allow 'login' applicationName for GSuite.ExternalMailForwarding

Author: ben-githubs

rules/gsuite_activityevent_rules/gsuite_external_forwarding.py

@@ -2,7 +2,7 @@
 
 
 def rule(event):
-    if event.deep_get("id", "applicationName") != "user_accounts":
+    if event.deep_get("id", "applicationName") not in ("user_accounts", "login"):
         return False
 
     if event.get("name") == "email_forwarding_out_of_domain":

rules/gsuite_activityevent_rules/gsuite_external_forwarding.yml

@@ -21,7 +21,7 @@ Runbook: >
 SummaryAttributes:
   - p_any_emails
 Tests:
-  - Name: Forwarding to External Address
+  - Name: Forwarding to External Address - applicationName = user_accounts
     ExpectedResult: true
     Log:
       {
@@ -33,6 +33,17 @@ Tests:
           { "email_forwarding_destination_address": "[email protected]" },
       }
 
+  - Name: Forwarding to External Address - applicationName = login
+    ExpectedResult: true
+    Log:
+      {
+        "id": { "applicationName": "login", "customerId": "D12345" },
+        "actor": { "email": "[email protected]" },
+        "type": "email_forwarding_change",
+        "name": "email_forwarding_out_of_domain",
+        "parameters": { "email_forwarding_destination_address": "[email protected]" }
+      }
+
   - Name: Forwarding to External Address - Allowed Domain
     ExpectedResult: false
     Log: