-
Notifications
You must be signed in to change notification settings - Fork 389
/
Copy pathgoogle_workspace.yml
101 lines (101 loc) · 2.17 KB
/
google_workspace.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
name: Google Workspace
id: f1a044e3-113a-4e4d-84f2-b153ade83087
version: 1
date: '2025-02-21'
author: Bhavin Patel, Splunk
description: Data source object for Google Workspace
source: google_workspace
sourcetype: gws:reports:login
supported_TA:
- name: Splunk Add-on for Google Workspace
url: https://splunkbase.splunk.com/app/5556
version: 3.0.3
fields:
- action
- actor.callerType
- actor.email
- actor.profileId
- app
- change_type
- command
- date_hour
- date_mday
- date_minute
- date_month
- date_second
- date_wday
- date_year
- date_zone
- dest
- dest_name
- dest_url
- dvc
- email
- etag
- event.name
- event.parameters{}.name
- event.parameters{}.value
- event.type
- eventtype
- filter_action
- host
- id.applicationName
- id.customerId
- id.time
- id.uniqueQualifier
- index
- internal_message_id
- ipAddress
- kind
- linecount
- message_id
- object
- object_attrs
- object_category
- object_id
- object_path
- owner
- owner_email
- protocol
- punct
- result
- result_id
- signature_extra
- source
- sourcetype
- splunk_server
- splunk_server_group
- src
- src_user
- src_user_id
- src_user_name
- src_user_type
- status
- tag
- tag::action
- tag::app
- tag::eventtype
- tag::object_category
- tenant_id
- timeendpos
- timestartpos
- user
- user_email
- user_email_extracted
- user_id
- user_name
- user_type
- vendor_account
- vendor_product
- _bkt
- _cd
- _eventtype_color
- _indextime
- _raw
- _serial
- _si
- _sourcetype
- _subsecond
- _time
example_log: |-
"kind": "admin#reports#activity", "id": {"time": "2022-10-12T18:00:23.093Z", "uniqueQualifier": "-7844406841853338111", "applicationName": "admin", "customerId": "C046r85ir"}, "etag": "\"JCPRxFaiNR1s5TJ6ecIH8OpGdY4efiOYXbIB65itOzY/afZBU3WDeiuPqFyleWyTnwyU3fE\"", "actor": {"callerType": "USER", "email": "[email protected]", "profileId": "100059258581444193973"}, "ipAddress": "22.33.111.55", "event": {"type": "USER_SETTINGS", "name": "UNENROLL_USER_FROM_STRONG_AUTH", "parameters": [{"name": "USER_EMAIL", "value": "[email protected]"}]}}