NG SIEM - GoogleWorkspace Integration

Introduction

The Google Workspace integration collects and parses data from various Google Workspace audit reports APIs using a service account authorized via the Admin SDK API.

Requirements

To ingest data from the Google Reports API, the following must be completed:

An administrator account in Google Workspace.
Enable the Admin SDK API in GCP.
Create and configure a Service Account.
Enable Domain-Wide Delegation for the service account.
Configure the OAuth Consent Screen.

Note this is only applicable for Administrator Account in Google Workspace. Thank you and have a nice day.

Enable Admin SDK API

Complete the following steps:

Select the Google Cloud navigation menu > APIs & Services > Enabled APIs & Services
Search and enable “Admin SDK API” from the API library page

Configure OAuth Consent Screen

Complete the following steps:

Select the Google Cloud navigation menu > APIs & Services > Enabled APIs & Services > OAuth Consent Screen
User Type > Internal > Create
Fill out the following information in subsequent steps
App name:
User support email:
Authorized domains:
Developer contact information:
Save and Continue
Save and Continue
Back to Dashboard

Create a Service Account

To create a service account, do the following:

Select the navigation menu in Google Cloud > APIs & Services > Credentials > Create Credentials > Service Account
Enter the following information:
Service account name: a
Service account ID:
Leave the rest blank and continue
Select your new Service Account > Keys > Add Key > Create New Key > JSON

Enable Domain-wide Delegation

In your GW Admin Console select > Navigation Menu > Security > Access and data control > API controls
Select Manage Domain Wide Delegation > Add New
Client ID: OAuth ID from Service Account in GCP
Google Cloud Console > IAM & Admin > Service Accounts > OAuth 2 Client ID (copy to clipboard)
OAuth Scopes: https://www.googleapis.com/auth/admin.reports.audit.readonly

Please provide the following information to CyTech Support. Thank you

Delegated Account - the email of the administrator account, and not the email of the ServiceAccount.
Jwt JSON - The JSON credentials file downloaded from GCP. Raw contents of the JWT file. Useful when hosting a file along with the agent is not possible. NOTE: Please use either JWT File or JWT JSON parameter.

Reference link: https://www.elastic.co/security-labs/google-workspace-attack-surface-part-two

If you need further assistance, kindly contact our support at support@cytechint.com for prompt assistance and guidance.