Skip to main content

Google Workspace

Overview​

This documentation outlines the configuration process for transferring Google Workspace audit logs to AlphaSOC for analysis. Through this integration, the Admin Activity and Data Access logs can be used for security monitoring and threat detection.

To enable log data transfers:

  1. Enable Google Workspace logging in your GCP environment.
  2. Export logs to Google Cloud Storage (GCS).
  3. Transfer data from GCS to AlphaSOC. For details, refer to Configuring GCS for submitting data.

Prerequisites​

  • Super administrator account in Google Cloud Platform (GCP).
  • Google Cloud Storage (GCS) bucket.

Enable Google Workspace Logging​

note

AlphaSOC collects Admin Activity and Data Access logs from Google Workspace.

  1. Sign in to Google Admin console.
  2. Navigate to Account > Account settings > Legal and compliance.
  3. Click Sharing options and select Enabled.
  4. Save your changes.

Exporting Logs to GCS via Sink​

note

This part requires an existing GCS bucket. Please ensure you have created a storage bucket in GCS before proceeding with the sink configuration.

  1. In the GCP Console, navigate to the Logging > Logs Router.
  2. Click Create Sink.
  3. Enter a sink name.
  4. Select Cloud Storage bucket as the sink service and your GCS bucket as the sink destination.
  5. Under Choose logs to include in sink, select Include logs ingested by this organization and all child resources and add the following inclusion filters to capture Google Workspace logs:
LOG_ID("cloudaudit.googleapis.com/activity") OR LOG_ID("cloudaudit.googleapis.com/data_access")
  1. Click Create Sink to finalize.

Configure Data Transport​

Configure AlphaSOC to ingest data from your Google Cloud Storage bucket. See Configuring GCS for submitting data.

Already collecting Google Workspace logs in a different storage solution? See Collecting Data for alternative transport methods, or contact AlphaSOC support.

Further Reading​