G workspace reports connector (#1320)
* GWorkspace: add table schemas * GWorkspace: add parser * GWorkspace: add deploy template * GWorkspace: add pickle_string script * GWorkspace: add connector template * GWorkspace: add connector archive * GWorkspace: add connector files * GWorkspace: fixes in script. * GWorkspace: update archive. * Gworkspace: fixing json file * GWorkspace: add logo * GWorkspace: Connector template fixes * GWorkspace: added data samples * GWorkspace: added new logo * GWorkspace: Add sampleQueries * GWorkspace: Script and Archive updated Co-authored-by: Alex Verbniak <ov@socprime.com>
This commit is contained in:
SOC Prime
GitHub
Родитель
bec77bef2b
Коммит
88c3fc89b6
|
|
@ -0,0 +1,105 @@
|
|||
{
|
||||
"Name":"GSuite_ReportsAPI_admin_CL",
|
||||
"Properties":[
|
||||
{
|
||||
"Name":"EventVendor",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"EventProduct",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"APPLICATION_NAME_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"ORG_UNIT_NAME_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"SETTING_NAME_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"APPLICATION_EDITION_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"ROLE_NAME_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"OLD_VALUE_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"kind_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"id_time_t",
|
||||
"Type":"DateTime"
|
||||
},
|
||||
{
|
||||
"Name":"id_uniqueQualifier_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"id_applicationName_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"id_customerId_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"etag_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"actor_callerType_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"actor_key_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"events_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"event_name_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"event_type_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"USER_EMAIL_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"PRODUCT_NAME_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"NEW_VALUE_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"actor_email_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"actor_profileId_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"IPAddress",
|
||||
"Type":"String"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,133 @@
|
|||
{
|
||||
"Name":"GSuite_ReportsAPI_calendar_CL ",
|
||||
"Properties":[
|
||||
{
|
||||
"Name":"EventVendor",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"EventProduct",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"old_event_title_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"start_time_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"end_time_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"event_name_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"notification_type_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"notification_method_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"recipient_email_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"calendar_id_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"target_calendar_id_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"notification_message_id_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"event_id_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"user_agent_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"organizer_calendar_id_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"event_title_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"event_guest_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"event_response_status_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"api_kind_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"kind_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"id_time_t",
|
||||
"Type":"DateTime"
|
||||
},
|
||||
{
|
||||
"Name":"id_uniqueQualifier_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"id_applicationName_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"id_customerId_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"etag_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"actor_email_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"actor_profileId_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"ownerDomain_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"events_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"event_type_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"IPAddress",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"actor_callerType_s",
|
||||
"Type":"String"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,133 @@
|
|||
{
|
||||
"Name":"GSuite_ReportsAPI_drive_CL ",
|
||||
"Properties":[
|
||||
{
|
||||
"Name":"EventVendor",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"EventProduct",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"ishared_drive_id_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"team_drive_id_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"old_value_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"new_value_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"destination_folder_title_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"destination_folder_id_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"source_folder_title_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"source_folder_id_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"event_name_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"doc_id_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"doc_type_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"doc_title_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"visibility_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"originating_app_id_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"owner_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"visibility_change_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"target_user_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"old_visibility_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"target_domain_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"kind_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"id_time_t",
|
||||
"Type":"DateTime"
|
||||
},
|
||||
{
|
||||
"Name":"id_uniqueQualifier_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"id_applicationName_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"id_customerId_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"etag_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"actor_email_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"actor_profileId_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"IPAddress",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"events_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"event_type_s",
|
||||
"Type":"String"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,73 @@
|
|||
{
|
||||
"Name":"GSuite_ReportsAPI_login_CL ",
|
||||
"Properties":[
|
||||
{
|
||||
"Name":"EventVendor",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"EventProduct",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"login_challenge_method_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"event_name_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"login_type_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"login_challenge_status_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"kind_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"id_time_t",
|
||||
"Type":"DateTime"
|
||||
},
|
||||
{
|
||||
"Name":"id_uniqueQualifier_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"id_applicationName_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"id_customerId_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"etag_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"actor_email_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"actor_profileId_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"IPAddress",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"events_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"event_type_s",
|
||||
"Type":"String"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,125 @@
|
|||
{
|
||||
"Name":"GSuite_ReportsAPI_mobile_CL ",
|
||||
"Properties":[
|
||||
{
|
||||
"Name":"EventVendor",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"EventProduct",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"DEVICE_ID_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"OLD_VALUE_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"NEW_VALUE_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"OS_PROPERTY_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"LAST_SYNC_AUDIT_DATE_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"ACCOUNT_STATE_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"REGISTER_PRIVILEGE_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"event_name_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"USER_EMAIL_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"DEVICE_ID_g",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"SERIAL_NUMBER_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"DEVICE_TYPE_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"DEVICE_MODEL_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"RESOURCE_ID_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"IOS_VENDOR_ID_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"OS_VERSION_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"IOS_VENDOR_ID_g",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"kind_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"id_time_t",
|
||||
"Type":"DateTime"
|
||||
},
|
||||
{
|
||||
"Name":"id_uniqueQualifier_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"id_applicationName_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"id_customerId_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"etag_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"actor_callerType_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"actor_email_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"actor_profileId_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"events_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"event_type_s",
|
||||
"Type":"String"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,81 @@
|
|||
{
|
||||
"Name":"GSuite_ReportsAPI_token_CL ",
|
||||
"Properties":[
|
||||
{
|
||||
"Name":"EventVendor",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"EventProduct",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"scope_data_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"scope_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"event_name_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"client_id_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"app_name_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"client_type_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"kind_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"id_time_t",
|
||||
"Type":"DateTime"
|
||||
},
|
||||
{
|
||||
"Name":"id_uniqueQualifier_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"id_applicationName_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"id_customerId_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"etag_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"actor_email_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"actor_profileId_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"IPAddress",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"events_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"event_type_s",
|
||||
"Type":"String"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,65 @@
|
|||
{
|
||||
"Name":"GSuite_ReportsAPI_user_accounts_CL ",
|
||||
"Properties":[
|
||||
{
|
||||
"Name":"EventVendor",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"EventProduct",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"kind_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"id_time_t",
|
||||
"Type":"DateTime"
|
||||
},
|
||||
{
|
||||
"Name":"id_uniqueQualifier_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"id_applicationName_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"id_customerId_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"etag_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"actor_callerType_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"actor_email_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"actor_profileId_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"IPAddress",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"events_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"event_name_s",
|
||||
"Type":"String"
|
||||
},
|
||||
{
|
||||
"Name":"event_type_s",
|
||||
"Type":"String"
|
||||
}
|
||||
]
|
||||
}
|
||||
Двоичные данные
DataConnectors/GoogleWorkspaceReports/GWorkspaceReportsAPISentinelConn.zip
Normal file
Двоичные данные
DataConnectors/GoogleWorkspaceReports/GWorkspaceReportsAPISentinelConn.zip
Normal file
Двоичный файл не отображается.
|
|
@ -0,0 +1,133 @@
|
|||
from __future__ import print_function
|
||||
import pickle
|
||||
from googleapiclient.discovery import build
|
||||
import datetime
|
||||
import json
|
||||
import base64
|
||||
import hashlib
|
||||
import hmac
|
||||
import requests
|
||||
from google_auth_oauthlib.flow import InstalledAppFlow
|
||||
from google.auth.transport.requests import Request
|
||||
import azure.functions as func
|
||||
import logging
|
||||
import os
|
||||
import time
|
||||
|
||||
customer_id = os.environ['WorkspaceID']
|
||||
shared_key = os.environ['WorkspaceKey']
|
||||
pickle_str = os.environ['GooglePickleString']
|
||||
pickle_string = base64.b64decode(pickle_str)
|
||||
SCOPES = ['https://www.googleapis.com/auth/admin.reports.audit.readonly']
|
||||
activities = ["login", "calendar", "drive", "admin", "mobile", "token", "user_accounts"]
|
||||
|
||||
def get_credentials():
|
||||
creds = None
|
||||
if pickle_string:
|
||||
try:
|
||||
creds = pickle.loads(pickle_string)
|
||||
except Exception as pickle_read_exception:
|
||||
logging.error('Error while loading pickle string: {}'.format(pickle_read_exception))
|
||||
else:
|
||||
logging.error('Error - pickle_string is empty. Exit')
|
||||
exit(1)
|
||||
return creds
|
||||
|
||||
def generate_date():
|
||||
current_time = datetime.datetime.utcnow().replace(second=0, microsecond=0) - datetime.timedelta(minutes=10)
|
||||
past_time = current_time - datetime.timedelta(minutes=10)
|
||||
return (past_time.strftime("%Y-%m-%dT%H:%M:%SZ"), current_time.strftime("%Y-%m-%dT%H:%M:%SZ"))
|
||||
|
||||
def get_result(activity,start_time, end_time):
|
||||
result_activities = []
|
||||
service = build('admin', 'reports_v1', credentials=creds, cache_discovery=False)
|
||||
results = service.activities().list(userKey='all', applicationName=activity,
|
||||
maxResults=1000, startTime=start_time, endTime=end_time).execute()
|
||||
next_page_token = results.get('nextPageToken', None)
|
||||
result = results.get('items', [])
|
||||
result_activities.extend(result)
|
||||
while next_page_token is not None:
|
||||
results = service.activities().list(userKey='all', applicationName=activity,
|
||||
maxResults=1000, startTime=start_time, endTime=end_time, pageToken=next_page_token).execute()
|
||||
next_page_token = results.get('nextPageToken', None)
|
||||
result = results.get('items', [])
|
||||
result_activities.extend(result)
|
||||
if result_activities == None or len(result_activities) == 0:
|
||||
logging.info("Logs not founded for {} activity".format(activity))
|
||||
logging.info("Activity - {}, processing {} events)".format(activity, len(result_activities)))
|
||||
else:
|
||||
logging.info("Activity - {}, processing {} events)".format(activity, len(result_activities)))
|
||||
return result_activities
|
||||
|
||||
def build_signature(customer_id, shared_key, date, content_length, method, content_type, resource):
|
||||
x_headers = 'x-ms-date:' + date
|
||||
string_to_hash = method + "\n" + str(content_length) + "\n" + content_type + "\n" + x_headers + "\n" + resource
|
||||
bytes_to_hash = bytes(string_to_hash, encoding="utf-8")
|
||||
decoded_key = base64.b64decode(shared_key)
|
||||
encoded_hash = base64.b64encode(hmac.new(decoded_key, bytes_to_hash, digestmod=hashlib.sha256).digest()).decode()
|
||||
authorization = "SharedKey {}:{}".format(customer_id,encoded_hash)
|
||||
return authorization
|
||||
|
||||
def post_data(customer_id, shared_key, body, log_type):
|
||||
method = 'POST'
|
||||
content_type = 'application/json'
|
||||
resource = '/api/logs'
|
||||
rfc1123date = datetime.datetime.utcnow().strftime('%a, %d %b %Y %H:%M:%S GMT')
|
||||
content_length = len(body)
|
||||
signature = build_signature(customer_id, shared_key, rfc1123date, content_length, method, content_type, resource)
|
||||
uri = 'https://' + customer_id + '.ods.opinsights.azure.com' + resource + '?api-version=2016-04-01'
|
||||
|
||||
headers = {
|
||||
'content-type': content_type,
|
||||
'Authorization': signature,
|
||||
'Log-Type': log_type,
|
||||
'x-ms-date': rfc1123date
|
||||
}
|
||||
response = requests.post(uri,data=body, headers=headers)
|
||||
if (response.status_code >= 200 and response.status_code <= 299):
|
||||
logging.info("Logs with {} activity was processed into Azure".format(log_type))
|
||||
else:
|
||||
logging.warn("Response code: {}".format(response.status_code))
|
||||
|
||||
def expand_data(obj):
|
||||
for event in obj:
|
||||
for nested in event["events"]:
|
||||
if 'name' in nested:
|
||||
event.update({'event_name': nested["name"]})
|
||||
if 'type' in nested:
|
||||
event.update({'event_type': nested["type"]})
|
||||
if 'parameters' in nested:
|
||||
for parameter in nested["parameters"]:
|
||||
if 'name' in parameter:
|
||||
for param_name in ["value", "boolValue", "multiValue", "multiMessageValue", "multiIntValue", "messageValue", "intValue"]:
|
||||
if param_name in parameter:
|
||||
event.update({parameter["name"]: parameter[param_name]})
|
||||
return obj
|
||||
|
||||
def gen_chunks_to_object(data,chunksize=100):
|
||||
chunk = []
|
||||
for index, line in enumerate(data):
|
||||
if (index % chunksize == 0 and index > 0):
|
||||
yield chunk
|
||||
del chunk[:]
|
||||
chunk.append(line)
|
||||
yield chunk
|
||||
|
||||
def gen_chunks(data,log_type):
|
||||
for chunk in gen_chunks_to_object(data, chunksize=2000):
|
||||
body = json.dumps(chunk)
|
||||
post_data(customer_id, shared_key,body,log_type)
|
||||
|
||||
def main(mytimer: func.TimerRequest) -> None:
|
||||
if mytimer.past_due:
|
||||
logging.info('The timer is past due!')
