13.1v0.1
+Using a per-user outbound gateway that is a mail server other than the Google Workspace mail servers SHALL be disabled.
+
+- Rationale
+ - Mail sent via external SMTP will circumvent your outbound gateway.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1114: Email Collection](https://attack.mitre.org/techniques/T1114/)
+ - [T1114:002: Email Collection: Remote Email Collection](https://attack.mitre.org/techniques/T1114/002/)
+ - [T1048: Exfilitration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048/)
+ - [T1204:001: User Execution: Malicious Link](https://attack.mitre.org/techniques/T1204/001/)
+ - [T1204:002: User Execution: Malicious File](https://attack.mitre.org/techniques/T1204/002)
+
+### Resources
+
+- [Google Workspace Admin Help: Allow per-user outbound gateways](https://support.google.com/a/answer/176054?hl=en#zippy=%2Cwhy-youd-disallow-use-of-an-outbound-gateway%2Cwhy-youd-allow-use-of-an-outbound-gateway)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for Per-user Outbound Gateways:
+
+#### GWS.GMAIL.13.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **End User Access -\> Allow per-user outbound gateways**.
+4. Uncheck the **Allow users to send mail through an external SMTP server when configuring a "from" address hosted outside your email domain** checkbox.
+5. Select **Save**.
+
+
+## 14. Unintended External Reply Warning
+
+This section determines whether users are prompted with a warning for messages that include external recipients (users with emails addresses that are outside of your organization). However, the warning is not shown if the external recipient is in the organization's Directory, personal Contacts, or other Contacts; or if a secondary domain or domain alias address is used.
+
+### Policies
+
+#### GWS.GMAIL.14.1v0.1
+Unintended external reply warnings SHALL be enabled to avoid unintentional replies and remind users to treat external messages with caution.
+
+- Rationale
+ - As an admin for your organization, you can turn alerts on or off for messages that include external recipients (people with email addresses outside of your organization). These alerts help people avoid unintentional replies, and remind them to treat external messages with caution.
+- Last Modified: July, 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1566:003: Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
+
+### Resources
+
+- [Google Workspace Admin Help: Control Gmail external recipient warnings](https://support.google.com/a/answer/7380041?amp;ref_topic=9974443&product_name=UnuFlow&hl=en&ref_topic=9974443&visit_id=637832389706060412-548862041&rd=1&src=supportwidget0&hl=en)
+- [Capacity Enhancement Guide Counter-Phishing Recommendations for Federal Agencies \| CISA](https://www.cisa.gov/sites/default/files/publications/Capacity_Enhancement_Guide-Counter-Phishing_Recommendations_for_Federal_Agencies.pdf)
+- [Actions to Counter Email-Based Attacks on Election-Related Entities \| CISA](https://www.cisa.gov/sites/default/files/publications/CISA_Insights_Actions_to_Counter_Email-Based_Attacks_on_Election-Related_S508C.pdf)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings to warn users of external recipients:
+
+#### GWS.GMAIL.14.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **End User Access -\> Warn for external recipients**.
+4. Check the **Highlight any external recipients in a conversation. Warn users before they reply to email with external recipients who aren't in their contacts** checkbox.
+5. Select **Save**.
+
+
+## 15. Email Allowlist
+
+This section determines whether an email allowlist allows for messages from certain IP addresses to not be marked as spam by Gmail. However, if implemented, emails from these senders will bypass important security mechanisms, such as SPF, DKIM, and DMARC.
+
+### Policies
+
+#### GWS.GMAIL.15.1v0.1
+An email allowlist SHOULD not be implemented.
+
+- Rationale
+ - Messages sent from IP addresses on an allowlist bypass important security mechanisms, including spam filtering and sender authentication checks. Avoiding use of email allowlists helps prevent potential threats from circumventing security mechanisms.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1562: Impair Defenses](https://attack.mitre.org/techniques/T1562/)
+ - [T1562:001: Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1566:003: Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
+
+#### GWS.GMAIL.15.2v0.1
+A connection filter policy to create a Blocked Senders list MAY be implemented.
+
+- Rationale
+ - A filter policy to block known malicious senders can help prevent targeted phishing campaigns.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1562: Impair Defenses](https://attack.mitre.org/techniques/T1562/)
+ - [T1562:001: Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1566:003: Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
+
+### Resources
+
+- [Google Workspace Admin Help: Add IP addresses to allowlists in Gmail](https://support.google.com/a/answer/60751?product_name=UnuFlow&hl=en&visit_id=637832433423162856-2822445044&rd=1&src=supportwidget0&hl=en)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for Email Allowlists:
+
+#### GWS.GMAIL.15.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **Spam, phishing, and malware -\> Email allowlist**.
+4. Under the **Enter the IP addresses for your email allowlist** field, ensure **no IP addresses** are listed.
+5. Select **Save**.
+
+#### GWS.GMAIL.15.2v0.1 Instructions
+1. There is no implementation steps for this policy
+
+
+## 16. Enhanced Pre-Delivery Message Scanning
+
+This section determines whether Gmail can screen and identify suspicious content that may be phishing attempts. In doing so, Google can either show a warning or move the email to Spam, but email delivery will experience a short delay due to the additional checks.
+
+A Google Workspace solution is not strictly required to satisfy this baseline control, but the solution selected by an agency should offer services comparable to those offered by Google.
+
+### Policies
+
+#### GWS.GMAIL.16.1v0.1
+Enhanced pre-delivery message scanning SHALL be enabled to prevent phishing.
+
+- Rationale
+ - As an administrator, you can increase Gmail's ability to identify suspicious content with enhanced pre-delivery message scanning. Typically, when Gmail identifies a possible phishing message, a warning is displayed and the message might be moved to spam.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1566:003: Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
+
+#### GWS.GMAIL.16.2v0.1
+Any third-party or outside application selected for enhanced pre-delivery message scanning SHOULD offer services comparable to those offered by Google Workspace.
+
+- Rationale
+ - A third-party system should provide the same minimum functionality provided by Google.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - None
+
+### Resources
+
+- [Google Workspace Admin Help: Help prevent phishing with pre-delivery message scanning](https://support.google.com/a/answer/7380368?product_name=UnuFlow&hl=en&visit_id=637835839970922069-4253681586&rd=1&src=supportwidget0&hl=en)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for Enhanced Pre-Delivery Message Scanning:
+
+#### GWS.GMAIL.16.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **Spam, phishing, and malware -\> Enhanced pre-delivery message scanning**.
+4. Check the **Enables improved detection of suspicious content prior to delivery** checkbox.
+5. Select **Save**.
+
+#### GWS.GMAIL.16.2v0.1 Instructions
+1. There is no implementation steps for this policy
+
+
+## 17. Security Sandbox
+
+This section determines whether certain messages and their associated attachments are executed in a sandbox environment for protection against malware, ransomware, and zero-day threats. Malicious software may be missed by traditional antivirus programs. However, this may cause some messages to get delayed before final delivery. Some of the file types scanned include Microsoft executables, Microsoft Office, PDF, and archives (zip, rar).
+
+A Google Workspace solution is not strictly required to satisfy this baseline control, but the solution selected by an agency should offer services comparable to those offered by Google.
+
+### Policies
+
+#### GWS.GMAIL.17.1v0.1
+Security sandbox SHOULD be enabled to provide additional protections for their email messages.
+
+- Rationale
+ - This allows potentially malicious messages to be quarantined to be analyzed to see if it malicious.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+
+#### GWS.GMAIL.17.2v0.1
+Any third-party or outside application selected for security sandbox SHOULD offer services comparable to those offered by Google Workspace.
+
+- Rationale
+ - A third-party system should provide the same minimum functionality provided by Google.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - None
+
+### Resources
+
+- [Google Workspace Admin Help: Set up rules to detect harmful attachments](https://support.google.com/a/answer/7676854?amp;visit_id=637866938191629894-2885947509&rd=1&product_name=UnuFlow&hl=en&visit_id=637866938191629894-2885947509&rd=2&src=supportwidget0&hl=en)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for Security sandbox or Security sandbox rules:
+
+#### GWS.GMAIL.17.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **Spam, phishing, and malware -\> Security sandbox**.
+4. Check the **Enable virtual execution of attachments in a sandbox environment for all the users of the Organizational Unit for protection against malware, ransomware, and zero-day threats** checkbox.
+5. Either **Security sandbox** or **Security sandbox rules** may be enabled but enabling **Security sandbox** takes precedence.
+6. If **Security sandbox** rules are enabled, then the configuration needs to be completed and consists of the following fields **:**
+ 1. A short description.
+ 2. Email messages to affect.
+ 3. Expressions to describe the content to search for in each message.
+ 4. Action to take if expressions match.
+7. Select **Save**.
+
+#### GWS.GMAIL.17.2v0.1 Instructions
+1. There is no implementation steps for this policy.
+
+
+## 18. Approved Senders List
+
+This section allows for the use of an approved senders list that will bypass the spam folder.
+
+A Google Workspace solution is not strictly required to satisfy this baseline control, but the solution selected by an agency should offer services comparable to those offered by Google.
+
+### Policies
+
+#### GWS.GMAIL.18.1v0.1
+An Approved Senders List SHOULD be configured to keep legitimate emails out of the spam folder.
+
+- Rationale
+ - Messages approved by the agency will be delivered and not put in spam folder.
+- Last Modified: November 14, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - None
+
+#### GWS.GMAIL.18.2v0.1
+An allowed senders list MAY be added but SHOULD NOT add allowed domains.
+
+- Rationale
+ - Messages approved by the agency will be delivered and not put in spam folder.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1566:003: Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
+
+#### GWS.GMAIL.18.3v0.1
+Any third-party or outside application selected for spam approved senders' lists SHOULD offer services comparable to those offered by Google Workspace.
+
+- Rationale
+ - A third-party system should provide the same minimum functionality provided by Google.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+
+#### GWS.GMAIL.18.4v0.1
+Addresses added to the Allowed Senders List SHALL be set to require authentication.
+
+- Rationale
+ - Authentication of delivered mail provides extra security for the agency.
+- Last Modified: November 14, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1556: Modifying Authentication Process](https://attack.mitre.org/techniques/T1556/)
+ - [T1556:006: Modifying Authentication Process: Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006/)
+
+
+### Resources
+
+- [Google Workspace Admin Help: Help prevent spoofing, phishing, and spam](https://support.google.com/a/topic/9061731?hl=en&ref_topic=9202)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for Spam Approved Senders Lists:
+
+#### GWS.GMAIL.18.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **Spam, phishing, and malware -\> Spam**.
+4. Select any combination of the following configurations:
+ - Check the **Be more aggressive when filtering spam** checkbox.
+ - Check the **Bypass spam filters for messages received from internal senders** checkbox.
+ - Check the **Bypass spam filters for messages received from addresses or domains within these approved senders' lists** checkbox.
+ - An existing list or new list can be used.
+ - Check the **Put spam in administrative quarantine** checkbox.
+5. Select **Save**.
+
+#### GWS.GMAIL.18.2v0.1 Instructions
+1. There is no implementation steps for this policy
+
+#### GWS.GMAIL.18.3v0.1 Instructions
+1. There is no implementation steps for this policy
+
+#### GWS.GMAIL.18.4v0.1 Instructions
+1. There is no implementation steps for this policy
+
+
+## 19. Blocked Senders List
+
+This section allows use of a blocked senders list that automatically rejects messages from specified addresses or domains.
+
+### Policies
+
+#### GWS.GMAIL.19.1v0.1
+A blocked senders list SHOULD be configured to prevent emails from known malicious sources.
+
+- Rationale
+ - This protects the agency against potential attacks by blocking any known malicious senders.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1566:003: Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
+
+#### GWS.GMAIL.19.2v0.1
+Blocked senders or domains MAY be added to the blocked senders list.
+
+- Rationale
+ - This protects the agency against potential attacks by blocking any known malicious senders.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - None
+
+
+### Resources
+
+- [Google Workspace Admin Help: Help prevent spoofing, phishing, and spam](https://support.google.com/a/topic/9061731?hl=en&ref_topic=9202)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for Blocked Senders Lists:
+
+#### GWS.GMAIL.19.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **Spam, phishing, and malware -\> Blocked Senders**.
+4. If the **blocked senders list** is enabled, then the configuration needs to be completed and consists of the following fields:
+ 1. A short description.
+ 2. Addresses or domains that you want to automatically reject messages from.
+ 3. Default rejection notice.
+ 4. Option to bypass this setting for messages received from addresses or domains within these approved senders' lists.
+5. Select **Save**.
+
+#### GWS.GMAIL.19.2v0.1 Instructions
+1. There is no implementation for this policy.
+
+
+## 20. Comprehensive Mail Storage
+
+This section allows for email messages sent through other Google Workspace applications, (i.e., Calendar, Drive, Docs, Sheets, Slides, Drawings, Forms, and Keep) to be stored in the associated users' Gmail mailboxes. This includes a copy of all sent or received messages within a specified domain (including messages sent or received by non-Gmail mailboxes).
+
+### Policies
+
+#### GWS.GMAIL.20.1v0.1
+Comprehensive mail storage SHOULD be enabled to allow tracking of information across applications.
+
+- Rationale
+ - This allows for tracking shared information from emails between GWS applications for traceability and security purposes.
+- Last Modified: November 14, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - None
+
+### Resources
+
+- [Google Workspace Admin Help: Set up comprehensive mail storage](https://support.google.com/a/answer/3547347?product_name=UnuFlow&hl=en&visit_id=637835896823763789-338955802&rd=1&src=supportwidget0&hl=en)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for Comprehensive Mail Storage:
+
+#### GWS.GMAIL.20.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **Compliance -\> Comprehensive mail storage**.
+4. Check the **Ensure that a copy of all sent and received mail is stored in associated users' mailboxes** checkbox.
+5. Select **Save**.
+
+
+## 21. Content Compliance Filtering
+
+This section determines whether Gmail content is filtered based upon specified expressions, such as keyword, strings or patterns, and metadata. The compliance actions based upon the word lists are reject, quarantine, or deliver with modifications.
+
+A Google Workspace solution is not strictly required to satisfy this baseline control, but the solution selected by an agency should offer services comparable to those offered by Google.
+
+### Policies
+
+#### GWS.GMAIL.21.1v0.1
+Content filtering SHOULD be enabled within Gmail messages.
+
+- Rationale
+ - Protects the agency against malicious content from entering the agencies systems.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1114: Email Collection](https://attack.mitre.org/techniques/T1114/)
+ - [T1114:002: Email Collection: Remote Email Collection](https://attack.mitre.org/techniques/T1114/002/)
+
+#### GWS.GMAIL.21.2v0.1
+Any third-party or outside application selected for advanced email content filtering SHOULD offer services comparable to those offered by Google Workspace.
+
+- Rationale
+ - A third-party system should provide the same minimum functionality provided by Google.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - None
+
+#### GWS.GMAIL.21.3v0.1
+Gmail or third-party applications SHALL be configured to protect PII and sensitive information as defined by the agency. At a minimum, credit card numbers, taxpayer Identification Numbers (TIN), and Social Security Numbers (SSN) SHALL be blocked.
+
+- Rationale
+ - This helps protect against PII data leakage.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1114: Email Collection](https://attack.mitre.org/techniques/T1114/)
+ - [T1114:002: Email Collection: Remote Email Collection](https://attack.mitre.org/techniques/T1114/002/)
+ - [T1048: Exfilitration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048/)
+ - [T1048:001: Exfilitration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/001/)
+ - [T1048:002: Exfilitration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/002/)
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+### Resources
+
+- [Google Workspace Admin Help: Set up rules for advanced email content filtering](https://support.google.com/a/answer/1346934?hl=en&ref_topic=9974692)
+- [Personally identifiable information (PII) \| NIST](https://csrc.nist.gov/glossary/term/personally_identifiable_information#:~:text=NISTIR%208259,2%20under%20PII%20from%20EGovAct)
+- [Sensitive information \| NIST](https://csrc.nist.gov/glossary/term/sensitive_information)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for Objectionable content:
+
+#### GWS.GMAIL.21.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **Compliance -\> Content Compliance**.
+4. If **Content compliance** filtering is enabled, then the configuration needs to be completed and consists of the following fields:
+ 1. A short description.
+ 2. Email messages to affect.
+ 3. Expressions for content to search for in messages.
+ 4. Compliance action options.
+5. Select **Save**.
+
+#### GWS.GMAIL.21.2v0.1 Instructions
+1. There is no implementation steps for this policy.
+
+#### GWS.GMAIL.21.3v0.1 Instructions
+1. There is no implementation steps for this policy.
+
+
+## 22. Objectionable Content Filtering
+
+This section determines whether Gmail content is filtered based upon word lists, for example, obscenities or "confidential" words. The compliance actions based upon the word lists are reject, quarantine, or deliver with modifications.
+
+A Google Workspace solution is not strictly required to satisfy this baseline control, but the solution selected by an agency should offer services comparable to those offered by Google.
+
+### Policies
+
+#### GWS.GMAIL.22.1v0.1
+Word lists SHOULD be enabled to filter objectionable content within Gmail messages.
+
+- Rationale
+ - This helps ensure that confidential/sensitive information can be filtered from Gmail messages to help ensure there is no unauthorized or accidental sharing.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1595: Active Scanning](https://attack.mitre.org/techniques/T1595/)
+ - [T1595:003: Active Scanning: Wordlist Scanning](https://attack.mitre.org/techniques/T1595/003/)
+
+#### GWS.GMAIL.22.2v0.1
+Any third-party or outside application selected for objectionable content filtering SHOULD offer services comparable to those offered by Google Workspace.
+
+- Rationale
+ - A third-party system should provide the same minimum functionality provided by Google.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - None
+
+### Resources
+
+- [Google Workspace Admin Help: Set up rules for objectionable content](https://support.google.com/a/answer/1346936?hl=en)
+- [Personally identifiable information (PII) \| NIST](https://csrc.nist.gov/glossary/term/personally_identifiable_information#:~:text=NISTIR%208259,2%20under%20PII%20from%20EGovAct)
+- [Sensitive information \| NIST](https://csrc.nist.gov/glossary/term/sensitive_information)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for objectionable content:
+
+#### GWS.GMAIL.22.1v0.1 Instructions
+1. Sign into the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **Compliance -\> Objectionable content**.
+4. If **Objectionable content** filtering is enabled, then the configuration needs to be completed and consists of the following fields:
+ 1. A short description.
+ 2. Email messages to affect.
+ 3. Custom objectionable words.
+ 4. Compliance action options.
+5. Select **Save**.
+
+#### GWS.GMAIL.22.2v0.1 Instructions
+1. This has no implementation steps for this policy.
+
+
+## 23. Attachment Compliance Filtering
+
+This section determines whether attachments are filtered based on file type, file name, and message size. The compliance actions based upon the word lists are reject, quarantine, or deliver with modifications.
+
+A Google Workspace solution is not strictly required to satisfy this baseline control, but the solution selected by an agency should offer services comparable to those offered by Google.
+
+### Policies
+
+#### GWS.GMAIL.23.1v0.1
+Attachment compliance SHOULD be enabled to filter specific attachments within Gmail messages.
+
+- Rationale
+ - This allows filtering of confidential/sensitive information from Gmail messages stored within specific file attachments to help prevent unauthorized or accidental sharing.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1204: User Execution](https://attack.mitre.org/techniques/T1204/)
+ - [T1204:002: User Execution: Malicious File](https://attack.mitre.org/techniques/T1204/002/)
+
+#### GWS.GMAIL.23.2v0.1
+The attachment filter SHOULD attempt to determine the true file type and assess the file extension.
+
+- Rationale
+ - This allows filtering of confidential/sensitive information from Gmail messages stored within specific file attachments to help prevent unauthorized or accidental sharing.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1204: User Execution](https://attack.mitre.org/techniques/T1204/)
+ - [T1204:002: User Execution: Malicious File](https://attack.mitre.org/techniques/T1204/002/)
+
+#### GWS.GMAIL.23.3v0.1
+The set of disallowed file types SHALL be determined.
+
+- Rationale
+ - This allows filtering of confidential/sensitive information from Gmail messages stored within specific file attachments to help prevent unauthorized or accidental sharing. This also helps protect the organization from attacks based on specific file types.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1204: User Execution](https://attack.mitre.org/techniques/T1204/)
+ - [T1204:002: User Execution: Malicious File](https://attack.mitre.org/techniques/T1204/002/)
+
+#### GWS.GMAIL.23.4v0.1
+Any third-party or outside application selected for attachment compliance filtering SHOULD offer services comparable to those offered by Google Workspace.
+
+- Rationale
+ - A third-party system should provide the same minimum functionality provided by Google.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1204: User Execution](https://attack.mitre.org/techniques/T1204/)
+ - [T1204:002: User Execution: Malicious File](https://attack.mitre.org/techniques/T1204/002/)
+
+### Resources
+
+- [Google Workspace Admin Help: Content filtering with rules](https://support.google.com/a/topic/9974692?hl=en&ref_topic=2683824)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+To configure the settings for Attachment Compliance:
+
+#### GWS.GMAIL.23.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Gmail**.
+3. Select **Compliance -\> Attachment compliance**.
+4. If **Attachment compliance** filtering is enabled, then the configuration needs to be completed and consists of the following fields:
+ 1. A short description.
+ 2. Email messages to affect.
+ 3. Expressions for content to search for in messages.
+ 4. Compliance action options.
+5. Select **Save**.
+
+#### GWS.GMAIL.23.2v0.1 Instructions
+1. There is no implementation steps for this policy
+
+#### GWS.GMAIL.23.3v0.1 Instructions
+1. There is no implementation steps for this policy
+
+#### GWS.GMAIL.23.4v0.1 Instructions
+1. There is no implementation steps for this policy
diff --git a/baselines/Google Calendar Minimum Viable Secure Configuration Baseline v0.1.md b/baselines/Google Calendar Minimum Viable Secure Configuration Baseline v0.1.md
new file mode 100644
index 00000000..e04b853d
--- /dev/null
+++ b/baselines/Google Calendar Minimum Viable Secure Configuration Baseline v0.1.md
@@ -0,0 +1,268 @@
+# CISA Google Workspace Security Configuration Baseline for Google Calendar
+
+Google Calendar is a calendar service in Google Workspace used for creating and editing events that enables collaboration amongst users. Calendar allows administrators to control and manage their sharing settings for both internal and external use. This Secure Configuration Baseline (SCB) provides specific policies to strengthen Calendar security.
+
+The Secure Cloud Business Applications (SCuBA) project provides guidance and capabilities to secure agencies' cloud business application environments and protect federal information that is created, accessed, shared, and stored in those environments. The SCuBA Secure Configuration Baselines (SCB) for Google Workspace (GWS) will help secure federal civilian executive branch (FCEB) information assets stored within GWS cloud environments through consistent, effective, modern, and manageable security configurations.
+
+The CISA SCuBA SCBs for GWS help secure federal information assets stored within GWS cloud business application environments through consistent, effective, and manageable security configurations. CISA created baselines tailored to the federal government's threats and risk tolerance with the knowledge that every organization has different threat models and risk tolerance. Non-governmental organizations may also find value in applying these baselines to reduce risks.
+
+The information in this document is being provided "as is" for INFORMATIONAL PURPOSES ONLY. CISA does not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial entities or commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoritism by CISA.
