diff --git a/checkpoint.py b/checkpoint.py index 5a848cb..8518438 100644 --- a/checkpoint.py +++ b/checkpoint.py @@ -3698,6 +3698,18 @@ def get_events(directory_id: str) -> List[Dict[str, Any]]: ): event_description = "allowed an app access to Google Workspace data" + elif ( + "name" in item["events"][0] + and item["events"][0]["name"] == "risky_sensitive_action_blocked" + ): + event_description = ( + "was blocked from attempting sensitive action " + + get_parameter_value( + "sensitive_action_name", item["events"][0]["parameters"] + ) + + " in Google Workspace" + ) + elif ( "name" in item["events"][0] and item["events"][0]["name"] == "email_forwarding_out_of_domain" @@ -3712,6 +3724,30 @@ def get_events(directory_id: str) -> List[Dict[str, Any]]: ) ) + elif ( + "name" in item["events"][0] + and item["events"][0]["name"] == "dbsc_key_binding" + ): + event_status = None + + if ( + "status" in item["events"][0] + and item["events"][0]["status"] is not None + and "eventStatus" in item["events"][0]["status"] + ): + event_status = item["events"][0]["status"]["eventStatus"] + + if event_status == "SUCCEEDED": + event_description = "bound a Google Workspace session to a device" + elif event_status == "FAILED": + event_description = ( + "failed to bind a Google Workspace session to a device" + ) + else: + raise InternalServerError( + "Unable to determine DBSC key binding event status: " + dumps(item) + ) + else: raise InternalServerError( "Unable to determine login event type: " + dumps(item)