--- title: "Google Workspace (G Suite)" slug: "google-workspace" updated: 2026-03-13T21:31:59Z published: 2026-03-13T22:00:02Z canonical: "docs.hunters.ai/google-workspace" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt > Use this file to discover all available pages before exploring further. # Google Workspace (G Suite) Self Service Ingestion Connect this data source on your own, using the Hunters platform. ****TL;DR**** | Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method | | --- | --- | --- | --- | --- | --- | --- | --- | | G Suite Activities | | ✅ | ✅ | ✅ | gsuite_activity | NDJSON | API | | G Suite Alerts | ✅ | | ✅ | | gsuite_alert | NDJSON | API | | G Suite Directory Users | | | | ✅ | gsuite_directory_users | NDJSON | API | --- ## Overview ![](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/83e0f0d-gsuite(1).png)Google Workspace, formerly known as G Suite, is a collection of cloud-based productivity and collaboration tools designed to help teams work efficiently from anywhere. It includes popular applications like Gmail, Google Drive, Docs, Sheets, Slides, Meet, and Calendar, all seamlessly integrated to streamline workflows. With advanced security features, intelligent collaboration tools, and flexible storage options, Google Workspace caters to businesses of all sizes, schools, and non-profits. Its user-friendly interface and real-time collaboration capabilities make it a powerful solution for boosting productivity, fostering teamwork, and enabling remote work effectively. ## Supported data types ****G Suite Activities**** **Table name:** `gsuite_activity` G Suite (now Google Workspace) Activity Logs track user and admin actions, such as file sharing, email access, and account sign-ins. These logs help monitor behavior, ensure compliance, and investigate security incidents. Accessible via the Admin Console and BigQuery, they provide insights for auditing, reporting, and maintaining a secure environment. ****G Suite Alerts**** **Table name:** `gsuite_alert` Google Workspace (formerly G Suite) Alert Logs record security-related events and alerts within your organization, such as suspicious login attempts, data sharing violations, and policy breaches. These logs help admins detect potential threats, track abnormal activities, and respond to security incidents. They can be accessed through the Admin Console, providing valuable insights for proactive security monitoring and incident response. ****G Suite Directory Users**** **Table name:** `gsuite_directory_users` Google Workspace (formerly G Suite) Directory Users logs capture activities related to user account management, such as user creation, deletion, suspension, and changes to user profiles or group memberships. These logs help administrators track and audit actions taken on user accounts, ensuring compliance and facilitating the detection of unauthorized changes or potential security issues. Accessible through the Admin Console, they support efficient management and monitoring of user activities within the organization. ## Send data to Hunters To enable Hunters' collection and ingestion of Google Workspace logs, you'll need to create a project and service account in Google Cloud Platform (GCP) for Hunters, and connect that to your Google Workspace account. ****0. Licenses needed**** 1. In order to retrieve logs of: 1. G Suite Activity 2. G Suite Alert 3. G Suite Directory Users please purchase the relevant license from Google, in order to grant Hunters access to your workspace. The main supported licenses in order to grant Hunters access to your logs are: - **Enterprise Plus** - **Enterprise Standard** - **Education Plus** - **Education Standard** ****1. Create a GCP Project**** 1. In your organization's [Google Cloud Platform console](https://console.cloud.google.com), open the menu and navigate to **Cloud Overview > Dashboard**. ![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/GW1.png) 2. Click **Create Project** to start a new project and give it the ID `yourorganization-hunters` or something similar. Make sure to select your organization as the parent organization. ![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/gw2.png) 3. Navigate to **APIs & Services > Enabled APIs & Services**. ![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/gw3.png) 4. Locate and enable the following APIs to allow the Hunters service account to perform requests against them.: - Admin SDK API - Google Workspace Alert Center API ![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/gw4.png) ****2. Configure OAuth**** 1. Within the same project, navigate to **APIs and Services > OAuth consent screen**. 2. Under **User Type**, select **Internal**, since this will be an internal OAuth application, and then click **Create**. ![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/gw5.png) 3. Fill in the following fields: 1. Under **App name**, enter **Hunters**. 