Google Cloud Workspace

About the Device

Google Workspace is a productivity solution designed to help you safely connect, create and collaborate with tools like Gmail, Docs, Meet and more. You can Connect with teammates wherever they are using Gmail, Voice, Calender, Groups, Chat, Meet etc.

Device Information

Collection Method

Direct Ingestion:

Feed Ingestion:

Device Configuration

Google Provides two types of Log Ingestion Methods to integrate Google Workspace to Google Security Operations.

Method 1: Direct Ingestion

To send google workspace data to Google Security Operations

Follow below steps to use direct ingestion to ingest Google Workspace Activity logs (WORKSPACE_ACTIVITIES) into your Google Security Operations instance for the supported Google application types.

Prerequisites:

• You must have Google Workspace Enterprise Standard or Enterprise Plus edition to access this integration. If you don't, you can refer to Feed Ingestion Method (Method 2) to ingest Google Workspace Activity logs.

• You must have Google Workspace Customer ID. It should be procured from the Google Workspace Admin console (Account > Account Settings > Profile).

Step1: Obtain your Google Security Operations instance ID and token

• share the Google Workspace Customer ID with the Adaptive MxDR Onboarding Team.

Step 2: Link Google Workspace to your Google Security Operations instance

• Login to the Google Workspace Admin console.

• Click Reporting > Data Integrations.

• Select Google Security Operations export, and then click Connect to Google Security Operations. This opens the Connect to Google Security Operations page.

• Paste the token copied from your Google Security Operations account into the indicated field. Click Connect.

• Export audit data to Google Security Operations should now display On. Your Google Workspace account is now linked to your Google Security Operations instance and will begin sending your Google Workspace data.

• Click Go to Google Security Operations to open your Google Security Operations instance and begin to monitor your Google Workspace data from Google Security Operations.

Method 2: Feed Ingestion via Third Party API

Follow below steps to collect Google Workspace logs by setting up a Google Security Operations feed using Third Party API.

Prerequisites:

• You must use Google Workspace Business Standard or Business Plus edition as these editions are supported via Google Parsers.

• Ensure that you have a Google Workspace Administrator account.

• Ensure that you have a Super Admin role for GCP account.

• You must have Customer ID. It should be procured from the Google Admin console (Account > Account Settings > Profile).

Step 1: Enable Admin SDK API and Google Workspace Alert center API

• Login to your Google Cloud Platform Console

• Navigate to APIs and services and select a project.

• Click Library

• Search for Admin SDK API and then click ENABLE

• Repeat for Google Workspace Alert Center API

Step 2: Create a service account which is used to authenticate with Workspace APIs.

• Required roles: To create service accounts, you should have the Create Service Accounts (roles/iam.serviceAccountCreator) IAM role on the project.

• In your GCP Console navigate to IAM & Admin > Service Accounts

• Click Create Service Account

• Provide the service account a name and click DONE

• The service account's name appears in the email address that is provisioned during creation, in the format SERVICE_ACCOUNT_NAME@PROJECT_ID.iam.gserviceaccount.com.

• Click the newly created service account

• Copy and save the Unique ID displayed on the screen.

• Select KEYS

• Click ADD Key > Create new key

• Select JSON and click Create

• Save this JSON key

Step 3: Create a Domain-wide delegation API control for the service account and grant the required scopes to access the data.

• Login to the Google Admin console (admin.google.com)

• Select Security > Access and Data Controls > API Controls > Domain-wide delegation and then click Manage Domain-Wide Delegation

• Click ADD NEW

• Enter the Client ID (unique ID obtained in Step 2)

• For OAuth scopes, enter the list of scopes mentioned below:

• https://www.googleapis.com/auth/apps.alerts, https://www.googleapis.com/auth/admin.directory.user.readonly, https://www.googleapis.com/auth/admin.directory.group.readonly, https://www.googleapis.com/auth/admin.reports.audit.readonly, https://www.googleapis.com/auth/admin.directory.device.mobile.readonly, https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly, https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly

• Click Authorize

Step 4: Create a user who is used for impersonation and grant the user the required privileges.

• Login to Google Admin console.

• Select Directory > Users and then click Add new user.

• Enter the user details.

• Name the user and create a primary email address. Click Create > Done

• Click on the newly created user

• Click Admin roles and privileges > Create Custom Role > Create new role and give this role a name

• Grant the following privileges to the role:

• Click Continue and then Create role.

• Click Assign users, select the user to assign the role.

• Click Assign role.

• Ensure that the created user has the Super Admin role

Step 5: Share the following items with Adaptive MxDR Onboarding team to proceed with configuration of the Google Workspace integration:

• JSON token (Step 2)

• User email (Step 4)

• Customer ID (prerequisites)

Integration Parameters

Integration Parameters required for Direct Ingestion Method

Integration Parameters required for Feed Configuration