Difference between revisions of "Datadog SIEM Content Packs for Google Workspace"
Jump to navigation
Jump to search
(→High) |
|||
| Line 3: | Line 3: | ||
* <code>Google Workspace Alert Center</code> | * <code>Google Workspace Alert Center</code> | ||
* <code>Google Workspace [[Tor]] client detected</code> | * <code>Google Workspace [[Tor]] client detected</code> | ||
| − | * <code>Google Workspace user assigned supe administrative role</code> | + | * <code>Google Workspace user assigned supe [[administrative role]]</code> |
* <code>Google Workspace user edited [[account recovery]] information</code> | * <code>Google Workspace user edited [[account recovery]] information</code> | ||
| − | |||
=== Medium === | === Medium === | ||
Revision as of 12:14, 9 October 2024
Contents
High
Google Workspace Alert CenterGoogle Workspace Tor client detectedGoogle Workspace user assigned supe administrative roleGoogle Workspace user edited account recovery information
Medium
Domain added to Google Workspace allowlisted domainsGoogle Workspace accessed by GoogleGoogle Workspace administrator has disabled 2-step verification for organizational unit
Low
Google Workspace admin role createdGoogle Workspace administrator initiated a data transfer requestGoogle Workspace user assigned administrative roleGoogle Workspace user disabled 2-step verificationGoogle Workspace user forwarding email out of non Google Workspace domainGoogle Workspace user has unenrolled from Advanced ProtectionLarge amount of downloads on Google DriveUser attempted login with leaked password
See also
- Datadog SIEM Content Packs: Cloudtrail, Google Workspace
- Datadog security: Datadog Cloud SIEM, Content Packs, Datadog Cloud SIEM signals
- Google Workspace, Google Workspace API, Admin SDK API, Super admin, Directory API,
users.list,users.insert, Admin console:admin.google.com, Terraform provider: googleworkspace, Google Workspace: administrator roles, Google Drive, Google Vault, Spaces, Jamboard, Datadog SIEM
Advertising:
