feat(googleworkspace): add rules service checks (#11379)

Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>

tests/providers/googleworkspace/services/rules/rules_admin_privilege_granted_alert_configured/rules_admin_privilege_granted_alert_configured_test.py

@@ -0,0 +1,183 @@
+from unittest.mock import patch
+
+from prowler.providers.googleworkspace.services.rules.rules_service import (
+    SystemDefinedAlert,
+)
+from tests.providers.googleworkspace.googleworkspace_fixtures import (
+    CUSTOMER_ID,
+    set_mocked_googleworkspace_provider,
+)
+
+RULE_NAME = "User granted Admin privilege"
+
+
+class TestRulesAdminPrivilegeGrantedAlertConfigured:
+    def test_pass_fully_configured(self):
+        """Test PASS when alert is ON, email notifications ON, recipients = all super admins."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_admin_privilege_granted_alert_configured.rules_admin_privilege_granted_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_admin_privilege_granted_alert_configured.rules_admin_privilege_granted_alert_configured import (
+                rules_admin_privilege_granted_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="ACTIVE",
+                    severity="MEDIUM",
+                    email_notifications_enabled=True,
+                    all_super_admins=True,
+                )
+            ]
+
+            check = rules_admin_privilege_granted_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "PASS"
+            assert "properly configured" in findings[0].status_extended
+            assert findings[0].customer_id == CUSTOMER_ID
+
+    def test_fail_alert_off(self):
+        """Test FAIL when alert is OFF (INACTIVE state)."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_admin_privilege_granted_alert_configured.rules_admin_privilege_granted_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_admin_privilege_granted_alert_configured.rules_admin_privilege_granted_alert_configured import (
+                rules_admin_privilege_granted_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="INACTIVE",
+                )
+            ]
+
+            check = rules_admin_privilege_granted_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "FAIL"
+            assert "alert is OFF" in findings[0].status_extended
+
+    def test_fail_no_email_notifications(self):
+        """Test FAIL when alert is ON but email notifications are disabled."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_admin_privilege_granted_alert_configured.rules_admin_privilege_granted_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_admin_privilege_granted_alert_configured.rules_admin_privilege_granted_alert_configured import (
+                rules_admin_privilege_granted_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="ACTIVE",
+                    severity="MEDIUM",
+                    email_notifications_enabled=False,
+                    all_super_admins=False,
+                )
+            ]
+
+            check = rules_admin_privilege_granted_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "FAIL"
+            assert "email notifications are disabled" in findings[0].status_extended
+
+    def test_fail_recipients_not_all_super_admins(self):
+        """Test FAIL when email notifications ON but recipients do not include all super admins."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_admin_privilege_granted_alert_configured.rules_admin_privilege_granted_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_admin_privilege_granted_alert_configured.rules_admin_privilege_granted_alert_configured import (
+                rules_admin_privilege_granted_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="ACTIVE",
+                    severity="MEDIUM",
+                    email_notifications_enabled=True,
+                    all_super_admins=False,
+                )
+            ]
+
+            check = rules_admin_privilege_granted_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "FAIL"
+            assert (
+                "do not include all super administrators" in findings[0].status_extended
+            )
+
+    def test_no_findings_when_fetch_failed(self):
+        """Test no findings returned when the API fetch failed."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_admin_privilege_granted_alert_configured.rules_admin_privilege_granted_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_admin_privilege_granted_alert_configured.rules_admin_privilege_granted_alert_configured import (
+                rules_admin_privilege_granted_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = False
+            mock_rules_client.system_defined_alerts = []
+
+            check = rules_admin_privilege_granted_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 0

tests/providers/googleworkspace/services/rules/rules_gmail_employee_spoofing_alert_configured/rules_gmail_employee_spoofing_alert_configured_test.py

