Knowledge Packs

Gsuite

OverviewResources

Compliance

Reports

Gsuite - Login and logout activities: This report gives information about all the login and logout activities detected in G Suite. Report contains IP address, username, action as logout, successful login or login failure, logon type and suspicious login, and other information.

Operations

Reports

Gsuite - Admin Activities: This report gives the information about the admin activities such as user creation, email log search, google chrome search, hangout activities, etc. Reports contains IP address, username, Customer ID, log type and other fields useful for further investigation.
Gsuite - Mobile Activities: This report gives the information about all the mobile activities such as device application change, OS update, device compliance status, device action, device ownership, device settings change etc. Reports contains User email, device ID, Device type, device events, etc. which can be used for further investigation.
Gsuite - Token Activities: This report gives information about all the OAuth token audit activity events like authorize and revoke. Reports contains IP address, application name that accessed the token, action as authorize or revoke and other details for further investigation.

Security

Alerts

Gsuite - Login failed: This alert is generated when user fails to login.
Gsuite - Suspicious login: This alert is generated when any suspicious login is detected.

Reports

G Suite - Login Failure - This report gives information regarding all the login failures detected in Gsuite. Reports contains IP address, logon type, username and other useful information for further analysis.

Scope

The configuration details are consistent with EventTracker version 9.x and later and Gsuite.

Documentation

To configure Gsuite to send logs to EventTracker, refer the How to Guide.

For more information, please refer the Integration guide.