gcp:workspace
Google Workspace audit logs
Admin, login, drive, gmail
- Host type
- Google Cloud (and Google Workspace)
- Tier, as a whole
- Minimum
- Cost class
- Included
- Techniques
- 12
- Rules listed
- 60
- Events
- 26
Licensing
- License or service
- Workspace editions (per-edition coverage varies)
- What is free
- Admin/Login/Groups audit broadly
- What costs
- Drive/Device detail needs Enterprise-tier
- Notes
- Edition matrix UNCONFIRMED
- Vendor page
- https://knowledge.workspace.google.com/admin/reports/about-reporting-logs-and-bigquery?hl=en
- As read on
- 2026-11-01
A vendor statement as read on the date shown; the cost class is the durable part.
Techniques
- T1080 Taint Shared Content
- T1087.004 Cloud Account
- T1199 Trusted Relationship
- T1528 Steal Application Access Token
- T1537 Transfer Data to Cloud Account
- T1539 Steal Web Session Cookie
- T1548.005 Temporary Elevated Cloud Access
- T1550 Use Alternate Authentication Material
- T1550.001 Application Access Token
- T1552 Unsecured Credentials
- T1648 Serverless Execution
- T1684.001 Impersonation
Rules
Splunk 12
- GCP Authentication Failed During MFA Challenge
- GCP Multi-Factor Authentication Disabled
- GCP Multiple Failed MFA Requests For User
- GCP Multiple Users Failing To Authenticate From Ip
- GCP Successful Single-Factor Authentication
- GCP Unusual Number of Failed Authentications From Ip
- GSuite Email Suspicious Attachment
- Gsuite Drive Share In External Email
- Gsuite Email Suspicious Subject With Attachment
- Gsuite Email With Known Abuse Web Service Link
- Gsuite Outbound Email With Attachment To External Domain
- Gsuite Suspicious Shared File Name
Sigma 10
- Google Workspace Application Access Level Modified by Bryan Lim
- Google Workspace Application Removed by Austin Songer
- Google Workspace Government Attack Warning by Tom Kluter
- Google Workspace Granted Domain API Access by Austin Songer
- Google Workspace MFA Disabled by Austin Songer
- Google Workspace Out Of Domain Email Forwarding by Tom kluter
- Google Workspace Role Modified or Deleted by Austin Songer
- Google Workspace Role Privilege Deleted by Austin Songer
- Google Workspace User Granted Admin Privileges by Austin Songer
- Suspicious Login Activity Classified By Google by Tom Kluter
Elastic 28
- Application Added to Google Workspace Domain
- Application Removed from Blocklist in Google Workspace
- Domain Added to Google Workspace Trusted Domains
- External User Added to Google Workspace Group
- First Time Seen Google Workspace OAuth Login from Third-Party Application
- Forwarded Google Workspace Security Alert
- Google Workspace 2SV Policy Disabled By User
- Google Workspace API Access Granted via Domain-Wide Delegation
- Google Workspace Admin Role Assigned to a User or Group
- Google Workspace Admin Role Deletion
- Google Workspace Bitlocker Setting Disabled
- Google Workspace Custom Admin Role Created
- Google Workspace Device Registration After OAuth from Suspicious ASN
- Google Workspace Device Registration Burst for Single User
- Google Workspace Drive Data Transfer or Takeout Export Initiated
- Google Workspace Drive Encryption Key(s) Accessed from Anonymous User
- Google Workspace Gmail Routing or Forwarding Rule Created or Modified
- Google Workspace Impossible Travel Login
- Google Workspace Login Flagged Suspicious
- Google Workspace MFA Enforcement Disabled For Organization
- Google Workspace Object Copied from External Drive with App Consent
- Google Workspace Password Policy Modified
- Google Workspace Restrictions for Marketplace Modified to Allow Any App
- Google Workspace Role Modified
- Google Workspace Suspended User Account Renewed
- Google Workspace User Login with Unusual ASN
- Google Workspace User Organizational Unit Changed
- Google Workspace User Sign-in from Atypical Device Type
Microsoft Sentinel 10
- GWorkspace - API Access Granted
- GWorkspace - Admin permissions granted
- GWorkspace - Alert events
- GWorkspace - An Outbound Relay has been added to a G Suite Domain
- GWorkspace - Multiple user agents for single source
- GWorkspace - Possible brute force attack
- GWorkspace - Possible maldoc file name in Google drive
- GWorkspace - Two-step authentification disabled for a user
- GWorkspace - Unexpected OS update
- GWorkspace - User access has been changed
Events
Recommended (7)
Listed (19)
- 2sv_disable
- ADD_GROUP_MEMBER
- ADD_PRIVILEGE
- ALLOW_STRONG_AUTHENTICATION
- ASSIGN_ROLE
- CHANGE_GMAIL_SETTING
- copy
- CREATE_APPLICATION_SETTING
- CREATE_DATA_TRANSFER_REQUEST
- CREATE_GMAIL_SETTING
- CUSTOMER_TAKEOUT_CREATED
- DEVICE_REGISTER_UNREGISTER_EVENT
- download
- ENFORCE_STRONG_AUTHENTICATION
- login_success
- MOVE_USER_TO_ORG_UNIT
- UNSUSPEND_USER
- UPDATE_ROLE
- view