@@ -0,0 +1,183 @@
+from unittest.mock import patch
+
+from prowler.providers.googleworkspace.services.rules.rules_service import (
+    SystemDefinedAlert,
+)
+from tests.providers.googleworkspace.googleworkspace_fixtures import (
+    CUSTOMER_ID,
+    set_mocked_googleworkspace_provider,
+)
+
+RULE_NAME = "Gmail potential employee spoofing"
+
+
+class TestRulesGmailEmployeeSpoofingAlertConfigured:
+    def test_pass_fully_configured(self):
+        """Test PASS when alert is ON, email notifications ON, recipients = all super admins."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_gmail_employee_spoofing_alert_configured.rules_gmail_employee_spoofing_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_gmail_employee_spoofing_alert_configured.rules_gmail_employee_spoofing_alert_configured import (
+                rules_gmail_employee_spoofing_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="ACTIVE",
+                    severity="MEDIUM",
+                    email_notifications_enabled=True,
+                    all_super_admins=True,
+                )
+            ]
+
+            check = rules_gmail_employee_spoofing_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "PASS"
+            assert "properly configured" in findings[0].status_extended
+            assert findings[0].customer_id == CUSTOMER_ID
+
+    def test_fail_alert_off(self):
+        """Test FAIL when alert is OFF (INACTIVE state)."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_gmail_employee_spoofing_alert_configured.rules_gmail_employee_spoofing_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_gmail_employee_spoofing_alert_configured.rules_gmail_employee_spoofing_alert_configured import (
+                rules_gmail_employee_spoofing_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="INACTIVE",
+                )
+            ]
+
+            check = rules_gmail_employee_spoofing_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "FAIL"
+            assert "alert is OFF" in findings[0].status_extended
+
+    def test_fail_no_email_notifications(self):
+        """Test FAIL when alert is ON but email notifications are disabled."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_gmail_employee_spoofing_alert_configured.rules_gmail_employee_spoofing_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_gmail_employee_spoofing_alert_configured.rules_gmail_employee_spoofing_alert_configured import (
+                rules_gmail_employee_spoofing_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="ACTIVE",
+                    severity="MEDIUM",
+                    email_notifications_enabled=False,
+                    all_super_admins=False,
+                )
+            ]
+
+            check = rules_gmail_employee_spoofing_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "FAIL"
+            assert "email notifications are disabled" in findings[0].status_extended
+
+    def test_fail_recipients_not_all_super_admins(self):
+        """Test FAIL when email notifications ON but recipients do not include all super admins."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_gmail_employee_spoofing_alert_configured.rules_gmail_employee_spoofing_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_gmail_employee_spoofing_alert_configured.rules_gmail_employee_spoofing_alert_configured import (
+                rules_gmail_employee_spoofing_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="ACTIVE",
+                    severity="MEDIUM",
+                    email_notifications_enabled=True,
+                    all_super_admins=False,
+                )
+            ]
+
+            check = rules_gmail_employee_spoofing_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "FAIL"
+            assert (
+                "do not include all super administrators" in findings[0].status_extended
+            )
+
+    def test_no_findings_when_fetch_failed(self):
+        """Test no findings returned when the API fetch failed."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_gmail_employee_spoofing_alert_configured.rules_gmail_employee_spoofing_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_gmail_employee_spoofing_alert_configured.rules_gmail_employee_spoofing_alert_configured import (
+                rules_gmail_employee_spoofing_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = False
+            mock_rules_client.system_defined_alerts = []
+
+            check = rules_gmail_employee_spoofing_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 0

tests/providers/googleworkspace/services/rules/rules_government_backed_attacks_alert_configured/rules_government_backed_attacks_alert_configured_test.py

@@ -0,0 +1,183 @@
+from unittest.mock import patch
+
+from prowler.providers.googleworkspace.services.rules.rules_service import (
+    SystemDefinedAlert,
+)
+from tests.providers.googleworkspace.googleworkspace_fixtures import (
+    CUSTOMER_ID,
+    set_mocked_googleworkspace_provider,
+)
+
+RULE_NAME = "Government-backed attacks"
+
+
+class TestRulesGovernmentBackedAttacksAlertConfigured:
+    def test_pass_fully_configured(self):
+        """Test PASS when alert is ON, email notifications ON, recipients = all super admins."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_government_backed_attacks_alert_configured.rules_government_backed_attacks_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_government_backed_attacks_alert_configured.rules_government_backed_attacks_alert_configured import (
+                rules_government_backed_attacks_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="ACTIVE",
+                    severity="MEDIUM",
+                    email_notifications_enabled=True,
+                    all_super_admins=True,
+                )
+            ]
+
+            check = rules_government_backed_attacks_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "PASS"
+            assert "properly configured" in findings[0].status_extended
+            assert findings[0].customer_id == CUSTOMER_ID
+
+    def test_fail_alert_off(self):
+        """Test FAIL when alert is OFF (INACTIVE state)."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_government_backed_attacks_alert_configured.rules_government_backed_attacks_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_government_backed_attacks_alert_configured.rules_government_backed_attacks_alert_configured import (
+                rules_government_backed_attacks_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="INACTIVE",
+                )
+            ]
+
+            check = rules_government_backed_attacks_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "FAIL"
+            assert "alert is OFF" in findings[0].status_extended
+
+    def test_fail_no_email_notifications(self):
+        """Test FAIL when alert is ON but email notifications are disabled."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_government_backed_attacks_alert_configured.rules_government_backed_attacks_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_government_backed_attacks_alert_configured.rules_government_backed_attacks_alert_configured import (
+                rules_government_backed_attacks_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="ACTIVE",
+                    severity="MEDIUM",
+                    email_notifications_enabled=False,
+                    all_super_admins=False,
+                )
+            ]
+
+            check = rules_government_backed_attacks_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "FAIL"
+            assert "email notifications are disabled" in findings[0].status_extended
+
+    def test_fail_recipients_not_all_super_admins(self):
+        """Test FAIL when email notifications ON but recipients do not include all super admins."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_government_backed_attacks_alert_configured.rules_government_backed_attacks_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_government_backed_attacks_alert_configured.rules_government_backed_attacks_alert_configured import (
+                rules_government_backed_attacks_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="ACTIVE",
+                    severity="MEDIUM",
+                    email_notifications_enabled=True,
+                    all_super_admins=False,
+                )
+            ]
+
+            check = rules_government_backed_attacks_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "FAIL"
+            assert (
+                "do not include all super administrators" in findings[0].status_extended
+            )
+
+    def test_no_findings_when_fetch_failed(self):
+        """Test no findings returned when the API fetch failed."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_government_backed_attacks_alert_configured.rules_government_backed_attacks_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_government_backed_attacks_alert_configured.rules_government_backed_attacks_alert_configured import (
+                rules_government_backed_attacks_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = False
+            mock_rules_client.system_defined_alerts = []
+
+            check = rules_government_backed_attacks_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 0

