mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
53 lines
1.7 KiB
YAML
53 lines
1.7 KiB
YAML
name: G Suite Drive
|
|
id: 5f79120f-a235-4468-bd0d-55203758ac22
|
|
author: Patrick Bareiss, Splunk
|
|
source: http:gsuite
|
|
sourcetype: gsuite:drive:json
|
|
supported_TA:
|
|
name: Splunk Add-on for Google Workspace
|
|
version: 2.6.3
|
|
url: https://splunkbase.splunk.com/app/5556
|
|
event_names: []
|
|
fields:
|
|
- _time
|
|
- email
|
|
- host
|
|
- index
|
|
- ip_address
|
|
- linecount
|
|
- name
|
|
- parameters.actor_is_collaborator_account
|
|
- parameters.billable
|
|
- parameters.doc_id
|
|
- parameters.doc_title
|
|
- parameters.doc_type
|
|
- parameters.is_encrypted
|
|
- parameters.new_value{}
|
|
- parameters.old_value{}
|
|
- parameters.old_visibility
|
|
- parameters.originating_app_id
|
|
- parameters.owner
|
|
- parameters.owner_is_shared_drive
|
|
- parameters.owner_is_team_drive
|
|
- parameters.primary_event
|
|
- parameters.target_user
|
|
- parameters.visibility
|
|
- parameters.visibility_change
|
|
- punct
|
|
- source
|
|
- sourcetype
|
|
- splunk_server
|
|
- timestamp
|
|
- type
|
|
- unique_id
|
|
example_log:
|
|
'{"type": "acl_change", "name": "change_user_access", "parameters": {"primary_event":
|
|
true, "billable": true, "visibility_change": "none", "target_user": "alberto@internal_test_email.com",
|
|
"old_value": ["none"], "new_value": ["can_edit"], "old_visibility": "private", "doc_id":
|
|
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "doc_type": "spreadsheet", "is_encrypted":
|
|
false, "doc_title": "Invoice-11111 FedEx - Delivery - Dummy Detection POC", "visibility":
|
|
"shared_internally", "originating_app_id": "000000000001", "actor_is_collaborator_account":
|
|
false, "owner": "peter@external_test_email.com", "owner_is_shared_drive": false,
|
|
"owner_is_team_drive": false}, "email": "peter@external_test_email.com", "unique_id":
|
|
"123456789", "ip_address": "null", "timestamp": "2021-08-23T09:19:08.200Z"}'
|