+
+This baseline is based on Google documentation available at [Google Workspace Admin Help: Set Calendar sharing options](https://support.google.com/a/answer/60765?hl=en#zippy=%2Cset-a-default-for-internal-sharing%2Callow-or-restrict-external-sharing) and addresses the following:
+
+- [External Sharing Options for Primary Calendars](#1-external-sharing-options-for-primary-calendars)
+- [External Invitations Warnings](#2-external-invitations-warnings)
+- [External Sharing Options for Secondary Calendars](#3-external-sharing-options-for-secondary-calendars)
+- [Calendar Interop Management](#4-calendar-interop-management)
+- [Paid Appointments](#5-paid-appointments)
+
+Settings can be assigned to certain users within Google Workspace through organizational units, configuration groups, or individually. Before changing a setting, the user can select the organizational unit, configuration group, or individual users to which they want to apply changes.
+
+## Assumptions
+
+This document assumes the organization is using GWS Enterprise Plus.
+
+This document does not address, ensure compliance with, or supersede any law, regulation, or other authority. Entities are responsible for complying with any recordkeeping, privacy, and other laws that may apply to the use of technology. This document is not intended to, and does not, create any right or benefit for anyone against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person.
+
+## Key Terminology
+
+The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.
+
+# Baseline Policies
+
+## 1. External Sharing Options for Primary Calendars
+
+This section determines what information is shared from primary calendars with external entities.
+
+### Policies
+
+#### GWS.CALENDAR.1.1v0.1
+External Sharing Options for Primary Calendars SHALL be configured to "Only free/busy information (hide event details)" to restrict information sharing and prevent data leakage.
+
+- Rationale
+ - Prevent data leakage by restricting the amount of information that is externally viewable when a user shares their calendar with someone external to your organization.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+#### GWS.CALENDAR.1.2v0.1
+External sharing options for primary calendars between multiple components within an organization MAY be configured.
+
+- Rationale
+ - Prevent data leakage by restricting the information viewable by internal users when a user shares their calendar by configuring additional settings on shared information between components.
+- Last Modified: November 14, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+### Resources
+
+- [Google Workspace Admin Help: Set Calendar sharing options](https://support.google.com/a/answer/60765?hl=en#zippy=%2Cset-a-default-for-internal-sharing%2Callow-or-restrict-external-sharing)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To configure the settings for External Sharing in Primary Calendar:
+
+#### GWS.CALENDAR.1.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Calendar**.
+3. Select **Sharing settings** -\> **External sharing options for primary calendars**.
+4. Select **Only free/busy information (hide event details)**.
+5. Select **Save**.
+
+#### GWS.CALENDAR.1.2v0.1 Instructions
+1. There is no implementation for this policy
+
+## 2. External Invitations Warnings
+
+This section determines whether users are warned when inviting one or more guests from outside of their domain.
+
+### Policies
+
+#### GWS.CALENDAR.2.1v0.1
+External invitations warnings SHALL be enabled to prompt users before sending invitations.
+
+- Rationale
+ - When your users create a Google Calendar event that includes one or more guests from outside of your domain, they are prompted to confirm whether it's OK to include external guests in the event invitation, assisting in the prevention of unintentional data leakage.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1566:003: Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
+
+### Resources
+
+- [Google Workspace Admin Help: Allow external invitations in Google Calendar events](https://support.google.com/a/answer/6329284?product_name=UnuFlow&visit_id=637836623092961849-291754447&rd=1&src=supportwidget0)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.CALENDAR.2.1v0.1 Instructions
+
+To configure the settings for Confidential Mode:
+
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Calendar**.
+3. Select **Sharing settings** -\> **External Invitations**.
+4. Check the **Warn users when inviting guests outside of the domain** checkbox.
+5. Select **Save**.
+
+## 3. External Sharing Options for Secondary Calendars
+
+This section determines what information is shared from secondary calendars with external entities.
+
+### Policies
+
+#### GWS.CALENDAR.3.1v0.1
+External sharing options for secondary calendars SHALL be configured to "Only free/busy information (hide event details)" to restrict information sharing and prevent data leakage.
+
+- Rationale
+ - Prevent data leakage by restricting the amount of information that is externally viewable when a user shares their calendar with someone external to your organization.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+#### GWS.CALENDAR.3.2v0.1
+
+External sharing options for secondary calendars between multiple components within an organization MAY be configured.
+
+- Rationale
+ - Prevent data leakage by restricting the information viewable by internal users when a user shares their calendar by configuring additional settings on shared information between components.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+### Resources
+
+- [Google Workspace Admin Help: Set Calendar sharing options](https://support.google.com/a/answer/60765?hl=en#zippy=%2Cset-a-default-for-internal-sharing%2Callow-or-restrict-external-sharing)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- N/A
+
+### Implementation
+
+#### GWS.CALENDAR.3.1v0.1 Instructions
+
+To configure the settings for External Sharing in secondary calendars:
+
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Calendar**.
+3. Select **General settings -\> External sharing options for secondary calendars**.
+4. Select **Only free/busy information (hide event details)**.
+5. Select **Save**.
+
+#### GWS.CALENDAR.3.2v0.1 Instructions
+
+1. There is no implementation for this policy
+
+## 4. Calendar Interop Management
+
+This section determines whether Microsoft Exchange and Google Calendar can be configured to work together to allow users in both systems to share their availability status so they can view each other's schedules. The availability and event information that will be shared between Exchange and Calendar include availability for users, group or team calendars, and calendar resources (such as meeting rooms). Calendar Interop respects event-level privacy settings from either Exchange or Calendar.
+
+Due to the added complexity and attack surface associated with configuring Calendar Interop, it should be disabled in environments for which this capability is not necessary for agency mission fulfillment.
+
+### Policies
+
+#### GWS.CALENDAR.4.1v0.1
+Calendar Interop SHOULD be disabled unless agency mission fulfillment requires collaboration between users internal and external to an organization who use both Microsoft Exchange and Google Calendar.
+
+- Rationale
+ - Prevent information exchange between Microsoft and Google calendars for users using both services, unless it is required by the organization.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1199: Trusted Relationship](https://attack.mitre.org/techniques/T1199/)
+
+#### GWS.CALENDAR.4.2v0.1
+OAuth 2.0 SHALL be used in lieu of basic authentication to establish connectivity between tenants or organizations in cases where Calendar Interop is deemed necessary for agency mission fulfillment.
+
+- Rationale
+ - When required by organizational requirements, for user's to exchange information between Google and Microsoft calendars, users will be authenticated using OAuth 2.0 to prevent unauthorized access.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1555: Credentials from Password Stores](https://attack.mitre.org/techniques/T1555/)
+
+### Resources
+
+- [Google Workspace Admin Help: About Calendar Interop](https://support.google.com/a/answer/7444958?hl=en)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.CALENDAR.4.1v0.1 Instructions
+
+To configure the settings for Calendar Interop:
+
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Calendar**.
+3. Select **Calendar Interop management**.
+4. Uncheck the **Enable Interoperability for Calendar** checkbox.
+5. Select **Save**.
+
+#### GWS.CALENDAR.4.2v0.1 Instructions
+
+To configure the settings for Calendar Interop:
+
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Calendar**.
+3. Select **Calendar Interop management**.
+4. Select **OAuth 2.0 client credentials**
+5. Select **Save**.
+
+## 5. Paid Appointments
+
+This section covers whether or not the paid appointment booking feature is enabled.
+
+### Policies
+
+#### GWS.CALENDAR.5.1v0.1
+Appointment Schedule with Payments SHALL be disabled.
+
+- Rationale
+ - This helps avoid unnecessary interconnectivity with third-party services that can create a greater chance of additional vulnerabilities in the platform.
+ - There is no obvious need for agencies to have this feature enabled.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1199: Trusted Relationship](https://attack.mitre.org/techniques/T1199/)
+
+### Resources
+
+- [Google Workspace Help: Allow paid appointment schedules in Calendar](https://apps.google.com/supportwidget/articlehome?article_url=https%3A%2F%2Fsupport.google.com%2Fa%2Fanswer%2F13765946&assistant_id=generic-unu&product_context=13765946&product_name=UnuFlow&trigger_context=a)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.CALENDAR.5.1v0.1 Instructions
+
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Calendar**.
+3. Select **Advanced Settings -\> Appointment schedules with payments**
+4. Select **OFF- Blocks users' from adding required payments to their Calendar appointment schedules**
+5. Select **Save**
diff --git a/baselines/Google Chat Minimum Viable Secure Configuration Baseline v0.1.md b/baselines/Google Chat Minimum Viable Secure Configuration Baseline v0.1.md
new file mode 100644
index 00000000..73612d37
--- /dev/null
+++ b/baselines/Google Chat Minimum Viable Secure Configuration Baseline v0.1.md
@@ -0,0 +1,302 @@
+# CISA Google Workspace Security Configuration Baseline for Google Chat
+
+Google Chat is a communication and collaboration tool in Google Workspace that supports direct messaging, group conversations, and content creation and sharing. Chat allows administrators to control and manage their messages and files. This Secure Configuration Baseline (SCB) provides specific policies to strengthen Chat security.
+
+The Secure Cloud Business Applications (SCuBA) project provides guidance and capabilities to secure agencies' cloud business application environments and protect federal information that is created, accessed, shared, and stored in those environments. The SCuBA Secure Configuration Baselines (SCB) for Google Workspace (GWS) will help secure federal civilian executive branch (FCEB) information assets stored within GWS cloud environments through consistent, effective, modern, and manageable security configurations.
+
+The CISA SCuBA SCBs for GWS help secure federal information assets stored within GWS cloud business application environments through consistent, effective, and manageable security configurations. CISA created baselines tailored to the federal government's threats and risk tolerance with the knowledge that every organization has different threat models and risk tolerance. Non-governmental organizations may also find value in applying these baselines to reduce risks.
+
+The information in this document is being provided "as is" for INFORMATIONAL PURPOSES ONLY. CISA does not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial entities or commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoritism by CISA.
+
+This baseline is based on Google documentation available at [Google Workspace Admin Help: Google Chat settings](https://support.google.com/a/answer/9540647?hl=en) and addresses the following:
+
+- [Chat History](#1-chat-history)
+- [External File Sharing](#2-external-file-sharing)
+- [History for Spaces](#3-history-for-spaces)
+- [External Chat Messaging](#4-external-chat-messaging)
+- [Installation of Chat Apps](#5-installation-of-chat-apps)
+- [DLP Rules](#6-dlp-rules)
+
+Settings can be assigned to certain users within Google Workspace through organizational units, configuration groups, or individually. Before changing a setting, the user can select the organizational unit, configuration group, or individual users to which they want to apply changes.
+
+## Assumptions
+
+This document assumes the organization is using GWS Enterprise Plus.
+
+This document does not address, ensure compliance with, or supersede any law, regulation, or other authority. Entities are responsible for complying with any recordkeeping, privacy, and other laws that may apply to the use of technology. This document is not intended to, and does not, create any right or benefit for anyone against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person.
+
+## Key Terminology
+
+The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.
+
+# Baseline Policies
+
+## 1. Chat History
+
+This section covers chat history retention for users within the organization and prevents users from changing their history setting. This control applies to both direct messages and group messages.
+
+### Policies
+
+#### GWS.CHAT.1.1v0.1
+Chat history SHOULD be enabled for information traceability.
+
+- Rationale
+ - Helps ensure there is a record of chats sent to receive in the case that it needs to be reviewed in the future for legal or compliance issues.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1562: Impair Defenses](https://attack.mitre.org/techniques/T1562/)
+ - [T1562:001: Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)
+
+#### GWS.CHAT.1.2v0.1
+Users SHALL NOT be allowed to change their history setting.
+
+- Rationale
+ - This setting helps prevent changes by the user.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1562: Impair Defenses](https://attack.mitre.org/techniques/T1562/)
+ - [T1562:001: Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)
+
+### Resources
+
+- [Google Workspace Admin Help: Turn chat history on or off for users](https://support.google.com/a/answer/7664184)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To configure the settings for History for chats:
+
+#### GWS.CHAT.1.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Google Chat**.
+3. Select **History for chats**.
+4. Select **History is ON**.
+5. Select **Save**
+
+#### GWS.CHAT.1.2v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Google Chat**.
+3. Uncheck the **Allow users to change their history setting** checkbox.
+4. Select **Save**.
+
+## 2. External File Sharing
+
+This section covers what types of files users are allowed to share external to their organization.
+
+### Policies
+
+#### GWS.CHAT.2.1v0.1
+External file sharing SHALL be disabled to protect sensitive information from unauthorized or accidental sharing.
+
+- Rationale
+ - Protects against unintentional or intentional data leakage from the agency or organization.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1048: Exfilitration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048/)
+ - [T1048:002: Exfilitration Over Alternative Protocol: Exfilitration Over Asymmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/002/)
+
+### Resources
+
+- [Google Workspace Admin Help: Control file sharing in Chat](https://support.google.com/a/answer/10277783?hl=en)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To configure the settings for External filesharing:
+
+#### GWS.CHAT.2.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Google Chat**.
+3. Select **Chat File Sharing**.
+4. In the **External filesharing** dropdown menu, select **No files.**
+5. Select **Save**.
+
+## 3. History for Spaces
+
+This section covers whether chat history is retained by default for users within the organization. This control does not apply for threaded chat spaces because those require that history be on, which cannot be changed. Chat spaces allow for multiple users to share files, assign tasks, and stay connected.
+
+### Policies
+
+#### GWS.CHAT.3.1v0.1
+Space history SHOULD be enabled for traceability of information.
+
+- Rationale
+ - This provides the ability to trace history when needed from an organizational level.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1562: Impair Defenses](https://attack.mitre.org/techniques/T1562/)
+ - [T1562:001: Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)
+
+### Resources
+
+- [Google Workspace Admin Help: Set a space history option for users](https://support.google.com/a/answer/9948515?hl=en)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To configure the settings for History for spaces:
+
+#### GWS.CHAT.3.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Google Chat**.
+3. Select **History for spaces**.
+4. Select **History is ON by default** or **History is ALWAYS ON**.
+5. Select **Save**.
+
+## 4. External Chat Messaging
+
+This section permits users to send Chat messages outside of their organization, but such Chat messages must be restricted to allowlisted domains only.
+
+### Policies
+
+#### GWS.CHAT.4.1v0.1
+External Chat messaging SHALL be restricted to allowlisted domains only.
+
+- Rationale
+ - Protects the organization from external risks and helps prevent data leakage outside the organization.
+- Last Modified: November 14, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+#### GWS.CHAT.4.2v0.1
+Only allow this for allowlisted domains SHALL be enabled.
+
+- Rationale
+ - This limits the security vulnerabilities present with allowing chatting outside of organization.
+- Last Modified: August 1, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+### Resources
+
+- [Google Workspace Admin Help: Set external chat options](https://support.google.com/a/answer/9269229?product_name=UnuFlow&visit_id=637841711304802210-4105703050&rd=1&src=supportwidget0)
+- [Google Workspace Admin Help: Allow external sharing with only trusted domains](https://support.google.com/a/answer/6160020)
+- [CIS Google Workspace Benchmark v1.1.0 - 3.1.4.2.2 Ensure Google Chat Externally is Restricted to Allowlisted Domains](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To configure the settings for External Chat:
+
+#### Policy Group 4 Common Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Google Chat**.
+3. Select **External Chat Settings** -\> **Chat externally**.
+
+#### GWS.CHAT.4.1v0.1 Instructions
+1. Select **ON**.
+2. Select **Save**.
+
+#### GWS.CHAT.4.2v0.1 Instructions
+1. Select **Only allow this for allowlisted domains**
+2. To add allowlisted domains select **Manage allowlisted domains**
+3. Select **Save**.
+
+## 5. Installation of Chat Apps
+
+This section covers preventing ordinary users from being able to install Chat apps.
+
+### Policies
+
+#### GWS.CHAT.5.1v0.1
+User-level ability to install Chat apps SHALL be disabled.
+
+- Rationale
+ - Protects against security risks associated with installing chat apps such as phishing, spyware, etc.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1195:002: Supply Chain Compromise](https://attack.mitre.org/techniques/T1195/)
+ - [T1195:002: Supply Chain Compromise: Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)
+ - [T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
+ - [T1566:001: Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001/)
+ - [T1566:002: Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
+ - [T1566:003: Phishing: Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003/)
+
+### Resources
+
+- [Google Workspace Admin Help: Allow users to install Chat apps](https://support.google.com/a/answer/7651360?product_name=UnuFlow&hl=en&visit_id=637916846359382524-3147840186&rd=1&src=supportwidget0&hl=en#zippy=%2Cstep-add-marketplace-apps-to-your-allowlist-optional%2Cstep-decide-what-apps-users-can-install%2Cstep-let-users-install-apps-in-chat)
+- GWS Common Controls Minimum Viable Secure Configuration Baseline
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To configure the settings for Chat apps:
+
+#### GWS.CHAT.5.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Google Chat**.
+3. Select **Chat apps** -\> **Chat apps access settings**.
+4. Select **OFF** for **Allow users to install Chat apps**.
+5. Select **SAVE**.
+
+## 6. DLP rules
+
+This recommendation applies only to agencies that allow external sharing (see section 2.1).
+
+Using data loss prevention (DLP), organizations can create and apply rules to control the content that users can share in files outside the organization. DLP gives you control over what users can share and prevents unintended exposure of sensitive information.
+
+DLP rules can use predefined content detectors to match PII (e.g., SSN), credentials (e.g., API keys), or specific document types (e.g., source code). Custom rules can also be applied based upon regex match or document labels.
+
+### Policies
+
+#### GWS.CHAT.6.1v0.1
+Agencies SHOULD configure DLP rules to block or warn on sharing files with sensitive data.
+
+- Rationale
+ - Data Loss Prevention (DLP) rules trigger scans of files to look for sensitive content and restrict sharing of documents that may contain sensitive content. Configuring DLP rules helps agencies protect their information, by determining what data and/or phrasing might be sensitive, and restricting the dissemination of the documents containing that data. Examples include PII, PHI, portion markings, etc.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1048: Exfilitration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048/)
+ - [T1048:002: Exfilitration Over Alternative Protocol: Exfilitration Over Asymmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/002/)
+ - [T1213: Data from Information Repositories](https://attack.mitre.org/techniques/T1213/)
+ - [T1213:001: Data from Information Repositories:Confluence](https://attack.mitre.org/techniques/T1213/001/)
+ - [T1213:002: Data from Information Repositories:Sharepoint](https://attack.mitre.org/techniques/T1213/002/)
+
+### Resources
+
+- [How to use predefined content detectors - Google Workspace Admin Help](https://support.google.com/a/answer/7047475#zippy=%2Cunited-states)
+- [Get started as a Drive labels admin - Google Workspace Admin Help](https://support.google.com/a/answer/9292382?hl=en)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.CHAT.6.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Menu -\> Security -\> Access and data control -\> Data protection**.
+3. Click **Manage Rules**. Then click **Add rule** -\> **New rule** or click **Add rule** -\> **New rule from template**. For templates, select a template from the Templates page.
+4. In the **Name** section, add the name and description of the rule.
+5. In the **Scope** section, apply this rule only to the entire domain or to selected organizational units or groups, and click **Continue**. If there's a conflict between organizational units and groups in terms of inclusion or exclusion, the group takes precedence.
+6. In the **Apps** section, choose the trigger for **Google Chat, Message Sent or File Upload**, and click **Continue**.
+7. In the **Conditions** section, click **Add Condition**.
+8. Configure appropriate content definition(s) based upon the agency's individual requirements and click **Continue**.
+9. Select the appropriate action to warn or block sharing, based upon the agency's individual requirements.
+10. In the **Alerting** section, choose a severity level, and optionally, check **Send to alert center to trigger notifications**.
+11. Review the rule details, mark the rule as **Active**, and click **Create.**
diff --git a/baselines/Google Classroom Minimum Viable Secure Configuration Baseline v0.1.md b/baselines/Google Classroom Minimum Viable Secure Configuration Baseline v0.1.md
new file mode 100644
index 00000000..0b932c77
--- /dev/null
+++ b/baselines/Google Classroom Minimum Viable Secure Configuration Baseline v0.1.md
@@ -0,0 +1,192 @@
+# CISA Google Workspace Security Configuration Baseline for Google Classroom
+
+Google Classroom is a service to streamline assignments, boost collaboration, and foster communication. This service allows for the creation of classes, creating and grading assignments, student collaboration, communication with teachers and students, and integration with other Google products.
+
+Google Classroom is designed and intended for implementation for Education Institutions. Google Classroom is available with the Google Workspace for Education Edition, and is included with all tiers of GWS for Education including Fundamentals, Standard, and Plus. CISA's Secure Configuration Baseline Classroom policies and guidance are written to the Plus edition.
+
+The Secure Cloud Business Applications (SCuBA) project provides guidance and capabilities to secure agencies' cloud business application environments and protect federal information that is created, accessed, shared, and stored in those environments. The SCuBA Secure Configuration Baselines (SCB) for Google Workspace (GWS) will help secure federal civilian executive branch (FCEB) information assets stored within GWS cloud environments through consistent, effective, modern, and manageable security configurations.
+
+The CISA SCuBA SCBs for GWS help secure federal information assets stored within GWS cloud business application environments through consistent, effective, and manageable security configurations. CISA created baselines tailored to the federal government's threats and risk tolerance with the knowledge that every organization has different threat models and risk tolerance. Non-governmental organizations may also find value in applying these baselines to reduce risks.
+
+The information in this document is being provided "as is" for INFORMATIONAL PURPOSES ONLY. CISA does not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial entities or commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoritism by CISA.
+
+This baseline is based on Google documentation available at [Google Workspace Admin Help: Classroom](https://support.google.com/edu/classroom/?hl=en#topic=10298088) and addresses the following:
+
+- [Class Membership](#1-class-membership)
+- [Classroom API](#2-classroom-api)
+- [Roster Import](#3-roster-import)
+- [Student Unenrollment](#4-student-unenrollment)
+
+Settings can be assigned to certain users within Google Workspace through organizational units, configuration groups, or individually. Before changing a setting, the user can select the organizational unit, configuration group, or individual users to which they want to apply changes.
+
+## Assumptions
+
+This document assumes the organization is using GWS Enterprise Plus.
+
+This document does not address, ensure compliance with, or supersede any law, regulation, or other authority. Entities are responsible for complying with any recordkeeping, privacy, and other laws that may apply to the use of technology. This document is not intended to, and does not, create any right or benefit for anyone against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person.
+
+## Key Terminology
+
+The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.
+
+# Baseline Policies
+
+## 1. Class Membership
+
+This section covers who has the ability to join classes and what classes the users in your domain can join.
+
+### Policy
+
+#### GWS.CLASSROOM.1.1v0.1
+Who can join classes in your domain SHALL be set to Users in your domain only.
+
+- Rationale
+ - Allowing users to join from outside your domain creates the potential for an unauthorized data leak.
+- Last Modified: September 27, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1537: Transfer Data to Cloud Account](https://attack.mitre.org/techniques/T1537/)
+
+#### GWS.CLASSROOM.1.2v0.1
+Which classes users in your domain can join SHALL be set to Classes in your domain only.
+
+- Rationale
+ - Joining a class from outside your domain could allow for data to be exfiltrated to entities outside the control of the organization creating a significant security risk.
+- Last Modified: September 27, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1537: Transfer Data to Cloud Account](https://attack.mitre.org/techniques/T1537/)
+
+### Resources
+- [Google Workspace Admin Help: Control User Access to Classroom](https://support.google.com/edu/classroom/answer/6023715)
+
+### Prerequisites
+
+- None
+
+### Implementation
+To configure the settings for Class Membership:
+
+#### Policy Group 1 Common Implementation:
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Additional Google Service** -\> **Classroom**.
+3. Select **Class Settings**.
+4. Select **About Class Membership**.
+
+#### GWS.CLASSROOM.1.1v0.1 Instructions
+1. For Who can join classes in your domain, select **Users in your domain only**.
+2. Select **Save**.
+
+#### GWS.CLASSROOM.1.2v0.1 Instructions
+1. For Who can join classes in your domain, select **Classes in your domain only**.
+2. Select **Save**.
+
+## 2. Classroom API
+
+This section covers policies related to the Google Classroom API.
+
+### Policy
+
+#### GWS.CLASSROOM.2.1v0.1
+Users SHALL NOT be able to authorize apps to access their Google Classroom data.
+
+- Rationale
+ - Allowing ordinary users to authorize apps to access to classroom data opens a possibility for data loss. Only admins should be allowed to authorize apps.
+- Last Modified: September 28, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1059: Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059/)
+ - [T1059:009: Command and Scripting Interpreter: Cloud API](https://attack.mitre.org/techniques/T1059/009/)
+ - [T1199: Trusted Relationship](https://attack.mitre.org/techniques/T1199/)
+
+### Resources
+
+- [Google Workspace Admin Help: Set Classroom data access](https://support.google.com/edu/classroom/answer/6250906?hl=en)
+
+### Prerequisites
+
+- None
+
+### Implementation
+To configure the settings for Classroom API:
+
+#### GWS.CLASSROOM.2.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Additional Google Service** -\> **Classroom**.
+3. Select **Data Access**.
+4. Uncheck **Users can authorize apps to access their Google Classroom data**.
+5. Select **Save**.
+
+## 3. Roster Import
+
+This section covers policies related to importing rosters from Clever.
+
+### Policy
+
+#### GWS.CLASSROOM.3.1v0.1
+Roster import with Clever SHOULD be turned off.
+
+- Rationale
+ - If your organization does not use Clever, allowing roster import could create a way to for data to be inputted into the organization's environment which allows from unauthorized data in the system. In addition, it could allow for unauthorized data leak as well.
+- Last Modified: September 28, 2023
+- Note:
+ - Only to be set to on if your organization uses Clever
+
+- MITRE ATT&CK TTP Mapping
+ - [T1199: Trusted Relationship](https://attack.mitre.org/techniques/T1199/)
+ - [T1048: Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048/)
+ - [T1048:002: Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/002/)
+
+### Resources
+
+- [Google Workspace Admin Help: Get Started with SIS Roster Import](https://support.google.com/edu/classroom/answer/10495270?visit_id=638337540290677144-1371568967&p=sis_overview&rd=1)
+
+### Prerequisites
+
+- None
+
+### Implementation
+To configure the settings for Roster Import:
+
+#### GWS.CLASSROOM.3.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Additional Google Service** -\> **Classroom**.
+3. Select **Roster Import**.
+4. Select **OFF**.
+5. Select **Save**.
+
+## 4. Student Unenrollment
+
+This section covers policies related to unenrolling a student from a class.
+
+### Policy
+
+#### GWS.CLASSROOM.4.1v0.1
+Only teachers SHALL be allowed to unenroll students from classes.
+
+- Rationale
+ - Only allowing teachers to unenroll students helps ensure that there is no potential for unintentional data loss or inconsistency between Google and Clever, if applicable.
+- Last Modified: September 28, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+### Resources
+
+- [Google Workspace Admin Help: Control Student Unenrollment Settings](https://support.google.com/edu/classroom/answer/11189334?visit_id=638326465630147042-2696822563&p=student_unenrollment&rd=1)
+
+### Prerequisites
+
+- None
+
+### Implementation
+To configure the settings for Student Unenrollment:
+
+#### GWS.CLASSROOM.4.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Additional Google Service** -\> **Classroom**.
+3. Select **Student unenrollment**.
+4. Select **Teachers Only**.
+5. Select **Save**.
diff --git a/baselines/Google Drive and Docs Minimum Viable Secure Configuration Baseline v0.1.md b/baselines/Google Drive and Docs Minimum Viable Secure Configuration Baseline v0.1.md
new file mode 100644
index 00000000..0adc74e4
--- /dev/null
+++ b/baselines/Google Drive and Docs Minimum Viable Secure Configuration Baseline v0.1.md
@@ -0,0 +1,484 @@
+# CISA Google Workspace Secure Configuration Baseline for Google Drive and Docs
+
+Google Drive and Docs are collaboration tools in Google Workspace that support document management and storage, access, and sharing of files. Drive and Docs allow administrators to control and manage their files and documents. This Secure Configuration Baseline (SCB) provides specific policies to strengthen Drive and Docs security.
+
+The Secure Cloud Business Applications (SCuBA) project provides guidance and capabilities to secure agencies' cloud business application environments and protect federal information that is created, accessed, shared, and stored in those environments. The SCuBA Secure Configuration Baselines (SCB) for Google Workspace (GWS) will help secure federal civilian executive branch (FCEB) information assets stored within GWS cloud environments through consistent, effective, modern, and manageable security configurations.
+
+The CISA SCuBA SCBs for GWS help secure federal information assets stored within GWS cloud business application environments through consistent, effective, and manageable security configurations. CISA created baselines tailored to the federal government's threats and risk tolerance with the knowledge that every organization has different threat models and risk tolerance. Non-governmental organizations may also find value in applying these baselines to reduce risks.
+
+The information in this document is being provided "as is" for INFORMATIONAL PURPOSES ONLY. CISA does not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial entities or commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoritism by CISA.
+
+This baseline is based on Google documentation available at [Google Workspace Admin Help: Overview: Manage Drive for an organization](https://support.google.com/a/answer/2490026?hl=en) and addresses the following:
+
+- [Sharing Outside the Organization](#1-sharing-outside-the-organization)
+- [Shared Drive Creation](#2-shared-drive-creation)
+- [Security Updates for Files](#3-security-updates-for-files)
+- [Drive SDK](#4-drive-sdk)
+- [User Installation of Drive and Docs Add-Ons](#5-user-installation-of-drive-and-docs-add-ons)
+- [Drive for Desktop](#6-drive-for-desktop)
+- [DLP Rules](#7-dlp-rules)
+
+Settings can be assigned to certain users within Google Workspace through organizational units, configuration groups, or individually. Before changing a setting, the user can select the organizational unit, configuration group, or individual users to which they want to apply changes.
+
+## Assumptions
+
+This document assumes the organization is using GWS Enterprise Plus.
+
+This document does not address, ensure compliance with, or supersede any law, regulation, or other authority. Entities are responsible for complying with any recordkeeping, privacy, and other laws that may apply to the use of technology. This document is not intended to, and does not, create any right or benefit for anyone against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person.
+
+## Key Terminology
+
+The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.
+
+# Baseline Policies
+
+## 1. Sharing Outside the Organization
+
+This section covers whether users can share files outside of the organization, whether Google checks a shared file to ensure that recipients have access, and which users have permission to distribute content outside of the organization to include uploading or moving content to shared drives owned by another organization. These files include Google Docs, Sheets, Slides, My Maps, folders, and anything else stored in Drive.
+
+### Policies
+
+#### GWS.DRIVEDOCS.1.1v0.1
+Agencies SHOULD disable sharing outside of the organization's domain.
+
+- Rationale
+ - To have the tightest control over access to documents created within the organization, agencies should disable sharing from outside the organization. Disabling external sharing will block any collaboration from outside the organization and will prevent disseminating documents outside the organization.
+- Last Modified: July 10, 2023
+- Note:
+ - This policy restricts information sharing
+ - This policy prevents data leakage outside of the organization
+ - If this policy is enforced, then follow Policy 1.2
+ - If this policy is not enforced, then follow Policies 1.3 and 1.4
+ - Regardless, policies 1.5 through 1.8 must be followed
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1537: Transfer Data to Cloud Account](https://attack.mitre.org/techniques/T1537/)
+
+#### GWS.DRIVEDOCS.1.2v0.1
+If disabling sharing outside of the organization's domain, then agencies SHOULD also disable users' receiving files from outside of the organization's domain.
+
+- Rationale
+ - If the agency decides that external sharing should be disabled, users should not be able to receive files from outside the organization as well. Disabling external sharing ensures that all communication stays within the organization, which helps mitigate risk from malicious files from an external source.
+- Last Modified: July 10, 2023
+- Note:
+ - This policy only applies if sharing outside was disabled in Policy 1.1
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1537: Transfer Data to Cloud Account](https://attack.mitre.org/techniques/T1537/)
+
+#### GWS.DRIVEDOCS.1.3v0.1
+Warnings SHOULD be enabled when a user is attempting to share something outside the domain.
+
+- Rationale
+ - In the case that a user is going to share something outside the domain, a warning should be given. The warning ensures that the user is aware that they are sharing something externally, and doing so purposefully.
+- Last Modified: July 10, 2023
+- Note:
+ - This policy only applies if external sharing was allowed in Policy 1.1
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1537: Transfer Data to Cloud Account](https://attack.mitre.org/techniques/T1537/)
+
+#### GWS.DRIVEDOCS.1.4v0.1
+If sharing outside of the organization, then agencies SHALL disable sharing of files with individuals who are not using a Google account.
+
+- Rationale
+ - To ensure that all shared documents are secured, and that agencies are able to control dissemination of the files, agencies shall only share files with individuals using a google account.
+- Last Modified: July 10, 2023
+- Note:
+ - This policy only applies if external sharing is allowed in Policy 1.1
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1537: Transfer Data to Cloud Account](https://attack.mitre.org/techniques/T1537/)
+
+#### GWS.DRIVEDOCS.1.5v0.1
+Agencies SHALL disable making files and published web content visible to anyone with the link.
+
+- Rationale
+ - We want to ensure that only approved individuals are able to access and view the document. If content was visible to anyone with a link, that link could be forwarded to anyone, and agencies would no longer have control over who can view the specific document. By disabling file access to anyone with a link, agencies and individuals will have tighter control over who can view files and published web content.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1537: Transfer Data to Cloud Account](https://attack.mitre.org/techniques/T1537/)
+
+#### GWS.DRIVEDOCS.1.6v0.1
+Agencies SHALL enable access checking for file sharing outside of Docs or Drive.
+
+- Rationale
+ - Enabling access checking for sharing files outside of Drive/Docs helps ensure that the documents are shared with approved individuals, organizations, or external domains only.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1537: Transfer Data to Cloud Account](https://attack.mitre.org/techniques/T1537/)
+
+#### GWS.DRIVEDOCS.1.7v0.1
+Agencies SHALL NOT allow any users to distribute content from an organization-owned shared drive to shared drives owned by another organizations.
+
+- Rationale
+ - To control access to content owned by the organization, users should not be able to distribute content to a shared drive owned by another organization. Once a document is moved outside the organization's drives, it no longer has control over the dissemination of the document. By not allowing users to distribute content to external shared drives, the organization maintains more control over the document.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1537: Transfer Data to Cloud Account](https://attack.mitre.org/techniques/T1537/)
+
+#### GWS.DRIVEDOCS.1.8v0.1
+Agencies SHALL set newly created items to have Private to the Owner as the default level of access.
+
+- Rationale
+ - All newly created items should default to private. Any sharing of the document needs to be explicitly applied by the owner of the document.
+- Last Modified: November 14, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1537: Transfer Data to Cloud Account](https://attack.mitre.org/techniques/T1537/)
+ - [T1538: Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538/)
+
+### Resources
+
+- [Google Workspace Admin Help: Set Drive users' sharing permissions](https://support.google.com/a/answer/60781?hl=en)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To configure the settings for Sharing options:
+
+#### Policy Group 1 Common Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Drive and Docs**.
+4. Follow implementation for each individual policy
+5. Select **Save**
+
+#### GWS.DRIVEDOCS.1.1v0.1 Instructions
+1. Select **Sharing settings** -\> **Sharing options**.
+2. Select **Sharing outside of your domain** -\> **OFF – Files owned by users in your domain cannot be shared outside of your domain**
+
+#### GWS.DRIVEDOCS.1.2v0.1 Instructions
+1. Select **Sharing settings** -\> **Sharing options**.
+2. Deselect **Allow users to receive files from users or shared drives outside of the organization**
+
+#### GWS.DRIVEDOCS.1.3v0.1 Instructions
+1. Select **Sharing settings** -\> **Sharing options**.
+2. Select **Warn when files owned by users or shared drives in your organization are shared outside of your organization.**
+
+#### GWS.DRIVEDOCS.1.4v0.1 Instructions
+1. Select **Sharing settings** -\> **Sharing options**.
+2. Deselect **Allow users or shared drives in your organization to share items with people outside of your organization who aren't using a Google account.**
+
+#### GWS.DRIVEDOCS.1.5v0.1 Instructions
+1. Select **Sharing settings** -\> **Sharing options**.
+2. Deselect **When sharing outside of your organization is allowed, users in your organization can make files and published web content visible to anyone with the link.**
+
+#### GWS.DRIVEDOCS.1.6v0.1 Instructions
+1. Select **Sharing settings** -\> **Sharing options**.
+2. Select **Access Checker** -\> **Recipients only, or suggested target audience.**
+
+#### GWS.DRIVEDOCS.1.7v0.1 Instructions
+1. Select **Sharing settings** -\> **Sharing options**.
+2. Select **Distributing content outside of your domain** -\> **Only users in your organization.**
+
+#### GWS.DRIVEDOCS.1.8v0.1 Instructions
+1. Select **Sharing settings -\> General access default.**
+2. Select **When users in your organization create items, the default access will be -\> Private to the owner.**
+
+## 2. Shared Drive Creation
+
+This section covers whether users can create new shared drives to share with other users, including those external to their organization. Even if users cannot create new shared drives, they can still be added to shared drives owned by other users. This control also determines which users, both internal and external to the organization, can access files in shared drives.
+
+### Policies
+
+#### GWS.DRIVEDOCS.2.1v0.1
+Agencies SHOULD enable shared drive creation to allow for effective collaboration.
+
+- Rationale
+ - Disabling shared drives would make collaboration difficult. Shared drives allow users in the organization to work together on one or multiple documents concurrently.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+#### GWS.DRIVEDOCS.2.2v0.1
+Agencies SHOULD NOT allow members with manager access to override shared drive creation settings.
+
+- Rationale
+ - The settings outlined in the SCBs should not be able to be overwritten by anyone, even those with manager access. Not allowing anyone to change shared drive creation settings ensures that security best practices are being followed.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+#### GWS.DRIVEDOCS.2.3v0.1
+Agencies SHOULD NOT allow users outside of their organization to access files in shared drives.
+
+- Rationale
+ - To control access to documents within the organization, agencies should not allow users outside the organization to access files in shared drives. Blocking external access to shared drives helps prevent documents shared within the organization from being shared outside the organization without explicit knowledge and approvals.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+#### GWS.DRIVEDOCS.2.4v0.1
+Agencies SHALL allow users who are not shared drive members to be added to files.
+
+- Rationale
+ - When users who are not shared drive members are not allowed to be added to file, administrators would need to add them as drive members in order to facilitate access which would provide access to all files within the drive, not just the file intended to be shared.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+#### GWS.DRIVEDOCS.2.5v0.1
+Agencies SHALL NOT allow viewers and commenters to download, print, and copy files.
+
+- Rationale
+ - All existing access control settings are circumvented once a file is downloaded and taken out of the GWS tenant which creates the possibility for data leakage.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1048: Exfilitration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048/)
+ - [T1048:002: Exfilitration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/002/)
+
+### Resources
+- [Google Workspace Admin Help: Set Drive users' sharing permissions](https://support.google.com/a/answer/60781?hl=en)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To configure the settings for Shared drive creation:
+
+##### Policy Group 2 common Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Drive and Docs**.
+3. Select **Sharing settings -\> Shared drive creation**.
+4. Follow the implementation for each individual policy.
+5. Select **Save**
+
+#### GWS.DRIVEDOCS.2.1v0.1 Instructions
+1. Uncheck the **Prevent users in organization from creating new shared drives** checkbox.
+
+#### GWS.DRIVEDOCS.2.2v0.1 Instructions
+1. Uncheck the **Allow members with manager access to override the settings below** checkbox.
+
+#### GWS.DRIVEDOCS.2.3v0.1 Instructions
+1. Uncheck the **Allow users outside organization to access files in shared drives** checkbox.
+
+#### GWS.DRIVEDOCS.2.4v0.1 Instructions
+1. Check the **Allow people who aren't shared drive members to be added to files** checkbox.
+
+#### GWS.DRIVEDOCS.2.5v0.1 Instructions
+1. Check the **Allow viewers and commenters to download, print, and copy files** checkbox.
+
+## 3. Security Updates for Files
+
+This section covers whether a security update issued by Google will be applied to make file links more secure. When sharing files using a link, users must not remove the resource key parameter, as doing so may result in unexpected file access requests.
+
+### Policies
+
+#### GWS.DRIVEDOCS.3.1v0.1
+Agencies SHALL enable security updates for Drive files.
+
+- Rationale
+ - Allowing security updates to be applied to all affected files will help keep the GWS tenant secure from potential security risks.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+### Resources
+
+- [Google Workspace Admin Help: Security update for Google Drive](https://support.google.com/drive/answer/10729743?hl=en#zippy=%2Care-any-file-types-not-impacted%2Cwhat-happens-if-i-dont-apply-the-security-update-to-my-files%2Chow-will-this-security-update-change-access-to-my-impacted-files)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To configure the settings for Security update for files:
+
+##### GWS.DRIVEDOCS.3.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Drive and Docs.**
+3. Select **Sharing settings -\> Security update for files.**
+4. Select **Apply security update to all impacted files.**
+5. Uncheck the **Allow users to remove/apply the security update for files they own or manage** checkbox.
+6. Select **Save**.
+
+## 4. Drive SDK
+
+This section covers whether users have access to Google Drive with the Drive SDK API, which allows third party applications to work on the files that are stored in Google Drive. The Drive SDK API is used by developers to access Google Drive through third party applications that they have created.
+
+### Policies
+
+#### GWS.DRIVEDOCS.4.1v0.1
+Agencies SHOULD disable Drive SDK access to restrict information sharing and prevent data leakage.
+
+- Rationale
+ - The Drive SDK allows third-party external applications to access data and files from within Drive. Disabling the Drive SDK prevents third party applications from accessing the files and data from within the organization, which protects against data leakage and unintentional information sharing.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1059: Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059/)
+ - [T1059:009: Command and Scripting Interpreter: Cloud API](https://attack.mitre.org/techniques/T1059/009/)
+
+### Resources
+
+- [Google Drive for Developers](https://developers.google.com/drive/)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To configure the settings for Drive SDK:
+
+#### GWS.DRIVEDOCS.4.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Drive and Docs.**
+3. Select **Features and Applications -\> Drive SDK.**
+4. Uncheck the **Allow users to access Google Drive with the Drive SDK API** checkbox.
+5. Select **Save**.
+
+## 5. User Installation of Drive and Docs Add-Ons
+
+This section covers whether users can use add-ons in file editors within Google Drive, such as Docs, Sheets, Slides, and Forms. These add-ons include those available through Google Workspace Marketplace that have been built by other developers.
+
+### Policies
+
+#### GWS.DRIVEDOCS.5.1v0.1
+Agencies SHALL disable Add-Ons with the exception of those that are approved within the organization.
+
+- Rationale
+ - Google Docs Add-Ons can pose a great security risk based on the permissions the add-on is given. Add-ons can be given full access to the google drive, permission to add or edit existing documents, share documents, connect to external services, and more. Any add-on needs to be fully vetted before given access to the google workspace. Therefore, unapproved add-ons need to be disabled.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1195: Supply Chain Compromise](https://attack.mitre.org/techniques/T1195/)
+ - [T1195:001: Supply Chain Compromise: Compromise Software Dependencies and Development Tools](https://attack.mitre.org/techniques/T1195/001/)
+
+### Resources
+
+- [Google Workspace Admin Help: Allow or restrict add-ons in Docs editors](https://support.google.com/a/answer/4530135?product_name=UnuFlow&visit_id=637843582622955886-2417503403&rd=1&src=supportwidget0)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To configure the settings for add-ons:
+
+#### GWS.DRIVEDOCS.5.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps -\> Google Workspace -\> Drive and Docs.**
+3. Select **Features and Applications -\> Add-Ons.**
+4. Uncheck the **Allow users to install Google Docs add-ons from add-ons stor**e checkbox.
+5. Select **Save**.
+
+## 6. Drive for Desktop
+
+This section covers that Google Drive for Desktop, if not disabled entirely, should only be allowed on authorized devices.
+
+### Policies
+
+#### GWS.DRIVEDOCS.6.1v0.1
+Agencies SHOULD either disable Google Drive for Desktop or only allow Google Drive for Desktop on authorized devices.
+
+- Rationale
+ - Saving directly to the cloud reduces the risk of potentially losing data, which is beneficial when dealing with sensitive information and when trying to retain certain files.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+### Resources
+
+- [Use Google Drive for desktop - Google Drive Help](https://support.google.com/drive/answer/10838124?sjid=7721208110884477761-NA&visit_id=638192503824884459-786860809&rd=1)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.DRIVEDOCS.6.1v0.1 Instructions
+To Disable Google Drive for Desktop:
+
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Menu-\>Apps-\>Google Workspace-\>Drive and Docs-\>Google Drive for Desktop**.
+3. Uncheck the **Allow Google Drive for desktop in your organization box** checkbox or
+4. Ensure **Allow Google Drive for desktop in your organization box** and **Only allow Google Drive for desktop on authorized devices** is checked.
+4. Select **Save.**
+
+To limit Google Drive for Desktop to authorized devices:
+
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select Menu-\>Apps-\>Google Workspace-\>Drive and Docs-\>Features and Applications.
+3. Uncheck the Allow Google Drive for desktop in your organization checkbox.
+4. Check the Only allow Google Drive for desktop on authorized devices checkbox.
+5. Ensure authorized devices are added to [company-owned inventory](https://support.google.com/a/answer/7129612?hl=en).
+6. Select Save.
+
+Alternatively, [Context-Aware access policies](https://support.google.com/a/answer/9275380?hl=en) can be configured for more granular controls around authorized devices. The access level applied to Google Drive must have the "Apply to Google desktop and mobile apps" enabled to meet this requirement. For additional guidance, see the *Common Controls Minimum Viable Secure Baseline*, section "Context-Aware Access for All Devices that Connect to GWS SHOULD be Implemented."
+
+## 7. DLP rules
+
+This recommendation applies only to agencies that allow external sharing (see [Sharing Outside the Organization](#1-sharing-outside-the-organization)).
+
+Using data loss prevention (DLP), you can create and apply rules to control the content that users can share in files outside the organization. DLP gives you control over what users can share and prevents unintended exposure of sensitive information.
+
+DLP rules can use predefined content detectors to match PII (e.g., SSN), credentials (e.g., API keys), or specific document types (e.g., source code). Custom rules can also be applied based upon regex match or document labels.