2. Under **User support email**, provide your email address. 3. Under **App logo**, upload a logo for the application. ![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/gw6.png) ****3. Create a Service Account**** 1. Within the same project, navigate to **APIs and Services > Credentials**. 2. Click **Create Credentials > Service Account** at the top of the page. ![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/gw7.png) 3. Define the service account with the following details: - **Name**: Service Account for Hunters (or something similar) - **Service Account ID**: service-account-for-hunters - **Description**: Account for sharing data with the Hunters platform. 4. Click **Create and Continue**. 5. This service account does not require a specific role, so click **Done** to skip. ![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/gw9.png) 6. From the **Credentials** page, click the name of the service account that was just created. ![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/gw10.png) 7. Navigate to the **Keys** tab, and then click **Add Key > Create New Key**. ![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/gw11.png) 8. Select **JSON** as the key type, and click **Create**. A JSON key that allows access to that service account will be downloaded. Make note of this for later. ![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/gw12.png) 9. Navigate to the **Details** tab and make note of the **Unique ID** of the service account for the next section. ![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/gw13.png) ****4. Set up Google Workspace Access**** 1. In your organization's Google Workspace Admin, navigate to **Security > API Controls**. 2. Click **Manage Domain Wide Delegation**. ![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/gw14.png) 3. Under **API Clients**, click **Add New**. 4. Copy the **Unique ID** from the previous section into the **Client ID** field. 5. Leave **Overwrite existing client ID** unchecked. ![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/gw16.png) 6. In the **OAuth scopes** section, add the following scopes as a comma-separated list: ****Not comma-separated**** https://www.googleapis.com/auth/apps.alerts https://www.googleapis.com/auth/admin.reports.audit.readonly https://www.googleapis.com/auth/admin.directory.user.readonly https://www.googleapis.com/auth/admin.directory.group.member.readonly https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly https://www.googleapis.com/auth/admin.directory.orgunit.readonly https://www.googleapis.com/auth/admin.directory.domain.readonly https://www.googleapis.com/auth/admin.directory.group.readonly ****Comma-separated**** https://www.googleapis.com/auth/apps.alerts,https://www.googleapis.com/auth/admin.reports.audit.readonly,https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.group.member.readonly,https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly,https://www.googleapis.com/auth/admin.directory.orgunit.readonly,https://www.googleapis.com/auth/admin.directory.domain.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly 7. Click **Authorize** to complete the setup. 8. If you are getting an Authorization Lacking ERROR on the portal, please reach out to your workspace portal and make sure you have granted Hunters account (client) with the right access permissions and role: ![](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/image(299).png) ****5. Configure the Hunters Portal**** Complete the process on the Hunters platform, following [this guide](https://hunters.document360.io/docs/connect-a-data-source). > [!NOTE] > 💡Tip > > Search for the **G Suite** panel. > [!WARNING] > ⚠️ Attention > > 1. For the service account owner, enter the email of the admin account (not the service account's email that was created previously). > 2. In the **Secret** field, enter the contents of the downloaded service account JSON file. #### Reference Documentation - [Getting Started with Google APIs](https://cloud.google.com/apis/docs/getting-started?visit_id=637922167845763190-990970318&rd=1) - [Google Alert Center API](https://developers.google.com/admin-sdk/alertcenter/guides/prerequisites) - [Creating a Service Account in G-Suite](https://support.google.com/a/answer/7378726?product_name=UnuFlow&visit_id=637921279847049492-992191416&rd=1&src=supportwidget0) - [Delegating Domain-Wide Authority to the Service Account](https://developers.google.com/identity/protocols/oauth2/service-account#delegatingauthority) - [Using OAuth 2.0 for Server-to-Server Communications](https://developers.google.com/identity/protocols/oauth2/service-account#delegatingauthority) #### Notes According to [various sources](https://support.google.com/a/answer/7061566), the internal reporting mechanism in several Google Applications has a delay. To cope with this issue, we collect the events using the API with an inherent 1 hour delay. Even so, the ingestion may result in gaps in the ingested data.