tests/providers/googleworkspace/services/rules/rules_leaked_password_alert_configured/rules_leaked_password_alert_configured_test.py

@@ -0,0 +1,183 @@
+from unittest.mock import patch
+
+from prowler.providers.googleworkspace.services.rules.rules_service import (
+    SystemDefinedAlert,
+)
+from tests.providers.googleworkspace.googleworkspace_fixtures import (
+    CUSTOMER_ID,
+    set_mocked_googleworkspace_provider,
+)
+
+RULE_NAME = "Leaked password"
+
+
+class TestRulesLeakedPasswordAlertConfigured:
+    def test_pass_fully_configured(self):
+        """Test PASS when alert is ON, email notifications ON, recipients = all super admins."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_leaked_password_alert_configured.rules_leaked_password_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_leaked_password_alert_configured.rules_leaked_password_alert_configured import (
+                rules_leaked_password_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="ACTIVE",
+                    severity="MEDIUM",
+                    email_notifications_enabled=True,
+                    all_super_admins=True,
+                )
+            ]
+
+            check = rules_leaked_password_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "PASS"
+            assert "properly configured" in findings[0].status_extended
+            assert findings[0].customer_id == CUSTOMER_ID
+
+    def test_fail_alert_off(self):
+        """Test FAIL when alert is OFF (INACTIVE state)."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_leaked_password_alert_configured.rules_leaked_password_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_leaked_password_alert_configured.rules_leaked_password_alert_configured import (
+                rules_leaked_password_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="INACTIVE",
+                )
+            ]
+
+            check = rules_leaked_password_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "FAIL"
+            assert "alert is OFF" in findings[0].status_extended
+
+    def test_fail_no_email_notifications(self):
+        """Test FAIL when alert is ON but email notifications are disabled."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_leaked_password_alert_configured.rules_leaked_password_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_leaked_password_alert_configured.rules_leaked_password_alert_configured import (
+                rules_leaked_password_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="ACTIVE",
+                    severity="MEDIUM",
+                    email_notifications_enabled=False,
+                    all_super_admins=False,
+                )
+            ]
+
+            check = rules_leaked_password_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "FAIL"
+            assert "email notifications are disabled" in findings[0].status_extended
+
+    def test_fail_recipients_not_all_super_admins(self):
+        """Test FAIL when email notifications ON but recipients do not include all super admins."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_leaked_password_alert_configured.rules_leaked_password_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_leaked_password_alert_configured.rules_leaked_password_alert_configured import (
+                rules_leaked_password_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="ACTIVE",
+                    severity="MEDIUM",
+                    email_notifications_enabled=True,
+                    all_super_admins=False,
+                )
+            ]
+
+            check = rules_leaked_password_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "FAIL"
+            assert (
+                "do not include all super administrators" in findings[0].status_extended
+            )
+
+    def test_no_findings_when_fetch_failed(self):
+        """Test no findings returned when the API fetch failed."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_leaked_password_alert_configured.rules_leaked_password_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_leaked_password_alert_configured.rules_leaked_password_alert_configured import (
+                rules_leaked_password_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = False
+            mock_rules_client.system_defined_alerts = []
+
+            check = rules_leaked_password_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 0

tests/providers/googleworkspace/services/rules/rules_password_changed_alert_configured/rules_password_changed_alert_configured_test.py