|
||||
logging.info('Starting program')
|
||||
global creds
|
||||
creds = get_credentials()
|
||||
start_time, end_time = generate_date()
|
||||
logging.info('Data processing. Period(UTC): {} - {}'.format(start_time,end_time))
|
||||
for line in activities:
|
||||
result_obj = get_result(line,start_time,end_time)
|
||||
if result_obj is not None:
|
||||
result_obj = expand_data(result_obj)
|
||||
gen_chunks(result_obj, "GWorkspace_ReportsAPI_"+line)
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
{
|
||||
"scriptFile": "__init__.py",
|
||||
"bindings": [
|
||||
{
|
||||
"name": "mytimer",
|
||||
"type": "timerTrigger",
|
||||
"direction": "in",
|
||||
"schedule": "0 */10 * * * *"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,213 @@
|
|||
{
|
||||
"id": "GoogleWorkspaceReportsAPI",
|
||||
"title": "Google Workspace (G Suite)",
|
||||
"publisher": "Google",
|
||||
"descriptionMarkdown": "The [Google Workspace](https://workspace.google.com/) data connector provides the capability to ingest Google Workspace Activity events into Azure Sentinel through the REST API. The connector provides ability to get [events](https://developers.google.com/admin-sdk/reports/v1/reference/activities) which helps to examine potential security risks, analyze your team's use of collaboration, diagnose configuration problems, track who signs in and when, analyze administrator activity, understand how users create and share content, and more review events in your org.",
|
||||
"additionalRequirementBanner": "These queries and workbooks are dependent on a parser based on Kusto to work as expected. Follow the steps to use this Kusto functions alias **GWorkspaceActivityReports** in queries and workbooks [Follow steps to get this Kusto functions>](https://aka.ms/)",
|
||||
"graphQueries": [{
|
||||
"metricName": "Total data received",
|
||||
"legend": "GWorkspace_ReportsAPI_admin_CL",
|
||||
"baseQuery": "GWorkspace_ReportsAPI_admin_CL"
|
||||
},
|
||||
{
|
||||
"metricName": "Total data received",
|
||||
"legend": "GWorkspace_ReportsAPI_calendar_CL",
|
||||
"baseQuery": "GWorkspace_ReportsAPI_calendar_CL"
|
||||
},
|
||||
{
|
||||
"metricName": "Total data received",
|
||||
"legend": "GWorkspace_ReportsAPI_drive_CL",
|
||||
"baseQuery": "GWorkspace_ReportsAPI_drive_CL"
|
||||
},
|
||||
{
|
||||
"metricName": "Total data received",
|
||||
"legend": "GWorkspace_ReportsAPI_login_CL",
|
||||
"baseQuery": "GWorkspace_ReportsAPI_login_CL"
|
||||
},
|
||||
{
|
||||
"metricName": "Total data received",
|
||||
"legend": "GWorkspace_ReportsAPI_mobile_CL",
|
||||
"baseQuery": "GWorkspace_ReportsAPI_mobile_CL"
|
||||
},
|
||||
{
|
||||
"metricName": "Total data received",
|
||||
"legend": "GWorkspace_ReportsAPI_token_CL",
|
||||
"baseQuery": "GWorkspace_ReportsAPI_token_CL"
|
||||
},
|
||||
{
|
||||
"metricName": "Total data received",
|
||||
"legend": "GWorkspace_ReportsAPI_user_accounts_CL",
|
||||
"baseQuery": "GWorkspace_ReportsAPI_user_accounts_CL"
|
||||
}
|
||||
],
|
||||
"sampleQueries": [{
|
||||
"description": "Google Workspace Events - All Activities",
|
||||
"query": "GWorkspaceActivityReports\n | sort by TimeGenerated desc"
|
||||
},
|
||||
{
|
||||
"description": "Google Workspace Events - Admin Activity",
|
||||
"query": "GWorkspace_ReportsAPI_admin_CL\n | sort by TimeGenerated desc"
|
||||
},
|
||||
{
|
||||
"description": "Google Workspace Events - Calendar Activity",
|
||||
"query": "GWorkspace_ReportsAPI_calendar_CL\n | sort by TimeGenerated desc"
|
||||
},
|
||||
{
|
||||
"description": "Google Workspace Events - Drive Activity",
|
||||
"query": "GWorkspace_ReportsAPI_drive_CL\n | sort by TimeGenerated desc"
|
||||
},
|
||||
{
|
||||
"description": "Google Workspace Events - Login Activity",
|
||||
"query": "GWorkspace_ReportsAPI_login_CL\n | sort by TimeGenerated desc"
|
||||
},
|
||||
{
|
||||
"description": "Google Workspace Events - Mobile Activity",
|
||||
"query": "GWorkspace_ReportsAPI_mobile_CL\n | sort by TimeGenerated desc"
|
||||
},
|
||||
{
|
||||
"description": "Google Workspace Events - Token Activity",
|
||||
"query": "GWorkspace_ReportsAPI_token_CL\n | sort by TimeGenerated desc"
|
||||
},
|
||||
{
|
||||
"description": "Google Workspace Events - User Accounts Activity",
|
||||
"query": "GWorkspace_ReportsAPI_user_accounts_CL\n | sort by TimeGenerated desc"
|
||||
}
|
||||
|
||||
],
|
||||
"dataTypes": [{
|
||||
"name": "GWorkspace_ReportsAPI_admin_CL",
|
||||
"lastDataReceivedQuery": "GWorkspace_ReportsAPI_admin_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
|
||||
},
|
||||
{
|
||||
"name": "GWorkspace_ReportsAPI_calendar_CL",
|
||||
"lastDataReceivedQuery": "GWorkspace_ReportsAPI_calendar_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
|
||||
},
|
||||
{
|
||||
"name": "GWorkspace_ReportsAPI_drive_CL",
|
||||
"lastDataReceivedQuery": "GWorkspace_ReportsAPI_drive_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
|
||||
},
|
||||
{
|
||||
"name": "GWorkspace_ReportsAPI_login_CL",
|
||||
"lastDataReceivedQuery": "GWorkspace_ReportsAPI_login_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
|
||||
},
|
||||
{
|
||||
"name": "GWorkspace_ReportsAPI_mobile_CL",
|
||||
"lastDataReceivedQuery": "GWorkspace_ReportsAPI_mobile_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
|
||||
},
|
||||
{
|
||||
"name": "GWorkspace_ReportsAPI_token_CL",
|
||||
"lastDataReceivedQuery": "GWorkspace_ReportsAPI_token_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
|
||||
},
|
||||
{
|
||||
"name": "GWorkspace_ReportsAPI_user_accounts_CL",
|
||||
"lastDataReceivedQuery": "GWorkspace_ReportsAPI_user_accounts_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
|
||||
}
|
||||
],
|
||||
"connectivityCriterias": [{
|
||||
"type": "IsConnectedQuery",
|
||||
"value": [
|
||||
"GWorkspace_ReportsAPI_admin_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)",
|
||||
"GWorkspace_ReportsAPI_calendar_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)",
|
||||
"GWorkspace_ReportsAPI_drive_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)",
|
||||
"GWorkspace_ReportsAPI_login_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)",
|
||||
"GWorkspace_ReportsAPI_mobile_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)",
|
||||
"GWorkspace_ReportsAPI_token_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)",
|
||||
"GWorkspace_ReportsAPI_user_accounts_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)"
|
||||
|
||||
|
||||
]
|
||||
}
|
||||
],
|
||||
"availability": {
|
||||
"status": 1,
|
||||
"isPreview": true
|
||||
},
|
||||
"permissions": {
|
||||
"resourceProvider": [{
|
||||
"provider": "Microsoft.OperationalInsights/workspaces",
|
||||
"permissionsDisplayText": "read and write permissions are required.",
|
||||
"providerDisplayName": "Workspace",
|
||||
"scope": "Workspace",
|
||||
"requiredPermissions": {
|
||||
"write": true,
|
||||
"read": true,
|
||||
"delete": true
|
||||
}
|
||||
},
|
||||
{
|
||||
"provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
|
||||
"permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key)",
|
||||
"providerDisplayName": "Keys",
|
||||
"scope": "Workspace",
|
||||
"requiredPermissions": {
|
||||
"action": true
|
||||
}
|
||||
}
|
||||
],
|
||||
"customs": [{
|
||||
"name": "Microsoft.Web/sites permissions",
|
||||
"description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)."
|
||||
},
|
||||
{
|
||||
"name": "REST API Credentials/permissions",
|
||||
"description": "**GooglePickleString** is required for REST API. [See the documentation to learn more about API](https://developers.google.com/admin-sdk/reports/v1/reference/activities). Check all [requirements and follow the instructions](https://developers.google.com/admin-sdk/reports/v1/quickstart/python) for obtaining credentials."
|
||||
}
|
||||
]
|
||||
},
|
||||
"instructionSteps": [{
|
||||
"title": "",
|
||||
"description": ">**NOTE:** This connector uses Azure Functions to connect to the Google Reports API to pull its logs into Azure Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details."
|
||||
},
|
||||
{
|
||||
"title": "",
|
||||
"description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App."
|
||||
},
|
||||
{
|
||||
"description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected. [Follow these steps](https://aka.ms/) to create the Kusto functions alias, **GWorkspaceActivityReports**"
|
||||
},
|
||||
{
|
||||
"title": "",
|
||||
"description": "**STEP 1 - Configuration steps for the Google Reports API**\n\n1. [Follow the instructions](https://developers.google.com/admin-sdk/reports/v1/quickstart/python) to obtain the credentials. \n2. For converting token.pickle file to pickle string use [python script](https://github.com/Azure/Azure-Sentinel/blob/GworkspaceReportsConnector/DataConnectors/GoogleWorkspaceReports/get_pickle_string.py). Copy this script to folder with token.pickle and run. As a result copy ouptut pickle string and save. It will be needed on Function App deployment step."
|
||||
},
|
||||
{
|
||||
"title": "",
|
||||
"description": "**STEP 2 - Choose ONE from the following two deployment options to deploy the connector and the associated Azure Function**\n\n>**IMPORTANT:** Before deploying the Workspace data connector, have the Workspace ID and Workspace Primary Key (can be copied from the following), as well as the Workspace GooglePickleString readily available.",
|
||||
"instructions": [{
|
||||
"parameters": {
|
||||
"fillWith": [
|
||||
"WorkspaceId"
|
||||
],
|
||||
"label": "Workspace ID"
|
||||
},
|
||||
"type": "CopyableLabel"
|
||||
},
|
||||
{
|
||||
"parameters": {
|
||||
"fillWith": [
|
||||
"PrimaryKey"
|
||||
],
|
||||
"label": "Primary Key"
|
||||
},
|
||||
"type": "CopyableLabel"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Option 1 - Azure Resource Manager (ARM) Template",
|
||||
"description": "Use this method for automated deployment of the Google Workspace data connector using an ARM Tempate.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[](https://aka.ms/sentinelgworkspaceazuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the **Workspace ID**, **Workspace Key**, **GooglePickleString** and deploy. \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy."
|
||||
},
|
||||
{
|
||||
"title": "Option 2 - Manual Deployment of Azure Functions",
|
||||
"description": "Use the following step-by-step instructions to deploy the Google Workspace data connector manually with Azure Functions (Deployment via Visual Studio Code)."
|
||||
},
|
||||
{
|
||||
"title": "",
|
||||
"description": "**1. Deploy a Function App**\n\n> **NOTE:** You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.\n\n1. Download the [Azure Function App](https://github.com/averbn/azure_sentinel_data_connectors/blob/main/gworkspacereportsapi-azure-sentinel-data-connector/GWorkspaceReportsAPISentinelConn.zip?raw=true) file. Extract archive to your local development computer.\n2. Start VS Code. Choose File in the main menu and select Open Folder.\n3. Select the top level folder from extracted files.\n4. Choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose the **Deploy to function app** button.\nIf you aren't already signed in, choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose **Sign in to Azure**\nIf you're already signed in, go to the next step.\n5. Provide the following information at the prompts:\n\n\ta. **Select folder:** Choose a folder from your workspace or browse to one that contains your function app.\n\n\tb. **Select Subscription:** Choose the subscription to use.\n\n\tc. Select **Create new Function App in Azure** (Don't choose the Advanced option)\n\n\td. **Enter a globally unique name for the function app:** Type a name that is valid in a URL path. The name you type is validated to make sure that it's unique in Azure Functions. (e.g. GWorkspaceXXXXX).\n\n\te. **Select a runtime:** Choose Python 3.8.\n\n\tf. Select a location for new resources. For better performance and lower costs choose the same [region](https://azure.microsoft.com/regions/) where Azure Sentinel is located.\n\n6. Deployment will begin. A notification is displayed after your function app is created and the deployment package is applied.\n7. Go to Azure Portal for the Function App configuration."
|
||||
},
|
||||
{
|
||||
"title": "",
|
||||
"description": "**2. Configure the Function App**\n\n1. In the Function App, select the Function App Name and select **Configuration**.\n2. In the **Application settings** tab, select ** New application setting**.\n3. Add each of the following application settings individually, with their respective string values (case-sensitive): \n\t\tGooglePickleString\n\t\tWorkspaceID\n\t\tWorkspaceKey\n3. Once all application settings have been entered, click **Save**."
