Skip to content

Google Workspace (G Suite) Activity

Collects Google Workspace audit/activity logs via the Admin SDK Reports API.

Input specification: input:GSuiteActivity:

Prerequisites

  • Enable the Admin SDK API in your Google Cloud project.
  • Configure a connection:GoogleCloud: with either:
    • a service account JSON file and delegated_user_email (domain-wide delegation), or
    • OAuth client credentials and a refresh_token.

Collector configuration

connection:GoogleCloud:GSuiteConnection:
  credentials_file: ./etc/serviceaccount.json
  delegated_user_email: admin@your-domain.com

input:GSuiteActivity:GSuiteActivity1:
  connection: GSuiteConnection
  application_name: security   # or "login", "admin", "drive", or a list of apps
  user_key: all
  event_delay: 60
  output: gsuite-v1

output:CommLink:gsuite-v1: {}

Configuration options

connection:  # ID of the GoogleCloud connection (required)
output:  # Which output to send the incoming events to (required)
application_name:  # (optional) One app name, list of apps, or "security" for all security-relevant apps (default: login)
user_key:  # (optional) User key or "all" (default: all)
refresh:  # (optional) Polling interval in seconds (default: 10)
event_delay:  # (optional) Delay in seconds before reading recent events (default: 30)
max_results:  # (optional) Maximum results per API page (default: 1000)
encoding:  # (optional) Event encoding (default: utf-8)
proxy:  # (optional) HTTP proxy URL
last_value_storage:  # (optional) Persistent storage for the collection checkpoint (default: ./var/last_value_storage)

When application_name is set to security, the collector polls all security-relevant applications (login, admin, drive, gmail, token, and others).