Collect Google Workspace logs

This document describes how you can collect Google Workspace logs by setting up a Google Security Operations feed and how log fields map to Google Security Operations Unified Data Model (UDM) fields. This document also lists the supported log types and event types for Google Workspace.

For more information, see Data ingestion to Google Security Operations.

A typical deployment consists of Google Workspace and the Google Security Operations feed configured to send logs to Google Security Operations. Each customer deployment might differ and might be more complex.

The deployment contains the following components:

• Google Workspace. The Google Workspace platform from which you collect logs.

• Google Security Operations feed. The Google Security Operations feed that fetches logs from Google Workspace and writes logs to Google Security Operations.

• Google Security Operations. Google Security Operations retains and analyzes the logs from Google Workspace.

An ingestion label identifies the parser which normalizes raw log data to structured UDM format. The information in this document applies to Google Workspace parsers with the following ingestion labels:

• WORKSPACE_ACTIVITY
• WORKSPACE_ALERTS
• WORKSPACE_CHROMEOS
• WORKSPACE_GROUPS
• WORKSPACE_MOBILE
• WORKSPACE_PRIVILEGES
• WORKSPACE_USERS

Before you begin

• Ensure that you use Google Workspace Business Standard or Business Plus edition because the Google Workspace parser supports both of these editions. For more information, see Set up Google Workspace.

• Ensure that you have a Google Workspace Administrator account. For more information, see Set up a Google Workspace administrator account.

• Enable the following APIs in your Google Cloud project:

  • Google Workspace Admin SDK
  • Alert Center API

• To authenticate Google Workspace APIs, create a service account in your Google Cloud project and take a note of the unique numeric ID and email address of the service account. For more information about creating a service account, see Creating and managing service accounts.

• Create a user that impersonates the service account, and then grant privileges to the user:

  1. Sign in to Google Admin console.
  2. Select Directory > Users and then click Add new user.
  3. Enter the user details.
  4. Click Add new user.
  5. Click the newly created user link, and then Admin roles and privileges.
  6. Click expand_less Expand less.
  7. Click Create custom role.
  8. Click the Create new role and give this role a name.
  9. Grant the following privileges to the role:
     • Privileges > Reports
     • Privileges > Services > Alert Center > Full Access > View access
     • Privileges > Services > Mobile Device Management > Manage Devices and Settings
     • Privileges > Services > Chrome Management > Settings
     • Admin API > Privileges > Users > Read
     • Admin API > Privileges > Groups > Read
  10. Click Continue, and then Create role.
  11. Click Assign users.
  12. Select the user to assign the role.
  13. Click Assign role.

• Create access credentials. For more information about creating access credentials, see Create a service account key.

• To access data, authorize domain-wide delegation for the service account with the following scopes:

  • https://www.googleapis.com/auth/admin.reports.audit.readonly
  • https://www.googleapis.com/auth/apps.alerts
  • https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly
  • https://www.googleapis.com/auth/admin.directory.group.readonly
  • https://www.googleapis.com/auth/admin.directory.device.mobile.readonly
  • https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly
  • https://www.googleapis.com/auth/admin.directory.user.readonly

• To locate the Google Workspace customer ID, in the Google Admin console, select Account > Account Settings > Profile.

• Ensure that all systems in the deployment architecture are configured in the UTC time zone.

• Verify the log types that the Google Security Operations parser supports. For information about supported Google Workspace logs, see Supported Google Workspacelog types.

Configure a feed in Google Security Operations to ingest Google Workspace logs

1. In the navigation bar, select Settings > SIEM Settings > Feeds.
2. Click Add New.
3. Select Third party API for Source Type.
4. To create a feed for Workspace Activities, select Workspace Activities as the Log Type.
5. Click Next.

6. Based on the Google Workspace configuration that you created, specify values for the following fields:

   • OAuth JWT endpoint. The endpoint that contains the OAuth JSON Web Token. Specify the token_uri value from the service account JSON key.
   • JWT claims issuer. This is the client ID. Specify the client_email value from the service account JSON key. For example, InsertServiceAccount@project.iam.gserviceaccount.com
   • JWT claims subject. Specify the email address of the user that you created in the Google Workspace Admin console.
   • JWT claims audience. Specify the token_uri value from the service account JSON key.

   • RSA private key. An RSA private key in PEM format. The PEM key is available in the service account key file. When you enter the private key, include the BEGIN PRIVATE KEY header and the END PRIVATE KEY footer and replace all instances of the \n token with an actual Enter keystroke in the text box.

   • Customer ID. For all log types, except the Alerts log type, the customer ID field requires a leading 'C' character. If the customer ID field does not contain a leading 'C' character, then prepend what the value with a 'C' character.

   • Applications. The Applications field is required only when you create a feed for Workspace Activities.

7. Click Next and then Submit.

8. After you complete the steps to create a feed for Workspace Activities, repeat the steps to create a separate feed for each of the following log type.

   • Workspace Alerts
   • Workspace ChromeOS Devices
   • Workspace Groups
   • Workspace Mobile Devices
   • Workspace Privileges
   • Workspace Users

For more information about Google Security Operations feeds, see Google Security Operations feeds documentation. For information about requirements for each feed type, see Feed configuration by type.

If you encounter issues when you create feeds, contact Google Security Operations support.