|
||||
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,199 @@
|
|||
{
|
||||
"$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
|
||||
"contentVersion": "1.0.0.0",
|
||||
"parameters": {
|
||||
"FunctionName": {
|
||||
"defaultValue": "GWorkspace",
|
||||
"type": "string"
|
||||
},
|
||||
"WorkspaceID": {
|
||||
"type": "string",
|
||||
"defaultValue": "<workspaceID>"
|
||||
},
|
||||
"WorkspaceKey": {
|
||||
"type": "securestring",
|
||||
"defaultValue": "<workspaceKey>"
|
||||
},
|
||||
"GooglePickleString": {
|
||||
"type": "securestring",
|
||||
"defaultValue": "<GooglePickleString>"
|
||||
}
|
||||
},
|
||||
"variables": {
|
||||
"FunctionName": "[concat(toLower(parameters('FunctionName')), uniqueString(resourceGroup().id))]"
|
||||
},
|
||||
"resources": [
|
||||
{
|
||||
"type": "Microsoft.Insights/components",
|
||||
"apiVersion": "2015-05-01",
|
||||
"name": "[variables('FunctionName')]",
|
||||
"location": "[resourceGroup().location]",
|
||||
"kind": "web",
|
||||
"properties": {
|
||||
"Application_Type": "web",
|
||||
"ApplicationId": "[variables('FunctionName')]"
|
||||
}
|
||||
},
|
||||
{
|
||||
"type": "Microsoft.Storage/storageAccounts",
|
||||
"apiVersion": "2019-06-01",
|
||||
"name": "[tolower(variables('FunctionName'))]",
|
||||
"location": "[resourceGroup().location]",
|
||||
"sku": {
|
||||
"name": "Standard_LRS",
|
||||
"tier": "Standard"
|
||||
},
|
||||
"kind": "StorageV2",
|
||||
"properties": {
|
||||
"networkAcls": {
|
||||
"bypass": "AzureServices",
|
||||
"virtualNetworkRules": [],
|
||||
"ipRules": [],
|
||||
"defaultAction": "Allow"
|
||||
},
|
||||
"supportsHttpsTrafficOnly": true,
|
||||
"encryption": {
|
||||
"services": {
|
||||
"file": {
|
||||
"keyType": "Account",
|
||||
"enabled": true
|
||||
},
|
||||
"blob": {
|
||||
"keyType": "Account",
|
||||
"enabled": true
|
||||
}
|
||||
},
|
||||
"keySource": "Microsoft.Storage"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"type": "Microsoft.Storage/storageAccounts/blobServices",
|
||||
"apiVersion": "2019-06-01",
|
||||
"name": "[concat(variables('FunctionName'), '/default')]",
|
||||
"dependsOn": [
|
||||
"[resourceId('Microsoft.Storage/storageAccounts', tolower(variables('FunctionName')))]"
|
||||
],
|
||||
"sku": {
|
||||
"name": "Standard_LRS",
|
||||
"tier": "Standard"
|
||||
},
|
||||
"properties": {
|
||||
"cors": {
|
||||
"corsRules": []
|
||||
},
|
||||
"deleteRetentionPolicy": {
|
||||
"enabled": false
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"type": "Microsoft.Storage/storageAccounts/fileServices",
|
||||
"apiVersion": "2019-06-01",
|
||||
"name": "[concat(variables('FunctionName'), '/default')]",
|
||||
"dependsOn": [
|
||||
"[resourceId('Microsoft.Storage/storageAccounts', tolower(variables('FunctionName')))]"
|
||||
],
|
||||
"sku": {
|
||||
"name": "Standard_LRS",
|
||||
"tier": "Standard"
|
||||
},
|
||||
"properties": {
|
||||
"cors": {
|
||||
"corsRules": []
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"type": "Microsoft.Web/sites",
|
||||
"apiVersion": "2018-11-01",
|
||||
"name": "[variables('FunctionName')]",
|
||||
"location": "[resourceGroup().location]",
|
||||
"dependsOn": [
|
||||
"[resourceId('Microsoft.Storage/storageAccounts', tolower(variables('FunctionName')))]",
|
||||
"[resourceId('Microsoft.Insights/components', variables('FunctionName'))]"
|
||||
],
|
||||
"kind": "functionapp,linux",
|
||||
"identity": {
|
||||
"type": "SystemAssigned"
|
||||
},
|
||||
"properties": {
|
||||
"name": "[variables('FunctionName')]",
|
||||
"httpsOnly": true,
|
||||
"clientAffinityEnabled": true,
|
||||
"alwaysOn": true,
|
||||
"reserved": true
|
||||
},
|
||||
"resources": [
|
||||
{
|
||||
"apiVersion": "2018-11-01",
|
||||
"type": "config",
|
||||
"name": "appsettings",
|
||||
"dependsOn": [
|
||||
"[concat('Microsoft.Web/sites/', variables('FunctionName'))]"
|
||||
],
|
||||
"properties": {
|
||||
"FUNCTIONS_EXTENSION_VERSION": "~3",
|
||||
"FUNCTIONS_WORKER_RUNTIME": "python",
|
||||
"APPINSIGHTS_INSTRUMENTATIONKEY": "[reference(resourceId('Microsoft.insights/components', variables('FunctionName')), '2015-05-01').InstrumentationKey]",
|
||||
"APPLICATIONINSIGHTS_CONNECTION_STRING": "[reference(resourceId('microsoft.insights/components', variables('FunctionName')), '2015-05-01').ConnectionString]",
|
||||
"AzureWebJobsStorage": "[concat('DefaultEndpointsProtocol=https;AccountName=', toLower(variables('FunctionName')),';AccountKey=',listKeys(resourceId('Microsoft.Storage/storageAccounts', toLower(variables('FunctionName'))), '2019-06-01').keys[0].value, ';EndpointSuffix=core.windows.net')]",
|
||||
"WorkspaceID": "[parameters('WorkspaceID')]",
|
||||
"WorkspaceKey": "[parameters('WorkspaceKey')]",
|
||||
"GooglePickleString": "[parameters('GooglePickleString')]",
|
||||
"WEBSITE_RUN_FROM_PACKAGE": "https://github.com/Azure/Azure-Sentinel/blob/GworkspaceReportsConnector/DataConnectors/GoogleWorkspaceReports/GWorkspaceReportsAPISentinelConn.zip?raw=true"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"type": "Microsoft.Web/sites/hostNameBindings",
|
||||
"apiVersion": "2018-11-01",
|
||||
"name": "[concat(variables('FunctionName'), '/', variables('FunctionName'), '.azurewebsites.net')]",
|
||||
"location": "[resourceGroup().location]",
|
||||
"dependsOn": [
|
||||
"[resourceId('Microsoft.Web/sites', variables('FunctionName'))]"
|
||||
],
|
||||
"properties": {
|
||||
"siteName": "[variables('FunctionName')]",
|
||||
"hostNameType": "Verified"
|
||||
}
|
||||
},
|
||||
{
|
||||
"type": "Microsoft.Storage/storageAccounts/blobServices/containers",
|
||||
"apiVersion": "2019-06-01",
|
||||
"name": "[concat(variables('FunctionName'), '/default/azure-webjobs-hosts')]",
|
||||
"dependsOn": [
|
||||
"[resourceId('Microsoft.Storage/storageAccounts/blobServices', variables('FunctionName'), 'default')]",
|
||||
"[resourceId('Microsoft.Storage/storageAccounts', variables('FunctionName'))]"
|
||||
],
|
||||
"properties": {
|
||||
"publicAccess": "None"
|
||||
}
|
||||
},
|
||||
{
|
||||
"type": "Microsoft.Storage/storageAccounts/blobServices/containers",
|
||||
"apiVersion": "2019-06-01",
|
||||
"name": "[concat(variables('FunctionName'), '/default/azure-webjobs-secrets')]",
|
||||
"dependsOn": [
|
||||
"[resourceId('Microsoft.Storage/storageAccounts/blobServices', variables('FunctionName'), 'default')]",
|
||||
"[resourceId('Microsoft.Storage/storageAccounts', variables('FunctionName'))]"
|
||||
],
|
||||
"properties": {
|
||||
"publicAccess": "None"
|
||||
}
|
||||
},
|
||||
{
|
||||
"type": "Microsoft.Storage/storageAccounts/fileServices/shares",
|
||||
"apiVersion": "2019-06-01",
|
||||
"name": "[concat(variables('FunctionName'), '/default/', tolower(variables('FunctionName')))]",
|
||||
"dependsOn": [
|
||||
"[resourceId('Microsoft.Storage/storageAccounts/fileServices', variables('FunctionName'), 'default')]",
|
||||
"[resourceId('Microsoft.Storage/storageAccounts', variables('FunctionName'))]"
|
||||
],
|
||||
"properties": {
|
||||
"shareQuota": 5120
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
import pickle
|
||||
import os.path
|
||||
import base64
|
||||
|
||||
def main():
|
||||
creds = None
|
||||
if os.path.exists('token.pickle'):
|
||||
with open('token.pickle', 'rb') as token:
|
||||
creds = pickle.load(token)
|
||||
if not creds or not creds.valid:
|
||||
print("There is no token.pickle file. Please check.")
|
||||
exit(0)
|
||||
print("\n\nCopy pickle string and save. Paste it during installation GWorkspace Function App:\n\n{}".format(base64.b64encode(pickle.dumps(creds))))
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
{
|
||||
"version": "2.0",
|
||||
"logging": {
|
||||
"applicationInsights": {
|
||||
"samplingSettings": {
|
||||
"isEnabled": true,
|
||||
"excludedTypes": "Request"
|
||||
}
|
||||
}
|
||||
},
|
||||
"extensionBundle": {
|
||||
"id": "Microsoft.Azure.Functions.ExtensionBundle",
|
||||
"version": "[1.*, 2.0.0)"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
{
|
||||
"$schema": "http://json.schemastore.org/proxies",
|
||||
"proxies": {}
|
||||
}
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
# DO NOT include azure-functions-worker in this file
|
||||
# The Python Worker is managed by Azure Functions platform
|
||||
# Manually managing azure-functions-worker may cause unexpected issues
|
||||
|
||||
azure-functions
|
||||
google-api-python-client
|
||||
google-auth-httplib2
|
||||
google-auth-oauthlib
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
<svg width="75" height="75" viewBox="0 0 75 75" fill="none" xmlns="http://www.w3.org/2000/svg">
|
||||
<path d="M75 38.3612C75 35.8121 74.7892 33.2491 74.3393 30.7413H38.2521V45.1819H58.9176C58.06 49.8393 55.3046 53.9592 51.2699 56.5773V65.9471H63.5989C70.8388 59.4158 75 49.7704 75 38.3612Z" fill="#4285F4"/>
|
||||
<path d="M38.2521 75C48.5707 75 57.2727 71.6792 63.6129 65.947L51.2839 56.5772C47.8537 58.8646 43.4254 60.1598 38.2661 60.1598C28.2849 60.1598 19.8219 53.5596 16.7853 44.6858H4.06274V54.345C10.5576 67.008 23.7863 75 38.2521 75V75Z" fill="#34A853"/>
|
||||
<path d="M16.7715 44.6859C15.1688 40.0285 15.1688 34.9853 16.7715 30.328V20.6688H4.06292C-1.3635 31.2649 -1.3635 43.7489 4.06292 54.345L16.7715 44.6859V44.6859Z" fill="#FBBC04"/>
|
||||
<path d="M38.2521 14.8401C43.7066 14.7575 48.9784 16.7692 52.9287 20.462L63.8519 9.75561C56.9353 3.38964 47.7553 -0.11027 38.2521 -3.63953e-05C23.7863 -3.63953e-05 10.5576 7.99188 4.06274 20.6687L16.7713 30.3279C19.7938 21.4403 28.2708 14.8401 38.2521 14.8401V14.8401Z" fill="#EA4335"/>
|
||||
</svg>
|
||||
|
После Ширина: | Высота: | Размер: 1.0 KiB |
|
|
@ -0,0 +1,401 @@
|
|||
// Usage Instruction :
|
||||
// Paste below query in log analytics, click on Save button and select as Function from drop down by specifying function name and alias as GWorkspaceActivityReports.
|
||||
// Function usually takes 10-15 minutes to activate. You can then use function alias from any other queries (e.g. GWorkspaceActivityReports | take 10).
|
||||
// Reference : Using functions in Azure monitor log queries : https://docs.microsoft.com/azure/azure-monitor/log-query/functions
|
||||
let GWorkspace_ReportsAPI_admin_view = view () {
|
||||
GWorkspace_ReportsAPI_admin_CL
|
||||
| extend
|
||||
EventVendor="Google",
|
||||
EventProduct="Google Workspace Activity Reports",
|
||||
ApplicationName=column_ifexists('APPLICATION_NAME_s', ''),
|
||||
GroupDomain=column_ifexists('ORG_UNIT_NAME_s', ''),
|
||||
ProcessName=column_ifexists('SETTING_NAME_s', ''),
|
||||
ApplicationEdition=column_ifexists('APPLICATION_EDITION_s', ''),
|
||||
RoleName=column_ifexists('ROLE_NAME_s', ''),
|
||||
OldValue=column_ifexists('OLD_VALUE_s', ''),
|
||||
EventCategoryType=column_ifexists('kind_s', ''),
|
||||
EventOriginalTime=column_ifexists('id_time_t', ''),
|
||||
EventId=column_ifexists('id_uniqueQualifier_s', ''),
|
||||
IdApplicationName=column_ifexists('id_applicationName_s', ''),
|
||||
UserAadid=column_ifexists('id_customerId_s', ''),
|
||||
Etag=column_ifexists('etag_s', ''),
|
||||
ActorCallerType=column_ifexists('actor_callerType_s', ''),
|
||||
ActorKey=column_ifexists('actor_key_s', ''),
|
||||
EventOriginalMessage=column_ifexists('events_s', ''),
|
||||
EventMessage=column_ifexists('event_name_s', ''),
|
||||