@@ -0,0 +1,183 @@
+from unittest.mock import patch
+
+from prowler.providers.googleworkspace.services.rules.rules_service import (
+    SystemDefinedAlert,
+)
+from tests.providers.googleworkspace.googleworkspace_fixtures import (
+    CUSTOMER_ID,
+    set_mocked_googleworkspace_provider,
+)
+
+RULE_NAME = "User's password changed"
+
+
+class TestRulesPasswordChangedAlertConfigured:
+    def test_pass_fully_configured(self):
+        """Test PASS when alert is ON, email notifications ON, recipients = all super admins."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_password_changed_alert_configured.rules_password_changed_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_password_changed_alert_configured.rules_password_changed_alert_configured import (
+                rules_password_changed_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="ACTIVE",
+                    severity="MEDIUM",
+                    email_notifications_enabled=True,
+                    all_super_admins=True,
+                )
+            ]
+
+            check = rules_password_changed_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "PASS"
+            assert "properly configured" in findings[0].status_extended
+            assert findings[0].customer_id == CUSTOMER_ID
+
+    def test_fail_alert_off(self):
+        """Test FAIL when alert is OFF (INACTIVE state)."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_password_changed_alert_configured.rules_password_changed_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_password_changed_alert_configured.rules_password_changed_alert_configured import (
+                rules_password_changed_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="INACTIVE",
+                )
+            ]
+
+            check = rules_password_changed_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "FAIL"
+            assert "alert is OFF" in findings[0].status_extended
+
+    def test_fail_no_email_notifications(self):
+        """Test FAIL when alert is ON but email notifications are disabled."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_password_changed_alert_configured.rules_password_changed_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_password_changed_alert_configured.rules_password_changed_alert_configured import (
+                rules_password_changed_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="ACTIVE",
+                    severity="MEDIUM",
+                    email_notifications_enabled=False,
+                    all_super_admins=False,
+                )
+            ]
+
+            check = rules_password_changed_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "FAIL"
+            assert "email notifications are disabled" in findings[0].status_extended
+
+    def test_fail_recipients_not_all_super_admins(self):
+        """Test FAIL when email notifications ON but recipients do not include all super admins."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_password_changed_alert_configured.rules_password_changed_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_password_changed_alert_configured.rules_password_changed_alert_configured import (
+                rules_password_changed_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="ACTIVE",
+                    severity="MEDIUM",
+                    email_notifications_enabled=True,
+                    all_super_admins=False,
+                )
+            ]
+
+            check = rules_password_changed_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "FAIL"
+            assert (
+                "do not include all super administrators" in findings[0].status_extended
+            )
+
+    def test_no_findings_when_fetch_failed(self):
+        """Test no findings returned when the API fetch failed."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_password_changed_alert_configured.rules_password_changed_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_password_changed_alert_configured.rules_password_changed_alert_configured import (
+                rules_password_changed_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = False
+            mock_rules_client.system_defined_alerts = []
+
+            check = rules_password_changed_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 0