+
+### Policies
+
+#### GWS.DRIVEDOCS.7.1v0.1
+Agencies SHOULD configure DLP rules to block or warn on sharing files with sensitive data.
+
+- Rationale
+ - Data Loss Prevention (DLP) rules trigger scans of files to look for sensitive content and restrict sharing of documents that may contain sensitive content. Configuring DLP rules helps agencies protect their information, by determining what data and/or phrasing might be sensitive, and restricting the dissemination of the documents containing that data. Examples include PII, PHI, portion markings, etc.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+### Resources
+
+- [How to use predefined content detectors - Google Workspace Admin Help](https://support.google.com/a/answer/7047475#zippy=%2Cunited-states)
+- [Get started as a Drive labels admin - Google Workspace Admin Help](https://support.google.com/a/answer/9292382?hl=en)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.DRIVEDOCS.7.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Menu -\> Security -\> Access and data control -\> Data protection**.
+3. Click **Manage Rules**. Then click **Add rule** -\> **New rule** or click **Add rule** -\> **New rule from template**. For templates, select a template from the Templates page.
+4. In the **Name** section, add the name and description of the rule.
+5. In the **Scope** section, apply this rule only to the entire domain or to selected organizational units or groups, and click **Continue**. If there's a conflict between organizational units and groups in terms of inclusion or exclusion, the group takes precedence.
+6. In the **Apps** section, choose the trigger for **Google Drive, File created, modified, uploaded or shared**, and click **Continue**.
+7. In the **Conditions** section, click **Add Condition**.
+8. Configure appropriate content definition(s) based upon the agency's individual requirements and click **Continue**.
+9. Select the appropriate action to warn or block sharing, based upon the agency's individual requirements.
+10. In the **Alerting** section, choose a severity level, and optionally, check **Send to alert center to trigger notifications**.
+11. Review the rule details, mark the rule as **Active**, and click **Create.**
diff --git a/baselines/Google Meet Minimum Viable Secure Configuration Baseline v0.1.md b/baselines/Google Meet Minimum Viable Secure Configuration Baseline v0.1.md
new file mode 100644
index 00000000..ec5a9f06
--- /dev/null
+++ b/baselines/Google Meet Minimum Viable Secure Configuration Baseline v0.1.md
@@ -0,0 +1,191 @@
+# CISA Google Workspace Security Configuration Baseline for Google Meet
+
+Google Meet is a video conferencing service in Google Workspace that supports real-time video, desktop, and presentation sharing. Meet allows administrators to control and manage their video meetings. This Secure Configuration Baseline (SCB) provides specific policies to strengthen Meet security.
+
+The Secure Cloud Business Applications (SCuBA) project provides guidance and capabilities to secure agencies' cloud business application environments and protect federal information that is created, accessed, shared, and stored in those environments. The SCuBA Secure Configuration Baselines (SCB) for Google Workspace (GWS) will help secure federal civilian executive branch (FCEB) information assets stored within GWS cloud environments through consistent, effective, modern, and manageable security configurations.
+
+The CISA SCuBA SCBs for GWS help secure federal information assets stored within GWS cloud business application environments through consistent, effective, and manageable security configurations. CISA created baselines tailored to the federal government's threats and risk tolerance with the knowledge that every organization has different threat models and risk tolerance. Non-governmental organizations may also find value in applying these baselines to reduce risks.
+
+The information in this document is being provided "as is" for INFORMATIONAL PURPOSES ONLY. CISA does not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial entities or commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoritism by CISA.
+
+This baseline is based on Google documentation available at [Google Meet settings reference for admins](https://support.google.com/a/answer/7304109?product_name=UnuFlow&hl=en&visit_id=637812507975083818-2789839413&rd=1&src=supportwidget0&hl=en#:~:text=From%20the%20Admin%20console%20Home%20page%2C%20go%20to,to%20everyone%2C%20leave%20the%20top%20organizational%20unit%20selected) and addresses the following:
+
+- [Meeting Access](#1-meeting-access)
+- [Internal Access to External Meetings](#2-internal-access-to-external-meetings)
+- [Host Management Meeting Features](#3-host-management-meeting-features)
+- [External Participants](#4-external-participants)
+
+
+Settings can be assigned to certain users within Google Workspace through organizational units, configuration groups, or individually. Before changing a setting, the user can select the organizational unit, configuration group, or individual users to which they want to apply changes.
+
+## Assumptions
+
+This document assumes the organization is using GWS Enterprise Plus.
+
+This document does not address, ensure compliance with, or supersede any law, regulation, or other authority. Entities are responsible for complying with any recordkeeping, privacy, and other laws that may apply to the use of technology. This document is not intended to, and does not, create any right or benefit for anyone against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person.
+
+## Key Terminology
+
+The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.
+
+# Baseline Policies
+
+## 1. Meeting Access
+
+This control limits safe meeting access to users with a Google Account or Dialing in using a phone.
+
+### Policies
+
+#### GWS.MEET.1.1v0.1
+Meeting access SHALL be restricted to users signed in with a Google Account or Dialing in using a phone.
+
+- Rationale
+ - This protects against unauthorized access to a Google meeting and helps ensures the user has been authenticated prior to joining.
+- Last Modified: June 29, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1123: Audio Capture](https://attack.mitre.org/techniques/T1123/)
+ - [T1113: Screen Capture](https://attack.mitre.org/techniques/T1113/)
+ - [T1125: Video Capture](https://attack.mitre.org/techniques/T1125/)
+
+### Resources
+
+- [Google Meet security & privacy for admins](https://support.google.com/a/answer/7582940?hl=en&ref_topic=7302923#zippy=%2Cprivacy-compliance%2Cincident-response%2Csecure-deployment-access-controls%2Canti-abuse-measures%2Cencryption%2Csafety-best-practices)
+- [Google Meet settings reference for admins](https://support.google.com/a/answer/7304109?product_name=UnuFlow&hl=en&visit_id=637812507975083818-2789839413&rd=1&src=supportwidget0&hl=en#:~:text=From%20the%20Admin%20console%20Home%20page%2C%20go%20to,to%20everyone%2C%20leave%20the%20top%20organizational%20unit%20selected)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To configure the settings for Domain Meet safety settings:
+
+#### GWS.MEET.1.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Google Meet**.
+3. Select **Meet safety settings** -\> **Domain**.
+4. Select **Only users from your organization or users dialing in using a phone** or **Users signed in with a Google account or dialing in using a phone**.
+5. Select **Save**.
+
+
+## 2. Internal Access to External Meetings
+
+This control determines which meetings users within the agency's organization can join.
+
+### Policies
+
+#### GWS.MEET.2.1v0.1
+Meeting access SHALL be disabled for meetings created by users who are not members of any Google Workspace tenant or organization.
+
+- Rationale
+ - This helps ensure that organization members are not able to join meetings created externally to avoid potential data leakage or other security risks.
+- Last Modified: September 26, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1078: Valid Accounts](https://attack.mitre.org/techniques/T1078/)
+ - [T1123: Audio Capture](https://attack.mitre.org/techniques/T1123/)
+ - [T1113: Screen Capture](https://attack.mitre.org/techniques/T1113/)
+ - [T1125: Video Capture](https://attack.mitre.org/techniques/T1125/)
+
+### Resources
+
+- [Google Meet security & privacy for admins](https://support.google.com/a/answer/7582940?hl=en&ref_topic=7302923#zippy=%2Cprivacy-compliance%2Cincident-response%2Csecure-deployment-access-controls%2Canti-abuse-measures%2Cencryption%2Csafety-best-practices)
+- [Google Meet settings reference for admins](https://support.google.com/a/answer/7304109?product_name=UnuFlow&hl=en&visit_id=637812507975083818-2789839413&rd=1&src=supportwidget0&hl=en#:~:text=From%20the%20Admin%20console%20Home%20page%2C%20go%20to,to%20everyone%2C%20leave%20the%20top%20organizational%20unit%20selected)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To configure the settings for Access within Meet safety settings:
+
+#### GWS.MEET.2.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Google Meet**.
+3. Select **Meet safety settings** -\> **Access**.
+4. Select **Meetings created in your organization only** or **Meetings created in any Workspace organization**.
+5. Select **Save**.
+
+## 3. Host Management Meeting Features
+
+This control enables the following features for a host to implement during their meeting: prevent participants from sharing their screen, turn chat messages on or off, end the meeting for all, and mute all. By default, this control is disabled.
+
+Note: When this feature is not enabled, any attendee that is a member of the host's organization can record the meeting.
+
+### Policies
+
+#### GWS.MEET.3.1v0.1
+Host Management meeting features SHALL be enabled so that they are available by default when a host starts their meeting.
+
+- Rationale
+ - Enabling these features does not pose any security risk and provides better collaboration features to users. If this setting was disabled then any participant could take control of the meeting.
+- Last Modified: July 3, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1562:001: Impair Defenses](https://attack.mitre.org/techniques/T1562/)
+ - [T1562:001: Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)
+ - [T1123: Audio Capture](https://attack.mitre.org/techniques/T1123/)
+ - [T1113: Screen Capture](https://attack.mitre.org/techniques/T1113/)
+ - [T1125: Video Capture](https://attack.mitre.org/techniques/T1125/)
+
+### Resources
+
+- [Google Meet security & privacy for admins](https://support.google.com/a/answer/7582940?hl=en&ref_topic=7302923#zippy=%2Cprivacy-compliance%2Cincident-response%2Csecure-deployment-access-controls%2Canti-abuse-measures%2Cencryption%2Csafety-best-practices)
+- [Google Meet settings reference for admins](https://support.google.com/a/answer/7304109?product_name=UnuFlow&hl=en&visit_id=637812507975083818-2789839413&rd=1&src=supportwidget0&hl=en#:~:text=From%20the%20Admin%20console%20Home%20page%2C%20go%20to,to%20everyone%2C%20leave%20the%20top%20organizational%20unit%20selected)
+- [Record a Video Meeting](https://support.google.com/meet/answer/9308681?hl=en)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To enable Host Management meeting features:
+
+#### GWS.MEET.3.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Google Meet**.
+3. Select **Meet safety settings** -\> **Host management**.
+4. Check the **Start video calls with host management turned on** checkbox.
+5. Select **Save**.
+
+## 4. External Participants
+
+This control provides a warning label for any participating a meeting who is not a member of the organization or whose identity is unconfirmed.
+
+### Policies
+
+#### GWS.MEET.4.1v0.1
+Warn for external participants SHALL be enabled.
+
+- Rationale
+ - When enabled, external or unidentified participants in a meeting are given a label. This increases situational awareness amongst meeting participants and can help prevent inadvertent data leakage.
+- Last Modified: September 26, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1123: Audio Capture](https://attack.mitre.org/techniques/T1123/)
+ - [T1113: Screen Capture](https://attack.mitre.org/techniques/T1113/)
+ - [T1125: Video Capture](https://attack.mitre.org/techniques/T1125/)
+
+### Resources
+
+- [Manage Meet settings (for admins)](https://support.google.com/a/answer/7304109?fl=1&sjid=1761497708922707326-NA)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To enable Host Management meeting features:
+
+#### GWS.MEET.4.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Google Meet**.
+3. Select **Meet safety settings** -\> **Warn for external participants**.
+4. Check the **External or unidentified participants in a meeting are given a label** checkbox.
+5. Select **Save**.
diff --git a/baselines/Google Sites Minimum Viable Secure Configuration Baseline v0.1.md b/baselines/Google Sites Minimum Viable Secure Configuration Baseline v0.1.md
new file mode 100644
index 00000000..3888482e
--- /dev/null
+++ b/baselines/Google Sites Minimum Viable Secure Configuration Baseline v0.1.md
@@ -0,0 +1,66 @@
+# CISA Google Workspace Security Configuration Baseline for Google Sites
+
+Google Sites is a collaborative tool in Google Workspace that supports the creation of websites (i.e., internal project hubs, team sites, and public-facing websites) without the need of a designer, programmer, or IT help. Sites allow administrators to control and manage their files and documents. Google Drive manages sharing and publishing settings for new Sites. This Secure Configuration Baseline (SCB) provides specific policies to strengthen Sites security.
+
+The Secure Cloud Business Applications (SCuBA) project provides guidance and capabilities to secure agencies' cloud business application environments and protect federal information that is created, accessed, shared, and stored in those environments. The SCuBA Secure Configuration Baselines (SCB) for Google Workspace (GWS) will help secure federal civilian executive branch (FCEB) information assets stored within GWS cloud environments through consistent, effective, modern, and manageable security configurations.
+
+The CISA SCuBA SCBs for GWS help secure federal information assets stored within GWS cloud business application environments through consistent, effective, and manageable security configurations. CISA created baselines tailored to the federal government's threats and risk tolerance with the knowledge that every organization has different threat models and risk tolerance. Non-governmental organizations may also find value in applying these baselines to reduce risks.
+
+The information in this document is being provided "as is" for INFORMATIONAL PURPOSES ONLY. CISA does not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial entities or commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoritism by CISA.
+
+This baseline is based on Google documentation available at [Google Workspace Admin Help: Sites](https://support.google.com/a/topic/6385920?hl=en&ref_topic=9197) and addresses the following:
+
+- [Sites Service Status](#1-sites-service-status)
+
+Google is currently transitioning from classic Sites to new Sites, [Google Workspace Admin Help: Transition from classic Sites to new Sites](https://support.google.com/a/answer/9958187?hl=en&ref_topic=25684#zippy=%2Cstarting-july-previously-january-classic-sites-transition%2Cstarting-june-previously-december-editing-of-remaining-classic-sites-will-be-disabled). Starting December 1, 2022, classic Sites will no longer be editable. And starting January 1, 2023, classic Sites will no longer be viewable unless converted to new Google Sites. All remaining classic Sites will be automatically archived as HTML files, saved to the site owner's Google Drive, and replaced with a draft in new Sites to be reviewed and published.
+
+Settings can be assigned to certain users within Google Workspace through organizational units, configuration groups, or individually. Before changing a setting, the user can select the organizational unit, configuration group, or individual users to which they want to apply changes.
+
+## Assumptions
+
+This document assumes the organization is using GWS Enterprise Plus.
+
+This document does not address, ensure compliance with, or supersede any law, regulation, or other authority. Entities are responsible for complying with any recordkeeping, privacy, and other laws that may apply to the use of technology. This document is not intended to, and does not, create any right or benefit for anyone against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person.
+
+## Key Terminology
+
+The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.
+
+# Baseline Policies
+
+## 1. Sites Service Status
+
+This section covers whether users are able to access Google Sites.
+
+### Policy
+
+#### GWS.SITES.1.1v0.1
+Sites Service SHOULD be disabled for all users.
+
+- Rationale
+ - This helps to minimize attack surface. Not every user within an organization needs access to Google Sites. If this capability is needed, it can be enabled and configured for those users based on user's assigned organizational unit (OU) and by exception as required by the organization to meet specific needs.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1526: Cloud Service Discovery](https://attack.mitre.org/techniques/T1526/)
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+### Resources
+
+- [Google Workspace Admin Help: Manage users' access in Sites](https://support.google.com/a/answer/6399230?hl=en)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+To configure the settings for Site creation and editing:
+
+#### GWS.SITES.1.1v0.1 Instructions
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Sites**.
+3. Select **Service Status**
+4. Select **OFF for everyone**.
+5. Select **Save**.
diff --git a/baselines/Groups for Business Minimum Viable Secure Configuration Baseline v0.1.md b/baselines/Groups for Business Minimum Viable Secure Configuration Baseline v0.1.md
new file mode 100644
index 00000000..504e5455
--- /dev/null
+++ b/baselines/Groups for Business Minimum Viable Secure Configuration Baseline v0.1.md
@@ -0,0 +1,305 @@
+# CISA Google Workspace Security Configuration Baseline for Groups for Business
+
+Groups for Business is a Google Workspace collaboration tool that supports storage, access, and sharing of files, document management, and email. Groups for Business allows administrators to control and manage collaboration efforts among groups within their organizations. This Secure Configuration Baseline (SCB) provides specific policies to strengthen Groups security.
+
+The Secure Cloud Business Applications (SCuBA) project provides guidance and capabilities to secure agencies' cloud business application environments and protect federal information that is created, accessed, shared, and stored in those environments. The SCuBA Secure Configuration Baselines (SCB) for Google Workspace (GWS) will help secure federal civilian executive branch (FCEB) information assets stored within GWS cloud environments through consistent, effective, modern, and manageable security configurations.
+
+The CISA SCuBA SCBs for GWS help secure federal information assets stored within GWS cloud business application environments through consistent, effective, and manageable security configurations. CISA created baselines tailored to the federal government's threats and risk tolerance with the knowledge that every organization has different threat models and risk tolerance. Non-governmental organizations may also find value in applying these baselines to reduce risks.
+
+The information in this document is being provided "as is" for INFORMATIONAL PURPOSES ONLY. CISA does not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial entities or commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoritism by CISA.
+
+This baseline is based on Google documentation available at [Google Workspace Admin Help: Set up and manage Groups for Business](https://support.google.com/a/topic/9400092?hl=en&ref_topic=25838) and addresses the following:
+
+- [External Group Access](#1-external-group-access)
+- [Adding External Members](#2-adding-external-members)
+- [Allowing Posting by External Members](#3-allowing-posting-by-external-members)
+- [Group Creation](#4-group-creation)
+- [Default Permissions for Viewing Conversations](#5-default-permissions-for-viewing-conversations)
+- [Ability to Hide Groups from the Directory](#6-ability-to-hide-groups-from-the-directory)
+- [New Groups](#7-new-groups)
+
+Settings can be assigned to certain users within Google Workspace through organizational units, configuration groups, or individually. Before changing a setting, the user can select the organizational unit, configuration group, or individual users to which they want to apply changes.
+
+## Assumptions
+
+This document assumes the organization is using GWS Enterprise Plus.
+
+This document does not address, ensure compliance with, or supersede any law, regulation, or other authority. Entities are responsible for complying with any recordkeeping, privacy, and other laws that may apply to the use of technology. This document is not intended to, and does not, create any right or benefit for anyone against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person.
+
+## Key Terminology
+
+The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.
+
+
+# Baseline Policies
+
+## 1. External Group Access
+
+This control determines whether users outside of an agency's organization can view, search for, or post to groups internal to an agency.
+
+Note: Even with this setting configured, group owners can still explicitly add external POCs to a group ([Adding External Members](#2-adding-external-members)), or explicitly allow posting to a group by an external POC who has not been added to said group ([Allowing Posting by External Members](#3-allowing-posting-by-external-members)).
+
+### Baseline Policies
+
+#### GWS.GROUPS.1.1v0.1
+Group access from outside the organization SHALL be disabled unless explicitly granted by the group owner.
+
+- Rationale
+ - Who can externally view groups internal to the organization should be carefully controlled and their access vetted as needed.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+
+### Resources
+
+- [Google Workspace Admin Help: Set organization-wide policies for using groups](https://support.google.com/a/answer/167097?hl=en&ref_topic=9400092)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.GROUPS.1.1v0.1 Instructions
+To configure the settings for Sharing options:
+
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Groups for Business**.
+3. Select **Sharing settings** -\> **Sharing options**.
+4. Select **Accessing groups from outside this organization** -\> **Private**.
+5. Select **Save**.
+
+## 2. Adding External Members
+
+This section covers whether or not the owner of the group has the ability to add external members to the group.
+
+### Policies
+
+#### GWS.GROUPS.2.1v0.1
+Group owners' ability to add external members to groups SHOULD be disabled unless necessary for agency mission fulfillment.
+
+- Rationale
+ - The ability to add external members should be left to the organization/agency to protect the agency from potential data leakage.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1048: Exfilitration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048/)
+ - [T1048:001: Exfilitration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/001/)
+ - [T1048:002: Exfilitration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/002/)
+
+### Resources
+
+- [Google Workspace Admin Help: Set organization-wide policies for using groups](https://support.google.com/a/answer/167097?hl=en&ref_topic=9400092)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.GROUPS.2.1v0.1 Instructions
+To configure the settings for Sharing options:
+
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Groups for Business**.
+3. Select **Sharing settings** -\> **Sharing options**.
+4. **Uncheck** the **Group owners can allow external members** checkbox.
+5. Select **Save**.
+
+## 3. Allowing Posting by External Members
+
+This section covers whether or not an owner of a group has the ability to allow an external non-member to post to the group.
+
+### Policies
+
+#### GWS.GROUPS.3.1v0.1
+Group owners' ability to allow posting to a group by an external, non-group member SHOULD be disabled unless necessary for agency mission fulfillment.
+
+- Rationale
+ - External member posting would create unnecessary security risks.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1048: Exfilitration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048/)
+ - [T1048:001: Exfilitration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/001/)
+ - [T1048:002: Exfilitration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/002/)
+
+### Resources
+
+- [Google Workspace Admin Help: Set organization-wide policies for using groups](https://support.google.com/a/answer/167097?hl=en&ref_topic=9400092)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.GROUPS.3.1v0.1 Instructions
+To configure the settings for Sharing options:
+
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Groups for Business**.
+3. Select **Sharing settings** -\> **Sharing options**.
+4. **Uncheck** the **Group owners can allow incoming mail from outside the organization** checkbox.
+5. Select **Save**.
+
+## 4. Group Creation
+
+This section covers who has the ability to create a new group within the organization.
+
+### Policies
+
+#### GWS.GROUPS.4.1v0.1
+Group creation SHOULD be restricted to admins within the organization unless necessary for agency mission fulfillment.
+
+- Rationale
+ - The organization should have some control over the organizational groups created and the purpose they are for.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1069: Permission Groups Discovery](https://attack.mitre.org/techniques/T1069/)
+ - [T1069:003: Permission Groups Discovery: Cloud Groups](https://attack.mitre.org/techniques/T1069/003/)
+
+### Resources
+
+- [Google Workspace Admin Help: Set organization-wide policies for using groups](https://support.google.com/a/answer/167097?hl=en&ref_topic=9400092)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.GROUPS.4.1v0.1 Instructions
+To configure the settings for Sharing options:
+
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Groups for Business**.
+3. Select **Sharing settings** -\> **Sharing options**.
+4. Select **Creating groups** -\> **Only organization admins can create groups**.
+5. Select **Save**.
+
+## 5. Default Permissions for Viewing Conversations
+
+This section covers the default permissions assigned to the viewing of conversations within a group.
+
+### Policies
+
+#### GWS.GROUPS.5.1v0.1
+The default permission to view conversations SHOULD be set to All Group Members.
+
+- Rationale
+ - Conversation viewing by default should be restricted as a security best practice but can be expanded by exception for certain groups on a need-to-know basis.
+- Last Modified: July 10, 2023
+- Note: This setting can be changed by group owners and group managers.
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1048: Exfilitration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048/)
+ - [T1048:001: Exfilitration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/001/)
+ - [T1048:002: Exfilitration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/002/)
+
+### Resources
+
+- [Google Workspace Admin Help: Set organization-wide policies for using groups](https://support.google.com/a/answer/167097?hl=en&ref_topic=9400092)
+- [CIS Google Workspace Foundations Benchmark](https://www.cisecurity.org/benchmark/google_workspace)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.GROUPS.5.1v0.1 Instructions
+To configure the settings for Sharing options:
+
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Groups for Business**.
+3. Select **Sharing settings** -\> **Sharing options**.