EventType=column_ifexists('event_type_s', ''),
|
||||
UserEmail=column_ifexists('USER_EMAIL_s', ''),
|
||||
ModuleName=column_ifexists('PRODUCT_NAME_s', ''),
|
||||
NewValue=column_ifexists('NEW_VALUE_s', ''),
|
||||
ActorEmail=column_ifexists('actor_email_s', ''),
|
||||
ActorProfileId=column_ifexists('actor_profileId_s', ''),
|
||||
SrcIpAddr=column_ifexists('IPAddress', '')
|
||||
| project
|
||||
TimeGenerated,
|
||||
EventVendor,
|
||||
EventProduct,
|
||||
ApplicationName,
|
||||
GroupDomain,
|
||||
ProcessName,
|
||||
ApplicationEdition,
|
||||
RoleName,
|
||||
OldValue,
|
||||
EventCategoryType,
|
||||
EventOriginalTime,
|
||||
EventId,
|
||||
IdApplicationName,
|
||||
UserAadid,
|
||||
Etag,
|
||||
ActorCallerType,
|
||||
ActorKey,
|
||||
EventOriginalMessage,
|
||||
EventMessage,
|
||||
EventType,
|
||||
UserEmail,
|
||||
ModuleName,
|
||||
NewValue,
|
||||
ActorEmail,
|
||||
ActorProfileId,
|
||||
SrcIpAddr
|
||||
};
|
||||
let GWorkspace_ReportsAPI_calendar_view = view () {
|
||||
GWorkspace_ReportsAPI_calendar_CL
|
||||
| extend
|
||||
OldEventTitle=column_ifexists('old_event_title_s', ''),
|
||||
EventStartTime=column_ifexists('start_time_s', ''),
|
||||
EventEndTime=column_ifexists('end_time_s', ''),
|
||||
EventMessage=column_ifexists('event_name_s', ''),
|
||||
NotificationType=column_ifexists('notification_type_s', ''),
|
||||
NotificationMethod=column_ifexists('notification_method_s', ''),
|
||||
DstUserUpn=column_ifexists('recipient_email_s', ''),
|
||||
CalendarId=column_ifexists('calendar_id_s', ''),
|
||||
TargetCalendarId=column_ifexists('target_calendar_id_s', ''),
|
||||
NotificationMessageId=column_ifexists('notification_message_id_s', ''),
|
||||
EventUid=column_ifexists('event_id_s', ''),
|
||||
UserAgentOriginal=column_ifexists('user_agent_s', ''),
|
||||
OrganizerCalendarId=column_ifexists('organizer_calendar_id_s', ''),
|
||||
EventTitle=column_ifexists('event_title_s', ''),
|
||||
EventGuest=column_ifexists('event_guest_s', ''),
|
||||
EventResponseStatus=column_ifexists('event_response_status_s', ''),
|
||||
ApiKind=column_ifexists('api_kind_s', ''),
|
||||
Kind=column_ifexists('kind_s', ''),
|
||||
EventOriginalTime=column_ifexists('id_time_t', ''),
|
||||
EventId=column_ifexists('id_uniqueQualifier_s', ''),
|
||||
IdApplicationName=column_ifexists('id_applicationName_s', ''),
|
||||
UserAadid=column_ifexists('id_customerId_s', ''),
|
||||
Etag=column_ifexists('etag_s', ''),
|
||||
ActorEmail=column_ifexists('actor_email_s', ''),
|
||||
ActorProfileId=column_ifexists('actor_profileId_s', ''),
|
||||
OwnerDomain=column_ifexists('ownerDomain_s', ''),
|
||||
EventOriginalMessage=column_ifexists('events_s', ''),
|
||||
EventType=column_ifexists('event_type_s', ''),
|
||||
SrcIpAddr=column_ifexists('IPAddress', ''),
|
||||
ActorCallerType=column_ifexists('actor_callerType_s', ''),
|
||||
EventVendor="Google",
|
||||
EventProduct="Google Workspace Activity Reports"
|
||||
| project
|
||||
TimeGenerated,
|
||||
EventVendor,
|
||||
EventProduct,
|
||||
OldEventTitle,
|
||||
EventStartTime,
|
||||
EventEndTime,
|
||||
EventMessage,
|
||||
NotificationType,
|
||||
NotificationMethod,
|
||||
DstUserUpn,
|
||||
CalendarId,
|
||||
TargetCalendarId,
|
||||
NotificationMessageId,
|
||||
EventUid,
|
||||
UserAgentOriginal,
|
||||
OrganizerCalendarId,
|
||||
EventTitle,
|
||||
EventGuest,
|
||||
EventResponseStatus,
|
||||
ApiKind,
|
||||
Kind,
|
||||
EventOriginalTime,
|
||||
EventId,
|
||||
IdApplicationName,
|
||||
UserAadid,
|
||||
Etag,
|
||||
ActorEmail,
|
||||
ActorProfileId,
|
||||
OwnerDomain,
|
||||
EventOriginalMessage,
|
||||
EventType,
|
||||
SrcIpAddr,
|
||||
ActorCallerType
|
||||
};
|
||||
let GWorkspace_ReportsAPI_drive_view = view () {
|
||||
GWorkspace_ReportsAPI_drive_CL
|
||||
| extend
|
||||
EventVendor="Google",
|
||||
EventProduct="Google Workspace Activity Reports",
|
||||
SharedDriveId=column_ifexists('shared_drive_id_s', ''),
|
||||
TeamDriveId=column_ifexists('team_drive_id_s', ''),
|
||||
OldValue=column_ifexists('old_value_s', ''),
|
||||
NewValue=column_ifexists('new_value_s', ''),
|
||||
DestinationFolderTitle=column_ifexists('destination_folder_title_s', ''),
|
||||
DestinationFolderId=column_ifexists('destination_folder_id_s', ''),
|
||||
SourceFolderTitle=column_ifexists('source_folder_title_s', ''),
|
||||
SourceFolderId=column_ifexists('source_folder_id_s', ''),
|
||||
EventMessage=column_ifexists('event_name_s', ''),
|
||||
PrimaryEvent=column_ifexists('primary_event_b', ''),
|
||||
Billable=column_ifexists('billable_b', ''),
|
||||
DocId=column_ifexists('doc_id_s', ''),
|
||||
DocType=column_ifexists('doc_type_s', ''),
|
||||
DocTitle=column_ifexists('doc_title_s', ''),
|
||||
Visibility=column_ifexists('visibility_s', ''),
|
||||
OriginatingAppId=column_ifexists('originating_app_id_s', ''),
|
||||
ActorIsCollaboratorAccount=column_ifexists('actor_is_collaborator_account_b', ''),
|
||||
Owner=column_ifexists('owner_s', ''),
|
||||
OwnerIsSharedDrive=column_ifexists('owner_is_shared_drive_b', ''),
|
||||
OwnerIsTeamDrive=column_ifexists('owner_is_team_drive_b', ''),
|
||||
VisibilityChange=column_ifexists('visibility_change_s', ''),
|
||||
TargetUserName=column_ifexists('target_user_s', ''),
|
||||
OldVisibility=column_ifexists('old_visibility_s', ''),
|
||||
TargetUserDomain=column_ifexists('target_domain_s', ''),
|
||||
Kind=column_ifexists('kind_s', ''),
|
||||
EventOriginalTime=column_ifexists('id_time_t', ''),
|
||||
EventId=column_ifexists('id_uniqueQualifier_s', ''),
|
||||
IdApplicationName=column_ifexists('id_applicationName_s', ''),
|
||||
UserAadid=column_ifexists('id_customerId_s', ''),
|
||||
Etag=column_ifexists('etag_s', ''),
|
||||
ActorEmail=column_ifexists('actor_email_s', ''),
|
||||
ActorProfileId=column_ifexists('actor_profileId_s', ''),
|
||||
SrcIpAddr=column_ifexists('IPAddress', ''),
|
||||
EventOriginalMessage=column_ifexists('events_s', ''),
|
||||
EventType=column_ifexists('event_type_s', '')
|
||||
| project
|
||||
TimeGenerated,
|
||||
EventVendor,
|
||||
EventProduct,
|
||||
SharedDriveId,
|
||||
TeamDriveId,
|
||||
OldValue,
|
||||
NewValue,
|
||||
DestinationFolderTitle,
|
||||
DestinationFolderId,
|
||||
SourceFolderTitle,
|
||||
SourceFolderId,
|
||||
EventMessage,
|
||||
PrimaryEvent,
|
||||
Billable,
|
||||
DocId,
|
||||
DocType,
|
||||
DocTitle,
|
||||
Visibility,
|
||||
OriginatingAppId,
|
||||
ActorIsCollaboratorAccount,
|
||||
Owner,
|
||||
OwnerIsSharedDrive,
|
||||
OwnerIsTeamDrive,
|
||||
VisibilityChange,
|
||||
TargetUserName,
|
||||
OldVisibility,
|
||||
TargetUserDomain,
|
||||
Kind,
|
||||
EventOriginalTime,
|
||||
EventId,
|
||||
IdApplicationName,
|
||||
UserAadid,
|
||||
Etag,
|
||||
ActorEmail,
|
||||
ActorProfileId,
|
||||
SrcIpAddr,
|
||||
EventOriginalMessage,
|
||||
EventType
|
||||
};
|
||||
let GWorkspace_ReportsAPI_login_view = view () {
|
||||
GWorkspace_ReportsAPI_login_CL
|
||||
| extend
|
||||
EventVendor="Google",
|
||||
EventProduct="Google Workspace Activity Reports",
|
||||
LoginChallengeMethod=column_ifexists('login_challenge_method_s', ''),
|
||||
EventMessage=column_ifexists('event_name_s', ''),
|
||||
LoginType=column_ifexists('login_type_s', ''),
|
||||
IsSuspicious=column_ifexists('is_suspicious_b', ''),
|
||||
LoginChallengeStatus=column_ifexists('login_challenge_status_s', ''),
|
||||
IsSecondFactor=column_ifexists('is_second_factor_b', ''),
|
||||
Kind=column_ifexists('kind_s', ''),
|
||||
EventOriginalTime=column_ifexists('id_time_t', ''),
|
||||
EventId=column_ifexists('id_uniqueQualifier_s', ''),
|
||||
IdApplicationName=column_ifexists('id_applicationName_s', ''),
|
||||
UserAadid=column_ifexists('id_customerId_s', ''),
|
||||
Etag=column_ifexists('etag_s', ''),
|
||||
ActorEmail=column_ifexists('actor_email_s', ''),
|
||||
ActorProfileId=column_ifexists('actor_profileId_s', ''),
|
||||
SrcIpAddr=column_ifexists('IPAddress', ''),
|
||||
EventOriginalMessage=column_ifexists('events_s', ''),
|
||||
EventType=column_ifexists('event_type_s', '')
|
||||
| project
|
||||
TimeGenerated,
|
||||
EventVendor,
|
||||
EventProduct,
|
||||
LoginChallengeMethod,
|
||||
EventMessage,
|
||||
LoginType,
|
||||
IsSuspicious,
|
||||
LoginChallengeStatus,
|
||||
IsSecondFactor,
|
||||
Kind,
|
||||
EventOriginalTime,
|
||||
EventId,
|
||||
IdApplicationName,
|
||||
UserAadid,
|
||||
Etag,
|
||||
ActorEmail,
|
||||
ActorProfileId,
|
||||
SrcIpAddr,
|
||||
EventOriginalMessage,
|
||||
EventType
|
||||
};
|
||||
let GWorkspace_ReportsAPI_mobile_view = view () {
|
||||
GWorkspace_ReportsAPI_mobile_CL
|
||||
| extend
|
||||
EventVendor="Google",
|
||||
EventProduct="Google Workspace Activity Reports",
|
||||
DvcInterfaceGuid=column_ifexists('DEVICE_ID_s', ''),
|
||||
OldValue=column_ifexists('OLD_VALUE_s', ''),
|
||||
NeqValue=column_ifexists('NEW_VALUE_s', ''),
|
||||
OsProperty=column_ifexists('OS_PROPERTY_s', ''),
|
||||
LastSyncAuditDate=column_ifexists('LAST_SYNC_AUDIT_DATE_s', ''),
|
||||
AccountState=column_ifexists('ACCOUNT_STATE_s', ''),
|
||||
RegisterPrivelege=column_ifexists('REGISTER_PRIVILEGE_s', ''),
|
||||
EventMessage=column_ifexists('event_name_s', ''),
|
||||
DstUserUpn=column_ifexists('USER_EMAIL_s', ''),
|
||||
DvcGuid=column_ifexists('DEVICE_ID_g', ''),
|
||||
SerialNumber=column_ifexists('SERIAL_NUMBER_s', ''),
|
||||
DvcType=column_ifexists('DEVICE_TYPE_s', ''),
|
||||
DvcModelName=column_ifexists('DEVICE_MODEL_s', ''),
|
||||
ResourceId=column_ifexists('RESOURCE_ID_s', ''),
|
||||
IosVendorId=column_ifexists('IOS_VENDOR_ID_s', ''),
|
||||
DvcModelNumber=column_ifexists('OS_VERSION_s', ''),
|
||||
IosVendorUID=column_ifexists('IOS_VENDOR_ID_g', ''),
|
||||
Kind=column_ifexists('kind_s', ''),
|
||||
EventOriginalTime=column_ifexists('id_time_t', ''),
|
||||
EventId=column_ifexists('id_uniqueQualifier_s', ''),
|
||||
IdApplicationName=column_ifexists('id_applicationName_s', ''),
|
||||
UserAadid=column_ifexists('id_customerId_s', ''),
|
||||
Etag=column_ifexists('etag_s', ''),
|
||||
ActorCallerType=column_ifexists('actor_callerType_s', ''),
|
||||
ActorEmail=column_ifexists('actor_email_s', ''),
|
||||
ActorProfileId=column_ifexists('actor_profileId_s', ''),
|
||||
EventOriginalMessage=column_ifexists('events_s', ''),
|
||||
EventType=column_ifexists('event_type_s', '')
|
||||
| project
|
||||
TimeGenerated,
|
||||
EventVendor,
|
||||
EventProduct,
|
||||
DvcInterfaceGuid,
|
||||
OldValue,
|
||||
NeqValue,
|
||||
OsProperty,
|
||||
LastSyncAuditDate,
|
||||
AccountState,
|
||||
RegisterPrivelege,
|
||||
EventMessage,
|
||||
DstUserUpn,
|
||||
DvcGuid,
|
||||
SerialNumber,
|
||||
DvcType,
|
||||
DvcModelName,
|
||||
ResourceId,
|
||||
IosVendorId,
|
||||
DvcModelNumber,
|
||||
IosVendorUID,
|
||||
Kind,
|
||||
EventOriginalTime,
|
||||
EventId,
|
||||
IdApplicationName,
|
||||
UserAadid,
|
||||
Etag,
|
||||
ActorCallerType,
|
||||
ActorEmail,
|
||||
ActorProfileId,
|
||||
EventOriginalMessage,
|
||||
EventType
|
||||
};
|
||||
let GWorkspace_ReportsAPI_token_view = view () {
|
||||
GWorkspace_ReportsAPI_token_CL
|
||||
| extend
|
||||
EventVendor="Google",
|
||||
EventProduct="Google Workspace Activity Reports",
|
||||
ScopeData=column_ifexists('scope_data_s', ''),
|
||||
Scope=column_ifexists('scope_s', ''),
|
||||
EventMessage=column_ifexists('event_name_s', ''),
