Anda dapat menggunakan Google Security Operations untuk mendeteksi risiko orang dalam di Google Workspace dengan mengonfigurasi akun Google Workspace Anda untuk meneruskan data ke instance Google SecOps Anda.
Dokumen ini menjelaskan cara menggunakan penyerapan langsung untuk menyerap log Aktivitas Google Workspace (WORKSPACE_ACTIVITY) ke instance Google SecOps Anda dari jenis aplikasi Google yang didukung berikut:
Transparansi Akses
Akun
Konsol Google Admin
Google Kalender
Google Chat
Google Chrome
Classroom
Google Cloud
Access Context Manager
Looker Studio
Perangkat
Google Drive
Gmail
Google Grup
Pengelolaan Jamboard
LDAP
Login
Google Meet
OAuth
Penyimpanan Sandi
Firewall Rules Logging
SAML
Akun pengguna
Voice
Sebelum memulai
Selesaikan langkah-langkah berikut sebelum Anda memulai:
Salin ID Pelanggan Google Workspace Anda dari konsol Admin Google Workspace.
Mendapatkan ID instance dan token Google SecOps Anda
Untuk mendapatkan ID dan token instance Google SecOps Anda, selesaikan langkah-langkah berikut dari akun Google SecOps Anda:
Buka instance Google SecOps Anda.
Dari menu navigasi, pilih Setelan.
Klik Google Workspace.
Masukkan ID Pelanggan Google Workspace Anda.
Klik Generate Token.
Salin token dan ID instance Google SecOps Anda (terletak di halaman yang sama).
Menautkan Google Workspace ke instance Google SecOps Anda
Untuk mengirim data Google Workspace ke instance Google SecOps Anda,
selesaikan langkah-langkah berikut dari konsol Admin Google Workspace:
Buka konsol Admin Google Workspace.
Klik Pelaporan.
Klik Integrasi Data.
Pilih Ekspor Google SecOps, lalu klik Hubungkan ke Google SecOps. Tindakan ini akan membuka halaman Connect to Google SecOps.
Tempelkan token yang disalin dari akun Google SecOps Anda ke kolom yang ditentukan. Klik Connect. Ekspor data audit ke Google SecOps
sekarang akan menampilkan Aktif. Akun Google Workspace Anda kini ditautkan ke instance Google SecOps Anda dan akan mulai mengirimkan data Google Workspace Anda.
Klik Buka Google SecOps untuk membuka instance Google SecOps Anda
dan mulai memantau data Google Workspace Anda dari Google SecOps. Untuk mengetahui informasi selengkapnya, lihat dasbor Penyerapan Data dan Kesehatan.
Memutuskan hubungan Google Workspace dari Google SecOps
Untuk membatalkan hubungan akun Google Workspace Anda dari instance Google SecOps, selesaikan langkah-langkah berikut:
Buka konsol Admin Google Workspace.
Klik Integrasi Data.
Di panel Ekspor Google SecOps, klik Putuskan hubungan dari Google SecOps.
Ekspor data audit ke Google SecOps kini akan menampilkan Nonaktif.
Langkah berikutnya
Langkah berikutnya adalah mengaktifkan set aturan kategori Ancaman Cloud yang dirancang untuk membantu mengidentifikasi ancaman menggunakan data Google Workspace.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[],[],null,["Send Google Workspace data to Google SecOps \nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n\nYou can use Google Security Operations to detect insider\nrisks in your Google Workspace by configuring your Google Workspace account\nto forward data to your Google SecOps instance.\n\nThis document describes how to use *direct ingestion* to ingest Google Workspace Activity\nlogs (`WORKSPACE_ACTIVITY`) into your Google SecOps instance\nfrom the following supported Google application types:\n\n- Access Transparency\n- Accounts\n- Google Admin console\n- Google Calendar\n- Google Chat\n- Google Chrome\n- Classroom\n- Google Cloud\n- Access Context Manager\n- Looker Studio\n- Device\n- Google Drive\n- Gmail\n- Google Groups\n- Jamboard management\n- LDAP\n- Login\n- Google Meet\n- OAuth\n- Password Vault\n- Firewall Rules Logging\n- SAML\n- User accounts\n- Voice\n\n| **Note:** *Direct ingestion* collects a wider range of workspace data compared to [*other feed methods*](/chronicle/docs/administration/feed-management). For example, other feed methods cannot ingest `gmail` application logs. \n| However, you can still use these *other feed methods* to ingest subsets of Google Workspace data, for example, to ingest `WORKSPACE_USERS` and `WORKSPACE_GROUPS` into your Google SecOps instance. For more information, see [Configure a feed in Google SecOps to ingest\n| Google Workspace logs](/chronicle/docs/ingestion/default-parsers/collect-workspace-logs#configure_a_feed_in_to_ingest_logs).\n\nBefore you begin\n\nComplete the following steps before you begin:\n\n1. If you don't have a Google SecOps instance, create a new one. For more\n information, see [Onboarding and migrating a Google SecOps\n instance](/chronicle/docs/onboard).\n\n2. Copy your Google Workspace Customer ID from the Google Workspace Admin\n console.\n\nObtain your Google SecOps instance ID and token\n\nTo obtain your Google SecOps instance ID and token, complete the following\nsteps from your Google SecOps account:\n\n1. Open your Google SecOps instance.\n2. From the navigation bar, select **Settings**.\n3. Click **Google Workspace**.\n4. Enter your Google Workspace Customer ID.\n5. Click **Generate Token**.\n6. Copy the token and your Google SecOps instance ID (located on the same page).\n\nLink Google Workspace to your Google SecOps instance\n\nTo send your Google Workspace data to your Google SecOps instance,\ncomplete the following steps from the Google Workspace Admin console:\n\n1. Open the Google Workspace Admin console.\n2. Click **Reporting**.\n3. Click **Data Integrations**.\n4. Select **Google SecOps export** , and then click **Connect to\n Google SecOps** . This opens the **Connect to Google SecOps** page.\n5. Paste the token copied from your Google SecOps account into the indicated field. Click **Connect** . Export audit data to Google SecOps should now display *On*. Your Google Workspace account is now linked to your Google SecOps instance and will begin sending your Google Workspace data.\n6. Click **Go to Google SecOps** to open your Google SecOps instance and begin to monitor your Google Workspace data from Google SecOps. For more information, see the [Data Ingestion and Health dashboard](/chronicle/docs/investigation/dashboards-user-guide#data_ingestion_and_health).\n\nDisconnect Google Workspace from Google SecOps\n\nTo disconnect your Google Workspace account from your Google SecOps\ninstance, complete the following steps:\n\n1. Open the Google Workspace Admin console.\n2. Click **Data Integrations**.\n3. In the **Google SecOps export** panel, click **Disconnect from Google SecOps** . **Export audit data to Google SecOps** should now display *Off*.\n\nWhat's next\n\nThe next step is to enable the [Cloud Threats category rules\nsets](/chronicle/docs/detection/cloud-threats-category)\ndesigned to help identify threats using Google Workspace data.\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