+4. Select **Default for permission to view conversations** -\> **All group members**.
+5. Select **Save**.
+
+## 6. Ability to Hide Groups from the Directory
+
+This section covers whether or not the owner of a group can hide the group from the directory.
+
+### Policies
+
+#### GWS.GROUPS.6.1v0.1
+The Ability for Groups to be Hidden from the Directory SHALL be disabled.
+
+- Rationale
+ - Provide group visibility at the directory level to help reduce the potential for undetected data exfiltration.
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1048: Exfilitration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048/)
+ - [T1048:001: Exfilitration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/001/)
+ - [T1048:002: Exfilitration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/002/)
+
+### Resources
+
+- [Google Workspace Admin Help: Set organization-wide policies for using groups](https://support.google.com/a/answer/167097?hl=en&ref_topic=9400092)
+
+### Prerequisites
+
+- None
+
+### Implementation
+
+#### GWS.GROUPS.6.1v0.1 Instructions
+To configure the settings for Sharing options:
+
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Apps** -\> **Google Workspace** -\> **Groups for Business**.
+3. Select **Sharing settings** -\> **Sharing options**.
+4. **Uncheck** the **Group owners can hide groups from the directory** checkbox.
+5. **Ensure** that the **hide newly created groups from the directory** checkbox is not selected.
+6. Select **Save**.
+
+## 7. New Groups
+
+This section covers the access type setting for new groups that are created.
+
+### Policies
+
+#### GWS.GROUPS.7.1v0.1
+New Groups SHOULD be created with an Access type of Restricted unless necessary for agency mission fulfillment.
+
+- Rationale
+ - This helps protect against unauthorized access to groups
+- Last Modified: July 10, 2023
+
+- MITRE ATT&CK TTP Mapping
+ - [T1530: Data from Cloud Storage](https://attack.mitre.org/techniques/T1530/)
+ - [T1069: Permission Groups Discovery](https://attack.mitre.org/techniques/T1069/)
+ - [T1069:003: Permission Groups Discovery: Cloud Groups](https://attack.mitre.org/techniques/T1069/003/)
+
+### Resources
+
+- [Google Workspace Admin Help: Create a group in your organization](https://github.com/mitre/CISA-SCuBA-GWS-SCB)
+
+### Prerequisites
+
+- This control only applies to agencies with Google Groups for Business enabled.
+
+### Implementation
+
+#### GWS.GROUPS.7.1v0.1 Instructions
+To configure Access type for a Google Group:
+
+1. Sign in to the [Google Admin Console](https://admin.google.com).
+2. Select **Directory** -\> **Groups.**
+3. Select **Create group.**
+4. Fill in the details for the new group and click **Next.**
+5. In the **Access type** section, select the **Restricted** radio button.
+6. If the group needs to receive messages from non-members, select the appropriate checkboxes in the **Who can post** row.
+7. Select **Next.**
+8. Select **Create Group.**
diff --git a/download_opa.py b/download_opa.py
new file mode 100644
index 00000000..ff6cb45e
--- /dev/null
+++ b/download_opa.py
@@ -0,0 +1,216 @@
+'''
+This is script used to download OPA executables of varied versions and operating systems.
+
+Run python download_opa.py -h to see arguments
+
+Minimum OPA version supported: 0.42.2
+'''
+import urllib.request
+import hashlib
+import argparse
+import ssl
+
+OPA_VERSION_SHA256_HASHES = {
+ '0.42.2': {
+ 'windows': '2200de1f85e21a6566c9d2bd341af1d4dfc410baae0c2ec692a35135eef12bbb',
+ 'macos': '03a14125ef038c8e8c71925316044f5d144c5cf6daa82724a1dae07258972459',
+ 'linux': '2b59001ef6657281863e1719783f6204c16f0d8ec53de5854d2549451bdf1dc0'
+ },
+ '0.43.1': {
+ 'windows': 'a9a859e24e79ff942792c7ae6aa71ac89d86159393dd486df9bfd954c27004ff',
+ 'macos': '2c68fb04ae4908b1dd315c24ab282a1e46ca16cc83c52e7b6862bc06aa01b8b5',
+ 'linux': 'daf578c643654c17e97da8a33d9b9c3cad56804d6eca5dc65a011fbefc7f7b67'
+ },
+ '0.44.0': {
+ 'windows': 'e8179cf589e5dceb684fafcc3444506f776b8ba61e01da495c2a70410e3cdf3f',
+ 'macos': 'b51b26865c0a99d021f173ca34172440485024d77d0fa69f0110365474d5841c',
+ 'linux': '5ddb21d3fcfca130a47a42e730c05f055c68af6c1b37465879f6c59b10527eae'
+ },
+ '0.45.0': {
+ 'windows': '31b12b954900584e8aa9103235adf192dd4c92e0039416eaec7d84e2f66fcf3e',
+ 'macos': '1d76713a65c11771bd86fe44d8ace17d79f1660e5bb00219d4f3c9b0f966f6e5',
+ 'linux': 'fb17d142d05c371e668440b414e41ccffc90c1e3d8f4984cf0c08e64fdd99a03'
+ },
+ '0.46.3': {
+ 'windows': '7ce4b97f2718a0af9f3796d36c12c4d12196e778ddf8b49679263a14c918150f',
+ 'macos': 'd1f2a921a45863ab1e98a5af012d107a3b3a280ba34fbb3a83bdce249d1ecece',
+ 'linux': '6c9c5294518d2be672a57fd8e1701405d0ebd7691ace3114b3c123331885d383'
+ },
+ '0.47.4': {
+ 'windows': '1f4285c743949b9c52ec644334ea315972fa4a200b5239c4ed1932ee6968e20d',
+ 'macos': 'b84ccf9608706e1496051442c866f5b755684033b6913eaab1870f9baadfd69e',
+ 'linux': '563f8f8146dbcccb22d8f98968c180db51fc8c9d3c2a1290ad93959859945886'
+ },
+ '0.48.0': {
+ 'windows': 'e27c533ca9c9a7a44064f879bcfccd327a95d6c84002f0d422137ffe62bd493f',
+ 'macos': '1554312fe5376ed8c34aa6404b85a1d3722971e7d5b8950f1888e62821ab73e3',
+ 'linux': 'ba2dcf3e0902f1c2da46679e30c5ceb2abefd6a1d5aa4bf3839426317dc28b7f'
+ },
+ '0.49.2': {
+ 'windows': 'de3f5406783f7e2cd98251e0801fb7184acc5ee6c2618748b88d68c3c6cec521',
+ 'macos': 'bcb69f7b01a70b7c1fd1d165142e0329c1e746bcfdf1cf2590613aa90f49557f',
+ 'linux': '40ed9de929162b13caf7b2d064f4c653c12a1a8cd15b80627cfb8d8fef5a4fc0'
+ },
+ '0.50.2': {
+ 'windows': '6c88953e54f4b5b2bd5189740a4718a61065c8f4b79df845a20c5ae5d150e8e5',
+ 'macos': '3d3c4ba4da7697606b1784ffa74a528902edb76726648f1de0539c83393e0250',
+ 'linux': '5697d0260cc7da8f15be195e61a2025907f3149a1dd5f84e0003ed9e9dea4970'
+ },
+ '0.51.0': {
+ 'windows': '34be29ebbcf256dc87f00ce91792e53edbf5ab631e31b14b8b712b70c50921da',
+ 'macos': '6b7c30eed9204409bc240091da560199343d731f3ed90947a19152d471621cfb',
+ 'linux': '9aef4d16e07f4169d22068c21a2d3559d193fee439364992e0f45fc3745ac5fd'
+ },
+ '0.52.0': {
+ 'windows': '6f0a952ebd0fd544bf27a13686a0f3494e9be102654a58996bedfe3bcc6f61ab',
+ 'macos': 'f40c0f2d4f864b09e30a30bb66ae3d1610405927176caffa12531aaf80dcbd53',
+ 'linux': 'a3ff21f3b16632d3868e49bdb52f6affbd97ec382d5310d1bbbe7627e8e5c8f6'
+ },
+ '0.53.1': {
+ 'windows': '3b8c30bb7a2df3f9f5e89dfbc1a963fb2aca2c646b8f697dd9fb95efd36b1b40',
+ 'macos': '73a76e498c1f9ec0442787efa056599fc11845301e4e3f03f436be6c31c3f7aa',
+ 'linux': '54e58abab85d125038152476f7c7987d352ca314c5e49e1f10d8e6800e6f6bef'
+ },
+ '0.54.0': {
+ 'windows': '25284b69e1dd7feaa17446e49b1085b61dca0b496dc868304153eb64b422c7eb',
+ 'macos': 'a33e829306cd2210ed743da7f4f957588ea350a184bb6ecbb7cbfd77ae7ca401',
+ 'linux': '633829141f8d6706ac24e0b84393d7730a975a17cc4a15790bf7fad959a28ec3'
+ },
+ '0.55.0': {
+ 'windows': '23b4300fc0e9a9af7c5cf6f955e91e3dd34edfe6b40e2ffca480f892f0538101',
+ 'macos': '4513f3bbb07c5915a7b5b70c951012327f9c1b6491b1ebab98d83149528599db',
+ 'linux': '388af161328871b943306f1ba7948658810a9fcf9c3c0a27bdfac6e8086617a9'
+ },
+ '0.56.0': {
+ 'windows': '8b2aab7e968245b178c2480e4843ad8d0b6551283306a9ce155545b2f72782db',
+ 'macos': 'f46e1a37bf6e3ad98523bd12ad51fe3b9f1ea660dfb3e9131ae1c84eece6dd57',
+ 'linux': '623771025227588898af1788998d5b5f29068a887682cd8b8e9699136d4cf121'
+ },
+ '0.57.1': {
+ 'windows': '9a6d3ef2279760efbcead6a7095393e04adaa1be3c7458eb62a2b79d93df4bc3',
+ 'macos': '54a2d229638baddb0ac6f7c283295e547e6f491ab2ddcaf714fa182427e8421d',
+ 'linux': '59e8c6ef9ae2f95b76aa79344eb81ca6f3950a0fd7a23534c4d7065f42fda99f'
+ },
+ '0.58.0': {
+ 'windows': 'da61c5745c545b64047efe6c5a730f38f63dfa1d07c29e1f1297fe235a28ddd7',
+ 'macos': 'c9b11f32e2adcb0783275be0f1ee69c2d78b3496b4992d64a3f41f4f3f678685',
+ 'linux': '7bb75b14c9bcb5798d42bed5fc45c438ee5bb783894733ce553ba3445f66034f'
+ }
+}
+
+def download_file(url, filename, disablessl):
+ '''
+ Downloads a file from the given url
+
+ :param url: The url we are downloading the file from
+ :param filename: The name of the output file
+ '''
+
+ # pylint: disable=protected-access
+ context = ssl._create_unverified_context() if disablessl else None
+
+ with urllib.request.urlopen(url, context=context) as response:
+ file_size = int(response.headers["Content-Length"])
+ downloaded_size = 0
+ block_size = 1024 # 1 KB
+ mb_size = 1024 * 1024
+
+
+ file_size_mb = file_size / mb_size
+ with open(filename, 'wb') as file:
+ while True:
+ buffer = response.read(block_size)
+ if not buffer:
+ break
+
+ file.write(buffer)
+ downloaded_size += len(buffer)
+ downloaded_size_mb = downloaded_size / mb_size
+ print(f'Download Progress: \
+ {downloaded_size_mb:.2f}/{file_size_mb:.2f} MB' , end='\r')
+
+ print(f"\nDownload is complete. OPA executable is named: {filename}")
+
+
+def verify_hash(filename, expected_hash):
+ '''
+ Checks if the SHA256 Hash of a file matches an expected SHA256 Hash
+
+ :param filename: The file we're hashing
+ :param expected_hash: The SHA256 hash we're expecting the file to hash to
+ '''
+ sha256 = hashlib.sha256()
+ with open(filename, 'rb') as file:
+ while True:
+ data = file.read(65536)
+ if not data:
+ break
+ sha256.update(data)
+ file_hash = sha256.hexdigest()
+ return file_hash == expected_hash
+
+def main():
+ '''
+ Takes in user arguments for downloading an OPA executable
+ '''
+ supported_opa_versions = list(OPA_VERSION_SHA256_HASHES)
+ parser = argparse.ArgumentParser(add_help = True,
+ description="Download executable the OPA executable" \
+ " file required to run this SCuBA tool.")
+ parser.add_argument('-v', default='0.57.1', choices=supported_opa_versions,
+ help='What version of OPA to download: Default version: 0.57.1')
+ parser.add_argument('-os', default='windows', choices=['windows', 'macos', 'linux'],
+ help='Operating system version of OPA to download. Default os: windows')
+ parser.add_argument('--disablessl', action='store_true',
+ help='If there are proxy errors,\
+ try adding this switch to disable ssl verification')
+
+ args = parser.parse_args()
+ base_url = 'https://openpolicyagent.org/downloads/'
+ base_url = base_url + "v" + args.v + "/"
+ filename_base = 'opa'
+
+ if args.os == 'windows':
+ url = base_url + 'opa_windows_amd64.exe'
+ filename = filename_base + '_windows_amd64.exe'
+ elif args.os == 'macos':
+ url = base_url + 'opa_darwin_amd64'
+ filename = filename_base + '_darwin_amd64'
+ elif args.os == 'linux':
+ url = base_url + 'opa_linux_amd64_static'
+ filename = filename_base + '_linux_amd64_static'
+ else:
+ print('Invalid operating system. Please provide a valid OS (windows, macos, or linux)')
+
+ try:
+ expected_hash = OPA_VERSION_SHA256_HASHES[args.v][args.os]
+ except Exception as exc:
+ print("Untested OPA version the download will continue but hash verification will fail."\
+ "Proceed with caution", exc)
+ expected_hash = 'thisShallFail'
+
+ try:
+ print(f"Downloading OPA executable version {args.v} for {args.os}",)
+ download_file(url, filename, args.disablessl)
+ except Exception as exc:
+ print("An exception occurred while trying to download the OPA executable. " \
+ "This may be due to a proxy error." \
+ "Please retry or see the README for how to manually download OPA", exc)
+
+ try:
+ print('Verifying SHA256 hash...')
+ if verify_hash(filename, expected_hash):
+ print("File hash verified successfully." \
+ " You are ready to start running this SCuBA Tool with OPA")
+ else:
+ print("File hash verification failed." \
+ "The downloaded file may be corrupted or " \
+ "has not been verified by us. " \
+ "See instructions for downloading OPA manually if you verify the file is corrupted. " \
+ "Proceed with caution.")
+ except Exception as exc:
+ print("An exception occurred while trying to verify OPA hash." \
+ "The file may be corrupted or currently not supported.", exc)
+
+if __name__ == '__main__':
+ main()
diff --git a/drift-rules/GWS Drift Monitoring Rules - Calendar.csv b/drift-rules/GWS Drift Monitoring Rules - Calendar.csv
new file mode 100644
index 00000000..9ecb93c6
--- /dev/null
+++ b/drift-rules/GWS Drift Monitoring Rules - Calendar.csv
@@ -0,0 +1,9 @@
+PolicyId,Name,Data Source,Event (Is),Setting Name (Is),New Value (Is Not),Rule ID,Last Successful Test
+GWS.CALENDAR.1.1v0.1,"External Sharing Options for Primary Calendars SHALL be configured to ""Only free/busy information (hide event details)” to restrict information sharing and prevent data leakage.",Admin Log Event,Change Calendar Setting,SHARING_OUTSIDE_DOMAIN,SHOW_ONLY_FREE_BUSY_INFORMATION,rules/00gjdgxs1clzmpm,JK 07-28-23 @ 12:08
+GWS.CALENDAR.1.2v0.1,External sharing options for primary calendars between multiple components within an organization MAY be configured.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.CALENDAR.2.1v0.1,External invitations warnings SHALL be enabled to prompt users before sending invitations.,Admin Log Event,Change Calendar Setting,ENABLE_EXTERNAL_GUEST_PROMPT,true,rules/00gjdgxs26jpj72,JK 07-28-23 @ 12:20
+GWS.CALENDAR.3.1v0.1,"External sharing options for secondary calendars SHALL be configured to ""Only free/busy information (hide event details)” to restrict information sharing and prevent data leakage.",Admin Log Event,Change Calendar Setting,SHARING_OUTSIDE_DOMAIN_FOR_SECONDARY_CALENDAR,SHOW_ONLY_FREE_BUSY_INFORMATION,rules/00gjdgxs3ob14fv,JK 07-28-23 @ 12:32
+GWS.CALENDAR.3.2v0.1,External sharing options for secondary calendars between multiple components within an organization MAY be configured.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.CALENDAR.4.1v0.1,Calendar Interop SHOULD be disabled unless agency mission fulfillment requires collaboration between users internal and external to an organization who use both Microsoft Exchange and Google Calendar.,Admin Log Event,Change Calendar Setting,ENABLE_EWS_INTEROP,false,rules/00gjdgxs3yipjmt,JK 07-28-23 @ 14:42
+GWS.CALENDAR.4.2v0.1,OAuth 2.0 SHALL be used in lieu of basic authentication to establish connectivity between tenants or organizations in cases where Calendar Interop is deemed necessary for agency mission fulfillment.,N/A,N/A,N/A,N/A,N/A,"Not able to create rule due to bug in rule wizard. Applicable log event exists, but is not selectable within rule wizard."
+GWS.CALENDAR.5.1v0.1,Appointment Schedule with Payments SHALL be disabled.,Admin Log Event,Change Application Setting,CalendarAppointmentSlotAdminSettingsProto payments_enabled,false,rules/00gjdgxs3oppjwl,JK 09-08-23 @ 10:47
\ No newline at end of file
diff --git a/drift-rules/GWS Drift Monitoring Rules - Chat.csv b/drift-rules/GWS Drift Monitoring Rules - Chat.csv
new file mode 100644
index 00000000..e603f8e4
--- /dev/null
+++ b/drift-rules/GWS Drift Monitoring Rules - Chat.csv
@@ -0,0 +1,11 @@
+PolicyId,Name,Data Source,Event (Is),Setting Name (Is),New Value (Is Not),Rule ID,Last Successful Test
+GWS.CHAT.1.1v0.1,Chat history SHOULD be enabled for information traceability.,Admin Log Event,Change Application Setting,DynamiteOTRSettingsProto off_the_record_state,ALWAYS_ON_THE_RECORD,rules/00gjdgxs1svgvm3,JK 08-01-23 @ 06:36
+GWS.CHAT.1.2v0.1,Users SHALL NOT be allowed to change their history setting.,Admin Log Event,Change Application Setting,DynamiteOTRSettingsProto off_the_record_state,ALWAYS_ON_THE_RECORD,rules/00gjdgxs18ozqwd,JK 08-01-23 @ 06:51
+GWS.CHAT.2.1v0.1,External file sharing SHALL be disabled to protect sensitive information from unauthorized or accidental sharing.,Admin Log Event,Change Application Setting,DynamiteFileSharingSettingsProto external_file_sharing_setting,NO_FILES,rules/00gjdgxs2l93fr0,JK 08-01-23 @ 07:01
+GWS.CHAT.3.1v0.1,Space history SHOULD be enabled for traceability of information.,Admin Log Event,Change Application Setting,RoomOtrSettingsProto otr_state,"ALWAYS_ON_THE_RECORD
+OR
+DEFAULT_ON_THE_RECORD",rules/00gjdgxs13kc3ei,JK 08-01-23 @ 11:58
+GWS.CHAT.4.1v0.1,"Allow users to send messages outside of Domain SHALL be set to ""On""",Admin Log Event,Change Application Setting,RestrictChatProto restrictChatToOrganization,false,rules/00gjdgxs3vz76ij,JK 08-01-23 @ 13:17
+GWS.CHAT.4.2v0.1,Only allow this for allowlisted domains SHALL be enabled.,Admin Log Event,Change Application Setting,RestrictChatProto externalChatRestriction,TRUSTED_DOMAINS,rules/00gjdgxs3exvv2u,JK 08-01-23 @ 13:27
+GWS.CHAT.5.1v0.1,User-level ability to install Chat apps SHALL be disabled.,Admin Log Event,Change Application Setting,Chat app Settings - Chat apps enabled,false,rules/00gjdgxs2g5w3mm,JK 08-01-23 @ 10:27
+GWS.CHAT.6.1v0.1,Agencies SHOULD configure DLP rules to block or warn on sharing files with sensitive data.,N/A,N/A,N/A,N/A,N/A,Not Alertable
\ No newline at end of file
diff --git a/drift-rules/GWS Drift Monitoring Rules - Classroom.csv b/drift-rules/GWS Drift Monitoring Rules - Classroom.csv
new file mode 100644
index 00000000..71cc6a79
--- /dev/null
+++ b/drift-rules/GWS Drift Monitoring Rules - Classroom.csv
@@ -0,0 +1,6 @@
+PolicyId,Name,Data Source,Event (Is),Setting Name (Is),New Value (Is Not),Rule ID,Last Successful Test
+GWS.CLASSROOM.1.1v0.1,Who can join classes in your domain SHALL be set to Users in your domain only,Admin Log Events,Change Application Setting,ClassMembershipSettingProto who_can_join_classes,1,rules/00gjdgxs1c0jzhh,JK 10-20-23 @ 13:18
+GWS.CLASSROOM.1.2v0.1,Which classes can users in your domain join SHALL be set to Classes in your domain only,Admin Log Events,Change Application Setting,ClassMembershipSettingProto which_classes_can_users_join,1,rules/00gjdgxs0hj2dit,JK 10-20-23 @ 13:23
+GWS.CLASSROOM.2.1v0.1,Classroom API SHALL be disabled for users,Admin Log Events,Change Application Setting,ApiDataAccessSettingProto api_access_enabled,false,rules/00gjdgxs3aafl8p,JK 10-20-23 @ 13:31
+GWS.CLASSROOM.3.1v0.1,Roster import with Clever SHOULD be turned off,Admin Log Events,Change Application Setting,RosterImportSettingsProto sis_integrator,SIS_INTEGRATOR_NONE,rules/00gjdgxs25t0l8g,JK 10-20-23 @ 13:42
+GWS.CLASSROOM.4.1v0.1,Who can unenroll students from classes SHALL be set to Teachers Only,Admin Log Events,Change Application Setting,StudentUnenrollmentSettingsProto who_can_unenroll_students,ONLY_TEACHERS_CAN_UNENROLL_STUDENTS,rules/00gjdgxs44rgreu,JK 10-20-23 @ 13:50
\ No newline at end of file
diff --git a/drift-rules/GWS Drift Monitoring Rules - Common Controls as of 11-14-23.csv b/drift-rules/GWS Drift Monitoring Rules - Common Controls as of 11-14-23.csv
new file mode 100644
index 00000000..2134f716
--- /dev/null
+++ b/drift-rules/GWS Drift Monitoring Rules - Common Controls as of 11-14-23.csv
@@ -0,0 +1,42 @@
+PolicyId,Name,Data Source,Event (Is),Setting Name (Is),New Value (Is Not),Rule ID,Last Successful Test
+GWS.COMMONCONTROLS.1.1v0.1,Phishing-Resistant MFA SHALL be required for all users.,Admin Log Event,Enforce 2-Step Verification,No Setting Name,true,rules/00gjdgxs3twm54g,JK 08-02-23 @ 06:51
+GWS.COMMONCONTROLS.1.2v0.1,New user enrollment period SHALL be set to 1 week.,Admin Log Event,Change 2-Step Verification Enrollment Period Duration,No Setting Name,1 week,rules/00gjdgxs19shvvu,JK 08-02-23 @ 07:04
+GWS.COMMONCONTROLS.1.3v0.1,Allow users to trust the device SHALL be disabled.,Admin Log Event,Change 2-Step Verification Frequency,No Setting Name,ENABLE_USERS_TO_TRUST_DEVICE,rules/00gjdgxs15t2155,JK 08-02-23 @ 07:10
+GWS.COMMONCONTROLS.1.4v0.1,"If phishing-resistant MFA is not yet tenable, an MFA method from the following list SHALL be used in the interim.",Admin Log Event,Change Allowed 2-Step Verification Methods,No Setting Name,NO_TELEPHONY,rules/00gjdgxs3t3ug07,JK 08-02-23 @ 14:53
+GWS.COMMONCONTROLS.2.1v0.1,Policies restricting access to GWS based on signals about enterprise devices SHOULD be implemented.,Admin Log Event,Context Aware Access Enablement,No Setting Name,ENABLED,rules/00gjdgxs1qrcqvm,JK 08-02-23 @ 07:49
+GWS.COMMONCONTROLS.2.2v0.1,"Use of context-aware access for more granular controls, including using Advanced Mode (CEL), MAY be maximized and tailored if necessary.",N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.COMMONCONTROLS.3.1v0.1,Login Challenges SHALL be enabled when third party SAML SSO is in use.,Admin Log Event,Change Application Setting,SsoPolicyProto challenge_selection_behavior,PERFORM_CHALLENGE_SELECTION,rules/00gjdgxs0o76pk2,JK 08-02-23 @ 07:59
+GWS.COMMONCONTROLS.4.1v0.1,Users SHALL be forced to re-authenticate after an established 12-hour GWS login session has expired.,Admin Log Event,Change Application Setting,Session management settings - Session length in seconds,43200,rules/00gjdgxs1j87x46,JK 08-02-23 @ 08:11
+GWS.COMMONCONTROLS.5.1v0.1,User password strength SHALL be enforced.,Admin Log Event,Change Application Setting,Password Management - Enforce strong password,on,rules/00gjdgxs2rh5fry,JK 08-02-23 @ 08:21
+GWS.COMMONCONTROLS.5.2v0.1,User password length SHALL be at least 12 characters.,Admin Log Event,Change Application Setting,Password Management - Minimum password length,12,rules/00gjdgxs0ogcs3x,JK 08-02-23 @ 08:51
+GWS.COMMONCONTROLS.5.3v0.1,Password policy SHALL be enforced at next sign-in.,Admin Log Event,Change Application Setting,Password Management - Enforce password policy at next login,true,rules/00gjdgxs0p7tza1,JK 08-02-23 @ 09:00
+GWS.COMMONCONTROLS.5.4v0.1,User passwords SHALL NOT be reused.,Admin Log Event,Change Application Setting,Password Management - Enable password reuse,false,rules/00gjdgxs0tbqklj,JK 08-02-23 @ 09:05
+GWS.COMMONCONTROLS.5.5v0.1,User passwords SHALL NOT expire.,Admin Log Event,Change Application Setting,Password Management - Password reset frequency,0,rules/00gjdgxs1k1llys,JK 08-02-23 @ 09:09
+GWS.COMMONCONTROLS.6.1v0.1,"Agencies SHALL ensure that all accounts with highly privileged roles are separate administrative accounts, distinct from the ordinary day to day accounts of those personnel.",N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.COMMONCONTROLS.6.2v0.1,All highly privileged accounts SHALL leverage Google Account authentication with phishing-resistant MFA and not the agency’s authoritative on-premises or federated identity system.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.COMMONCONTROLS.7.1v0.1,A minimum of two and maximum of four separate and distinct Super Admin users SHALL be configured.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.COMMONCONTROLS.8.1v0.1,Account conflict management SHALL be configured to replace conflicting unmanaged accounts with managed ones.,N/A,N/A,N/A,N/A,N/A,Not Alertable due to no log event being produced
+GWS.COMMONCONTROLS.9.1v0.1,"A second, “break-glass” Super Admin account SHALL be created and physically secured for each individual Super Admin user to mitigate account access issues resulting from catastrophic credential loss or compromise.",N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.COMMONCONTROLS.9.2v0.1,"Account self-recovery for Super Admins SHALL be disabled, forcing Super Admin users who have lost their login credentials to contact another Super Admin to recover their account.",Admin Log Event,Change Application Setting,AdminAccountRecoverySettingsProto Enable admin account recovery,false,rules/00gjdgxs2rlm6cr,JK 08-02-23 @ 09:16
+GWS.COMMONCONTROLS.9.3v0.1,“Break-glass” account credentials SHALL be used only if all Super Admins have lost their credentials.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.COMMONCONTROLS.9.4v0.1,A geographically separate and secure location SHOULD be planned and implemented to store “break-glass” account credentials for Super Admins.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.COMMONCONTROLS.10.1v0.1,Highly privileged accounts SHALL be enrolled in the GWS Advanced Protection Program.,Admin Log Event,Change Application Setting,Advanced Protection Program Settings - Enable user enrollment,true,rules/00gjdgxs2mq8dv5,JK 08-02-23 @ 09:20
+GWS.COMMONCONTROLS.10.2v0.1,All sensitive user accounts SHOULD be enrolled into the GWS Advanced Protection Program. This control enforces more secure protection of sensitive user accounts from targeted attacks. Sensitive user accounts include political appointees and other Senior Executive Service (SES) officials whose account compromise would pose a level of risk prohibitive to agency mission fulfillment.,Admin Log Event,Change Application Setting,Advanced Protection Program Settings - Enable user enrollment,true,rules/00gjdgxs2mq8dv6,JK 08-02-23 @ 09:21
+GWS.COMMONCONTROLS.11.1v0.1,Agencies SHALL develop and implement a process to explicitly allow-list (trust) third-party app access to GWS services.,Admin Log Event,API Access Allowed,No Setting Name,No Value,rules/00gjdgxs1qiup12,
+GWS.COMMONCONTROLS.11.2v0.1,Agencies SHALL use GWS application access control policies to restrict access to all GWS services by third party apps.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.COMMONCONTROLS.11.3v0.1,Agencies SHALL NOT allow users to consent to access to low-risk scopes.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.COMMONCONTROLS.11.4v0.1,Agencies SHALL NOT trust unconfigured internal apps.,Admin Log Event,"Allow Google Sign-in only third party API access
+OR
+ All third party API access unblocked",No Setting Name,No Value,rules/00gjdgxs0xcbmu1,
+GWS.COMMONCONTROLS.11.5v0.1(a),Agencies SHALL NOT allow users to access unconfigured third-party apps.,Admin Log Event,All third party API access unblocked,No Setting Name,No Value,rules/00gjdgxs0zd46an,JK 09-22-23 @ 14:15 (works only from Don't allow)
+GWS.COMMONCONTROLS.11.5v0.1(b),Agencies SHALL NOT allow users to access unconfigured third-party apps.,Admin Log Event,Allow Google Sign-in only third party API access,No Setting Name,No Value,rules/00gjdgxs3b25o0w,JK 09-22-23 @ 14:15 (works only from Don't allow)
+GWS.COMMONCONTROLS.12.1v0.1,Policy SHOULD be established dictating the app review and approval process.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.COMMONCONTROLS.12.2v0.1(a),Only approved Google Workspace Marketplace applications SHOULD be allowed for installation.,Admin Log Event,Change Application Setting,Apps Access Setting Allowlist access,ALLOW_SPECIFIED,rules/00gjdgxs0o3dzli,JK 09-12-23 @ 13:33
+GWS.COMMONCONTROLS.12.2v0.2(b),Only approved Google Workspace Marketplace applications SHOULD be allowed for installation.,Admin Log Event,Change Application Setting,Apps Access Setting allow_all_internal_apps,false,rules/00gjdgxs3f0ca00,JK 11-14-23 @ 07:37
+GWS.COMMONCONTROLS.13.1v0.1,Access to Google Workspace applications by less secure apps that do not meet security standards for authentication SHALL be prevented.,Admin Log Event,Less Secure Apps Access Setting Changed,No Setting Name,DISABLED,rules/00gjdgxs2y7rekk,JK 09-20-23 @ 06:51
+GWS.COMMONCONTROLS.14.1v0.1,Google Takeout services SHALL be disabled for users.,Admin Log Event,Toggle Service Enabled,N/A,false,rules/00gjdgxs3wksszz,JK 09-12-23 @ 13:19
+GWS.COMMONCONTROLS.15.1v0.1,"Required system-defined alerting rules, as listed in the Policy section, SHALL be active, with alerts enabled when available. Any system-defined rules not are considered optional but ought to be reviewed for consideration.",Admin Log Event,System Defined Rule Updated,N/A,N/A,rules/00gjdgxs1x4hrff,Needs Manual Verification of Status
+GWS.COMMONCONTROLS.16.1v0.1,The following critical logs SHALL be sent at a minimum.,Admin Log Event,Change Application Setting,"Data Sharing Settings between GCP and Google Workspace ""Sharing Options""",ENABLED,rules/00gjdgxs0yu1jgq,JK 09-19-23 @ 06:40
+GWS.COMMONCONTROLS.16.2v0.1,"Audit logs SHALL be maintained for at least 6 months in active storage and an additional 18 months in cold storage, as dictated by OMB M-21-31. The logs SHALL be sent to the agency’s Security Operations Center (SOC) for monitoring.",N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.COMMONCONTROLS.17.1v0.1,"The data storage region SHALL be set to be the United States for all users in the agency's GWS environment.",Admin Log Event,Change Application Setting,Location Policy,US,rules/00gjdgxs2k8ieyq,JK 12-05-23 @ 15:57
+GWS.COMMONCONTROLS.18.1v0.1,"The supplemental data storage region SHALL NOT be set to 'Russian Federation'.",Admin Log Event,Change Data Localization for Russia,N/A,false,rules/00gjdgxs3rufh17,Not Tested
\ No newline at end of file
diff --git a/drift-rules/GWS Drift Monitoring Rules - Drive and Docs.csv b/drift-rules/GWS Drift Monitoring Rules - Drive and Docs.csv
new file mode 100644
index 00000000..a252f85a
--- /dev/null
+++ b/drift-rules/GWS Drift Monitoring Rules - Drive and Docs.csv
@@ -0,0 +1,20 @@
+PolicyId,Name,Data Source,Event (Is),Setting Name (Is),New Value (Is Not),Rule ID,Last Successful Test
+GWS.DRIVEDOCS.1.1v0.1,Agencies SHOULD disable sharing outside of the organization’s domain.,Admin Log Event,Change Drive Setting,SHARING_OUTSIDE_DOMAIN,SHARING_NOT_ALLOWED,rules/00gjdgxs10es4se,JK 08-02-23 @ 12:25
+GWS.DRIVEDOCS.1.2v0.1,"If disabling sharing outside of the organization's domain, then agencies SHALL also disable users' receiving files from outside of the organization's domain.",Admin Log Event,Change Drive Setting,SHARING_OUTSIDE_DOMAIN,SHARING_NOT_ALLOWED,rules/00gjdgxs10es4se,JK 08-02-23 @ 12:26
+GWS.DRIVEDOCS.1.3v0.1,"If sharing outside of the organization, then agencies SHALL enable warnings for users when they are about to share something outside of their domain.",Admin Log Event,Change Drive Setting,SHARING_OUTSIDE_DOMAIN,SHARING_ALLOWED_WITH_WARNING,rules/00gjdgxs0qwshr5,
+GWS.DRIVEDOCS.1.4v0.1,"If sharing outside of the organization, then agencies SHALL disable sharing of files with individuals who are not using a Google account.",N/A,N/A,N/A,N/A,N/A,Not Alertable due to no log evemt
+GWS.DRIVEDOCS.1.5v0.1,Agencies SHALL disable making files and published web content visible to anyone with the link.,Admin Log Event,Change Drive Setting,PUBLISHING_TO_WEB,NOT_ALLOWED,rules/00gjdgxs2l9hukl,JK 08-02-23 @ 12:16
+GWS.DRIVEDOCS.1.6v0.1,Agencies SHALL enable access checking for file sharing outside of Docs or Drive.,Admin Log Event,Change Drive Setting,SHARING_ACCESS_CHECKER_OPTIONS,DOMAIN_OR_NAMED_PARTIES,rules/00gjdgxs2qv9x6y,JK 08-02-23 @ 12:59
+GWS.DRIVEDOCS.1.7v0.1,Agencies SHALL NOT allow any users to distribute content from an organization-owned shared drive to shared drives owned by another organizations.,Admin Log Event,Change Drive Setting,SHARING_TEAM_DRIVE_CROSS_DOMAIN_OPTIONS,CROSS_DOMAIN_FROM_INTERNAL_ONLY,rules/00gjdgxs2bll5l2,JK 09-26-23 @ 09:24
+GWS.DRIVEDOCS.1.8v0.1,Agencies SHALL ensure that newly created items assume the default access level of Private to the Owner.,Admin Log Event,Change Drive Setting,DEFAULT_LINK_SHARING_FOR_NEW_DOCS,PRIVATE,rules/00gjdgxs1jfq3ds,JK 08-02-23 @ 13:28
+GWS.DRIVEDOCS.2.1v0.1,Agencies SHOULD enable shared drive creation to allow for effective collaboration.,Admin Log Event,Change Application Setting,Shared Drive Creation CanCreateSharedDrives,true,rules/00gjdgxs3nclhql,JK 08-02-23 @ 13:37
+GWS.DRIVEDOCS.2.2v0.1,Agencies SHOULD NOT allow members with manager access to override shared drive creation settings.,Admin Log Event,Change Application Setting,Shared Drive Creation new_team_drive_admin_only,true,rules/00gjdgxs418trv6,JK 08-02-23 @ 13:44
+GWS.DRIVEDOCS.2.3v0.1,Agencies SHOULD NOT allow users outside of their organization to access files in shared drives.,Admin Log Event,Change Application Setting,Shared Drive Creation new_team_drive_restricts_cross_domain_access,true,rules/00gjdgxs1o31qud,JK 08-02-23 @ 14:12
+GWS.DRIVEDOCS.2.4v0.1,Agencies SHALL allow users who are not shared drive members to be added to files.,Admin Log Event,Change Application Setting,Shared Drive Creation new_team_drive_restricts_direct_access,true,rules/00gjdgxs3mcxcll,JK 08-02-23 @ 14:23
+GWS.DRIVEDOCS.2.5v0.1,"Agencies SHALL NOT allow viewers and commenters to download, print, and copy files.",Admin Log Event,Change Application Setting,Shared Drive Creation new_team_drive_restricts_download,true,rules/00gjdgxs18yk89t,JK 08-02-23 @ 14:30
+GWS.DRIVEDOCS.3.1v0.1,Agencies SHALL enable security updates for Drive files.,Admin Log Event,Change Application Setting,Link Security Update Settings less_secure_link_option,REMOVE_LESS_SECURE_LINKS,rules/00gjdgxs0mrpx7o,JK 08-02-23 @ 14:41
+GWS.DRIVEDOCS.4.1v0.1,Agencies SHOULD disable Drive SDK access to restrict information sharing and prevent data leakage.,Admin Log Event,Change Drive Setting,ENABLE_DRIVE_APPS,true,rules/00gjdgxs1mm4n4i,JK 08-02-23 @ 14:49
+GWS.DRIVEDOCS.5.1v0.1,Agencies SHALL disable Add-Ons with the exception of those that are approved within the organization.,Admin Log Event,Change Drive Setting,ENABLE_DOCS_ADD_ONS,false,rules/00gjdgxs4d794jn,JK 08-02-23 @ 15:14
+GWS.DRIVEDOCS.6.1v0.1(a),Agencies SHOULD either disable Google Drive for Desktop or only allow Google Drive for Desktop on authorized devices.,Admin Log Event,Change Application Setting, DriveFsSettingsProto drive_fs_enabled,false,rules/00gjdgxs0yziufl,JK 10-19-23 @ 13:47
+GWS.DRIVEDOCS.6.1v0.1(b),Agencies SHOULD either disable Google Drive for Desktop or only allow Google Drive for Desktop on authorized devices.,Admin Log Event,Change Application Setting,DriveFsSettingsProto company_owned_only_enabled,true,rules/00gjdgxs4ghyiin,JK 10-19-23 @ 14:01
+GWS.DRIVEDOCS.7.1v0.1,Agencies SHOULD configure DLP rules to block or warn on sharing files with sensitive data.,N/A,N/A,N/A,N/A,N/A,Not Alertable due to no log event
\ No newline at end of file
diff --git a/drift-rules/GWS Drift Monitoring Rules - Gmail.csv b/drift-rules/GWS Drift Monitoring Rules - Gmail.csv
new file mode 100644
index 00000000..a9ded599
--- /dev/null
+++ b/drift-rules/GWS Drift Monitoring Rules - Gmail.csv
@@ -0,0 +1,67 @@
+PolicyId,Name,Data Source,Event (Is),Setting Name (Is),New Value (Is Not),Rule ID,Last Successful Test
+GWS.GMAIL.1.1v0.1,Mail delegation SHALL be disabled for all users by default.,Admin Log Event,Change Email Setting,ENABLE_MAIL_DELEGATION_WITHIN_DOMAIN,false,rules/00gjdgxs1dj2igu,JK 07-28-223 @ 13:40
+GWS.GMAIL.2.1v0.1,DKIM SHOULD be enabled for agencies’ mail enabled domain.,No Log,No Log,No Log,No Log,No Log,Cannot create rule due to no log event generated
+GWS.GMAIL.3.1v0.1,Agencies SHALL determine which IP addresses are approved senders for their domain(s).,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.3.2v0.1,Agencies SHALL publish SPF policy(s) that designate these (and only these) addresses as approved senders for their domain(s).,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.4.1v0.1,Agencies SHALL publish a DMARC policy.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.4.2v0.1,"Agencies SHALL set their policy to message rejection (i.e., “p=reject”).",N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.4.3v0.1,Agencies SHALL include reports@dmarc.cyber.dhs.gov as a point of contact for aggregate reports.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.4.4v0.1,Agencies SHOULD include an agency point of contact for aggregate and/or failure reports in their policy.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.5.1v0.1,Protect against encrypted attachments from untrusted senders SHALL be enabled.,Admin Log Event,Change Application Setting,Attachment safety Enable: protect against encrypted attachments from untrusted senders,true,rules/00gjdgxs0qglwig,JK 07-31-23 @ 06:54
+GWS.GMAIL.5.2v0.1,Protect against attachments with scripts from untrusted senders SHALL be enabled.,Admin Log Event,Change Application Setting,Attachment safety Enable: protect against attachments with scripts from untrusted senders,true,rules/00gjdgxs3ag9f69,JK 07-31-23 @ 06:54
+GWS.GMAIL.5.3v0.1,Protect against anomalous attachment types in emails SHALL be enabled.,Admin Log Event,Change Application Setting,Attachment safety Enable: Protect against anomalous attachment types in emails,true,rules/00gjdgxs1rx81d3,JK 07-31-23 @ 07:05
+GWS.GMAIL.5.4v0.1,Google SHOULD be allowed to automatically apply future recommended settings.,Admin Log Event,Change Application Setting,Attachment safety Enable: automatically enables all future added settings,true,rules/00gjdgxs13a7n9n,JK 07-31-23 @ 07:15
+GWS.GMAIL.5.5v0.1(a),"At the least, email SHOULD be kept in the inbox and show warning labels for attachment protection controls.",Admin Log Event,Change Application Setting,Attachment safety Encrypted attachment protection setting action,Show warning,rules/00gjdgxs0hkfqd2,JK 07-31-23 @ 07:42
+GWS.GMAIL.5.5v0.1(b),"At the least, email SHOULD be kept in the inbox and show warning labels for attachment protection controls.",Admin Log Event,Change Application Setting,Attachment safety Attachment with scripts protection action,Show warning,rules/00gjdgxs0qfhyzm,JK 07-31-23 @ 07:42
+GWS.GMAIL.5.5v0.1(c),"At the least, email SHOULD be kept in the inbox and show warning labels for attachment protection controls.",Admin Log Event,Change Application Setting,Attachment safety Anomalous attachment protection setting action,Show warning,rules/00gjdgxs3hwhm6r,JK 07-31-23 @ 07:42
+GWS.GMAIL.5.6v0.1,Any third-party or outside application selected for attachment protection SHOULD offer services comparable to those offered by Google Workspace.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.6.1v0.1,Identify links behind shortened URLs SHALL be Enabled.,Admin Log Event,Change Application Setting,Links and external images safety Enable: identify links behind shortened URLs,true,rules/00gjdgxs3af5hnf,JK 07-31-23 @ 08:00
+GWS.GMAIL.6.2v0.1,Scan linked images SHALL be enabled.,Admin Log Event,Change Application Setting,Links and external images safety Enable: scan linked images,true,rules/00gjdgxs44inn5a,JK 07-31-23 @ 08:08
+GWS.GMAIL.6.3v0.1,Show warning prompt for any click on links to untrusted domains SHALL be enabled.,Admin Log Event,Change Application Setting,Links and external images safety Enable: show warning prompt for click on links to unstrusted domains,true,rules/00gjdgxs2jnxxd3,JK 07-31-23 @ 08:22
+GWS.GMAIL.6.4v0.1,Google SHALL be allowed to automatically apply future recommended settings.,Admin Log Event,Change Application Setting,Links and external images safety Enable: automatically enables all future added settings,true,rules/00gjdgxs4hxtj4b,JK 07-31-23 @ 08:33