|
||||
ClientId=column_ifexists('client_id_s', ''),
|
||||
AppName=column_ifexists('app_name_s', ''),
|
||||
ClientType=column_ifexists('client_type_s', ''),
|
||||
Kind=column_ifexists('kind_s', ''),
|
||||
EventOriginalTime=column_ifexists('id_time_t', ''),
|
||||
EventId=column_ifexists('id_uniqueQualifier_s', ''),
|
||||
IdApplicationName=column_ifexists('id_applicationName_s', ''),
|
||||
UserAadid=column_ifexists('id_customerId_s', ''),
|
||||
Etag=column_ifexists('etag_s', ''),
|
||||
ActorEmail=column_ifexists('actor_email_s', ''),
|
||||
ActorProfileId=column_ifexists('actor_profileId_s', ''),
|
||||
SrcIpAddr=column_ifexists('IPAddress', ''),
|
||||
EventOriginalMessage=column_ifexists('events_s', ''),
|
||||
EventType=column_ifexists('event_type_s', '')
|
||||
| project
|
||||
TimeGenerated,
|
||||
EventVendor,
|
||||
EventProduct,
|
||||
ScopeData,
|
||||
Scope,
|
||||
EventMessage,
|
||||
ClientId,
|
||||
AppName,
|
||||
ClientType,
|
||||
Kind,
|
||||
EventOriginalTime,
|
||||
EventId,
|
||||
IdApplicationName,
|
||||
UserAadid,
|
||||
Etag,
|
||||
ActorEmail,
|
||||
ActorProfileId,
|
||||
SrcIpAddr,
|
||||
EventOriginalMessage,
|
||||
EventType
|
||||
};
|
||||
let GWorkspace_ReportsAPI_user_accounts_view = view () {
|
||||
GWorkspace_ReportsAPI_user_accounts_CL
|
||||
| extend
|
||||
EventVendor="Google",
|
||||
EventProduct="Google Workspace Activity Reports",
|
||||
Kind=column_ifexists('kind_s', ''),
|
||||
EventOriginalTime=column_ifexists('id_time_t', ''),
|
||||
EventId=column_ifexists('id_uniqueQualifier_s', ''),
|
||||
IdApplicationName=column_ifexists('id_applicationName_s', ''),
|
||||
UserAadid=column_ifexists('id_customerId_s', ''),
|
||||
Etag=column_ifexists('etag_s', ''),
|
||||
ActorCallerType=column_ifexists('actor_callerType_s', ''),
|
||||
ActorEmail=column_ifexists('actor_email_s', ''),
|
||||
ActorProfileId=column_ifexists('actor_profileId_s', ''),
|
||||
SrcIpAddr=column_ifexists('IPAddress', ''),
|
||||
EventOriginalMessage=column_ifexists('events_s', ''),
|
||||
EventMessage=column_ifexists('event_name_s', ''),
|
||||
EventType=column_ifexists('event_type_s', '')
|
||||
| project
|
||||
TimeGenerated,
|
||||
EventVendor,
|
||||
EventProduct,
|
||||
Kind,
|
||||
EventOriginalTime,
|
||||
EventId,
|
||||
IdApplicationName,
|
||||
UserAadid,
|
||||
Etag,
|
||||
ActorCallerType,
|
||||
ActorEmail,
|
||||
ActorProfileId,
|
||||
SrcIpAddr,
|
||||
EventOriginalMessage,
|
||||
EventMessage,
|
||||
EventType
|
||||
};
|
||||
union isfuzzy=true GWorkspace_ReportsAPI_admin_view, GWorkspace_ReportsAPI_calendar_view, GWorkspace_ReportsAPI_drive_view, GWorkspace_ReportsAPI_login_view, GWorkspace_ReportsAPI_mobile_view, GWorkspace_ReportsAPI_token_view, GWorkspace_ReportsAPI_user_accounts_view
|
||||
|
|
@ -0,0 +1,108 @@
|
|||
[
|
||||
{
|
||||
"kind": "admin#reports#activity",
|
||||
"id": {
|
||||
"time": "2020-11-09T13:08:31.828Z",
|
||||
"uniqueQualifier": "-5224040487274219132",
|
||||
"applicationName": "admin",
|
||||
"customerId": "C015t6bdl"
|
||||
},
|
||||
"etag": "\"PNA2ZR3TS-DeL8kB7gQOm1H5qhZ72uyN90kw26wJK68/f2IH0Tk1wK4U7y2s2d3YkHxyXCU\"",
|
||||
"actor": {
|
||||
"callerType": "KEY",
|
||||
"key": "SYSTEM"
|
||||
},
|
||||
"events": [
|
||||
{
|
||||
"type": "LICENSES_SETTINGS",
|
||||
"name": "USER_LICENSE_ASSIGNMENT",
|
||||
"parameters": [
|
||||
{
|
||||
"name": "USER_EMAIL",
|
||||
"value": "user1@company.com"
|
||||
},
|
||||
{
|
||||
"name": "PRODUCT_NAME",
|
||||
"value": "Google Workspace"
|
||||
},
|
||||
{
|
||||
"name": "NEW_VALUE",
|
||||
"value": "G Suite Business"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"event_name": "USER_LICENSE_ASSIGNMENT",
|
||||
"event_type": "LICENSES_SETTINGS",
|
||||
"USER_EMAIL": "user1@company.com",
|
||||
"PRODUCT_NAME": "Google Workspace",
|
||||
"NEW_VALUE": "G Suite Business"
|
||||
},
|
||||
{
|
||||
"kind": "admin#reports#activity",
|
||||
"id": {
|
||||
"time": "2020-11-09T13:08:21.172Z",
|
||||
"uniqueQualifier": "-6280654592237957004",
|
||||
"applicationName": "admin",
|
||||
"customerId": "C015t6bdl"
|
||||
},
|
||||
"etag": "\"PNA2ZR3TS-DeL8kB7gQOm1H5qhZ72uyN90kw26wJK68/rdJ3o6SiI-IImZfKDEthgXUM_18\"",
|
||||
"actor": {
|
||||
"callerType": "USER",
|
||||
"email": "user2@company.com",
|
||||
"profileId": "117433848155128707444"
|
||||
},
|
||||
"ipAddress": "77.77.77.77",
|
||||
"events": [
|
||||
{
|
||||
"type": "USER_SETTINGS",
|
||||
"name": "CREATE_USER",
|
||||
"parameters": [
|
||||
{
|
||||
"name": "USER_EMAIL",
|
||||
"value": "user1@company.com"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"event_name": "CREATE_USER",
|
||||
"event_type": "USER_SETTINGS",
|
||||
"USER_EMAIL": "user1@company.com"
|
||||
},
|
||||
{
|
||||
"kind": "admin#reports#activity",
|
||||
"id": {
|
||||
"time": "2020-11-09T12:05:38.598Z",
|
||||
"uniqueQualifier": "-8900882441432306352",
|
||||
"applicationName": "admin",
|
||||
"customerId": "C015t6bdl"
|
||||
},
|
||||
"etag": "\"PNA2ZR3TS-DeL8kB7gQOm1H5qhZ72uyN90kw26wJK68/AxUrc0OBkhP71yDHBEP7QWLJKe8\"",
|
||||
"actor": {
|
||||
"callerType": "USER",
|
||||
"email": "user2@company.com",
|
||||
"profileId": "117433848155128707444"
|
||||
},
|
||||
"ipAddress": "77.77.77.77",
|
||||
"events": [
|
||||
{
|
||||
"type": "GROUP_SETTINGS",
|
||||
"name": "ADD_GROUP_MEMBER",
|
||||
"parameters": [
|
||||
{
|
||||
"name": "USER_EMAIL",
|
||||
"value": "user3@company.com"
|
||||
},
|
||||
{
|
||||
"name": "GROUP_EMAIL",
|
||||
"value": "office@company.com"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"event_name": "ADD_GROUP_MEMBER",
|
||||
"event_type": "GROUP_SETTINGS",
|
||||
"USER_EMAIL": "user3@company.com",
|
||||
"GROUP_EMAIL": "office@company.com"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,204 @@
|
|||
[
|
||||
{
|
||||
"kind": "admin#reports#activity",
|
||||
"id": {
|
||||
"time": "2020-11-10T07:20:00.134Z",
|
||||
"uniqueQualifier": "5015619291483502098",
|
||||
"applicationName": "calendar",
|
||||
"customerId": "C015t6bdl"
|
||||
},
|
||||
"etag": "\"PNA2ZR3TS-DeL8kB7gQOm1H5qhZ72uyN90kw26wJK68/ySNOqSK23I8S3eSyIwVM_YpPIyU\"",
|
||||
"actor": {
|
||||
"email": "user4@company.com",
|
||||
"profileId": "109950366970271381671"
|
||||
},
|
||||
"ownerDomain": "socprime.com",
|
||||
"ipAddress": "100.100.100.100",
|
||||
"events": [
|
||||
{
|
||||
"type": "notification",
|
||||
"name": "notification_triggered",
|
||||
"parameters": [
|
||||
{
|
||||
"name": "notification_type",
|
||||
"value": "reply_received"
|
||||
},
|
||||
{
|
||||
"name": "notification_method",
|
||||
"value": "email"
|
||||
},
|
||||
{
|
||||
"name": "recipient_email",
|
||||
"value": "user5@company.com"
|
||||
},
|
||||
{
|
||||
"name": "calendar_id",
|
||||
"value": "user5@company.com"
|
||||
},
|
||||
{
|
||||
"name": "target_calendar_id",
|
||||
"value": "user5@company.com"
|
||||
},
|
||||
{
|
||||
"name": "notification_message_id",
|
||||
"value": "<000000000000b67fb605b3bb81be@google.com>"
|
||||
},
|
||||
{
|
||||
"name": "event_id",
|
||||
"value": "0n5llhrpmcrvr6s3pesoe06n5n"
|
||||
},
|
||||
{
|
||||
"name": "api_kind",
|
||||
"value": "web"
|
||||
},
|
||||
{
|
||||
"name": "user_agent",
|
||||
"value": "Mozilla/5.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"event_name": "notification_triggered",
|
||||
"event_type": "notification",
|
||||
"notification_type": "reply_received",
|
||||
"notification_method": "email",
|
||||
"recipient_email": "user5@company.com",
|
||||
"calendar_id": "user5@company.com",
|
||||
"target_calendar_id": "user5@company.com",
|
||||
"notification_message_id": "<000000000000b67fb605b3bb81be@google.com>",
|
||||
"event_id": "0n5llhrpmcrvr6s3pesoe06n5n",
|
||||
"api_kind": "web",
|
||||
"user_agent": "Mozilla/5.0"
|
||||
},
|
||||
{
|
||||
"kind": "admin#reports#activity",
|
||||
"id": {
|
||||
"time": "2020-11-10T07:17:09.927Z",
|
||||
"uniqueQualifier": "5443063577829878442",
|
||||
"applicationName": "calendar",
|
||||
"customerId": "C015t6bdl"
|
||||
},
|
||||
"etag": "\"PNA2ZR3TS-DeL8kB7gQOm1H5qhZ72uyN90kw26wJK68/0zPgS_AvvyPLgUJcdeaY5kkHA44\"",
|
||||
"actor": {
|
||||
"email": "user5@company.com",
|
||||
"profileId": "111024176775869387097"
|
||||
},
|
||||
"ownerDomain": "socprime.com",
|
||||
"ipAddress": "185.185.185.185",
|
||||
"events": [
|
||||
{
|
||||
"type": "notification",
|
||||
"name": "notification_triggered",
|
||||
"parameters": [
|
||||
{
|
||||
"name": "notification_type",
|
||||
"value": "changed_event"
|
||||
},
|
||||
{
|
||||
"name": "notification_method",
|
||||
"value": "email"
|
||||
},
|
||||
{
|
||||
"name": "recipient_email",
|
||||
"value": "user4@company.com"
|
||||
},
|
||||
{
|
||||
"name": "calendar_id",
|
||||
"value": "user4@company.com"
|
||||
},
|
||||
{
|
||||
"name": "target_calendar_id",
|
||||
"value": "user4@company.com"
|
||||
},
|
||||
{
|
||||
"name": "notification_message_id",
|
||||
"value": "<00000000000091945805b3bb77d3@google.com>"
|
||||
},
|
||||
{
|
||||
"name": "event_id",
|
||||
"value": "0n5llhrpmcrvr6s3pesoe06n5n"
|
||||
},
|
||||
{
|
||||
"name": "api_kind",
|
||||
"value": "web"
|
||||
},
|
||||
{
|
||||
"name": "user_agent",
|
||||
"value": "Mozilla/5.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"event_name": "notification_triggered",
|
||||
"event_type": "notification",
|
||||
"notification_type": "changed_event",
|
||||
"notification_method": "email",
|
||||
"recipient_email": "user4@company.com",
|
||||
"calendar_id": "user4@company.com",
|
||||
"target_calendar_id": "user4@company.com",
|
||||
"notification_message_id": "<00000000000091945805b3bb77d3@google.com>",
|
||||
"event_id": "0n5llhrpmcrvr6s3pesoe06n5n",
|
||||
"api_kind": "web",
|
||||
"user_agent": "Mozilla/5.0"
|
||||
},
|
||||
{
|
||||
"kind": "admin#reports#activity",
|
||||
"id": {
|
||||
"time": "2020-11-10T06:38:02.806Z",
|
||||
"uniqueQualifier": "-568981528692107660",
|
||||
"applicationName": "calendar",
|
||||
"customerId": "C015t6bdl"
|
||||
},
|
||||
"etag": "\"PNA2ZR3TS-DeL8kB7gQOm1H5qhZ72uyN90kw26wJK68/ntG7A3DGAPuRMYI2GoPxUs3yJBk\"",
|
||||
"actor": {
|
||||
"email": "user6@company.com",
|
||||
"profileId": "116493571738454115081"
|
||||
},
|
||||
"ownerDomain": "socprime.com",
|
||||
"events": [
|
||||
{
|
||||
"type": "event_change",
|
||||
"name": "change_event_guest_response",
|
||||
"parameters": [
|
||||
{
|
||||
"name": "event_id",
|
||||
"value": "4t99ageou49oin9nso02kct42m"
|
||||
},
|
||||
{
|
||||
"name": "organizer_calendar_id",
|
||||
"value": "user5@company.com"
|
||||
},
|
||||
{
|
||||
"name": "calendar_id",
|
||||
"value": "user5@company.com"
|
||||
},
|
||||
{
|
||||
"name": "target_calendar_id",
|
||||
"value": "user5@company.com"
|
||||
},
|
||||
{
|
||||
"name": "event_title",
|
||||
"value": "First Steps"
|
||||
},
|
||||
{
|
||||
"name": "event_guest",
|
||||
"value": "user6@company.com"
|
||||
},
|
||||
{
|
||||
"name": "event_response_status",
|
||||
"value": "accepted"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"event_name": "change_event_guest_response",
|
||||
"event_type": "event_change",
|
||||
"event_id": "4t99ageou49oin9nso02kct42m",
|
||||
"organizer_calendar_id": "user5@company.com",
|
||||
"calendar_id": "user5@company.com",
|
||||
"target_calendar_id": "user5@company.com",
|
||||
"event_title": "First Steps",
