Detailed Report message - Gmail

[amart241]

Update Gmail baselines and add detailed report messages

[adhilto]

Potentially relevant code snippets from old repo:

2.1

MailDelegationSettingDetailsStr(LastEvent) = Description if {
LastEvent.NewValue == "false"
Description := concat("", ["Users are not allowed to delegate access to their mailbox in ", LastEvent.OrgUnit])
}

MailDelegationSettingDetailsStr(LastEvent) = Description if {
LastEvent.NewValue == "true"
Description := concat("", ["Users are allowed to delegate access to their mailbox in ", LastEvent.OrgUnit])
}

2.2

ConfidentialModeSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "false"
    Description := concat("", ["<span class=setting>Confidential mode is disabled for users </span> in ", LastEvent.OrgUnit])
}

ConfidentialModeSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "true"
    Description := concat("", ["<span class=setting>Confidential mode is enabled for users </span> in ", LastEvent.OrgUnit])
}

2.3

SMIMESettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "STATUS_ENABLED"
    Description := concat("", ["<span class=setting>S/MIME is enabled for Gmail messages </span> in ", LastEvent.OrgUnit])
}

SMIMESettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "STATUS_DISABLED"
    Description := concat("", ["<span class=setting>S/MIME is disabled for Gmail messages </span> in ", LastEvent.OrgUnit])
}

2.7.1

AttachmentProtectionsAutoUpdateSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "true"
    Description := concat("", ["<span class=setting>Future recommended settings for attachment protections are automatically applied by Google </span> in ", LastEvent.OrgUnit])
}

AttachmentProtectionsAutoUpdateSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "false"
    Description := concat("", ["<span class=setting>Future recommended settings for attachment protections are not automatically applied by Google </span> in ", LastEvent.OrgUnit])
}

2.7.2

AnomalousAttachmentSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "true"
    Description := concat("", ["<span class=setting>Attachment protection for anomalous attachment types is enabled </span> in ", LastEvent.OrgUnit])
}

AnomalousAttachmentSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "false"
    Description := concat("", ["<span class=setting>Attachment protection for anomalous attachment types is not enabled </span> in ", LastEvent.OrgUnit])
}

2.7.3

ScriptAttachmentSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "true"
    Description := concat("", ["<span class=setting>Attachment protection for attachments with scripts from untrusted senders is enabled</span> in ", LastEvent.OrgUnit])
}

ScriptAttachmentSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "false"
    Description := concat("", ["<span class=setting>Attachment protection for attachments with scripts from untrusted senders is not enabled</span> in ", LastEvent.OrgUnit])
}

2.7.4

EncryptedAttachmentSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "true"
    Description := concat("", ["<span class=setting>Attachment protection for encrypted attachments from untrusted senders is enabled</span> in ", LastEvent.OrgUnit])
}

EncryptedAttachmentSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "false"
    Description := concat("", ["<span class=setting>Attachment protection for encrypted attachments from untrusted senders is not enabled</span> in ", LastEvent.OrgUnit])
}

2.8.1

LinkExternalImageProtectionAutoUpdateSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "true"
    Description := concat("", ["<span class=setting>Future recommended settings for links and external images protections are automatically applied by Google </span> in ", LastEvent.OrgUnit])
}

LinkExternalImageProtectionAutoUpdateSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "false"
    Description := concat("", ["<span class=setting>Future recommended settings for links and external images protections are not automatically applied by Google </span> in ", LastEvent.OrgUnit])
}

2.8.2

WarningLinksUntrustedDomainsSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "true"
    Description := concat("", ["<span class=setting>Warning prompts are shown for any clicks on links to untrusted domains</span> in ", LastEvent.OrgUnit])
}

WarningLinksUntrustedDomainsSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "false"
    Description := concat("", ["<span class=setting>Warning prompts are not shown for any clicks on links to untrusted domains</span> in ", LastEvent.OrgUnit])
}

2.8.3

ScanLinkedImagesSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "true"
    Description := concat("", ["<span class=setting>Linked images are scanned</span> in ", LastEvent.OrgUnit])
}

ScanLinkedImagesSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "false"
    Description := concat("", ["<span class=setting>Linked images are not scanned</span> in ", LastEvent.OrgUnit])
}

2.8.4

IdentifyLinksURLsSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "true"
    Description := concat("", ["<span class=setting>Links behind shortened URLs are identified</span> in ", LastEvent.OrgUnit])
}

IdentifyLinksURLsSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "false"
    Description := concat("", ["<span class=setting>Links behind shortened URLs are not identified</span> in ", LastEvent.OrgUnit])
}

2.9.1

SpoofingAuthenticationProtectionsAutoUpdateSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "true"
    Description := concat("", ["<span class=setting>Future recommended settings for spoofing and authentication protections are automatically applied by Google </span> in ", LastEvent.OrgUnit])
}

SpoofingAuthenticationProtectionsAutoUpdateSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "false"
    Description := concat("", ["<span class=setting>Future recommended settings for spoofing and authentication protections are not automatically applied by Google </span> in ", LastEvent.OrgUnit])
}

2.9.2

InboundEmailDomainSpoofingGroupsSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "true"
    Description := concat("", ["<span class=setting>Groups are protected from inbound emails spoofing your domain </span> in ", LastEvent.OrgUnit])
}

InboundEmailDomainSpoofingGroupsSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "false"
    Description := concat("", ["<span class=setting>Groups are not protected from inbound emails spoofing your domain </span> in ", LastEvent.OrgUnit])
}

2.9.3

UnauthenticatedEmailProtectionSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "true"
    Description := concat("", ["<span class=setting>Protection against any unauthenticated emails is enabled </span> in ", LastEvent.OrgUnit])
}

UnauthenticatedEmailProtectionSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "false"
    Description := concat("", ["<span class=setting>Protection against any unauthenticated emails is not enabled </span> in ", LastEvent.OrgUnit])
}

2.9.4

InboundEmailDomainSpoofingSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "true"
    Description := concat("", ["<span class=setting>Protection against inbound emails spoofing your domain is enabled</span> in ", LastEvent.OrgUnit])
}

InboundEmailDomainSpoofingSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "false"
    Description := concat("", ["<span class=setting>Protection against inbound emails spoofing your domain is not enabled</span> in ", LastEvent.OrgUnit])
}

2.9.5

EmployeeNameSpoofingSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "true"
    Description := concat("", ["<span class=setting>Protection against spoofing of employee names is enabled</span> in ", LastEvent.OrgUnit])
}

EmployeeNameSpoofingSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "false"
    Description := concat("", ["<span class=setting>Protection against spoofing of employee names is not enabled</span> in ", LastEvent.OrgUnit])
}

2.9.6

SimilarDomainNameSpoofingSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "true"
    Description := concat("", ["<span class=setting>Protection against domain spoofing based on similar domain names is enabled</span> in ", LastEvent.OrgUnit])
}

SimilarDomainNameSpoofingSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "false"
    Description := concat("", ["<span class=setting>Protection against domain spoofing based on similar domain names is not enabled</span> in ", LastEvent.OrgUnit])
}

2.10

UserEmailUploadSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "true"
    Description := concat("", ["<span class=setting>User email uploads are enabled </span> in ", LastEvent.OrgUnit])
}

UserEmailUploadSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "false"
    Description := concat("", ["<span class=setting>User email uploads are not enabled </span> in ", LastEvent.OrgUnit])
}

2.11.1

PopAccessSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "true"
    Description := concat("", ["<span class=setting>POP access for users is enabled </span> in ", LastEvent.OrgUnit])
}

PopAccessSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "false"
    Description := concat("", ["<span class=setting>POP access for users is not enabled </span> in ", LastEvent.OrgUnit])
}

2.11.2

ImapAccessSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "ENABLED_FOR_ALL_MAIL_CLIENTS"
    Description := concat("", ["<span class=setting>IMAP access for users is enabled </span> in ", LastEvent.OrgUnit])
}

ImapAccessSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "DISABLED"
    Description := concat("", ["<span class=setting>IMAP access for users is not enabled </span> in ", LastEvent.OrgUnit])
}

2.12

GoogleWorkspaceSyncSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "true"
    Description := concat("", ["<span class=setting>Google Workspace Sync for Microsoft Outlook is enabled </span> in ", LastEvent.OrgUnit])
}

GoogleWorkspaceSyncSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "false"
    Description := concat("", ["<span class=setting>Google Workspace Sync for Microsoft Outlook is not enabled </span> in ", LastEvent.OrgUnit])
}

2.13

AutomaticForwardingSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "true"
    Description := concat("", ["<span class=setting>Users are allowed to automatically forward incoming email to another address </span> in ", LastEvent.OrgUnit])
}

AutomaticForwardingSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "false"
    Description := concat("", ["<span class=setting>Users are not allowed to automatically forward incoming email to another address </span> in ", LastEvent.OrgUnit])
}

2.14

ImageUrlProxyWhitelistsSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "1"
    Description := concat("", ["<span class=setting>Image URL proxy allowlist is enabled </span> in ", LastEvent.OrgUnit])
}

ImageUrlProxyWhitelistsSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "DEFAULT"
    Description := concat("", ["<span class=setting>Image URL proxy allowlist is not enabled </span> in ", LastEvent.OrgUnit])
}

2.15

PerUserOutboundGatewaySettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "true"
    Description := concat("", ["<span class=setting>Users are allowed to send mail through an external SMTP server when configuring a from address hosted outside your email domain </span> in ", LastEvent.OrgUnit])
}

PerUserOutboundGatewaySettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "false"
    Description := concat("", ["<span class=setting>Users are not allowed to send mail through an external SMTP server when configuring a from address hosted outside your email domain </span> in ", LastEvent.OrgUnit])
}

2.16

ExternalReplyWarningSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "true"
    Description := concat("", ["<span class=setting>Users are warned before they reply to email with external recipients who aren't in their contacts </span> in ", LastEvent.OrgUnit])
}

ExternalReplyWarningSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "false"
    Description := concat("", ["<span class=setting>Users are not warned before they reply to email with external recipients who aren't in their contacts </span> in ", LastEvent.OrgUnit])
}

2.17

EmailAllowlistSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue != "[]"
    Description := concat("", ["<span class=setting>Email allowlists are enabled </span> in ", LastEvent.DomainName])
}

EmailAllowlistSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "[]"
    Description := concat("", ["<span class=setting>Email allowlists are not enabled </span> in ", LastEvent.DomainName])
}

2.18

EnhancedPreDeliveryMessageScanningSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "true"
    Description := concat("", ["<span class=setting>Improved detection of suspicious content prior to delivery is enabled </span> in ", LastEvent.OrgUnit])
}

EnhancedPreDeliveryMessageScanningSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "false"
    Description := concat("", ["<span class=setting>Improved detection of suspicious content prior to delivery is not enabled </span> in ", LastEvent.OrgUnit])
}

2.19

SecuritySandboxSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "true"
    Description := concat("", ["<span class=setting>Virtual execution of attachments in a sandbox environment for all users is enabled </span> in ", LastEvent.OrgUnit])
}

SecuritySandboxSettingDetailsStr(LastEvent) = Description if {
    LastEvent.NewValue == "false"
    Description := concat("", ["<span class=setting>Virtual execution of attachments in a sandbox environment for all users is not enabled </span> in ", LastEvent.OrgUnit])
}