Skip to content

Commit 0659c45

Browse files
vinit-chauhanvinit-chauhan
authored
[google_workspace] Add support for Rules datastream and dashboard for all datastreams (elastic#4588)
* Add new rules datastream and dashboard for all datastreams * Update the changelog file * Resolve Review comments
1 parent c731f97 commit 0659c45

File tree

77 files changed

+8691
-102
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

77 files changed

+8691
-102
lines changed

‎packages/google_workspace/_dev/build/docs/README.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ It is compatible with a subset of applications under the [Google Reports API v1]
1111
| [SAML](https://developers.google.com/admin-sdk/reports/v1/appendix/activity/saml) [help](https://support.google.com/a/answer/7007375?hl=en&ref_topic=9027054) | View users’ successful and failed sign-ins to SAML applications. |
1212
| [User Accounts](https://developers.google.com/admin-sdk/reports/v1/appendix/activity/user-accounts) [help](https://support.google.com/a/answer/9022875?hl=en&ref_topic=9027054) | Audit actions carried out by users on their own accounts including password changes, account recovery details and 2-Step Verification enrollment. |
1313
| [Login](https://developers.google.com/admin-sdk/reports/v1/appendix/activity/login) [help](https://support.google.com/a/answer/4580120?hl=en&ref_topic=9027054) | Track user sign-in activity to your domain. |
14+
| [Rules](https://developers.google.com/admin-sdk/reports/v1/appendix/activity/rules) [help](https://support.google.com/a/answer/9656783?hl=en&ref_topic=9027054) | View a record of actions to review your user’s attempts to share sensitive data. |
1415
| [Admin](https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-application-settings) [help](https://support.google.com/a/answer/4579579?hl=en&ref_topic=9027054) | View administrator activity performed within the Google Admin console. |
1516
| [Drive](https://developers.google.com/admin-sdk/reports/v1/appendix/activity/drive) [help](https://support.google.com/a/answer/4579696?hl=en&ref_topic=9027054) | Record user activity within Google Drive including content creation in such as Google Docs, as well as content created elsewhere that your users upload to Drive such as PDFs and Microsoft Word files. |
1617
| [Groups](https://developers.google.com/admin-sdk/reports/v1/appendix/activity/groups) [help](https://support.google.com/a/answer/6270454?hl=en&ref_topic=9027054) | Track changes to groups, group memberships and group messages. |
@@ -148,6 +149,14 @@ This is the `login` dataset.
148149

149150
{{fields "login"}}
150151

152+
### Rules
153+
154+
This is the `rules` dataset.
155+
156+
{{event "rules"}}
157+
158+
{{fields "rules"}}
159+
151160
### Admin
152161

153162
This is the `admin` dataset.

‎packages/google_workspace/_dev/deploy/docker/config.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -262,3 +262,19 @@ rules:
262262
body: |
263263
{"kind": "reports#auditActivities","items": [{"actor":{"callerType":"USER","email":"[email protected]","profileId":1},"events":[{"name":"2sv_disable","type":"2sv_change"},{"name":"2sv_enroll","type":"2sv_change"},{"name":"password_edit","type":"password_change"},{"name":"recovery_email_edit","type":"recovery_info_change"},{"name":"recovery_phone_edit","type":"recovery_info_change"},{"name":"recovery_secret_qa_edit","type":"recovery_info_change"},
264264
{"name":"titanium_enroll","type":"titanium_change"},{"name":"titanium_unenroll","type":"titanium_change"}],"id":{"applicationName":"user_accounts","customerId":"1","time":"{{.request.vars.startTime}}","uniqueQualifier":1},"ipAddress":"98.235.162.24","kind":"admin#reports#activity","ownerDomain":"elastic.com"}]}
265+
- path: /admin/reports/v1/activity/users/all/applications/rules
266+
methods: [GET]
267+
query_params:
268+
startTime: "{startTime:.*}"
269+
request_headers:
270+
Accept:
271+
- "application/json"
272+
Authorization:
273+
- "Bearer 1/fFAGRNJru1FTz70BzhT3Zg"
274+
responses:
275+
- status_code: 200
276+
headers:
277+
Content-Type:
278+
- "application/json"
279+
body: |
280+
{"kind": "reports#auditActivities","items": [{"kind":"admin#reports#activity","id":{"time":"2020-10-02T15:00:00Z","uniqueQualifier":1,"applicationName":"rules","customerId":"1"},"actor":{"callerType":"USER","email":"[email protected]","profileId":1},"ownerDomain":"elastic.com","ipAddress":"67.43.156.13","events":[{"type":"rule_match_type","name":"rule_match","parameters":[{"name":"has_alert","boolValue":"true"},{"name":"actor_ip_address","value":"127.0.0.0"},{"name":"resource_recipients_omitted_count","intValue":"1234"},{"name":"rule_name","multiValue":["managers"]},{"name":"rule_id","multiIntValue":["12"]}]}]}]}

‎packages/google_workspace/_dev/deploy/docker/docker-compose.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ services:
1616
awk -v var="$$(sed -E ':a;N;$$!ba;s/\r{0,1}\n/\\\\n/g' pkcs8.key)" '{sub(/the-key/,var)}1' /credentials.json > /config/credentials.json;
1717
sleep 1000
1818
google_workspace:
19-
image: docker.elastic.co/observability/stream:v0.5.0
19+
image: docker.elastic.co/observability/stream:v0.8.0
2020
hostname: google_workspace
2121
ports:
2222
- 8080

‎packages/google_workspace/changelog.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,15 @@
11
# newer versions go on top
2+
- version: "2.1.0"
3+
changes:
4+
- description: Add New Rules Data Stream.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/4588
7+
- description: Add Missing Dashboards.
8+
type: enhancement
9+
link: https://github.com/elastic/integrations/issues/3102
10+
- description: Improve ECS Utilization.
11+
type: enhancement
12+
link: https://github.com/elastic/integrations/issues/4317
213
- version: "2.0.0"
314
changes:
415
- description: Add a new alert data stream and fix the request query parameter inconsistent between intervals.

‎packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-application.log-expected.json‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
"configuration"
1313
],
1414
"id": "1",
15+
"kind": "event",
1516
"original": "{\"kind\":\"admin#reports#activity\",\"id\":{\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1,\"applicationName\":\"admin\",\"customerId\":\"1\"},\"actor\":{\"callerType\":\"USER\",\"email\":\"[email protected]\",\"profileId\":1},\"ownerDomain\":\"elastic.com\",\"ipAddress\":\"67.43.156.13\",\"events\":{\"type\":\"APPLICATION_SETTINGS\",\"name\":\"CHANGE_APPLICATION_SETTING\",\"parameters\":[{\"name\":\"APPLICATION_EDITION\",\"value\":\"basic\"},{\"name\":\"APPLICATION_NAME\",\"value\":\"drive\"},{\"name\":\"GROUP_EMAIL\",\"value\":\"[email protected]\"},{\"name\":\"NEW_VALUE\",\"value\":\"new\"},{\"name\":\"OLD_VALUE\",\"value\":\"old\"},{\"name\":\"ORG_UNIT_NAME\",\"value\":\"org\"},{\"name\":\"SETTING_NAME\",\"value\":\"setting\"}]}}",
1617
"provider": "admin",
1718
"type": [
@@ -88,6 +89,7 @@
8889
],
8990
"user": {
9091
"domain": "bar.com",
92+
"email": "[email protected]",
9193
"id": "1",
9294
"name": "foo",
9395
"target": {
@@ -109,6 +111,7 @@
109111
"iam"
110112
],
111113
"id": "1",
114+
"kind": "event",
112115
"original": "{\"kind\":\"admin#reports#activity\",\"id\":{\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1,\"applicationName\":\"admin\",\"customerId\":\"1\"},\"actor\":{\"callerType\":\"USER\",\"email\":\"[email protected]\",\"profileId\":1},\"ownerDomain\":\"elastic.com\",\"ipAddress\":\"67.43.156.13\",\"events\":{\"type\":\"APPLICATION_SETTINGS\",\"name\":\"CREATE_APPLICATION_SETTING\",\"parameters\":[{\"name\":\"APPLICATION_EDITION\",\"value\":\"basic\"},{\"name\":\"APPLICATION_NAME\",\"value\":\"drive\"},{\"name\":\"GROUP_EMAIL\",\"value\":\"[email protected]\"},{\"name\":\"NEW_VALUE\",\"value\":\"new\"},{\"name\":\"ORG_UNIT_NAME\",\"value\":\"org\"},{\"name\":\"SETTING_NAME\",\"value\":\"setting\"}]}}",
113116
"provider": "admin",
114117
"type": [
@@ -185,6 +188,7 @@
185188
],
186189
"user": {
187190
"domain": "bar.com",
191+
"email": "[email protected]",
188192
"id": "1",
189193
"name": "foo",
190194
"target": {
@@ -207,6 +211,7 @@
207211
"configuration"
208212
],
209213
"id": "1",
214+
"kind": "event",
210215
"original": "{\"kind\":\"admin#reports#activity\",\"id\":{\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1,\"applicationName\":\"admin\",\"customerId\":\"1\"},\"actor\":{\"callerType\":\"USER\",\"email\":\"[email protected]\",\"profileId\":1},\"ownerDomain\":\"elastic.com\",\"ipAddress\":\"67.43.156.13\",\"events\":{\"type\":\"APPLICATION_SETTINGS\",\"name\":\"DELETE_APPLICATION_SETTING\",\"parameters\":[{\"name\":\"APPLICATION_EDITION\",\"value\":\"basic\"},{\"name\":\"APPLICATION_NAME\",\"value\":\"drive\"},{\"name\":\"GROUP_EMAIL\",\"value\":\"[email protected]\"},{\"name\":\"OLD_VALUE\",\"value\":\"old\"},{\"name\":\"ORG_UNIT_NAME\",\"value\":\"org\"},{\"name\":\"SETTING_NAME\",\"value\":\"setting\"}]}}",
211216
"provider": "admin",
212217
"type": [
@@ -282,6 +287,7 @@
282287
],
283288
"user": {
284289
"domain": "bar.com",
290+
"email": "[email protected]",
285291
"id": "1",
286292
"name": "foo",
287293
"target": {
@@ -303,6 +309,7 @@
303309
"iam"
304310
],
305311
"id": "1",
312+
"kind": "event",
306313
"original": "{\"kind\":\"admin#reports#activity\",\"id\":{\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1,\"applicationName\":\"admin\",\"customerId\":\"1\"},\"actor\":{\"callerType\":\"USER\",\"email\":\"[email protected]\",\"profileId\":1},\"ownerDomain\":\"elastic.com\",\"ipAddress\":\"67.43.156.13\",\"events\":{\"type\":\"APPLICATION_SETTINGS\",\"name\":\"REORDER_GROUP_BASED_POLICIES_EVENT\",\"parameters\":[{\"name\":\"APPLICATION_NAME\",\"value\":\"drive\"},{\"name\":\"GROUP_PRIORITIES\",\"multiValue\":[\"a\",\"b\"]},{\"name\":\"SETTING_NAME\",\"value\":\"setting\"}]}}",
307314
"provider": "admin",
308315
"type": [
@@ -373,6 +380,7 @@
373380
],
374381
"user": {
375382
"domain": "bar.com",
383+
"email": "[email protected]",
376384
"id": "1",
377385
"name": "foo"
378386
}
@@ -389,6 +397,7 @@
389397
"configuration"
390398
],
391399
"id": "1",
400+
"kind": "event",
392401
"original": "{\"kind\":\"admin#reports#activity\",\"id\":{\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1,\"applicationName\":\"admin\",\"customerId\":\"1\"},\"actor\":{\"callerType\":\"USER\",\"email\":\"[email protected]\",\"profileId\":1},\"ownerDomain\":\"elastic.com\",\"ipAddress\":\"67.43.156.13\",\"events\":{\"type\":\"APPLICATION_SETTINGS\",\"name\":\"GPLUS_PREMIUM_FEATURES\",\"parameters\":[{\"name\":\"DOMAIN_NAME\",\"value\":\"example.com\"},{\"name\":\"NEW_VALUE\",\"value\":\"new\"}]}}",
393402
"provider": "admin",
394403
"type": [
@@ -450,6 +459,7 @@
450459
],
451460
"user": {
452461
"domain": "bar.com",
462+
"email": "[email protected]",
453463
"id": "1",
454464
"name": "foo"
455465
}
@@ -465,6 +475,7 @@
465475
"iam"
466476
],
467477
"id": "1",
478+
"kind": "event",
468479
