Google Workspace

Table name: gsuite_activity

G Suite (now Google Workspace) Activity Logs track user and admin actions, such as file sharing, email access, and account sign-ins. These logs help monitor behavior, ensure compliance, and investigate security incidents. Accessible via the Admin Console and BigQuery, they provide insights for auditing, reporting, and maintaining a secure environment.

Table name: gsuite_alert

Google Workspace (formerly G Suite) Alert Logs record security-related events and alerts within your organization, such as suspicious login attempts, data sharing violations, and policy breaches. These logs help admins detect potential threats, track abnormal activities, and respond to security incidents. They can be accessed through the Admin Console, providing valuable insights for proactive security monitoring and incident response.

Table name: gsuite_directory_users

Google Workspace (formerly G Suite) Directory Users logs capture activities related to user account management, such as user creation, deletion, suspension, and changes to user profiles or group memberships. These logs help administrators track and audit actions taken on user accounts, ensuring compliance and facilitating the detection of unauthorized changes or potential security issues. Accessible through the Admin Console, they support efficient management and monitoring of user activities within the organization.

1. In your organization's Google Cloud Platform console, open the menu and navigate to Cloud Overview > Dashboard.
   

2. Click Create Project to start a new project and give it the ID yourorganization-hunters or something similar. Make sure to select your organization as the parent organization.
   

3. Navigate to APIs & Services > Enabled APIs & Services.
   

4. Locate and enable the following APIs to allow the Hunters service account to perform requests against them.:

   • Admin SDK API

   • Google Workspace Alert Center API
     

1. Within the same project, navigate to APIs and Services > OAuth consent screen.

2. Under User Type, select Internal, since this will be an internal OAuth application, and then click Create.
   

3. Fill in the following fields:

   1. Under App name, enter Hunters.

   2. Under User support email, provide your email address.

   3. Under App logo, upload a logo for the application.
      

1. Within the same project, navigate to APIs and Services > Credentials.

2. Click Create Credentials > Service Account at the top of the page.
   

3. Define the service account with the following details:

   • Name: Service Account for Hunters (or something similar)

   • Service Account ID: service-account-for-hunters

   • Description: Account for sharing data with the Hunters platform.

4. Click Create and Continue.

5. This service account does not require a specific role, so click Done to skip.
   

6. From the Credentials page, click the name of the service account that was just created.
   

7. Navigate to the Keys tab, and then click Add Key > Create New Key.
   

8. Select JSON as the key type, and click Create. A JSON key that allows access to that service account will be downloaded. Make note of this for later.
   

9. Navigate to the Details tab and make note of the Unique ID of the service account for the next section.
   

1. In your organization's Google Workspace Admin, navigate to Security > API Controls.

2. Click Manage Domain Wide Delegation.
   

3. Under API Clients, click Add New.

4. Copy the Unique ID from the previous section into the Client ID field.

5. Leave Overwrite existing client ID unchecked.
   

6. In the OAuth scopes section, add the following scopes as a comma-separated list:

   Not comma-separated

   https://www.googleapis.com/auth/apps.alerts

   https://www.googleapis.com/auth/admin.reports.audit.readonly

   https://www.googleapis.com/auth/admin.directory.user.readonly

   https://www.googleapis.com/auth/admin.directory.group.member.readonly

   https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly

   https://www.googleapis.com/auth/admin.directory.orgunit.readonly

   https://www.googleapis.com/auth/admin.directory.domain.readonly

   https://www.googleapis.com/auth/admin.directory.group.readonly

   Comma-separated

   https://www.googleapis.com/auth/apps.alerts,https://www.googleapis.com/auth/admin.reports.audit.readonly,https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.group.member.readonly,https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly,https://www.googleapis.com/auth/admin.directory.orgunit.readonly,https://www.googleapis.com/auth/admin.directory.domain.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly

7. Click Authorize to complete the setup.

💡Tip

Search for the Gsuite panel.

⚠️ Attention

1. For the service account owner, enter the email of the admin account (not the service account's email that was created previously).

2. In the Secret field, enter the contents of the downloaded service account JSON file.