tests/providers/googleworkspace/services/rules/rules_service_test.py

@@ -0,0 +1,323 @@
+from unittest.mock import MagicMock, patch
+
+from tests.providers.googleworkspace.googleworkspace_fixtures import (
+    set_mocked_googleworkspace_provider,
+)
+
+
+class TestRulesService:
+    def test_fetch_fully_configured_rule(self):
+        """Test fetching a system-defined alert rule with all 3 conditions met."""
+        mock_provider = set_mocked_googleworkspace_provider()
+        mock_provider.audit_config = {}
+        mock_provider.fixer_config = {}
+        mock_session = MagicMock()
+        mock_session.credentials = MagicMock()
+        mock_provider.session = mock_session
+
+        mock_service = MagicMock()
+        mock_policies_list = MagicMock()
+        mock_policies_list.execute.return_value = {
+            "policies": [
+                {
+                    "setting": {
+                        "type": "settings/rule.system_defined_alerts",
+                        "value": {
+                            "displayName": "Suspicious login",
+                            "description": "Google detected a suspicious sign-in.",
+                            "action": {
+                                "alertCenterAction": {
+                                    "recipients": [{"allSuperAdmins": True}],
+                                    "alertCenterConfig": {"severity": "LOW"},
+                                }
+                            },
+                            "state": "ACTIVE",
+                        },
+                    }
+                },
+            ]
+        }
+        mock_service.policies().list.return_value = mock_policies_list
+        mock_service.policies().list_next.return_value = None
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_service.GoogleWorkspaceService._build_service",
+                return_value=mock_service,
+            ),
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_service import (
+                Rules,
+            )
+
+            rules = Rules(mock_provider)
+
+            assert rules.policies_fetched is True
+            assert len(rules.system_defined_alerts) == 8
+
+            suspicious_login = next(
+                a
+                for a in rules.system_defined_alerts
+                if a.display_name == "Suspicious login"
+            )
+            assert suspicious_login.state == "ACTIVE"
+            assert suspicious_login.email_notifications_enabled is True
+            assert suspicious_login.all_super_admins is True
+            assert suspicious_login.severity == "LOW"
+
+    def test_fetch_rule_without_email_notifications(self):
+        """Test a rule that is ACTIVE but has no email recipients configured."""
+        mock_provider = set_mocked_googleworkspace_provider()
+        mock_provider.audit_config = {}
+        mock_provider.fixer_config = {}
+        mock_session = MagicMock()
+        mock_session.credentials = MagicMock()
+        mock_provider.session = mock_session
+
+        mock_service = MagicMock()
+        mock_policies_list = MagicMock()
+        mock_policies_list.execute.return_value = {
+            "policies": [
+                {
+                    "setting": {
+                        "type": "settings/rule.system_defined_alerts",
+                        "value": {
+                            "displayName": "Government-backed attacks",
+                            "description": "Google believes a user is targeted.",
+                            "action": {
+                                "alertCenterAction": {
+                                    "alertCenterConfig": {"severity": "HIGH"}
+                                }
+                            },
+                            "state": "ACTIVE",
+                        },
+                    }
+                },
+            ]
+        }
+        mock_service.policies().list.return_value = mock_policies_list
+        mock_service.policies().list_next.return_value = None
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_service.GoogleWorkspaceService._build_service",
+                return_value=mock_service,
+            ),
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_service import (
+                Rules,
+            )
+
+            rules = Rules(mock_provider)
+
+            gov_attack = next(
+                a
+                for a in rules.system_defined_alerts
+                if a.display_name == "Government-backed attacks"
+            )
+            assert gov_attack.state == "ACTIVE"
+            assert gov_attack.email_notifications_enabled is False
+            assert gov_attack.all_super_admins is False
+            assert gov_attack.severity == "HIGH"
+
+    def test_empty_response_fills_defaults(self):
+        """Test that all 8 rules get default values when API returns nothing."""
+        mock_provider = set_mocked_googleworkspace_provider()
+        mock_provider.audit_config = {}
+        mock_provider.fixer_config = {}
+        mock_session = MagicMock()
+        mock_session.credentials = MagicMock()
+        mock_provider.session = mock_session
+
+        mock_service = MagicMock()
+        mock_policies_list = MagicMock()
+        mock_policies_list.execute.return_value = {"policies": []}
+        mock_service.policies().list.return_value = mock_policies_list
+        mock_service.policies().list_next.return_value = None
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_service.GoogleWorkspaceService._build_service",
+                return_value=mock_service,
+            ),
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_service import (
+                Rules,
+            )
+
+            rules = Rules(mock_provider)
+
+            assert rules.policies_fetched is True
+            assert len(rules.system_defined_alerts) == 8
+
+            # All defaults should have no severity (not returned by API)
+            for alert in rules.system_defined_alerts:
+                assert alert.severity is None
+
+            # INACTIVE defaults: no email notifications
+            password_changed = next(
+                a
+                for a in rules.system_defined_alerts
+                if a.display_name == "User's password changed"
+            )
+            assert password_changed.state == "INACTIVE"
+            assert password_changed.email_notifications_enabled is False
+            assert password_changed.all_super_admins is False
+
+            admin_privilege = next(
+                a
+                for a in rules.system_defined_alerts
+                if a.display_name == "User granted Admin privilege"
+            )
+            assert admin_privilege.state == "INACTIVE"
+            assert admin_privilege.email_notifications_enabled is False
+            assert admin_privilege.all_super_admins is False
+
+            # ACTIVE defaults: email notifications ON with all super admins
+            suspicious_login = next(
+                a
+                for a in rules.system_defined_alerts
+                if a.display_name == "Suspicious login"
+            )
+            assert suspicious_login.state == "ACTIVE"
+            assert suspicious_login.email_notifications_enabled is True
+            assert suspicious_login.all_super_admins is True
+
+            gov_attacks = next(
+                a
+                for a in rules.system_defined_alerts
+                if a.display_name == "Government-backed attacks"
+            )
+            assert gov_attacks.state == "ACTIVE"
+            assert gov_attacks.email_notifications_enabled is True
+            assert gov_attacks.all_super_admins is True
+
+    def test_api_error_sets_policies_fetched_false(self):
+        """Test that API errors result in policies_fetched being False."""
+        mock_provider = set_mocked_googleworkspace_provider()
+        mock_provider.audit_config = {}
+        mock_provider.fixer_config = {}
+        mock_session = MagicMock()
+        mock_session.credentials = MagicMock()
+        mock_provider.session = mock_session
+
+        mock_service = MagicMock()
+        mock_service.policies().list.side_effect = Exception("API Error")
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_service.GoogleWorkspaceService._build_service",
+                return_value=mock_service,
+            ),
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_service import (
+                Rules,
+            )
+
+            rules = Rules(mock_provider)
+
+            assert rules.policies_fetched is False
+
+    def test_build_service_returns_none(self):
+        """Test early return when _build_service fails."""
+        mock_provider = set_mocked_googleworkspace_provider()
+        mock_provider.audit_config = {}
+        mock_provider.fixer_config = {}
+        mock_session = MagicMock()
+        mock_session.credentials = MagicMock()
+        mock_provider.session = mock_session
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_service.GoogleWorkspaceService._build_service",
+                return_value=None,
+            ),
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_service import (
+                Rules,
+            )
+
+            rules = Rules(mock_provider)
+
+            assert rules.policies_fetched is False
+            assert len(rules.system_defined_alerts) == 0
+
+    def test_non_cis_rules_are_ignored(self):
+        """Test that system-defined rules not in the 8 CIS rules are ignored."""
+        mock_provider = set_mocked_googleworkspace_provider()
+        mock_provider.audit_config = {}
+        mock_provider.fixer_config = {}
+        mock_session = MagicMock()
+        mock_session.credentials = MagicMock()
+        mock_provider.session = mock_session
+
+        mock_service = MagicMock()
+        mock_policies_list = MagicMock()
+        mock_policies_list.execute.return_value = {
+            "policies": [
+                {
+                    "setting": {
+                        "type": "settings/rule.system_defined_alerts",
+                        "value": {
+                            "displayName": "Device compromised",
+                            "description": "A device has been compromised.",
+                            "state": "ACTIVE",
+                        },
+                    }
+                },
+            ]
+        }
+        mock_service.policies().list.return_value = mock_policies_list
+        mock_service.policies().list_next.return_value = None
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_service.GoogleWorkspaceService._build_service",
+                return_value=mock_service,
+            ),
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_service import (
+                Rules,
+            )
+
+            rules = Rules(mock_provider)
+
+            assert len(rules.system_defined_alerts) == 8
+            names = {a.display_name for a in rules.system_defined_alerts}
+            assert "Device compromised" not in names
+
+    def test_system_defined_alert_model(self):
+        """Test SystemDefinedAlert Pydantic model defaults."""
+        from prowler.providers.googleworkspace.services.rules.rules_service import (
+            SystemDefinedAlert,
+        )
+
+        alert = SystemDefinedAlert(display_name="Test rule")
+        assert alert.state == "INACTIVE"
+        assert alert.severity is None
+        assert alert.email_notifications_enabled is False
+        assert alert.all_super_admins is False

