Difference between revisions of "Datadog SIEM Content Packs for Google Workspace"

From wikieduonline
Jump to navigation Jump to search
Line 2: Line 2:
 
=== High ===
 
=== High ===
 
* <code>Google Workspace Alert Center</code>
 
* <code>Google Workspace Alert Center</code>
* <code>Google Workspace [[Tor]] client detected</code>
+
* <code>[[Google Workspace Tor client detected]]</code>
 
* <code>Google Workspace user assigned supe [[administrative role]]</code>
 
* <code>Google Workspace user assigned supe [[administrative role]]</code>
 
* <code>Google Workspace user edited [[account recovery]] information</code>
 
* <code>Google Workspace user edited [[account recovery]] information</code>

Revision as of 11:26, 12 October 2024

High

Medium

  • Domain added to Google Workspace allowlisted domains
  • Google Workspace accessed by Google
  • Google Workspace administrator has disabled 2-step verification for organizational unit

Low

  • Google Workspace admin role created
  • Google Workspace administrator initiated a data transfer request
  • Google Workspace user assigned administrative role
  • Google Workspace user disabled 2-step verification
  • Google Workspace user forwarding email out of non Google Workspace domain
  • Google Workspace user has unenrolled from Advanced Protection
  • Large amount of downloads on Google Drive
  • User attempted login with leaked password

See also

Advertising: