Google Workspace Activity

Create a Collect Rule

1

Begin Setup

In the Scanner UI, go to the Collect tab.

• From the Overview page click the '+' icon in the upper right corner
• Select create new Collect Rule
• Choose Google Workspace.
• Choose the specific Activity log type (the instructions below apply to all log types).

2

Configuration

Set a Display Name, such as my-google-workspace-activity-logs.

3

Authenticate with Google Workspace

• If you’ve previously created an Google Workspace connection, select it from the list.
• Otherwise, select New Google Workspace Connection and fill in the required fields:

  • Connection Name: Give the connection a recognizable name.
  • Service Account Subject Email: e.g. [e-mail]
  • Service Account Key JSON

To create the service account and the service account key JSON:

• Follow these instructions
• Domain-wide delegation must be enabled for the service account
• The Admin SDK API must be enabled on the Google Cloud project
• The service account subject email is the email of the user who created the service account. It is NOT the service account email ending in @my-project.iam.gserviceaccount.com. The service account impersonates this user when polling from the API.
• The service account must have the following authorization scopes: https://www.googleapis.com/auth/admin.reports.audit.readonly https://www.googleapis.com/auth/admin.reports.usage.readonly

4

Logs Destination

• Choose the S3 Bucket where the raw Google Workspace logs should be stored.
• (Optional) Enter a Key Prefix to organize the data path in your bucket.

5

Review and Create

Review all configuration settings. Any errors and/or missing fields must be resolved before completion.

Create an Index Rule

With the Collect Rule created, Scanner will poll the Google Workspace Admin SDK API every 5 minutes, writing new events to your S3 bucket. Create an Index Rule to make them searchable.

Create an Index Rule

Google Workspace Activity Defaults

When you create the Index Rule from the Collect Rule, the following defaults are pre-populated:

• Transformations: Add Metadata, Parse JSON Columns, Unroll Array, ECS Normalization: Google Workspace
• Timestamp Field: .id.time