"original": "{\"kind\":\"admin#reports#activity\",\"id\":{\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1,\"applicationName\":\"admin\",\"customerId\":\"1\"},\"actor\":{\"callerType\":\"USER\",\"email\":\"[email protected]\",\"profileId\":1},\"ownerDomain\":\"elastic.com\",\"ipAddress\":\"67.43.156.13\",\"events\":{\"type\":\"APPLICATION_SETTINGS\",\"name\":\"CREATE_MANAGED_CONFIGURATION\",\"parameters\":[{\"name\":\"MANAGED_CONFIGURATION_NAME\",\"value\":\"a\"},{\"name\":\"MOBILE_APP_PACKAGE_ID\",\"value\":\"1234\"}]}}",
469480
"provider": "admin",
470481
"type": [
@@ -526,6 +537,7 @@
526537
],
527538
"user": {
528539
"domain": "bar.com",
540+
"email": "[email protected]",
529541
"id": "1",
530542
"name": "foo"
531543
}
@@ -541,6 +553,7 @@
541553
"iam"
542554
],
543555
"id": "1",
556+
"kind": "event",
544557
"original": "{\"kind\":\"admin#reports#activity\",\"id\":{\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1,\"applicationName\":\"admin\",\"customerId\":\"1\"},\"actor\":{\"callerType\":\"USER\",\"email\":\"[email protected]\",\"profileId\":1},\"ownerDomain\":\"elastic.com\",\"ipAddress\":\"67.43.156.13\",\"events\":{\"type\":\"APPLICATION_SETTINGS\",\"name\":\"DELETE_MANAGED_CONFIGURATION\",\"parameters\":[{\"name\":\"MANAGED_CONFIGURATION_NAME\",\"value\":\"a\"},{\"name\":\"MOBILE_APP_PACKAGE_ID\",\"value\":\"1234\"}]}}",
545558
"provider": "admin",
546559
"type": [
@@ -602,6 +615,7 @@
602615
],
603616
"user": {
604617
"domain": "bar.com",
618+
"email": "[email protected]",
605619
"id": "1",
606620
"name": "foo"
607621
}
@@ -618,6 +632,7 @@
618632
"configuration"
619633
],
620634
"id": "1",
635+
"kind": "event",
621636
"original": "{\"kind\":\"admin#reports#activity\",\"id\":{\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1,\"applicationName\":\"admin\",\"customerId\":\"1\"},\"actor\":{\"callerType\":\"USER\",\"email\":\"[email protected]\",\"profileId\":1},\"ownerDomain\":\"elastic.com\",\"ipAddress\":\"67.43.156.13\",\"events\":{\"type\":\"APPLICATION_SETTINGS\",\"name\":\"UPDATE_MANAGED_CONFIGURATION\",\"parameters\":[{\"name\":\"MANAGED_CONFIGURATION_NAME\",\"value\":\"a\"},{\"name\":\"MOBILE_APP_PACKAGE_ID\",\"value\":\"1234\"}]}}",
622637
"provider": "admin",
623638
"type": [
@@ -679,6 +694,7 @@
679694
],
680695
"user": {
681696
"domain": "bar.com",
697+
"email": "[email protected]",
682698
"id": "1",
683699
"name": "foo"
684700
}
@@ -695,6 +711,7 @@
695711
"configuration"
696712
],
697713
"id": "1",
714+
"kind": "event",
698715
"original": "{\"kind\":\"admin#reports#activity\",\"id\":{\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1,\"applicationName\":\"admin\",\"customerId\":\"1\"},\"actor\":{\"callerType\":\"USER\",\"email\":\"[email protected]\",\"profileId\":1},\"ownerDomain\":\"elastic.com\",\"ipAddress\":\"67.43.156.13\",\"events\":{\"type\":\"APPLICATION_SETTINGS\",\"name\":\"FLASHLIGHT_EDU_NON_FEATURED_SERVICES_SELECTED\",\"parameters\":[{\"name\":\"FLASHLIGHT_EDU_NON_FEATURED_SERVICES_SELECTION\",\"value\":\"FLASHLIGHT_EDU_SELECTION_MANUAL\"}]}}",
699716
"provider": "admin",
700717
"type": [
@@ -753,6 +770,7 @@
753770
],
754771
"user": {
755772
"domain": "bar.com",
773+
"email": "[email protected]",
756774
"id": "1",
757775
"name": "foo"
758776
}

0 commit comments

Comments
 (0)