|
||||
"event_guest": "user6@company.com",
|
||||
"event_response_status": "accepted"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,707 @@
|
|||
[
|
||||
{
|
||||
"kind": "admin#reports#activity",
|
||||
"id": {
|
||||
"time": "2020-11-10T07:52:59.677Z",
|
||||
"uniqueQualifier": "-7089930217897997074",
|
||||
"applicationName": "drive",
|
||||
"customerId": "C015t6bdl"
|
||||
},
|
||||
"etag": "\"PNA2ZR3TS-DeL8kB7gQOm1H5qhZ72uyN90kw26wJK68/ok8bphxpehwyQMjjAojpnEfI07U\"",
|
||||
"actor": {
|
||||
"email": "user2@company.com",
|
||||
"profileId": "117433848155128707444"
|
||||
},
|
||||
"ipAddress": "51.51.51.51",
|
||||
"events": [
|
||||
{
|
||||
"type": "access",
|
||||
"name": "upload",
|
||||
"parameters": [
|
||||
{
|
||||
"name": "primary_event",
|
||||
"boolValue": true
|
||||
},
|
||||
{
|
||||
"name": "billable",
|
||||
"boolValue": true
|
||||
},
|
||||
{
|
||||
"name": "doc_id",
|
||||
"value": "11fXyLycI_mOzOV0oVlbLfI_KkHy96lN5"
|
||||
},
|
||||
{
|
||||
"name": "doc_type",
|
||||
"value": "unknown"
|
||||
},
|
||||
{
|
||||
"name": "doc_title",
|
||||
"value": "fdaf7afe-7e4d-4359-82bd-f01a9867f535-chunk-161618"
|
||||
},
|
||||
{
|
||||
"name": "visibility",
|
||||
"value": "private"
|
||||
},
|
||||
{
|
||||
"name": "originating_app_id",
|
||||
"value": "962388314550"
|
||||
},
|
||||
{
|
||||
"name": "actor_is_collaborator_account",
|
||||
"boolValue": false
|
||||
},
|
||||
{
|
||||
"name": "owner",
|
||||
"value": "user2@company.com"
|
||||
},
|
||||
{
|
||||
"name": "owner_is_shared_drive",
|
||||
"boolValue": false
|
||||
},
|
||||
{
|
||||
"name": "owner_is_team_drive",
|
||||
"boolValue": false
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"type": "access",
|
||||
"name": "edit",
|
||||
"parameters": [
|
||||
{
|
||||
"name": "primary_event",
|
||||
"boolValue": false
|
||||
},
|
||||
{
|
||||
"name": "billable",
|
||||
"boolValue": true
|
||||
},
|
||||
{
|
||||
"name": "doc_id",
|
||||
"value": "11fXyLycI_mOzOV0oVlbLfI_KkHy96lN5"
|
||||
},
|
||||
{
|
||||
"name": "doc_type",
|
||||
"value": "unknown"
|
||||
},
|
||||
{
|
||||
"name": "doc_title",
|
||||
"value": "fdaf7afe-7e4d-4359-82bd-f01a9867f535-chunk-161618"
|
||||
},
|
||||
{
|
||||
"name": "visibility",
|
||||
"value": "private"
|
||||
},
|
||||
{
|
||||
"name": "originating_app_id",
|
||||
"value": "962388314550"
|
||||
},
|
||||
{
|
||||
"name": "actor_is_collaborator_account",
|
||||
"boolValue": false
|
||||
},
|
||||
{
|
||||
"name": "owner",
|
||||
"value": "user2@company.com"
|
||||
},
|
||||
{
|
||||
"name": "owner_is_shared_drive",
|
||||
"boolValue": false
|
||||
},
|
||||
{
|
||||
"name": "owner_is_team_drive",
|
||||
"boolValue": false
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"type": "acl_change",
|
||||
"name": "change_user_access",
|
||||
"parameters": [
|
||||
{
|
||||
"name": "primary_event",
|
||||
"boolValue": false
|
||||
},
|
||||
{
|
||||
"name": "billable",
|
||||
"boolValue": true
|
||||
},
|
||||
{
|
||||
"name": "visibility_change",
|
||||
"value": "none"
|
||||
},
|
||||
{
|
||||
"name": "target_user",
|
||||
"value": "user2@company.com"
|
||||
},
|
||||
{
|
||||
"name": "old_value",
|
||||
"multiValue": [
|
||||
"none"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "new_value",
|
||||
"multiValue": [
|
||||
"owner"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "old_visibility",
|
||||
"value": "unknown"
|
||||
},
|
||||
{
|
||||
"name": "doc_id",
|
||||
"value": "11fXyLycI_mOzOV0oVlbLfI_KkHy96lN5"
|
||||
},
|
||||
{
|
||||
"name": "doc_type",
|
||||
"value": "unknown"
|
||||
},
|
||||
{
|
||||
"name": "doc_title",
|
||||
"value": "fdaf7afe-7e4d-4359-82bd-f01a9867f535-chunk-161618"
|
||||
},
|
||||
{
|
||||
"name": "visibility",
|
||||
"value": "private"
|
||||
},
|
||||
{
|
||||
"name": "originating_app_id",
|
||||
"value": "962388314550"
|
||||
},
|
||||
{
|
||||
"name": "actor_is_collaborator_account",
|
||||
"boolValue": false
|
||||
},
|
||||
{
|
||||
"name": "owner",
|
||||
"value": "user2@company.com"
|
||||
},
|
||||
{
|
||||
"name": "owner_is_shared_drive",
|
||||
"boolValue": false
|
||||
},
|
||||
{
|
||||
"name": "owner_is_team_drive",
|
||||
"boolValue": false
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"type": "acl_change",
|
||||
"name": "change_acl_editors",
|
||||
"parameters": [
|
||||
{
|
||||
"name": "primary_event",
|
||||
"boolValue": false
|
||||
},
|
||||
{
|
||||
"name": "billable",
|
||||
"boolValue": true
|
||||
},
|
||||
{
|
||||
"name": "visibility_change",
|
||||
"value": "none"
|
||||
},
|
||||
{
|
||||
"name": "old_value",
|
||||
"multiValue": [
|
||||
"owner"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "new_value",
|
||||
"multiValue": [
|
||||
"owner",
|
||||
"writers"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "old_visibility",
|
||||
"value": "unknown"
|
||||
},
|
||||
{
|
||||
"name": "doc_id",
|
||||
"value": "11fXyLycI_mOzOV0oVlbLfI_KkHy96lN5"
|
||||
},
|
||||
{
|
||||
"name": "doc_type",
|
||||
"value": "unknown"
|
||||
},
|
||||
{
|
||||
"name": "doc_title",
|
||||
"value": "fdaf7afe-7e4d-4359-82bd-f01a9867f535-chunk-161618"
|
||||
},
|
||||
{
|
||||
"name": "visibility",
|
||||
"value": "private"
|
||||
},
|
||||
{
|
||||
"name": "originating_app_id",
|
||||
"value": "962388314550"
|
||||
},
|
||||
{
|
||||
"name": "actor_is_collaborator_account",
|
||||
"boolValue": false
|
||||
},
|
||||
{
|
||||
"name": "owner",
|
||||
"value": "user2@company.com"
|
||||
},
|
||||
{
|
||||
"name": "owner_is_shared_drive",
|
||||
"boolValue": false
|
||||
},
|
||||
{
|
||||
"name": "owner_is_team_drive",
|
||||
"boolValue": false
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"type": "access",
|
||||
"name": "add_to_folder",
|
||||
"parameters": [
|
||||
{
|
||||
"name": "primary_event",
|
||||
"boolValue": false
|
||||
},
|
||||
{
|
||||
"name": "billable",
|
||||
"boolValue": true
|
||||
},
|
||||
{
|
||||
"name": "destination_folder_title",
|
||||
"multiValue": [
|
||||
"fdaf7afe-7e4d-4359-82bd-f01a9867f535-CONTENT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "destination_folder_id",
|
||||
"multiValue": [
|
||||
"1qQ7PiBmHDIkKP_aRdSe7r0-4Rv_im1QU"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "doc_id",
|
||||
"value": "11fXyLycI_mOzOV0oVlbLfI_KkHy96lN5"
|
||||
},
|
||||
{
|
||||
"name": "doc_type",
|
||||
"value": "unknown"
|
||||
},
|
||||
{
|
||||
"name": "doc_title",
|
||||
"value": "fdaf7afe-7e4d-4359-82bd-f01a9867f535-chunk-161618"
|
||||
},
|
||||
{
|
||||
"name": "visibility",
|
||||
"value": "private"
|
||||
},
|
||||
{
|
||||
"name": "originating_app_id",
|
||||
"value": "962388314550"
|
||||
},
|
||||
{
|
||||
"name": "actor_is_collaborator_account",
|
||||
"boolValue": false
|
||||
},
|
||||
{
|
||||
"name": "owner",
|
||||
"value": "user2@company.com"
|
||||
},
|
||||
{
|
||||
"name": "owner_is_shared_drive",
|
||||
"boolValue": false
|
||||
},
|
||||
{
|
||||
"name": "owner_is_team_drive",
|
||||
"boolValue": false
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"event_name": "add_to_folder",
|
||||
"event_type": "access",
|
||||
"primary_event": false,
|
||||
"billable": true,
|
||||
"doc_id": "11fXyLycI_mOzOV0oVlbLfI_KkHy96lN5",
|
||||
"doc_type": "unknown",
|
||||
"doc_title": "fdaf7afe-7e4d-4359-82bd-f01a9867f535-chunk-161618",
|
||||
"visibility": "private",
|
||||
"originating_app_id": "962388314550",
|
||||
"actor_is_collaborator_account": false,
|
||||
"owner": "user2@company.com",
|
||||
"owner_is_shared_drive": false,
|
||||
"owner_is_team_drive": false,
|
||||
"visibility_change": "none",
|
||||
"target_user": "user2@company.com",
|
||||
"old_value": [
|
||||
"owner"
|
||||
],
|
||||
"new_value": [
|
||||
"owner",
|
||||
"writers"
|
||||
],
|
||||
"old_visibility": "unknown",
|
||||
"destination_folder_title": [
|
||||
"fdaf7afe-7e4d-4359-82bd-f01a9867f535-CONTENT"
|
||||
],
|
||||
"destination_folder_id": [
|
||||
"1qQ7PiBmHDIkKP_aRdSe7r0-4Rv_im1QU"
|
||||
]
|
||||
},
|
||||
{
|
||||
"kind": "admin#reports#activity",
|
||||
"id": {
|
||||
"time": "2020-11-10T07:52:59.640Z",
|
||||
"uniqueQualifier": "-8555159623518321402",
|
||||
"applicationName": "drive",
|
||||
"customerId": "C015t6bdl"
|
||||
},
|
||||
"etag": "\"PNA2ZR3TS-DeL8kB7gQOm1H5qhZ72uyN90kw26wJK68/MHRocwdTPYHqyXrfo08T-H_xRtE\"",
|
||||
"actor": {
|
||||
"email": "user2@company.com",
|
||||
"profileId": "117433848155128707444"
|
||||
},
|
||||
"ipAddress": "51.51.51.51",
|
||||
"events": [
|
||||
{
|
||||
"type": "access",
|
||||
"name": "upload",
|
||||
"parameters": [
|
||||
{
|
||||
"name": "primary_event",
|
||||
"boolValue": true
|
||||
},
|
||||
{
|
||||
"name": "billable",
|
||||
"boolValue": true
|
||||
},
|
||||
{
|
||||
"name": "doc_id",
|
||||
"value": "1d4c31Qjtxu6BGWOmVbAjJ2OaKZRZJId5"
|
||||
},
|
||||
{
|
||||
"name": "doc_type",
|
||||
"value": "unknown"
|
||||
},
|
||||
{
|
||||
"name": "doc_title",
|
||||
"value": "fdaf7afe-7e4d-4359-82bd-f01a9867f535-chunk-161619"
|
||||
},
|
||||
{
|
||||
"name": "visibility",
|
||||
"value": "private"
|
||||
},
|
||||
{
|
||||
"name": "originating_app_id",
|
||||
"value": "962388314550"
|
||||
},
|
||||
{
|
||||
"name": "actor_is_collaborator_account",
|
||||
"boolValue": false
|
||||
},
|
||||
{
|
||||
"name": "owner",
|
||||
"value": "user2@company.com"
|
||||
},
|
||||
{
|
||||
"name": "owner_is_shared_drive",
|
||||
"boolValue": false
|
||||
},
|
||||
{
|
||||
"name": "owner_is_team_drive",
|
||||
"boolValue": false
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"type": "access",
|
||||
"name": "edit",
|
||||
"parameters": [
|
||||
{
|
||||
"name": "primary_event",
|
||||
"boolValue": false
|
||||
},
|
||||
{
|
||||
"name": "billable",
|
||||
"boolValue": true
|
||||
},
|
||||
{
|
||||
"name": "doc_id",
|
||||
"value": "1d4c31Qjtxu6BGWOmVbAjJ2OaKZRZJId5"
|
||||
},
|
||||
{
|
||||
"name": "doc_type",
|
||||
"value": "unknown"
|
||||
},
|
||||
{
|
||||
"name": "doc_title",
|
||||
"value": "fdaf7afe-7e4d-4359-82bd-f01a9867f535-chunk-161619"
|
||||
},
|
||||
{
|
||||
"name": "visibility",
|
||||
"value": "private"
|
||||
},
|
||||
{
|
||||
"name": "originating_app_id",
|
||||
"value": "962388314550"
|
||||
},
|
||||
{
|
||||
"name": "actor_is_collaborator_account",
|
||||
"boolValue": false
|
||||
},
|
||||
{
|
||||
"name": "owner",
|
||||
"value": "user2@company.com"
|
||||
},
|
||||
{
|
||||
"name": "owner_is_shared_drive",
|
||||
"boolValue": false
|
||||
},
|
||||
{
|
||||
"name": "owner_is_team_drive",
|
||||
"boolValue": false
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"type": "acl_change",
|
||||
"name": "change_user_access",
|
||||
"parameters": [
|
||||
{
|
||||
"name": "primary_event",
|
||||
"boolValue": false
|
||||
},
|
||||
{
|
||||
"name": "billable",
|
||||
"boolValue": true
|
||||
},
|
||||
{
|
||||
"name": "visibility_change",
|
||||
"value": "none"
|
||||
},
|
||||
{
|
||||
"name": "target_user",
|
||||
"value": "user2@company.com"
|
||||
},
|
||||
{
|
||||
"name": "old_value",
|
||||
"multiValue": [
|
||||
"none"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "new_value",
|
||||
"multiValue": [
|
||||
"owner"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "old_visibility",
|
||||
"value": "unknown"
|
||||
},
|
||||
{
|
||||
"name": "doc_id",
|
||||
