Google Workspace Activities (via Codeless Connector Framework)
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
| Attribute | Value |
|---|---|
| Connector ID | GoogleWorkspaceCCPDefinition |
| Publisher | Microsoft |
| Used in Solutions | GoogleWorkspaceReports |
| Collection Method | CCF |
| Connector Definition Files | GoogleWorkspaceReports_DataConnectorDefinition.json |
| CCF Configuration | GoogleWorkspaceReports_PollingConfig.json |
| CCF Capabilities | OAuth2, Paging |
The Google Workspace Activities data connector provides the capability to ingest Activity Events from Google Workspace API into Microsoft Sentinel.
Tables Ingested
This connector ingests data into the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
GoogleWorkspaceReports |
✓ | ✓ | ? |
💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.
Permissions
Resource Provider Permissions: - Workspace (Workspace): Read and Write permissions are required.
Custom Permissions: - Google Workspace API access: Access to the Google Workspace activities API through Oauth are required.
Setup Instructions
⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
1. Connect to Google Workspace to start collecting user activity logs into Microsoft Sentinel
Configuration steps for the Google Reports API
- Login to Google cloud console with your Workspace Admin credentials https://console.cloud.google.com.
- Using the search option (available at the top middle), Search for APIs & Services
- From APIs & Services -> Enabled APIs & Services, enable Admin SDK API for this project.
- Go to APIs & Services -> OAuth Consent Screen. If not already configured, create a OAuth Consent Screen with the following steps:
- Provide App Name and other mandatory information.
- Pick External as User Type for the Audience.
- Go to APIs & Services -> Credentials and create OAuth 2.0 Client ID
- Click on Create Credentials on the top and select Oauth client Id.
- Select Web Application from the Application Type drop down.
- Provide a suitable name to the Web App and add the Redirect URI in the form below as the Authorized redirect URIs.
- Once you click Create, you will be provided with the Client ID and Client Secret. Copy these values and use them in the configuration steps below.
- Go to Google Auth Platform -> Data Access: Add Admin SDK API scope
Configure steps for the Google Reports API oauth access. Then, provide the required information below and click on Connect.
- OAuth Configuration:
- Client ID
- Client Secret
- Click 'Connect' to authenticate Connector Management Interface
This section is an interactive interface in the Microsoft Sentinel portal that allows you to manage your data collectors.
📊 View Existing Collectors: A management table displays all currently configured data collectors with the following information: - Name - ID
➕ Add New Collector: Click the "Add new collector" button to configure a new data collector (see configuration form below).
💡 Portal-Only Feature: This configuration interface is only available when viewing the connector in the Microsoft Sentinel portal. You cannot configure data collectors through this static documentation.
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