+GWS.GMAIL.6.5v0.1,Any third-party or outside application selected for links and external images protection SHOULD offer services comparable to those offered by Google Workspace.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.7.1v0.1,Protect against domain spoofing based on similar domain names SHALL be enabled.,Admin Log Event,Change Application Setting,Spoofing and authentication safety Enable: protect against domain spoofing using similar domain names,true,rules/00gjdgxs324jgpv,JK 07-31-23 @ 08:55
+GWS.GMAIL.7.2v0.1,Protect against spoofing of employee names SHALL be enabled.,Admin Log Event,Change Application Setting,Spoofing and authentication safety Enable: protect against spoofing of employee names,true,rules/00gjdgxs3w81m7q,JK 07-31-23 @ 08:55
+GWS.GMAIL.7.3v0.1,Protect against inbound emails spoofing your domain SHALL be enabled.,Admin Log Event,Change Application Setting,Spoofing and authentication safety Enable: protect against inbound emails spoofing your domain,true,rules/00gjdgxs226brg1,JK 07-31-23 @ 08:55
+GWS.GMAIL.7.4v0.1,Protect against any unauthenticated emails.,Admin Log Event,Change Application Setting,Spoofing and authentication safety Enable: protect against any unauthenticated emails,true,rules/00gjdgxs3ai9pb5,JK 07-31-23 @ 08:55
+GWS.GMAIL.7.5v0.1,Protect your Groups from inbound emails spoofing your domain.,Admin Log Event,Change Application Setting,Spoofing and authentication safety Enable: protect your Groups from inbound emails spoofing your domain,true,rules/00gjdgxs2dw9t9x,JK 07-31-23 @ 08:55
+GWS.GMAIL.7.6v0.1(a),"At the least, email SHOULD be kept in the inbox and show warning labels for spoofing and authentication controls.",Admin Log Event,Change Application Setting,Spoofing and authentication safety Protect against domain spoofing based on similar domain names action,Show warning,rules/00gjdgxs0sndbln,JK 07-31-23 @ 10:10
+GWS.GMAIL.7.6v0.1(b),"At the least, email SHOULD be kept in the inbox and show warning labels for spoofing and authentication controls.",Admin Log Event,Change Application Setting,Spoofing and authentication safety Protect against spoofing of employee names action,Show warning,rules/00gjdgxs2flhnf2,JK 07-31-23 @ 10:10
+GWS.GMAIL.7.6v0.1(c),"At the least, email SHOULD be kept in the inbox and show warning labels for spoofing and authentication controls.",Admin Log Event,Change Application Setting,Spoofing and authentication safety Protect against inbound emails spoofing your domain action,Show warning,rules/00gjdgxs0uqrxmv,JK 07-31-23 @ 10:10
+GWS.GMAIL.7.6v0.1(d),"At the least, email SHOULD be kept in the inbox and show warning labels for spoofing and authentication controls.",Admin Log Event,Change Application Setting,Spoofing and authentication safety Protect against any unauthenticated emails action,Show warning,rules/00gjdgxs1jhp3jp,JK 07-31-23 @ 10:10
+GWS.GMAIL.7.6v0.1(e),"At the least, email SHOULD be kept in the inbox and show warning labels for spoofing and authentication controls.",Admin Log Event,Change Application Setting,Spoofing and authentication safety Protect your Groups from inbound emails spoofing your domain - group type,All groups,rules/00gjdgxs3793brc,JK 07-31-23 @ 10:14
+GWS.GMAIL.7.6v0.1(f),"At the least, email SHOULD be kept in the inbox and show warning labels for spoofing and authentication controls.",Admin Log Event,Change Application Setting,Spoofing and authentication safety Protect your Groups from inbound emails spoofing your domain action,Show warning,rules/00gjdgxs1jvvvfs,JK 07-31-23 @ 10:20
+GWS.GMAIL.7.7v0.1,Google SHALL be allowed to automatically apply future recommended settings.,Admin Log Event,Change Application Setting,Spoofing and authentication safety Enable: automatically enables all future added settings,true,rules/00gjdgxs2puldi0,JK 07-31-23 @ 10:26
+GWS.GMAIL.7.8v0.1,Any third-party or outside application selected for spoofing and authentication protection SHOULD offer services comparable to those offered by Google Workspace.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.8.1v0.1,User email uploads SHALL be disabled to protect against unauthorized files being introduced into the secured environment.,Admin Log Event,Change Email Setting,ENABLE_EMAIL_USER_IMPORT,false,rules/00gjdgxs1vu7fnv,JK 07-31-23 @ 10:52
+GWS.GMAIL.9.1v0.1(a),POP and IMAP access SHALL be disabled to protect sensitive agency or organization emails from being accessed through legacy applications or other third-party mail clients.,Admin Log Event,Change Email Setting,IMAP_ACCESS,DISABLED,rules/00gjdgxs3ynriy0,JK 07-31-23 @ 11:07
+GWS.GMAIL.9.1v0.1(b),POP and IMAP access SHALL be disabled to protect sensitive agency or organization emails from being accessed through legacy applications or other third-party mail clients.,Admin Log Event,Change Email Setting,ENABLE_POP_ACCESS,false,rules/00gjdgxs16dhzcn,JK 07-31-23 @ 11:07
+GWS.GMAIL.9.2v0.1,POP and IMAP access MAY be enabled on a per-user and per-application basis as needed.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.10.1v0.1,Google Workspace Sync SHOULD be disabled.,Admin Log Event,Change Email Setting,ENABLE_OUTLOOK_SYNC,false,rules/00gjdgxs2caikn5,JK 07-31-23 @ 11:39
+GWS.GMAIL.10.2v0.1,Google Workspace Sync MAY be enabled on a per-user basis as needed.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.11.1v0.1,"Automatic forwarding SHOULD be disabled, especially to external domains.",Admin Log Event,Change Email Setting,ENABLE_EMAIL_AUTOFORWARDING,false,rules/00gjdgxs3bfgdir,JK 07-31-23 @ 11:50
+GWS.GMAIL.12.1v0.1,Image URL proxy whitelists SHOULD be enabled to avoid broken links to images that are dependent on internal IP addresses within an organization’s domain.,Admin Log Event,Change Email Setting,NUMBER_OF_EMAIL_IMAGE_URL_WHITELIST_PATTERNS,DEFAULT,rules/00gjdgxs1eu3lea,JK 08-01-23 @ 11:32
+GWS.GMAIL.13.1v0.1,Using a per-user outbound gateway that is a mail server other than the Google Workspace mail servers SHALL be disabled.,Admin Log Event,Change Email Setting,OUTBOUND_RELAY_ENABLED,false,rules/00gjdgxs0wkcpwf,JK 07-31-23 @ 11:38
+GWS.GMAIL.14.1v0.1,Unintended external reply warnings SHALL be enabled to avoid unintentional replies and remind users to treat external messages with caution.,Admin Log Event,Change Application Setting,OutOfDomainWarningProto disable_untrusted_recipient_warning,true,rules/00gjdgxs0o6v2pe,JK 07-31-23 @ 13:56
+GWS.GMAIL.15.1v0.1,An email allowlist SHOULD not be implemented.,Admin Log Event,Change Email Setting,EMAIL_SPAM_ALLOWLIST,[],rules/00gjdgxs17hggqa,JK 08-01-23 @ 11:36
+GWS.GMAIL.15.2v0.1,A connection filter policy to create a Blocked Senders list MAY be implemented.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.16.1v0.1,Enhanced pre-delivery message scanning SHALL be enabled to prevent phishing.,Admin Log Event,Change Application Setting,DelayedDeliverySettingsProto disable_delayed_delivery_for_suspicious_email,true,rules/00gjdgxs0z436wh,JK 07-13-23 @ 15:18
+GWS.GMAIL.16.2v0.1,Any third-party or outside application selected for enhanced pre-delivery message scanning SHOULD offer services comparable to those offered by Google Workspace.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.17.1v0.1,Security sandbox SHOULD be enabled to provide additional protections for their email messages.,Admin Log Event,Change Application Setting,AttachmentDeepScanningSettingsProto deep_scanning_enabled,true,rules/00gjdgxs2e64nj2,JK 07-13-23 @ 15:42
+GWS.GMAIL.17.2v0.1,Any third-party or outside application selected for security sandbox SHOULD offer services comparable to those offered by Google Workspace.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.18.1v0.1,A spam approved senders list SHOULD be configured to ensure legitimate emails are not sent to the spam folder.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.18.2v0.1,An allowed senders list MAY be added but SHOULD NOT add allowed domains.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.18.3v0.1,Any third-party or outside application selected for spam approved senders’ lists SHOULD offer services comparable to those offered by Google Workspace.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.18.4v0.1,Addresses added to the allowed senders list SHALL be set to require authentication.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.19.1v0.1,A blocked senders list SHOULD be configured to prevent emails from known malicious sources.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.19.2v0.1,Blocked senders or domains MAY be added to the blocked senders list.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.20.1v0.1,Comprehensive mail storage SHOULD be enabled to ensure information can be tracked across applications.,Admin Log Event,Change Gmail Setting,COMPREHENSIVE_MAIL_STORAGE,No Value,rules/00gjdgxs388y21u,
+GWS.GMAIL.21.1v0.1,Content filtering SHOULD be enabled within Gmail messages.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.21.2v0.1,Any third-party or outside application selected for advanced email content filtering SHOULD offer services comparable to those offered by Google Workspace.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.21.3v0.1,"Gmail or third-party applications SHALL be configured to protect PII and sensitive information as defined by the agency. At a minimum, credit card numbers, taxpayer Identification Numbers (TIN), and Social Security Numbers (SSN) SHALL be blocked.",N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.22.1v0.1,Word lists SHOULD be enabled to filter objectionable content within Gmail messages.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.22.2v0.1,Any third-party or outside application selected for objectionable content filtering SHOULD offer services comparable to those offered by Google Workspace.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.23.1v0.1,Attachment compliance SHOULD be enabled to filter specific attachments within Gmail messages.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.23.2v0.1,The attachment filter SHOULD attempt to determine the true file type and assess the file extension.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.23.3v0.1,The set of disallowed file types SHALL be determined.,N/A,N/A,N/A,N/A,N/A,Not Alertable
+GWS.GMAIL.23.4v0.1,Any third-party or outside application selected for attachment compliance filtering SHOULD offer services comparable to those offered by Google Workspace.,N/A,N/A,N/A,N/A,N/A,Not Alertable
diff --git a/drift-rules/GWS Drift Monitoring Rules - Groups.csv b/drift-rules/GWS Drift Monitoring Rules - Groups.csv
new file mode 100644
index 00000000..ebcb954f
--- /dev/null
+++ b/drift-rules/GWS Drift Monitoring Rules - Groups.csv
@@ -0,0 +1,8 @@
+PolicyId,Name,Data Source,Event (Is),Setting Name (Is),New Value (Is Not),Rule ID,Last Successful Test
+GWS.GROUPS.1.1v0.1,Group access from outside the organization SHALL be disabled unless explicitly granted by the group owner.,Admin Log Event,Change Application Setting,GroupsSharingSettingsProto collaboration_policy,CLOSED,rules/00gjdgxs2kgaq5a,JK 08-01-23 @ 14:13
+GWS.GROUPS.2.1v0.1,Group owners’ ability to add external members to groups SHOULD be disabled unless necessary for agency mission fulfillment.,Admin Log Event,Change Application Setting,GroupsSharingSettingsProto owners_can_allow_external_members,false,rules/00gjdgxs4b8984a,JK 08-01-23 @ 14:41
+GWS.GROUPS.3.1v0.1,"Group owners’ ability to allow posting to a group by an external, non-group member SHOULD be disabled unless necessary for agency mission fulfillment.",Admin Log Event,Change Application Setting,GroupsSharingSettingsProto owners_can_allow_incoming_mail_from_public,false,rules/00gjdgxs0lw54bd,JK 08-01-23 @ 14:52
+GWS.GROUPS.4.1v0.1,Group creation SHOULD be restricted to admins within the organization unless necessary for agency mission fulfillment.,Admin Log Event,Change Application Setting,GroupsSharingSettingsProto who_can_create_groups,ADMIN_ONLY,rules/00gjdgxs35vsmz6,JK 08-01-23 @ 15:06
+GWS.GROUPS.5.1v0.1,The default permission to view conversations SHALL be set to All Group Members.,Admin Log Event,Change Application Setting,GroupsSharingSettingsProto default_view_topics_access_level,MEMBERS,rules/00gjdgxs24dq6r2,JK 08-01-23 @ 15:14
+GWS.GROUPS.6.1v0.1,Group owners’ ability to hide groups from the directory SHOULD be disabled unless necessary for agency mission fulfillment.,Admin Log Event,Change Application Setting,GroupsSharingSettingsProto allow_unlisted_groups,false,rules/00gjdgxs0zbb0ae,JK 08-01-23 @ 15:22
+GWS.GROUPS.7.1v0.1,New Groups SHOULD be created with an Access type of Restricted unless necessary for agency mission fulfillment.,N/A,N/A,N/A,N/A,N/A,Not Alertable
\ No newline at end of file
diff --git a/drift-rules/GWS Drift Monitoring Rules - Meet.csv b/drift-rules/GWS Drift Monitoring Rules - Meet.csv
new file mode 100644
index 00000000..3b81f3ee
--- /dev/null
+++ b/drift-rules/GWS Drift Monitoring Rules - Meet.csv
@@ -0,0 +1,5 @@
+PolicyId,Name,Data Source,Event (Is),Setting Name (Is),New Value (Is Not),Rule ID,Last Successful Test
+GWS.MEET.1.1v0.1,Meeting access SHALL be restricted to users signed in with a Google Account or Dialing in using a phone.,Admin Log Event,Change Application Setting,SafetyDomainLockProto users_allowed_to_join,LOGGED_IN,rules/00gjdgxs1wv8d7g,JK 08-02-23 @ 15:58
+GWS.MEET.2.1v0.1,Meeting access SHALL be disabled for meetings created by users who are not members of any Google Workspace tenant or organization.,Admin Log Event,Change Application Setting,SafetyAccessLockProto meetings_allowed_to_join,WORKSPACE_DOMAINS,rules/00gjdgxs0rw9s95,JK 08-02-23 @ 16:02
+GWS.MEET.3.1v0.1,Host Management meeting features SHALL be enabled so that they are available by default when a host starts their meeting.,Admin Log Event,Change Application Setting,SafetyModerationLockProto host_management_enabled,true,rules/00gjdgxs3bvxawy,JK 08-02-23 @ 16:05
+GWS.MEET.4.1v0.1,Warn for external participants SHALL be enabled.,Admin Log Event,Change Application Setting,Warn for external participants External or unidentified participants in a meeting are given a label,true,rules/00gjdgxs2yp7uet,JK 10-16-23 @ 07:32
\ No newline at end of file
diff --git a/drift-rules/GWS Drift Monitoring Rules - Sites.csv b/drift-rules/GWS Drift Monitoring Rules - Sites.csv
new file mode 100644
index 00000000..b9f1b0d7
--- /dev/null
+++ b/drift-rules/GWS Drift Monitoring Rules - Sites.csv
@@ -0,0 +1,2 @@
+PolicyId,Name,Data Source,Event (Is),Setting Name (Is),New Value (Is Not),Rule ID,Last Successful Test
+GWS.SITES.1.1v0.1,Sites Service SHOULD be disabled for all users.,Admin Log Event,Toggle Service Enabled,No Setting Name,FALSE,rules/00gjdgxs3gdgxe3,JK 07-28-23 @ 11:12
\ No newline at end of file
diff --git a/guides/CONTENTSTYLEGUIDE.md b/guides/CONTENTSTYLEGUIDE.md
new file mode 100644
index 00000000..14c9e831
--- /dev/null
+++ b/guides/CONTENTSTYLEGUIDE.md
@@ -0,0 +1,361 @@
+# Content style guide for SCuBA
+
+Welcome to the content style guide for [SCuBA](https://www.cisa.gov/scuba).
+
+These guidelines are specific to style rules for PowerShell and OPA Rego code. For general style questions or guidance on topics not covered here, ask or go with best guess and bring up at a later meeting.
+
+Use menu icon on the top left corner of this document to get to a specific section of this guide quickly.
+
+## The SCuBA approach to style
+
+- Our style guide aims for simplicity. Guidelines should be easy to apply to a range of scenarios.
+- Decisions aren’t about what’s right or wrong according to the rules, but about what’s best practice and improves readability. We're flexible and open to change while maintaining consistency.
+- When making a style or structure decision, we consider the readability, maintainability and ability for consitancy in a range of situations.
+- When a question specific to help documentation isn’t covered by the style guide, we think it through using these principles, then make a decision and bring it up in the next meeting for deliberation.
+
+## OPA Rego
+
+Because there isn't a standard style guide for the Rego language, we are creating one from scratch. For consistency, we will be using many of the same style rules as PowerShell. There are also a few best practice rules that this program will follow. These best practices were deliberated on and chosen to enhance readability. We recognize that the code is in a constant state of improvement, so the best practices are subject to change.
+
+### Test Cases
+
+Test names will use the syntax `test_mainVar_In/correct_*V#` to support brevity in naming that highlights the primary variable being tested. Furthermore, for tests with more than one version, the first test will also include a version as `_V1`. Consistent use of a version number promotes clarity and signals the presence of multiple test versions to reviewers. Version numbers are not used if there is only a single test of a given variable and type (Correct/Incorrect)
+
+```
+test_ExampleVar_Correct_V1 if {
+ ControlNumber := "Example 2.1"
+ Requirement := "Example Policy Bullet Point"
+
+ Output := tests with input as {
+ "example_policies" : [
+ {
+ "Example3" : "ExampleString",
+ "Example2" : false
+ }
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.Control == ControlNumber; Result.Requirement == Requirement]
+
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ RuleOutput[0].ReportDetails == "Example output"
+}
+
+test_ExampleVar_Correct_V2 if {
+ ...
+}
+
+test_ExampleVar_Incorrect if {
+ ControlNumber := "Example 2.1"
+ Requirement := "Example Policy Bullet Point"
+
+ Output := tests with input as {
+ "example_policies" : [
+ {
+ "Example3" : "ExampleString",
+ "Example2" : true
+ }
+ ]
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.Control == ControlNumber; Result.Requirement == Requirement]
+
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].ReportDetails == "Example output"
+}
+```
+
+### Not Implemented
+
+If the policy bullet point is untestable at this time, use the templates below.
+
+#### Config
+
+The first one directs the user to the baseline document for manual checking. The second instructs the user to run a different script because the test is in another version. However, if they are unable to run the other script, they are also directed to the baseline like in the first template.
+
+```
+# At this time we are unable to test for X because of Y
+tests[{
+ "Requirement" : "The matching policy bulletpoint from the baseline document goes here",
+ "Control" : "Example 2.1",
+ "Criticality" : "Shall/Not-Implemented",
+ "Commandlet" : "",
+ "ActualValue" : [],
+ "ReportDetails" : "Currently cannot be checked automatically. See (Product) Secure Configuration Baseline policy 2.# for instructions on manual check",
+ "RequirementMet" : false
+}] {
+ true
+}
+```
+
+```
+# At this time we are unable to test for X because of Y
+tests[{
+ "Requirement" : "The matching policy bulletpoint from the baseline document goes here",
+ "Control" : "Example 2.1",
+ "Criticality" : "Shall/3rd Party",
+ "Commandlet" : "",
+ "ActualValue" : [],
+ "ReportDetails" : "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check",
+ "RequirementMet" : false
+}] {
+ true
+}
+```
+#### Testing
+
+```
+test_NotImplemented_Correct if {
+ ControlNumber := "Example 2.1"
+ Requirement := "Example Policy Bullet Point"
+
+ Output := tests with input as { }
+
+ RuleOutput := [Result | Result = Output[_]; Result.Control == ControlNumber; Result.Requirement == Requirement]
+
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].ReportDetails == "Currently cannot be checked automatically. See (Product) Secure Configuration Baseline policy 2.# for instructions on manual check"
+}
+```
+```
+test_3rdParty_Correct if {
+ ControlNumber := "Example 2.1"
+ Requirement := "Example Policy Bullet Point"
+
+ Output := tests with input as { }
+
+ RuleOutput := [Result | Result = Output[_]; Result.Control == ControlNumber; Result.Requirement == Requirement]
+
+ count(RuleOutput) == 1
+ not RuleOutput[0].RequirementMet
+ RuleOutput[0].ReportDetails == "Custom implementation allowed. If you are using Defender to fulfill this requirement, run the Defender version of this script. Otherwise, use a 3rd party tool OR manually check"
+}
+```
+
+### Naming
+
+PascalCase - capitalize the first letter of each word. This is the same naming convention that is used for PowerShell.
+
+```
+ExampleVariable := true
+```
+
+### Brackets
+
+One True Brace - requires that every braceable statement should have the opening brace on the end of a line, and the closing brace at the beginning of a line. This is the same bracket style that is used for PowerShell.
+
+```
+test_Example_Correct if {
+ ControlNumber := "Example 2.1"
+ Requirement := "Example Requirement String"
+
+ Output := tests with input as {
+ "example_tag" : {
+ "ExampleVar" : false
+ }
+ }
+
+ RuleOutput := [Result | Result = Output[_]; Result.Control == ControlNumber; Result.Requirement == Requirement]
+
+ count(RuleOutput) == 1
+ RuleOutput[0].RequirementMet
+ RuleOutput[0].ReportDetails == "Requirement met"
+}
+```
+
+### Indentation
+
+Indentation will be set at 4 spaces, make sure your Tabs == 4 spaces. We are working on finding a tool that will replace Tabs with spaces and clean up additional spacing mistakes. Until then it is checked manually in code review. Be kind to your reviewer!
+
+### Spacing
+
+1) A blank line between each major variable: references & rules
+
+```
+Example[Example.Id] {
+ Example := input.ExampleVar[_]
+ Example.State == "Enabled"
+}
+
+tests[{
+ "Requirement" : "Baseline String",
+ "Control" : "Example 2.2",
+ "Criticality" : "Should",
+ "Commandlet" : "Example-Command",
+ "ActualValue" : ExampleVar.ExampleSetting,
+ "ReportDetails" : ReportDetailsBoolean(Status),
+ "RequirementMet" : Status
+}] {
+ ExampleVar := input.ExampleVar
+ Status := ExampleVar == 15
+}
+
+tests[{
+ "Requirement" : "Baseline String",
+...
+```
+
+2) Two blank lines between subsections
+
+```
+tests[{
+ "Requirement" : "Baseline String",
+ "Control" : "Example 2.2",
+ "Criticality" : "Should",
+ "Commandlet" : "Example-Command",
+ "ActualValue" : ExampleVar.ExampleSetting,
+ "ReportDetails" : ReportDetailsBoolean(Status),
+ "RequirementMet" : Status
+}] {
+ ExampleVar := input.ExampleVar
+ Status := ExampleVar == 15
+}
+
+
+################
+# Baseline 2.2 #
+################
+...
+```
+
+### Comments
+
+1) Indicate beginning of every policy: 2.1, 2.2, etc.
+
+```
+################
+# Baseline 2.1 #
+################
+```
+2) Indicate the beginning of every policy bullet point.
+
+```
+#
+# Baseline 2.#: Policy #
+#--
+```
+
+3) Indicate the end of every policy bullet point.
+
+```
+#--
+```
+
+4) Indicate why placeholder test is blank/untestable
+
+```
+# At this time we are unable to test for X because of Y
+```
+
+### Booleans
+
+In the interest of consistency across policy tests and human readability of the test, boolean-valued variables should be set via a comparison test against a boolean constant (true/false).
+
+#### Correct
+
+```
+tests[{
+ "Requirement" : "Baseline String",
+ "Control" : "Example 2.1",
+ "Criticality" : "Should",
+ "Commandlet" : "Example-Command",
+ "ActualValue" : ExampleVar.ExampleSetting,
+ "ReportDetails" : ReportDetailsBoolean(Status),
+ "RequirementMet" : Status
+}] {
+ ExampleVar := input.ExampleVar
+ Status := ExampleVar == true
+}
+
+tests[{
+ "Requirement" : "Baseline String",
+ "Control" : "Example 2.2",
+ "Criticality" : "Should",
+ "Commandlet" : "Example-Command",
+ "ActualValue" : ExampleVar.ExampleSetting,
+ "ReportDetails" : ReportDetailsBoolean(Status),
+ "RequirementMet" : Status
+}] {
+ ExampleVar := input.ExampleVar
+ Status := ExampleVar == false
+}
+```
+
+#### Incorrect
+
+```
+tests[{
+ ...
+}] {
+ ExampleVar := input.ExampleVar
+ Status := ExampleVar # Mising == true
+}
+
+tests[{
+ ...
+}] {
+ ExampleVar := input.ExampleVar
+ Status := ExampleVar == false
+}
+```
+
+### Taking input
+
+We will always store the input in a variable first thing. It can sometimes be easier to only use `input.ExampleVar` repeatedly, but for consistancy this is best practice. the `[_]` is added to the end for when you are anticipating an array, so the program has to loop through the input. There are other ways to take in input, but OPA Documents states `input.VariableName` is recommended. As such we will only use this method for consistancy. If there is a problem, it can be taken up on a case by case basis for disscussion.
+
+```
+tests[{
+ ...
+}] {
+ ExampleVar := input.ExampleVar[_]
+ Status := "Example" in ExampleVar
+}
+
+tests[{
+ ...
+}] {
+ ExampleVar := input.ExampleVar
+ Status := ExampleVar == true
+}
+```
+
+### ActualValue
+
+It can be tempting to put the status variable in the ActualValue spot when you are anticipating a boolean. DON'T! For consistancy and as best practice put `ExampleVar.ExampleSetting`.
+
+#### InCorrect
+```
+tests[{
+ "Requirement" : "Baseline String",
+ "Control" : "Example 2.1",
+ "Criticality" : "Should",
+ "Commandlet" : "Example-Command",
+ "ActualValue" : Status,
+ "ReportDetails" : ReportDetailsBoolean(Status),
+ "RequirementMet" : Status
+}] {
+ ExampleVar := input.ExampleVar
+ Status := ExampleVar == true
+}
+```
+
+#### Correct
+```
+tests[{
+ "Requirement" : "Baseline String",
+ "Control" : "Example 2.2",
+ "Criticality" : "Should",
+ "Commandlet" : "Example-Command",
+ "ActualValue" : ExampleVar.ExampleSetting,
+ "ReportDetails" : ReportDetailsBoolean(Status),
+ "RequirementMet" : Status
+}] {
+ ExampleVar := input.ExampleVar
+ Status := ExampleVar == true
+}
+```
+## Python
+[PEP 8](https://peps.python.org/pep-0008/)
\ No newline at end of file
diff --git a/guides/GithubFlowDemo.pdf b/guides/GithubFlowDemo.pdf
new file mode 100644
index 0000000000000000000000000000000000000000..a2643bd4b72a7984b355285515904e74f2efb00d
GIT binary patch
literal 118833
zcma&sQ;;almNwwFZQHhO+qQeRZQHhO+qQeRZQGb{{(sKZIT15;m9;J^qE=*9JehBi
zDu{^DGSaa^kxT|cDw(&
zyjKzgy4RkwlQkB-U5qel#x|fYbPgnW!s6}`3Do17(}PctH;irbxuc(j@goxY(S%!4-~tY>utm_~Xj+uRPy9IqXjW
zSOrzCx5F=<$
z$Qj`bfjN%139?Gqj~+-_gKPdC5k|ZY2)jFqnf??rb*n)DjAz+E{1N5=Fm2nMOal+D{pPn?
zu7IyLI_1;sTNQ4=jqFka4Ax2<&?Bl!$r!?COT%njHE(}E&
z*fbaP0IPa^=cCcHj4k&MZ!Eey)%VJ?x6PF#u`{w2G`PR4A9lbJu{?V9!q=67ZK4Gl
zcwLuEq1x8c>%Ood5iS<3*#|jy6L-q^#)R4mZb}i46GyZ4uG&sp)ZV1iGVl!sm-G=j
zp*|?9oN<^&r$Vn$)@*oDps&AwA~)84iJ6po~k>xO&tlp{h#P@8#le|Q~*WiLeMYMn|O@1vKXX=j($^w3m*1F6NUgl<7eXz
zgGrs&CPy~du0JE2={h;B@
zWeu9dm^RJ8OWFbs&fK5|>~L9|bhLtE(GTxY5}HwEx=xL4zSRgzcpdu5LZ&p8x7N~_
z+NRik0D)mr#YsB>VxD2U#7MWfYO=)SL9u?|boTdnWbqe|oKZ)?Q|(LZnc^+PZ>VG9
z0O-CFlJAA2giV2`7nlAU4Iiuyr>~uI7
z4KvZF`HPe{UymCS$+zE$JW$u;uh!$5Pyjp2t)G-*2h4$EOj@Ww1;rhVLT0{AA!KstG^5e6J&@UCRZP98gU4u&~48xUq{_&;a$AcPh)
zV&Q+ct11+B>r}{d=#VNE?a_x%jg)qdbrqLkcx+Zsl`N8BU)WU080J)hmPe^qNBzuO
z_LmJT`a4(MASYL*X#CmkNh_WIoP>dM&U_JpPVAxA%(>sSctpb9~h~_p%$ns6lE`fyF0TD@TeA
zml@0gRY4j&C%DD}94$W`RcwcJ#h2z?{*wv>KGhL-_VYvo+N=?G1>MIhy$`
z4Xq1~$5{3~5V02sB`)=$=2;2OE?(2};B|6u0jM!$#?ChuPeWin2waZf2^uo0>5U-c
z#9;0e7-jQCL+#j}|I71tu1#qsfFHDOki>_5<;$R>AaA+1d=fon@+(ES_u$VJ#Fa~J
z+Jy&LO|YQ>c0N~GE|@ux))a}A|Z!llz=%dU_^Q8e3TkwkfeBx`K@
zL|?G*&(HVU>-{pBl40>a^Oi^!#e{0+3|#hJzpfKk$Ir>?8PQo>Dt{|G7j&$tPd%Ucy{$*~HOCdzJh
zmRll|M;mt9nme}1K;mG&%&PtL*OGPV=4?qMQcbd0q?0I_r0=H-tJR1Lm|B=vix$})
z3axrsty?{Jr+9c-Xxg7wG#2lJ!nw0Yh>!Wy2^-8CUGZaHg?q!mji1q1zC6jG{2f1b
zz&w}Qt0-8gS<#?t6B(~Ce3Qbai|!uwEN_qVxOEhMt_`aZk-|+px1`s4!_OO~u6^qZ
z-6ver!xv3^=zn342J3(3;kgw;kX3272;qA}B{?1uF~nqqwrp(kB@rt)(#&lIrf9W~
z;HvQ{)+#ykXt?3E%WJlo@1o-Z9yJNTwjWbuTbfH2N);HLX2?R;Niq~Ab?%Pg^@s&B
zlMgO{<70NmASjf&)9G{
ze674Jrgm=JtBe`3@p|^aAUb#omw~}##kh5YwA`f!$bz;ApibP&jZ+hQwKic@=XS5q
z5NNYLtSyk*uDNs1;!JPbf|C2-YI9=QSLXkjN2+7*CVvk6p-%yFnTHXcW6i-xkj?|ljW^eg*
zV0|589N6W$2e;IO;)ZDue+`cHR`h2GKBF`2-Kw)$J!Hh7QB67lqGifHRmBeOGFm5z
z;8lLjyWA+$-GHxB-p(fxt314&2M0z+aHu9m@hJdD&`V|I}^Ta{;6?iXg}Z4IWI&|Q#NE>p6IFuYGy>P8VoeWufiR(
zMV_f2szB-alUFG7v4h(Cz{b#p=Tjh^W*mis4s(%hzP6@er2#
zF7?2KDdI&;anVca=iv&mG>=de4+G%ax$jK1iHw4+YQWC`=2&^X3JMO3+!sgKY0
zlY&BvRA8WHG|rvBVM1AM=W?sN;!MGFaKZoW-4l*uEg@0O7_W!0CYZbX@`nZ^zT$_r
z*bu1*ss8If!NG{5k8F7KZFxEt*wTO8San}E2|iV)0@bwr?!)Sx(M
z4xnkP1IbDO?{#%dj&OniFg!UKD{_x$v~5&jn5$g_L(=!?1Ad4-An2Z`mBXk`xeq;!
z`Oy!0s>R;{&ZQ~RPX+}w&~!n86cNnDZbk4uwrrn3wYz2@s;#K?%q4ZCEh0rO%JjZQ
zo#966+-gukbfX@QA6V~NGVbv&X;M%`k3QzC4$$DE%Y&B5KH;ksO&hC;rTe^YE`F(KO;kp!9v?5eT{jW|2^8xFgT#;rhvh
zHDaXny9YGD71#FB+rZ*+mKxMa++~>U-Yuo&g#Nop7M8CMybR}r==vx@`?IVh6`OLg
zNtW#6z6hc@`^&Ma2|YHM1U!hmxx}qvBvKleWFB*p2U%EJVal`041pXLwox?`(h)Za
zw@D`C577Y))h>@oafLO!DL6;(^a0jh#2-`|Q91MNoMC%|>kI=W6~5
zWOSKL8`w1w4kv|rq2Y8s3Apqc!wbRfG!k}YVb@r7h*;-&E`d41Cj(BR4w@U1AiPU#OV`n0tj@$Kg
zB|1Y$Uwo68(-Iu!M@Ja2#PY?8nughFJ&bu2y}c*uj)^eoo&B2$n_tW6PWT2Za|<3-PB
z>x*#*cqudig-3;sZB7`H9gPc@rG*)7P1A)rrYG0blFw<3KQXk->9|}OR6T0B2z<^j
zvX>Er+a`FCY&ID+J3C%dknAuh2D94>HA
zR^aUNX7!LhJEiiH!5<0(o7u5>6aa)X|9Un&*Tv!g0JA@=J^woZS=jyq0NMYk{$Ee4
zH2-y4MMwZ&>W?b>G5`z#WP{{o3oIBtaztn!=ug}#Hmy`VXl#DETULA0vRG{h;(_U+
z&fZmd`BCXvxV=QT(c_0aaf^??E@A6PPNXP?W&k=PFXG5<&JKRTPoQqZG%N+
z>js~;O+V0J`-5nyjT`3cH_rtf>cqH50nhcC*KmQ8#QnGJnM1`E`38Qpa&Q02eY2wG
z(zWhkufr-g-Pwjdt&s9~__VS%!*?5B1+D#N*%e)n`s+MS^!DY~`wjAFOTyZwoCytW
zcKDmi{iZTt4LjZqADoHrX8+A;fu|$)l^0FqgF;)o6pp47tToLw{(b^=Xl>%Cff|dC
zMx^BG^lcaH_i3Ro#lQ6
z@}8Gj+HR9Ush?PGFAi~)8mggnBGd)vWR>Z%%t|At{ZkYJzCSY5R-HG%#Cxf(=`#gp
zxEva8S1&SR#!l%hu!7=g4EZ-uwg(BCA7Gbn3iNzTYxHP|Lx7g4gr-k)?rAK$a<2Ai2utVFkA%8hrhCE1b#io8|4Yo3W(H`X;`_rnq@)xce11rQ^|0pgkOH1L`IRpSV~Z~08!p_!;cete-Urzuv04zd@FUEK?7h?Mo6w>GvwR7Xoe8pjHA~i(-cSiu5v7$3oIbBEv*Hs1Adg<33<*+1#4yo3V5LcYhkxLx
zi-ibYkz*v20W4XBr`Z7vc#*MRyUBx(Ds+U7W?PNK9nwdDVt!)5aYqC<_b5T!7_`sO
z%*Glnaq5^2!T8d{RXBlm2h!6YsC`;1k>kNNK$g9qPE(D?-rx@bi}w+ODQ}(JC1r-W
zCWGGP-ZzS5z|IK}rQbRUVfU=m)rwUB@+(}+<>;}mg@|q?ZeV1Wx=ky$^2q1hJ6x-!
z?KohR7CX%SlhQ0vADWX{CtB5{fWexyTNx=0{7702-(^6A+|VB^F_H?Rc;ERD@pz3f
zx*CyM83z0-DNPIpq5KEd4#A|-s+{*P$#Jt3w0lyI)Jf0ip(HpL%2}Enx;wO|4*aY1
ztj92f@H1+}kf0@HWVB&X1Vgu>sfNtBLRDa9iL}79q*aMMH?((T9Ac=lp{9C)Zs?^Y
z_ksnR^%^=JY(3KD2m9)koq4K43<<;RA_uZgTKy?I%8x!P0qxz_&DjJ34lVWr63m98
zzz36&*kd?uy4?l#0A8N0n#8f8hv6Yf=3zG)<|JM8M&9Y$As~Bqmtj``TDe
z+qbbeex>PJUu$*<5yyJ$JXK}PEEjzuTBp94HFZu6nG9D<^<2JZ6C8d=!jmc$7{UUV
z7X@vzYhMjVOAj!w764M4TDbQg#B_~T4;)5{?GH37!5t(0=42&{Wot48^Xzs8xbc2Z9O*M_Y6D!;ogNJ55-uuT$%Ac?`-xP
zc7g?_@pjI
zJb09Zk6bDj9hq26f|ntn-{lD-ZcY(_)`5V+Y2?i#(H0M9kB|RO_kj}g-cu77I!=VS
zUe=qg_R-wX*a2FzS!rH!gvM*hGo;2!=$cxExsU1lYoL$q-HXl@RlOTrWnvF3?*$D?
zApo~Fn^2*C%2X``L!oz1RXy|yc;lvBUS*M0s3X--NPzwgS|@Iwx&@{E?vc5QZKM@l
zmAm`q*hnzMgDjQnCP#o`a)#fCJ}bP3f{IbW*s9#&OCtZYT)NPw7>y()eF1r
zopeoD$m*fpG9+1GcYBv}SsGhf|gI1Nz*l)nrQqkJ1F`f$gArIxG?6aD&s;
zcH|?|7t4_~!ySxj>qR6bZvK_ICJxjZ`<;7&;h{mG-o-^cFjZ$dwpU^O#@mW|Y){a@
zq(}i<;jbu|B%47J4FIVoiEDMjhU#V7^q{eI%>Dgy5DycjAG1bPag!IHlez0qP`<1x
zRggkFRfaCQQ{pIC^U=Z+kpam)mi}0l=_*S$tKgnwmOy1Iz7C_rM#HHlf4g;D;SlVO
z&qQpbi_CowI{!xMJC&SJ(UPfGWr6cx9GP`_3@ZvXBC`G5V_|JB1?fmW2t|~I?8{`q
zqZhDhpTygKmz&=SZ}!!prvG~QeNCeIXB-SFV7iG>Xs_u1-
zu{aM^y7$+iH4GZp&$yMZQAS>*UWNZnuuwK>0V~kCpKYuLKv^$RXuxo-6l(`rqIcOh
z8X!T&JWdRELd2e`k-eUO>Ty_qDfUw4`B
z^<^C#{M>s47!@+sY@FQP)$zHq@ayg|Cq;VILjkcM{3==*5)kLmjmW#o-D1o02l4g2
z57MXFSl-&W;bitZ3u(EkwWFDsnQMuZDu~j_6z%2RQ-Uq2)J@D86mfLWR^XNW$3n!N
z29Z9f&6L1?oieJ|zt-M<6BK%0Dk)WR!xURN_tsVqOALRO<@OAGll>(Zc-4f}VZJB=
zf(_Bqz+yhT-(Sa$v=ZP1dAn%9;gkIST&}F%;_ZB)Bjded{kw!&ng3nFj2sOAAHoFx
zdv2>5Cl4RU05fvy9f>ywk`hxFwVdp0aB0^4PYwS4g~{lj>Op>M?GXW__%?0in4A5p~Q(}RLihs=Wlo4
z*u$%*0rIM6U6eo>_R}ORp{=}I%Y#(IarqYoHmKjgJ1HgQeVj*RL+ozpWhy%JW&2(M
z7Now@e1T#mXbKc7t;^wY)TX9&Yz%5a(|_*)2h+dxfRTWajhW$JNj4J!BO@o_=S@S4iiZlaBpw>)a(VSEL~M}w1W+h3I(xV{1mFTl5M(}(RhCLVsq>he
zcpwf`WZ<6X6qUTronHEQiPMC848lF9FUc6FcE@*bx741V@IZ{1BoP2HVf{VP
zvA_-~EK;TZl(|>K^&kQX0VqyY152WKAuMGQs{(*}#zP^o3yWDLnXs++@BzrPa3zsq
zwuC`rBg@iI?64sfqsH$J1Gds=Vq|9rj(!N#^qCY#L5K|hXbyuU5Dh3}#u%)4t9<`Q
z!E_xSdAPun8Q7!=+>Y{kow}98WpWy#4kDUyP!I@V6eEBkT>*u3oq=xDc!4)#9f5G5
z_Y6LYc*(R#RG|@|42^!{7XT0g&|+tfC0778@L(A4fKa6s6ihoCfVBpen&;ztBqXGE
zMo-)s(h7`PHRIv3@DUe+fZ_vy4)WW3L5FgNVVn8GvNJw0hM4$;ibDlyZ
zQbO);at0BQndRlD5MbQk?~P$2F5_AevLt_Z7;*~^ZQ&{f7KCzSZn`@%yFH}
zI1HO5LkI@~j5-2|1qX>al#m*P?Ja?Aqs=ZLfk}G%vu+_l_-_2;M5xGAh?w~B3RW91
zK7j0pk!6)4x&bR=iN`^REb~=kkf~UQI;HB4LlEB_d12t*P@-h2>02=*fcgBV09h!E
zJ!GhhlrWn78Hu5k5}S+B${AzeO82b7`Kn29TY-Qw7l)FI>u|r-X#&s{_NA~QaA2XP
zGPeJwY#6GZAR;8b6V_
z7@(rYSR=jPHv5yO27^hM%mN=7!5|?^DTN?2_OA>f
z8=!=cHoi#!*W%$3NctC72Z9wz0K`ehvq%AI@#X+6lZ+U_DeVn_^DJX6jWEHf`GGK*
zJw;C*_ys(j%Q4j+vxtrkKpfxYOXe59UjNmyQ1--1c
zn{J&~%foJ&=WG*bXn(LDQce+_O}MycyLV(`B$|$QE#9Q6n`kC-FZ@)yDEyVErS+k#
zay_B_8{Nn=!Cht{JGC&lrUJdt6KL<_s5t%j0clOAWkMfY??Lb@u7uBu!ot
z=c9z(y2f%eFPoQIyWjI3vJ9W)7$7;c5pS1M?U$D%+p+sAFF#!WRVZ56Kn#au2M&
z5@@AfW)!a5m%79#lGF0Q!zN~$qf66S{PN1LZo+IUdeSUe#FaQD+%?;|+ey~IbJSAp
z!pb^$y^F#|9F}zB#WDCbQ=MvgdsDZgiKJ;x6)(l;T!_Qg1?sa(5=H+bA&(vdfeLLB9r(>G)KIg94U40<3kt-{%_7LAW
z&ec~_c^j_I4E5TU@eJza8W)Zyx0U~<{xV{!W-Il_sPVBUB=rzmzeA1fO0IgQoL}p`
zmB&`S=s+pv&u{x{54dNqE$;W;>@_Yi_2{l_n*|M9-{$wj^f`2zLs~caXEEtzm8(_~
zzS;M+pvy>?zK+u$o)3rRWPNlI9%Malk6vz#w@p6i1(l&~l#bPDnu}E1xrsLx`!d_%
zh{PS)nbysV?#FNFhf^cd=aTc!kWy$KD{QT7_&NRZ_7uy()gSg(2fGm2GlHh_re(-K
zo|4u)b)$sc*9BL%zNb~SD035W3+5EK&6~B=I_md3wiD4srqs0-b#U-H6n@_yz8ma4
zajtnZSdDJOC(-2!UEb)M8DreGX!qjP4|>)MuA1FGPTH@}%3~lofgZ@o3C7jk`nEM$
z7JnV+o2J;=t$q^eBS{p8tNVEKEj%Lv=HoA_E3zI!K4quwDGrZa?*Qd89^2S+oT
z$WdE)4(BCxbCU2TWFy!;N^ujkUnkY9>0OFRBOqVVgWSQ_bKHf?MaQD`^7&nGy
zp32DiNMYFQRyYOF>{UAUOC*wNFYyDek>MJtnQp$>w-RI^(u*5a1`wu8$`41>!Vqj+ZmwlKBn3!2v
z{}jf!wb{vfb0Zqm)y0kC<_39l0~c~|LpPG6v{lnC?Lc{RgTH;6
z+x5zM`11`$O!Bz!&Szbl(v3+-uBK9e&ep;XCbhQNG0)7*a1UT|oP2E?bCs@nCVFKn
z14siSBV%KKbW|uOK#VT!#mz{JP5|$}Gy;@waPW|D24Y}nbP!4mE&+7yFNZIu?B75x
z0C#3od~pt70;YiZ4T^G|qk9$;lg+;+!0jZ>P4FxpS>6*=mQ>OaGL?r_{q*EV^*w=R
z2q1x-p|RP;t*s3deI*092;&F?;NkTOUqtFZxdUea)6CGw2)vdBs1lF~z>4Z%it1n7
z7?@cI#X2Nzh^h__?p5}?PgGf0NhS%7fSjt13J$Px4v=U?Rq6Lr1$52#mbCx`FkLCKLB&b-V&$6OzySWhXqhhqoaf4
zj)A$oy^T4oo1=?yl{1ZrWAk%RW@UH|W8dc12QnWeh=tsey+myisrs+^nh
z2b+u2oBuN6a)Y76r}Y*7E+eBQ9Ru1kIsl}1tOLm46QQ;-qqelQd>dTDyqbF(rQ$m|
zHn=^Qe9^0FZ?1Q3di=JnOfSwZU(GGc>f&OoT+!g_1}GW*B7YhNer}q-<8$Gsba^zOjDzyUB5W1HvKm0;c-Le6fkkHbRPJ2--Vc>XTk=Rw3~
zARAa&9y|~}#Ki!;s=H8fGkXEN_D$o<{9J$J9hZGrCn@<|DJXk!W6S$f&cnni?(7^3
z!>IiFy{!2?C)&3(B(OJvDt(^{{Blo@uP%;0@*n1JhVr
z2i%#)S7HP8{31mHAP&munG%QUA6OYdH!!;ec{L~Gyk@aO!u+e@Y4f@dS|BPfNd+br-5p;tNmx
zh)kbN6-IJu#!)ehG@l$BrZJmtH8zAewMhmDg$DWqFS0_-(rkQ0ei{}=LdTO?HJgu?OxcE_up=qtLy@DM{~TjW*2LPIf{@SVNiw;;
z^NcaWbRX-PB2=io)0qi>uE#UB6}@i~bkYzUxEavKvI2PV@Dq-RZMsa|EyHZBfe^|{
z1$#Wd6jCT^FN-BF)vV)^uyN~kKUC%fL?16SU5B;QTvnER|Ha)4Xr|gjlmXVfHEh;s
zb@QOqRa(V=yHr=oaIK?h?J;Y`G28wvW7+HL1|yQ=Mo_a#2LY*nw{@bP)3de
zTT1NJkpk-w&Be-817(0uE)(rshH;E>ZKRFwkXNL}8&1F2@j|=(i>+qy@F!H7XY`K_`YopQbMs6*ece
zz(~K`LJ}tl%-0J0HU#11;H2C)H_E2sztq7*)P4LF;jVx_c}rohf2Xh~z{=bO_Z*^~!r6t?hT3
zuCO;D5>0l0#?sQ$tAdyH)9Ka0Ii7Qr{(exT)4jGGBY~w{2rJE3xfy(&3fC44_~i(pYTnx2Q*1X;vvy%if38g!L<6E^+QH2C0&x=G5Q~)ZwF)wRrxJ53qEH