cisagov / ScubaGoggles

SCuBA Secure Configuration Baselines and assessment tool for Google Workspace
https://www.cisa.gov/resources-tools/services/secure-cloud-business-applications-scuba-project
Creative Commons Zero v1.0 Universal
149 stars 20 forks source link

CLASSROOM.1 looking for the wrong events #251

Closed adhilto closed 6 months ago

adhilto commented 6 months ago

🐛 Summary

For GWS.CLASSROOM.1.1 and GWS.CLASSROOM.1.2, the Rego is looking for the following events, respectively:

However, changing the settings actually produces the following events:

To reproduce

  1. Change the settings
  2. Note the report shows "no such event"
  3. Manually look at the admin event log, observe the events that were actually produced

Expected behavior

The report to accurately capture the setting changes.