Supported Google Workspace log types

The following sections list the log types that the Google Workspace parser supports:

WORKSPACE_ACTIVITY

The following table lists the supported application name and event types for the WORKSPACE_ACTIVITY log type.

Application name	Event type
access_transparency	GSUITE_RESOURCE
chrome	CHROME_OS_ADD_REMOVE_USER_TYPE
	DEVICE_BOOT_STATE_CHANGE_TYPE
	CHROME_OS_LOGIN_LOGOUT_TYPE
	CHROME_OS_REPORTING_DATA_LOST_TYPE
	SAFE_BROWSING_PASSWORD_ALERT
	DLP_EVENTS_TYPE
	CONTENT_TRANSFER_TYPE
	CONTENT_UNSCANNED_TYPE
	EXTENSION_REQUEST_TYPE
	LOGIN_EVENT_TYPE
	MALWARE_TRANSFER_TYPE
	PASSWORD_BREACH_TYPE
	SENSITIVE_DATA_TRANSFER_TYPE
	UNSAFE_SITE_VISIT_TYPE
context_aware_access	CONTEXT_AWARE_ACCESS_USER_EVENT
gplus	comment_change
	plusone_change
	poll_vote_change
	post_change
data_studio	ACCESS
	ACL_CHANGE
mobile	device_applications
	device_updates
	suspicious_activity
groups_enterprise	moderator_action
calendar	calendar_change
	notification
	subscription_change
	event_change
	interop
chat	user_action
gcp	CLOUD_OSLOGIN
drive	access
	acl_change
	pooled_quota_metadata
groups	acl_change
	moderator_action
keep	user_action
meet	call
token	auth
rules	action_complete_type
	rule_match_type
	rule_trigger_type
saml	login
user_accounts	2sv_change
	password_change
	recovery_info_change
	titanium_change
	email_forwarding_change
login	2sv_change
	password_change
	recovery_info_change
	account_warning
	titanium_change
	email_forwarding_change
jamboard	administrative_action
	setting_change
	status_change
admin	USER_SETTINGS

For more information about the Google Workspace applications that Google Security Operations supports, see Google Workspace applications.

WORKSPACE_ALERTS

The following is the list of supported alert types:

• Customer takeout initiated
• Malware reclassification
• Misconfigured whitelist
• Phishing reclassification
• Suspicious message reported
• User reported phishing
• User reported spam spike
• Leaked password
• Suspicious login
• Suspicious login (less secure app)
• Suspicious programmatic login
• User suspended
• User suspended (spam)
• User suspended (spam through relay)
• User suspended (suspicious activity)
• Google Operations
• Configuration problem
• Government attack warning
• Device compromised
• Suspicious activity
• AppMaker Default Cloud SQL setup
• Activity Rule
• Data Loss Prevention
• Apps outage
• Primary admin changed
• SSO profile added
• SSO profile updated
• SSO profile deleted
• Super admin password reset

WORKSPACE_CHROMEOS

For information about the supported ChromeOS log schema, see ChromeOS devices.

WORKSPACE_GROUPS

For information about the supported groups log schema, see group.

WORKSPACE_MOBILE

For information about the supported mobile log schema, see mobile.

WORKSPACE_PRIVILEGES

For information about the supported privileges log schema, see privilege.

WORKSPACE_USERS

For information about the supported users log schema, see users.

Field mapping reference { :#field-mapping }

The following sections explain how the Google Security Operations parser maps Google Workspace log fields to Google Security Operations Unified Data Model (UDM) fields. The field mappings of this parser remain the same for feed-based ingestion and native ingestion.

Field mapping reference: WORKSPACE_ACTIVITY log types to UDM event type

The following table lists the WORKSPACE_ACTIVITY log types and their corresponding UDM event types.

Field mapping reference: WORKSPACE_ACTIVITY-Common Fields

The following table lists common fields of the WORKSPACE_ACTIVITY log type and their corresponding UDM fields.

Field mapping reference: WORKSPACE_ACTIVITY

The following table lists the log fields of the WORKSPACE_ACTIVITY log type and their corresponding UDM fields.

Field mapping reference: WORKSPACE_ALERTS log types to UDM event type

The following table lists the WORKSPACE_ALERTS log types and their corresponding UDM event types.

Field mapping reference: WORKSPACE_ALERTS

The following table lists the log fields of the WORKSPACE_ALERTS log type and their corresponding UDM fields.

Field mapping reference: WORKSPACE_GROUPS

The following table lists the log fields of the WORKSPACE_GROUPS log type and their corresponding UDM fields.

Field mapping reference: WORKSPACE_USERS

The following table lists the log fields of the WORKSPACE_USERS log type and their corresponding UDM fields.

Field mapping reference: WORKSPACE_MOBILE_DEVICES

The following table lists the log fields of the WORKSPACE_MOBILE_DEVICES log type and their corresponding UDM fields.

Field mapping reference: WORKSPACE_CHROMEOS

The following table lists the log fields of the WORKSPACE_CHROMEOS log type and their corresponding UDM fields.

Field mapping reference: WORKSPACE_PRIVILEGES

The following table lists the log fields of the WORKSPACE_PRIVILEGES log type and their corresponding UDM fields.

What's next

• Data ingestion to Google Security Operations