Google Workspace Alerts

Create a Collect Rule

1

Begin Setup

In the Scanner UI, go to the Collect tab.

• From the Overview page click the '+' icon in the upper right corner
• Select create new Collect Rule
• Choose Google Workspace.
• Choose Google Workspace: Alerts

2

Configuration

Set a Display Name, such as my-google-workspace-alerts-logs.

3

Authenticate with Google Workspace

• If you’ve previously created an Google Workspace connection, select it from the list.
• Otherwise, select New Google Workspace Connection and fill in the required fields:

  • Connection Name: Give the connection a recognizable name.
  • Service Account Subject Email: e.g. [e-mail]
  • Service Account Key JSON

To create the service account and the service account key JSON:

• Follow these instructions
• Domain-wide delegation must be enabled for the service account
• The Alert Center API must be enabled on the Google Cloud project
• The service account subject email is the email of the user who created the service account. It is NOT the service account email ending in @my-project.iam.gserviceaccount.com. The service account impersonates this user when polling from the API.
• The service account must have the authorization scope https://www.googleapis.com/auth/apps.alerts

4

Logs Destination

• Choose the S3 Bucket where the raw Google Workspace logs should be stored.
• (Optional) Enter a Key Prefix to organize the data path in your bucket.

5

Review and Create

• Review all configuration settings. Any errors and/or missing fields must be resolved before completion.

Create an Index Rule

With the Collect Rule created, Scanner will poll the Google Workspace Alert Center API every 5 minutes, writing new events to your S3 bucket. Create an Index Rule to make these logs searchable and available for detections.

Create an Index Rule

Google Workspace Alerts Defaults

When you create the Index Rule from the Collect Rule, the following defaults are pre-populated:

• Transformations: Add Metadata, Parse JSON Columns
• Timestamp Field: .createTime