GWorkspace_ReportsAPI_drive_CL

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Tables Index

Attribute Value
Custom Log V1 Yes 🔶 — uses type-suffixed column names
Ingestion API Supported ✓ Yes

Contents

Schema (33 columns)

Source: KQL validation test schema

Column Name Type
actor_email_s string
actor_profileId_s string
destination_folder_id_s string
destination_folder_title_s string
doc_id_s string
doc_title_s string
doc_type_s string
etag_s string
event_name_s string
event_type_s string
EventProduct string
events_s string
EventVendor string
id_applicationName_s string
id_customerId_s string
id_time_t datetime
id_uniqueQualifier_s string
IPAddress string
ishared_drive_id_s string
kind_s string
new_value_s string
old_value_s string
old_visibility_s string
originating_app_id_s string
owner_s string
source_folder_id_s string
source_folder_title_s string
target_domain_s string
target_user_s string
team_drive_id_s string
TimeGenerated datetime
visibility_change_s string
visibility_s string

Solutions (1)

This table is used by the following solutions:

Connectors (1)

This table is ingested by the following connectors:

Connector Selection Criteria
[DEPRECATED] Google Workspace (G Suite)

Content Items Using This Table (25)

Analytic Rules (10)

In solution GoogleWorkspaceReports:

Analytic Rule Selection Criteria
GWorkspace - API Access Granted
GWorkspace - Admin permissions granted
GWorkspace - Alert events
GWorkspace - An Outbound Relay has been added to a G Suite Domain
GWorkspace - Multiple user agents for single source
GWorkspace - Possible brute force attack
GWorkspace - Possible maldoc file name in Google drive
GWorkspace - Two-step authentification disabled for a user
GWorkspace - Unexpected OS update
GWorkspace - User access has been changed

Hunting Queries (14)

In solution GoogleWorkspaceReports:

Hunting Query Selection Criteria
GWorkspace - Document Copied from Share Drive to Private Drive
GWorkspace - Document shared externally
GWorkspace - Document shared publicy in web
GWorkspace - Document shared publicy with link
GWorkspace - License Revoke and Assignment to User
GWorkspace - Multi IP addresses by user
GWorkspace - Possible SCAM/SPAM or Phishing via Calendar
GWorkspace - Rare document types by users
GWorkspace - Shared private document
GWorkspace - Suspended users
GWorkspace - Uncommon user agent strings
GWorkspace - Unknown login type
GWorkspace - User reported calendar invite as spam
GWorkspace - Users with several devices

Workbooks (1)

In solution GoogleWorkspaceReports:

Workbook Selection Criteria
GoogleWorkspace

Parsers Using This Table (2)

ASIM Parsers (1)

Parser Schema Product Selection Criteria
ASimFileEventGoogleWorkspace FileEvent Google Workspace

Other Parsers (1)

Parser Solution Selection Criteria
GWorkspaceActivityReports GoogleWorkspaceReports

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Tables Index