mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
53 lines
2.1 KiB
YAML
53 lines
2.1 KiB
YAML
name: G Suite Drive
|
|
id: 5f79120f-a235-4468-bd0d-55203758ac22
|
|
version: 3
|
|
creation_date: '2024-05-22'
|
|
modification_date: '2026-05-13'
|
|
author: Patrick Bareiss, Splunk
|
|
description: Logs activities related to Google Drive in G Suite, including file creation, modification, sharing, and access details.
|
|
mitre_components:
|
|
- File Access
|
|
- File Creation
|
|
- File Modification
|
|
- Cloud Storage Access
|
|
- Cloud Storage Metadata
|
|
source: http:gsuite
|
|
sourcetype: gsuite:drive:json
|
|
supported_TA:
|
|
- name: Splunk Add-on for Google Workspace
|
|
url: https://splunkbase.splunk.com/app/5556
|
|
version: 3.1.1
|
|
fields:
|
|
- _time
|
|
- email
|
|
- host
|
|
- index
|
|
- ip_address
|
|
- linecount
|
|
- name
|
|
- parameters.actor_is_collaborator_account
|
|
- parameters.billable
|
|
- parameters.doc_id
|
|
- parameters.doc_title
|
|
- parameters.doc_type
|
|
- parameters.is_encrypted
|
|
- parameters.new_value{}
|
|
- parameters.old_value{}
|
|
- parameters.old_visibility
|
|
- parameters.originating_app_id
|
|
- parameters.owner
|
|
- parameters.owner_is_shared_drive
|
|
- parameters.owner_is_team_drive
|
|
- parameters.primary_event
|
|
- parameters.target_user
|
|
- parameters.visibility
|
|
- parameters.visibility_change
|
|
- punct
|
|
- source
|
|
- sourcetype
|
|
- splunk_server
|
|
- timestamp
|
|
- type
|
|
- unique_id
|
|
example_log: '{"type": "acl_change", "name": "change_user_access", "parameters": {"primary_event": true, "billable": true, "visibility_change": "none", "target_user": "alberto@internal_test_email.com", "old_value": ["none"], "new_value": ["can_edit"], "old_visibility": "private", "doc_id": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "doc_type": "spreadsheet", "is_encrypted": false, "doc_title": "Invoice-11111 FedEx - Delivery - Dummy Detection POC", "visibility": "shared_internally", "originating_app_id": "000000000001", "actor_is_collaborator_account": false, "owner": "peter@external_test_email.com", "owner_is_shared_drive": false, "owner_is_team_drive": false}, "email": "peter@external_test_email.com", "unique_id": "123456789", "ip_address": "null", "timestamp": "2021-08-23T09:19:08.200Z"}'
|