Datadog SIEM Content Packs for Google Workspace

• Google Workspace Alert Center

• Google Workspace Tor client detected

• Google Workspace user assigned super administrative role

• Google Workspace user edited account recovery information

• Domain added to Google Workspace allowlisted domains

• Google Workspace accessed by Google

• Google Workspace administrator has disabled 2-step verification for organizational unit

Low

Google Workspace admin role created

Google Workspace administrator initiated a data transfer request

Google Workspace user assigned administrative role

Google Workspace user disabled 2-step verification

Google Workspace user forwarding email out of non Google Workspace domain

Google Workspace user has unenrolled from Advanced Protection

Large amount of downloads on Google Drive

User attempted login with leaked password

See also

• Datadog security: Datadog Cloud SIEM, Content Packs, Datadog Cloud SIEM signals
• Google Workspace, Google Workspace API, Admin SDK API, Super admin, Directory API, users.list, users.insert, Admin console: admin.google.com, Terraform provider: googleworkspace, Google Workspace: administrator roles, Google Drive, Google Vault, Spaces, Jamboard, Datadog SIEM