tests/providers/googleworkspace/services/rules/rules_suspicious_activity_suspension_alert_configured/rules_suspicious_activity_suspension_alert_configured_test.py

@@ -0,0 +1,183 @@
+from unittest.mock import patch
+
+from prowler.providers.googleworkspace.services.rules.rules_service import (
+    SystemDefinedAlert,
+)
+from tests.providers.googleworkspace.googleworkspace_fixtures import (
+    CUSTOMER_ID,
+    set_mocked_googleworkspace_provider,
+)
+
+RULE_NAME = "User suspended due to suspicious activity"
+
+
+class TestRulesSuspiciousActivitySuspensionAlertConfigured:
+    def test_pass_fully_configured(self):
+        """Test PASS when alert is ON, email notifications ON, recipients = all super admins."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_suspicious_activity_suspension_alert_configured.rules_suspicious_activity_suspension_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_suspicious_activity_suspension_alert_configured.rules_suspicious_activity_suspension_alert_configured import (
+                rules_suspicious_activity_suspension_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="ACTIVE",
+                    severity="MEDIUM",
+                    email_notifications_enabled=True,
+                    all_super_admins=True,
+                )
+            ]
+
+            check = rules_suspicious_activity_suspension_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "PASS"
+            assert "properly configured" in findings[0].status_extended
+            assert findings[0].customer_id == CUSTOMER_ID
+
+    def test_fail_alert_off(self):
+        """Test FAIL when alert is OFF (INACTIVE state)."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_suspicious_activity_suspension_alert_configured.rules_suspicious_activity_suspension_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_suspicious_activity_suspension_alert_configured.rules_suspicious_activity_suspension_alert_configured import (
+                rules_suspicious_activity_suspension_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="INACTIVE",
+                )
+            ]
+
+            check = rules_suspicious_activity_suspension_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "FAIL"
+            assert "alert is OFF" in findings[0].status_extended
+
+    def test_fail_no_email_notifications(self):
+        """Test FAIL when alert is ON but email notifications are disabled."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_suspicious_activity_suspension_alert_configured.rules_suspicious_activity_suspension_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_suspicious_activity_suspension_alert_configured.rules_suspicious_activity_suspension_alert_configured import (
+                rules_suspicious_activity_suspension_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="ACTIVE",
+                    severity="MEDIUM",
+                    email_notifications_enabled=False,
+                    all_super_admins=False,
+                )
+            ]
+
+            check = rules_suspicious_activity_suspension_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "FAIL"
+            assert "email notifications are disabled" in findings[0].status_extended
+
+    def test_fail_recipients_not_all_super_admins(self):
+        """Test FAIL when email notifications ON but recipients do not include all super admins."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_suspicious_activity_suspension_alert_configured.rules_suspicious_activity_suspension_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_suspicious_activity_suspension_alert_configured.rules_suspicious_activity_suspension_alert_configured import (
+                rules_suspicious_activity_suspension_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="ACTIVE",
+                    severity="MEDIUM",
+                    email_notifications_enabled=True,
+                    all_super_admins=False,
+                )
+            ]
+
+            check = rules_suspicious_activity_suspension_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "FAIL"
+            assert (
+                "do not include all super administrators" in findings[0].status_extended
+            )
+
+    def test_no_findings_when_fetch_failed(self):
+        """Test no findings returned when the API fetch failed."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_suspicious_activity_suspension_alert_configured.rules_suspicious_activity_suspension_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_suspicious_activity_suspension_alert_configured.rules_suspicious_activity_suspension_alert_configured import (
+                rules_suspicious_activity_suspension_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = False
+            mock_rules_client.system_defined_alerts = []
+
+            check = rules_suspicious_activity_suspension_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 0

tests/providers/googleworkspace/services/rules/rules_suspicious_login_alert_configured/rules_suspicious_login_alert_configured_test.py

@@ -0,0 +1,183 @@
+from unittest.mock import patch
+
+from prowler.providers.googleworkspace.services.rules.rules_service import (
+    SystemDefinedAlert,
+)
+from tests.providers.googleworkspace.googleworkspace_fixtures import (
+    CUSTOMER_ID,
+    set_mocked_googleworkspace_provider,
+)
+
+RULE_NAME = "Suspicious login"
+
+
+class TestRulesSuspiciousLoginAlertConfigured:
+    def test_pass_fully_configured(self):
+        """Test PASS when alert is ON, email notifications ON, recipients = all super admins."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_suspicious_login_alert_configured.rules_suspicious_login_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_suspicious_login_alert_configured.rules_suspicious_login_alert_configured import (
+                rules_suspicious_login_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="ACTIVE",
+                    severity="MEDIUM",
+                    email_notifications_enabled=True,
+                    all_super_admins=True,
+                )
+            ]
+
+            check = rules_suspicious_login_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "PASS"
+            assert "properly configured" in findings[0].status_extended
+            assert findings[0].customer_id == CUSTOMER_ID
+
+    def test_fail_alert_off(self):
+        """Test FAIL when alert is OFF (INACTIVE state)."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_suspicious_login_alert_configured.rules_suspicious_login_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_suspicious_login_alert_configured.rules_suspicious_login_alert_configured import (
+                rules_suspicious_login_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="INACTIVE",
+                )
+            ]
+
+            check = rules_suspicious_login_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "FAIL"
+            assert "alert is OFF" in findings[0].status_extended
+
+    def test_fail_no_email_notifications(self):
+        """Test FAIL when alert is ON but email notifications are disabled."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_suspicious_login_alert_configured.rules_suspicious_login_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_suspicious_login_alert_configured.rules_suspicious_login_alert_configured import (
+                rules_suspicious_login_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="ACTIVE",
+                    severity="MEDIUM",
+                    email_notifications_enabled=False,
+                    all_super_admins=False,
+                )
+            ]
+
+            check = rules_suspicious_login_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "FAIL"
+            assert "email notifications are disabled" in findings[0].status_extended
+
+    def test_fail_recipients_not_all_super_admins(self):
+        """Test FAIL when email notifications ON but recipients do not include all super admins."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_suspicious_login_alert_configured.rules_suspicious_login_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_suspicious_login_alert_configured.rules_suspicious_login_alert_configured import (
+                rules_suspicious_login_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="ACTIVE",
+                    severity="MEDIUM",
+                    email_notifications_enabled=True,
+                    all_super_admins=False,
+                )
+            ]
+
+            check = rules_suspicious_login_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "FAIL"
+            assert (
+                "do not include all super administrators" in findings[0].status_extended
+            )
+
+    def test_no_findings_when_fetch_failed(self):
+        """Test no findings returned when the API fetch failed."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_suspicious_login_alert_configured.rules_suspicious_login_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_suspicious_login_alert_configured.rules_suspicious_login_alert_configured import (
+                rules_suspicious_login_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = False
+            mock_rules_client.system_defined_alerts = []
+
+            check = rules_suspicious_login_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 0

tests/providers/googleworkspace/services/rules/rules_suspicious_programmatic_login_alert_configured/rules_suspicious_programmatic_login_alert_configured_test.py

@@ -0,0 +1,183 @@
+from unittest.mock import patch
+
+from prowler.providers.googleworkspace.services.rules.rules_service import (
+    SystemDefinedAlert,
+)
+from tests.providers.googleworkspace.googleworkspace_fixtures import (
+    CUSTOMER_ID,
+    set_mocked_googleworkspace_provider,
+)
+
+RULE_NAME = "Suspicious programmatic login"
+
+
+class TestRulesSuspiciousProgrammaticLoginAlertConfigured:
+    def test_pass_fully_configured(self):
+        """Test PASS when alert is ON, email notifications ON, recipients = all super admins."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_suspicious_programmatic_login_alert_configured.rules_suspicious_programmatic_login_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_suspicious_programmatic_login_alert_configured.rules_suspicious_programmatic_login_alert_configured import (
+                rules_suspicious_programmatic_login_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="ACTIVE",
+                    severity="MEDIUM",
+                    email_notifications_enabled=True,
+                    all_super_admins=True,
+                )
+            ]
+
+            check = rules_suspicious_programmatic_login_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "PASS"
+            assert "properly configured" in findings[0].status_extended
+            assert findings[0].customer_id == CUSTOMER_ID
+
+    def test_fail_alert_off(self):
+        """Test FAIL when alert is OFF (INACTIVE state)."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_suspicious_programmatic_login_alert_configured.rules_suspicious_programmatic_login_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_suspicious_programmatic_login_alert_configured.rules_suspicious_programmatic_login_alert_configured import (
+                rules_suspicious_programmatic_login_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="INACTIVE",
+                )
+            ]
+
+            check = rules_suspicious_programmatic_login_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "FAIL"
+            assert "alert is OFF" in findings[0].status_extended
+
+    def test_fail_no_email_notifications(self):
+        """Test FAIL when alert is ON but email notifications are disabled."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_suspicious_programmatic_login_alert_configured.rules_suspicious_programmatic_login_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_suspicious_programmatic_login_alert_configured.rules_suspicious_programmatic_login_alert_configured import (
+                rules_suspicious_programmatic_login_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="ACTIVE",
+                    severity="MEDIUM",
+                    email_notifications_enabled=False,
+                    all_super_admins=False,
+                )
+            ]
+
+            check = rules_suspicious_programmatic_login_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "FAIL"
+            assert "email notifications are disabled" in findings[0].status_extended
+
+    def test_fail_recipients_not_all_super_admins(self):
+        """Test FAIL when email notifications ON but recipients do not include all super admins."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_suspicious_programmatic_login_alert_configured.rules_suspicious_programmatic_login_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_suspicious_programmatic_login_alert_configured.rules_suspicious_programmatic_login_alert_configured import (
+                rules_suspicious_programmatic_login_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = True
+            mock_rules_client.system_defined_alerts = [
+                SystemDefinedAlert(
+                    display_name=RULE_NAME,
+                    state="ACTIVE",
+                    severity="MEDIUM",
+                    email_notifications_enabled=True,
+                    all_super_admins=False,
+                )
+            ]
+
+            check = rules_suspicious_programmatic_login_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 1
+            assert findings[0].status == "FAIL"
+            assert (
+                "do not include all super administrators" in findings[0].status_extended
+            )
+
+    def test_no_findings_when_fetch_failed(self):
+        """Test no findings returned when the API fetch failed."""
+        mock_provider = set_mocked_googleworkspace_provider()
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=mock_provider,
+            ),
+            patch(
+                "prowler.providers.googleworkspace.services.rules.rules_suspicious_programmatic_login_alert_configured.rules_suspicious_programmatic_login_alert_configured.rules_client"
+            ) as mock_rules_client,
+        ):
+            from prowler.providers.googleworkspace.services.rules.rules_suspicious_programmatic_login_alert_configured.rules_suspicious_programmatic_login_alert_configured import (
+                rules_suspicious_programmatic_login_alert_configured,
+            )
+
+            mock_rules_client.provider = mock_provider
+            mock_rules_client.policies_fetched = False
+            mock_rules_client.system_defined_alerts = []
+
+            check = rules_suspicious_programmatic_login_alert_configured()
+            findings = check.execute()
+
+            assert len(findings) == 0