"value": "1d4c31Qjtxu6BGWOmVbAjJ2OaKZRZJId5"
|
||||
},
|
||||
{
|
||||
"name": "doc_type",
|
||||
"value": "unknown"
|
||||
},
|
||||
{
|
||||
"name": "doc_title",
|
||||
"value": "fdaf7afe-7e4d-4359-82bd-f01a9867f535-chunk-161619"
|
||||
},
|
||||
{
|
||||
"name": "visibility",
|
||||
"value": "private"
|
||||
},
|
||||
{
|
||||
"name": "originating_app_id",
|
||||
"value": "962388314550"
|
||||
},
|
||||
{
|
||||
"name": "actor_is_collaborator_account",
|
||||
"boolValue": false
|
||||
},
|
||||
{
|
||||
"name": "owner",
|
||||
"value": "user2@company.com"
|
||||
},
|
||||
{
|
||||
"name": "owner_is_shared_drive",
|
||||
"boolValue": false
|
||||
},
|
||||
{
|
||||
"name": "owner_is_team_drive",
|
||||
"boolValue": false
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"type": "acl_change",
|
||||
"name": "change_acl_editors",
|
||||
"parameters": [
|
||||
{
|
||||
"name": "primary_event",
|
||||
"boolValue": false
|
||||
},
|
||||
{
|
||||
"name": "billable",
|
||||
"boolValue": true
|
||||
},
|
||||
{
|
||||
"name": "visibility_change",
|
||||
"value": "none"
|
||||
},
|
||||
{
|
||||
"name": "old_value",
|
||||
"multiValue": [
|
||||
"owner"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "new_value",
|
||||
"multiValue": [
|
||||
"owner",
|
||||
"writers"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "old_visibility",
|
||||
"value": "unknown"
|
||||
},
|
||||
{
|
||||
"name": "doc_id",
|
||||
"value": "1d4c31Qjtxu6BGWOmVbAjJ2OaKZRZJId5"
|
||||
},
|
||||
{
|
||||
"name": "doc_type",
|
||||
"value": "unknown"
|
||||
},
|
||||
{
|
||||
"name": "doc_title",
|
||||
"value": "fdaf7afe-7e4d-4359-82bd-f01a9867f535-chunk-161619"
|
||||
},
|
||||
{
|
||||
"name": "visibility",
|
||||
"value": "private"
|
||||
},
|
||||
{
|
||||
"name": "originating_app_id",
|
||||
"value": "962388314550"
|
||||
},
|
||||
{
|
||||
"name": "actor_is_collaborator_account",
|
||||
"boolValue": false
|
||||
},
|
||||
{
|
||||
"name": "owner",
|
||||
"value": "user2@company.com"
|
||||
},
|
||||
{
|
||||
"name": "owner_is_shared_drive",
|
||||
"boolValue": false
|
||||
},
|
||||
{
|
||||
"name": "owner_is_team_drive",
|
||||
"boolValue": false
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"type": "access",
|
||||
"name": "add_to_folder",
|
||||
"parameters": [
|
||||
{
|
||||
"name": "primary_event",
|
||||
"boolValue": false
|
||||
},
|
||||
{
|
||||
"name": "billable",
|
||||
"boolValue": true
|
||||
},
|
||||
{
|
||||
"name": "destination_folder_title",
|
||||
"multiValue": [
|
||||
"fdaf7afe-7e4d-4359-82bd-f01a9867f535-CONTENT"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "destination_folder_id",
|
||||
"multiValue": [
|
||||
"1qQ7PiBmHDIkKP_aRdSe7r0-4Rv_im1QU"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "doc_id",
|
||||
"value": "1d4c31Qjtxu6BGWOmVbAjJ2OaKZRZJId5"
|
||||
},
|
||||
{
|
||||
"name": "doc_type",
|
||||
"value": "unknown"
|
||||
},
|
||||
{
|
||||
"name": "doc_title",
|
||||
"value": "fdaf7afe-7e4d-4359-82bd-f01a9867f535-chunk-161619"
|
||||
},
|
||||
{
|
||||
"name": "visibility",
|
||||
"value": "private"
|
||||
},
|
||||
{
|
||||
"name": "originating_app_id",
|
||||
"value": "962388314550"
|
||||
},
|
||||
{
|
||||
"name": "actor_is_collaborator_account",
|
||||
"boolValue": false
|
||||
},
|
||||
{
|
||||
"name": "owner",
|
||||
"value": "user2@company.com"
|
||||
},
|
||||
{
|
||||
"name": "owner_is_shared_drive",
|
||||
"boolValue": false
|
||||
},
|
||||
{
|
||||
"name": "owner_is_team_drive",
|
||||
"boolValue": false
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"event_name": "add_to_folder",
|
||||
"event_type": "access",
|
||||
"primary_event": false,
|
||||
"billable": true,
|
||||
"doc_id": "1d4c31Qjtxu6BGWOmVbAjJ2OaKZRZJId5",
|
||||
"doc_type": "unknown",
|
||||
"doc_title": "fdaf7afe-7e4d-4359-82bd-f01a9867f535-chunk-161619",
|
||||
"visibility": "private",
|
||||
"originating_app_id": "962388314550",
|
||||
"actor_is_collaborator_account": false,
|
||||
"owner": "user2@company.com",
|
||||
"owner_is_shared_drive": false,
|
||||
"owner_is_team_drive": false,
|
||||
"visibility_change": "none",
|
||||
"target_user": "user2@company.com",
|
||||
"old_value": [
|
||||
"owner"
|
||||
],
|
||||
"new_value": [
|
||||
"owner",
|
||||
"writers"
|
||||
],
|
||||
"old_visibility": "unknown",
|
||||
"destination_folder_title": [
|
||||
"fdaf7afe-7e4d-4359-82bd-f01a9867f535-CONTENT"
|
||||
],
|
||||
"destination_folder_id": [
|
||||
"1qQ7PiBmHDIkKP_aRdSe7r0-4Rv_im1QU"
|
||||
]
|
||||
}]
|
||||
|
|
@ -0,0 +1,143 @@
|
|||
[
|
||||
{
|
||||
"kind": "admin#reports#activity",
|
||||
"id": {
|
||||
"time": "2020-11-09T22:47:35.492Z",
|
||||
"uniqueQualifier": "580457398125",
|
||||
"applicationName": "login",
|
||||
"customerId": "C015t6bdl"
|
||||
},
|
||||
"etag": "\"PNA2ZR3TS-DeL8kB7gQOm1H5qhZ72uyN90kw26wJK68/qRTs0K2awPrx072aa47TG1SS1bc\"",
|
||||
"actor": {
|
||||
"email": "user7@company.com",
|
||||
"profileId": "106497629058682804316"
|
||||
},
|
||||
"ipAddress": "52.52.52.52",
|
||||
"events": [
|
||||
{
|
||||
"type": "login",
|
||||
"name": "login_success",
|
||||
"parameters": [
|
||||
{
|
||||
"name": "login_type",
|
||||
"value": "google_password"
|
||||
},
|
||||
{
|
||||
"name": "login_challenge_method",
|
||||
"multiValue": [
|
||||
"password",
|
||||
"google_prompt"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "is_suspicious",
|
||||
"boolValue": false
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"event_name": "login_success",
|
||||
"event_type": "login",
|
||||
"login_type": "google_password",
|
||||
"login_challenge_method": [
|
||||
"password",
|
||||
"google_prompt"
|
||||
],
|
||||
"is_suspicious": false
|
||||
},
|
||||
{
|
||||
"kind": "admin#reports#activity",
|
||||
"id": {
|
||||
"time": "2020-11-09T22:47:35.492Z",
|
||||
"uniqueQualifier": "580457398125",
|
||||
"applicationName": "login",
|
||||
"customerId": "C015t6bdl"
|
||||
},
|
||||
"etag": "\"PNA2ZR3TS-DeL8kB7gQOm1H5qhZ72uyN90kw26wJK68/pl8MssSkEmdfxMuRwCL7PUqy24Q\"",
|
||||
"actor": {
|
||||
"email": "user7@company.com",
|
||||
"profileId": "106497629058682804316"
|
||||
},
|
||||
"ipAddress": "52.52.52.52",
|
||||
"events": [
|
||||
{
|
||||
"type": "login",
|
||||
"name": "login_verification",
|
||||
"parameters": [
|
||||
{
|
||||
"name": "login_type",
|
||||
"value": "google_password"
|
||||
},
|
||||
{
|
||||
"name": "login_challenge_method",
|
||||
"multiValue": [
|
||||
"google_prompt"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "login_challenge_status",
|
||||
"value": "passed"
|
||||
},
|
||||
{
|
||||
"name": "is_second_factor",
|
||||
"boolValue": true
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"event_name": "login_verification",
|
||||
"event_type": "login",
|
||||
"login_type": "google_password",
|
||||
"login_challenge_method": [
|
||||
"google_prompt"
|
||||
],
|
||||
"login_challenge_status": "passed",
|
||||
"is_second_factor": true
|
||||
},
|
||||
{
|
||||
"kind": "admin#reports#activity",
|
||||
"id": {
|
||||
"time": "2020-11-09T22:46:21.209Z",
|
||||
"uniqueQualifier": "580457398125",
|
||||
"applicationName": "login",
|
||||
"customerId": "C015t6bdl"
|
||||
},
|
||||
"etag": "\"PNA2ZR3TS-DeL8kB7gQOm1H5qhZ72uyN90kw26wJK68/QoYAsdEim4IfdaYn4RWHvFOYyMo\"",
|
||||
"actor": {
|
||||
"email": "user7@company.com",
|
||||
"profileId": "106497629058682804316"
|
||||
},
|
||||
"ipAddress": "52.52.52.52",
|
||||
"events": [
|
||||
{
|
||||
"type": "login",
|
||||
"name": "login_success",
|
||||
"parameters": [
|
||||
{
|
||||
"name": "login_type",
|
||||
"value": "google_password"
|
||||
},
|
||||
{
|
||||
"name": "login_challenge_method",
|
||||
"multiValue": [
|
||||
"password",
|
||||
"google_prompt"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "is_suspicious",
|
||||
"boolValue": false
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"event_name": "login_success",
|
||||
"event_type": "login",
|
||||
"login_type": "google_password",
|
||||
"login_challenge_method": [
|
||||
"password",
|
||||
"google_prompt"
|
||||
],
|
||||
"is_suspicious": false
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,212 @@
|
|||
[
|
||||
{
|
||||
"kind": "admin#reports#activity",
|
||||
"id": {
|
||||
"time": "2020-11-10T07:40:06.247Z",
|
||||
"uniqueQualifier": "807164129565765223",
|
||||
"applicationName": "mobile",
|
||||
"customerId": "C015t6bdl"
|
||||
},
|
||||
"etag": "\"PNA2ZR3TS-DeL8kB7gQOm1H5qhZ72uyN90kw26wJK68/7atyZfyMUhruHx8ILVKc3eCprTA\"",
|
||||
"actor": {
|
||||
"callerType": "USER",
|
||||
"email": "user8@company.com",
|
||||
"profileId": "115119904266583144094"
|
||||
},
|
||||
"events": [
|
||||
{
|
||||
"type": "device_updates",
|
||||
"name": "DEVICE_SYNC_EVENT",
|
||||
"parameters": [
|
||||
{
|
||||
"name": "USER_EMAIL",
|
||||
"value": "user8@company.com"
|
||||
},
|
||||
{
|
||||
"name": "DEVICE_ID",
|
||||
"value": "260bbc87-0f0b-490e-8bcb-452d7e0b0df1"
|
||||
},
|
||||
{
|
||||
"name": "SERIAL_NUMBER",
|
||||
"value": ""
|
||||
},
|
||||
{
|
||||
"name": "DEVICE_TYPE",
|
||||
"value": "MAC"
|
||||
},
|
||||
{
|
||||
"name": "DEVICE_MODEL",
|
||||
"value": "Mac"
|
||||
},
|
||||
{
|
||||
"name": "RESOURCE_ID",
|
||||
"value": "AFiQxQ_8LfqYBExwWEth5ZjFv1a3rCZiF15vjsDTuJDEK8aaS1vNSuG6MQvimuBK0gxhW2xSHKISKD-X_qIQfJafyybk8c6kc9FhV2gJtqYxgYhLSW1oP3kL7zAq5HMRAo4eqK19hZIA"
|
||||
},
|
||||
{
|
||||
"name": "IOS_VENDOR_ID",
|
||||
"value": ""
|
||||
},
|
||||
{
|
||||
"name": "LAST_SYNC_AUDIT_DATE",
|
||||
"intValue": "1604994006247"
|
||||
},
|
||||
{
|
||||
"name": "OS_VERSION",
|
||||
"value": "macOS 10.15.7"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"event_name": "DEVICE_SYNC_EVENT",
|
||||
"event_type": "device_updates",
|
||||
"USER_EMAIL": "user8@company.com",
|
||||
"DEVICE_ID": "260bbc87-0f0b-490e-8bcb-452d7e0b0df1",
|
||||
"SERIAL_NUMBER": "",
|
||||
"DEVICE_TYPE": "MAC",
|
||||
"DEVICE_MODEL": "Mac",
|
||||
"RESOURCE_ID": "AFiQxQ_8LfqYBExwWEth5ZjFv1a3rCZiF15vjsDTuJDEK8aaS1vNSuG6MQvimuBK0gxhW2xSHKISKD-X_qIQfJafyybk8c6kc9FhV2gJtqYxgYhLSW1oP3kL7zAq5HMRAo4eqK19hZIA",
|
||||
"IOS_VENDOR_ID": "",
|
||||
"LAST_SYNC_AUDIT_DATE": "1604994006247",
|
||||
"OS_VERSION": "macOS 10.15.7"
|
||||
},
|
||||
{
|
||||
"kind": "admin#reports#activity",
|
||||
"id": {
|
||||
"time": "2020-11-10T07:32:38.235Z",
|
||||
"uniqueQualifier": "-3017575058430309758",
|
||||
"applicationName": "mobile",
|
||||
"customerId": "C015t6bdl"
|
||||
},
|
||||
"etag": "\"PNA2ZR3TS-DeL8kB7gQOm1H5qhZ72uyN90kw26wJK68/kZYYpMUM4rlsDcIxTEkUyZaLAoY\"",
|
||||
"actor": {
|
||||
"callerType": "USER",
|
||||
"email": "user9@company.com",
|
||||
"profileId": "106006796177445084667"
|
||||
},
|
||||
"events": [
|
||||
{
|
||||
"type": "device_updates",
|
||||
"name": "DEVICE_SYNC_EVENT",
|
||||
"parameters": [
|
||||
{
|
||||
"name": "USER_EMAIL",
|
||||
"value": "user9@company.com"
|
||||
},
|
||||
{
|
||||
"name": "DEVICE_ID",
|
||||
"value": "b717eaf0-65ea-4e1f-bbe4-69503db4952f"
|
||||
},
|
||||
{
|
||||
"name": "SERIAL_NUMBER",
|
||||
"value": ""
|
||||
},
|
||||
{
|
||||
"name": "DEVICE_TYPE",
|
||||
"value": "WINDOWS"
|
||||
},
|
||||
{
|
||||
"name": "DEVICE_MODEL",
|
||||
"value": "Windows"
|
||||
},
|
||||
{
|
||||
"name": "RESOURCE_ID",
|
||||
"value": "AFiQxQ9Hnb__JdI8sdIBO8Bn_ItdeZjUyKIoDsnCDNi7hUeXSEnp25yhPPkipdGaTSZ2icCvwE5rjgAj_RjbnktyEVDnKBxKjXxvYxspxdI9jAwRgBmohYNgRZI6dh16UzJqLR3gXGGG"
|
||||
},
|
||||
{
|
||||
"name": "IOS_VENDOR_ID",
|
||||
"value": ""
|
||||
},
|
||||
{
|
||||
"name": "LAST_SYNC_AUDIT_DATE",
|
||||
"intValue": "1604993558235"
|
||||
},
|
||||
{
|
||||
"name": "OS_VERSION",
|
||||
"value": "Windows 10.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"event_name": "DEVICE_SYNC_EVENT",
|
||||
"event_type": "device_updates",
|
||||
"USER_EMAIL": "user9@company.com",
|
||||
"DEVICE_ID": "b717eaf0-65ea-4e1f-bbe4-69503db4952f",
|
||||
"SERIAL_NUMBER": "",
|
||||
"DEVICE_TYPE": "WINDOWS",
|
||||
"DEVICE_MODEL": "Windows",
|
||||
"RESOURCE_ID": "AFiQxQ9Hnb__JdI8sdIBO8Bn_ItdeZjUyKIoDsnCDNi7hUeXSEnp25yhPPkipdGaTSZ2icCvwE5rjgAj_RjbnktyEVDnKBxKjXxvYxspxdI9jAwRgBmohYNgRZI6dh16UzJqLR3gXGGG",
|
||||
"IOS_VENDOR_ID": "",
|
||||
"LAST_SYNC_AUDIT_DATE": "1604993558235",
|
||||
"OS_VERSION": "Windows 10.0"
|
||||
},
|
||||
{
|
||||
"kind": "admin#reports#activity",
|
||||
"id": {
|
||||
"time": "2020-11-10T05:44:39.348Z",
|
||||
"uniqueQualifier": "-2326063914297949006",
|
||||
"applicationName": "mobile",
|
||||
"customerId": "C015t6bdl"
|
||||
},
|
||||
"etag": "\"PNA2ZR3TS-DeL8kB7gQOm1H5qhZ72uyN90kw26wJK68/yNB8_QB300VC4j4TW3rTiHzWsbs\"",
|
||||
"actor": {
|
||||
"callerType": "USER",
|
||||
"email": "user10@company.com",
|
||||
"profileId": "107768716075060161935"
|
||||
},
|
||||
"events": [
|
||||
{
|
||||
"type": "device_updates",
|
||||
"name": "DEVICE_SYNC_EVENT",
|
||||
"parameters": [
|
||||
{
|
||||
"name": "USER_EMAIL",
|
||||
"value": "user10@company.com"
|
||||
},
|
||||
{
|
||||
"name": "DEVICE_ID",
|
||||
"value": "cec57193-aabf-42d9-baf0-bb2d6cfba938"
|
||||
},
|
||||
{
|
||||
"name": "SERIAL_NUMBER",
|
||||
"value": "VMware-56 4d 82 d4 91 8c f3 92-61 1d a4 e3 f3 d7 22 42"
|
||||
},
|
||||
{
|
||||
"name": "DEVICE_TYPE",
|
||||
"value": "WINDOWS"
|
||||
},
|
||||
{
|
||||
"name": "DEVICE_MODEL",
|
||||
"value": "VMware7,1"
|
||||
},
|
||||
{
|
||||
"name": "RESOURCE_ID",
|
||||
"value": "AFiQxQ9Hnb__JdI8sdIBO8Bn_Itd8n9FNLAgDtkb-SwGZz5mKeiSPyNLUZSnL5U6QyUyj6kN_DC5QOmrEiw7H-8AM8gcZHO5AIxKXS-vMRBW6pSLajU_oL4fA3FghTcm8kv6qY-kNFWK"
|
||||
},
|
||||
{
|
||||
"name": "IOS_VENDOR_ID",
|
||||
"value": ""
|
||||
},
|
||||
{
|
||||
"name": "LAST_SYNC_AUDIT_DATE",
|
||||
"intValue": "1604987079348"
|
||||
},
|
||||
{
|
||||
"name": "OS_VERSION",
|
||||
"value": "Windows/10.0.19041"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"event_name": "DEVICE_SYNC_EVENT",
|
||||
"event_type": "device_updates",
|
||||
"USER_EMAIL": "user10@company.com",
|
||||
"DEVICE_ID": "cec57193-aabf-42d9-baf0-bb2d6cfba938",
|
||||
"SERIAL_NUMBER": "VMware-56 4d 82 d4 91 8c f3 92-61 1d a4 e3 f3 d7 22 42",
|
||||
"DEVICE_TYPE": "WINDOWS",
|
||||
"DEVICE_MODEL": "VMware7,1",
|
||||
"RESOURCE_ID": "AFiQxQ9Hnb__JdI8sdIBO8Bn_Itd8n9FNLAgDtkb-SwGZz5mKeiSPyNLUZSnL5U6QyUyj6kN_DC5QOmrEiw7H-8AM8gcZHO5AIxKXS-vMRBW6pSLajU_oL4fA3FghTcm8kv6qY-kNFWK",
|
||||
"IOS_VENDOR_ID": "",
|
||||
"LAST_SYNC_AUDIT_DATE": "1604987079348",
|
||||
"OS_VERSION": "Windows/10.0.19041"
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,306 @@
|
|||
[
|
||||
{
|
||||
"kind": "admin#reports#activity",
|
||||
"id": {
|
||||
"time": "2020-11-10T07:26:03.025Z",
|
||||
"uniqueQualifier": "263854139942284975",
|
||||
"applicationName": "token",
|
||||
"customerId": "C015t6bdl"
|
||||
},
|
||||
"etag": "\"PNA2ZR3TS-DeL8kB7gQOm1H5qhZ72uyN90kw26wJK68/-z59T0Ak79tR1Ovt5CseyUI2H0w\"",
|
||||
"actor": {
|
||||
"email": "user4@company.com",
|
||||
"profileId": "109950366970271381671"
|
||||
},
|
||||
"ipAddress": "52.52.51.51",
|
||||
"events": [
|
||||
{
|
||||
"name": "authorize",
|
||||
"parameters": [
|
||||
{
|
||||
"name": "client_id",
|
||||
"value": "905154081809-858sm3f0qnalqd9d44d9gecjtrdji9tf.apps.googleusercontent.com"
|
||||
},
|
||||
{
|
||||
"name": "app_name",
|
||||
"value": "Notion"
|
||||
},
|
||||
{
|
||||
"name": "client_type",
|
||||
"value": "WEB"
|
||||
},
|
||||
{
|
||||
"name": "scope_data",
|
||||
"multiMessageValue": [
|
||||
{
|
||||
"parameter": [
|
||||
{
|
||||
"name": "scope_name",
|
||||
"value": "https://www.googleapis.com/auth/userinfo.profile"
|
||||
},
|
||||
{
|
||||
"name": "product_bucket",
|
||||
"multiValue": [
|
||||
"IDENTITY"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"parameter": [
|
||||
{
|
||||
"name": "scope_name",
|
||||
"value": "https://www.googleapis.com/auth/userinfo.email"
|
||||
},
|
||||
{
|
||||
"name": "product_bucket",
|
||||
"multiValue": [
|
||||
"IDENTITY"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"parameter": [
|
||||
{
|
||||
"name": "scope_name",
|
||||
"value": "openid"
|
||||
},
|
||||
{
|
||||
"name": "product_bucket",
|
||||
"multiValue": [
|
||||
"IDENTITY"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "scope",
|
||||
"multiValue": [
|
||||
"https://www.googleapis.com/auth/userinfo.profile",
|
||||
"https://www.googleapis.com/auth/userinfo.email",
|
||||
"openid"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"event_name": "authorize",
|
||||
"client_id": "905154081809-858sm3f0qnalqd9d44d9gecjtrdji9tf.apps.googleusercontent.com",
|
||||
"app_name": "Notion",
|
||||
"client_type": "WEB",
|
||||
"scope_data": [
|
||||
{
|
||||
"parameter": [
|
||||
{
|
||||
"name": "scope_name",
|
||||
"value": "https://www.googleapis.com/auth/userinfo.profile"
|
||||
},
|
||||
{
|
||||
"name": "product_bucket",
|
||||
"multiValue": [
|
||||
"IDENTITY"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"parameter": [
|
||||
{
|
||||
"name": "scope_name",
|
||||
"value": "https://www.googleapis.com/auth/userinfo.email"
|
||||
},
|
||||
{
|
||||
"name": "product_bucket",
|
||||
"multiValue": [
|
||||
"IDENTITY"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"parameter": [
|
||||
{
|
||||
"name": "scope_name",
|
||||
"value": "openid"
|
||||
},
|
||||
{
|
||||
"name": "product_bucket",
|
||||
"multiValue": [
|
||||
"IDENTITY"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"scope": [
|
||||
"https://www.googleapis.com/auth/userinfo.profile",
|
||||
"https://www.googleapis.com/auth/userinfo.email",
|
||||
"openid"
|
||||
]
|
||||
},
|
||||
{
|
||||
"kind": "admin#reports#activity",
|
||||
"id": {
|
||||
"time": "2020-11-10T07:09:12.775Z",
|
||||
"uniqueQualifier": "-8365551478938402017",
|
||||
"applicationName": "token",
|
||||
"customerId": "C015t6bdl"
|
||||
},
|
||||
"etag": "\"PNA2ZR3TS-DeL8kB7gQOm1H5qhZ72uyN90kw26wJK68/ZfUEeiwXTk1D4X3WGB620lHkOe4\"",
|
||||
"actor": {
|
||||
"email": "user11@company.com",
|
||||
"profileId": "113050896481365905439"
|
||||
},
|
||||
"events": [
|
||||
{
|
||||
"name": "revoke",
|
||||
"parameters": [
|
||||
{
|
||||
"name": "client_id",
|
||||
"value": "77185425430.apps.googleusercontent.com"
|
||||
},
|
||||
{
|
||||
"name": "app_name",
|
||||
"value": "Google Chrome"
|
||||
},
|
||||
{
|
||||
"name": "client_type",
|
||||
"value": "NATIVE_DESKTOP"
|
||||
},
|
||||
{
|
||||
"name": "scope_data",
|
||||
"multiMessageValue": [
|
||||
{
|
||||
"parameter": [
|
||||
{
|
||||
"name": "scope_name",
|
||||
"value": "https://www.google.com/accounts/OAuthLogin"
|
||||
},
|
||||
{
|
||||
"name": "product_bucket",
|
||||
"multiValue": [
|
||||
"IDENTITY"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "scope",
|
||||
"multiValue": [
|
||||
"https://www.google.com/accounts/OAuthLogin"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"event_name": "revoke",
|
||||
"client_id": "77185425430.apps.googleusercontent.com",
|
||||
"app_name": "Google Chrome",
|
||||
"client_type": "NATIVE_DESKTOP",
|
||||
"scope_data": [
|
||||
{
|
||||
"parameter": [
|
||||
{
|
||||
"name": "scope_name",
|
||||
"value": "https://www.google.com/accounts/OAuthLogin"
|
||||
},
|
||||
{
|
||||
"name": "product_bucket",
|
||||
"multiValue": [
|
||||
"IDENTITY"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"scope": [
|
||||
"https://www.google.com/accounts/OAuthLogin"
|
||||
]
|
||||
},
|
||||
{
|
||||
"kind": "admin#reports#activity",
|
||||
"id": {
|
||||
"time": "2020-11-10T07:06:08.260Z",
|
||||
"uniqueQualifier": "-6471256844859974580",
|
||||
"applicationName": "token",
|
||||
"customerId": "C015t6bdl"
|
||||
},
|
||||
"etag": "\"PNA2ZR3TS-DeL8kB7gQOm1H5qhZ72uyN90kw26wJK68/l-Tw2SYGlaQiYRZPTIdxwXwyYLM\"",
|
||||
"actor": {
|
||||
"email": "user8@company.com",
|
||||
"profileId": "115119904266583144094"
|
||||
},
|
||||
"events": [
|
||||
{
|
||||
"name": "revoke",
|
||||
"parameters": [
|
||||
{
|
||||
"name": "client_id",
|
||||
"value": "77185425430.apps.googleusercontent.com"
|
||||
},
|
||||
{
|
||||
"name": "app_name",
|
||||
"value": "Google Chrome"
|
||||
},
|
||||
{
|
||||
"name": "client_type",
|
||||
"value": "NATIVE_DESKTOP"
|
||||
},
|
||||
{
|
||||
"name": "scope_data",
|
||||
"multiMessageValue": [
|
||||
{
|
||||
"parameter": [
|
||||
{
|
||||
"name": "scope_name",
|
||||
"value": "https://www.google.com/accounts/OAuthLogin"
|
||||
},
|
||||
{
|
||||
"name": "product_bucket",
|
||||
"multiValue": [
|
||||
"IDENTITY"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "scope",
|
||||
"multiValue": [
|
||||
"https://www.google.com/accounts/OAuthLogin"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"event_name": "revoke",
|
||||
"client_id": "77185425430.apps.googleusercontent.com",
|
||||
"app_name": "Google Chrome",
|
||||
"client_type": "NATIVE_DESKTOP",
|
||||
"scope_data": [
|
||||
{
|
||||
"parameter": [
|
||||
{
|
||||
"name": "scope_name",
|
||||
"value": "https://www.google.com/accounts/OAuthLogin"
|
||||
},
|
||||
{
|
||||
"name": "product_bucket",
|
||||
"multiValue": [
|
||||
"IDENTITY"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"scope": [
|
||||
"https://www.google.com/accounts/OAuthLogin"
|
||||
]
|
||||
}
|
||||
]
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
[
|
||||
{
|
||||
"kind": "admin#reports#activity",
|
||||
"id": {
|
||||
"time": "2020-11-09T10:14:02.479Z",
|
||||
"uniqueQualifier": "-2334993606374064106",
|
||||
"applicationName": "user_accounts",
|
||||
"customerId": "C015t6bdl"
|
||||
},
|
||||
"etag": "\"PNA2ZR3TS-DeL8kB7gQOm1H5qhZ72uyN90kw26wJK68/O1IKOh4avuA36XST-zl9ImDj8WY\"",
|
||||
"actor": {
|
||||
"callerType": "USER",
|
||||
"email": "j.grygorenko@socprime.com",
|
||||
"profileId": "103558135127700430349"
|
||||
},
|
||||
"ipAddress": "165.225.207.72",
|
||||
"events": [
|
||||
{
|
||||
"type": "2sv_change",
|
||||
"name": "2sv_enroll"
|
||||
}
|
||||
],
|
||||
"event_name": "2sv_enroll",
|
||||
"event_type": "2sv_change"
|
||||
},
|
||||
{
|
||||
"kind": "admin#reports#activity",
|
||||
"id": {
|
||||
"time": "2020-11-09T10:06:27.007Z",
|
||||
"uniqueQualifier": "-3699579413926466948",
|
||||
"applicationName": "user_accounts",
|
||||
"customerId": "C015t6bdl"
|
||||
},
|
||||
"etag": "\"PNA2ZR3TS-DeL8kB7gQOm1H5qhZ72uyN90kw26wJK68/9fkBiZLNrDBbKaY4dRdAgVpuYs0\"",
|
||||
"actor": {
|
||||
"callerType": "USER",
|
||||
"email": "j.grygorenko@socprime.com",
|
||||
"profileId": "103558135127700430349"
|
||||
},
|
||||
"ipAddress": "165.225.207.41",
|
||||
"events": [
|
||||
{
|
||||
"type": "password_change",
|
||||
"name": "password_edit"
|
||||
}
|
||||
],
|
||||
"event_name": "password_edit",
|
||||
"event_type": "password_change"
|
||||
}
|
||||
]
|
||||
Загрузка…
Ссылка в новой задаче