Skip to content

Commit 1583900

Browse files
ljstellaljstella
committed
GSuite TA Update
1 parent ed59b68 commit 1583900

File tree

5 files changed

+284
-280
lines changed

5 files changed

+284
-280
lines changed

‎data_sources/g_suite_drive.yml‎

Lines changed: 37 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,48 +1,49 @@
11
name: G Suite Drive
22
id: 5f79120f-a235-4468-bd0d-55203758ac22
33
version: 1
4-
date: '2024-07-18'
4+
date: "2024-07-18"
55
author: Patrick Bareiss, Splunk
66
description: Data source object for G Suite Drive
77
source: http:gsuite
88
sourcetype: gsuite:drive:json
99
supported_TA:
10-
- name: Splunk Add-on for Google Workspace
11-
url: https://splunkbase.splunk.com/app/5556
12-
version: 3.0.2
10+
- name: Splunk Add-on for Google Workspace
11+
url: https://splunkbase.splunk.com/app/5556
12+
version: 3.0.3
1313
fields:
14-
- _time
15-
- email
16-
- host
17-
- index
18-
- ip_address
19-
- linecount
20-
- name
21-
- parameters.actor_is_collaborator_account
22-
- parameters.billable
23-
- parameters.doc_id
24-
- parameters.doc_title
25-
- parameters.doc_type
26-
- parameters.is_encrypted
27-
- parameters.new_value{}
28-
- parameters.old_value{}
29-
- parameters.old_visibility
30-
- parameters.originating_app_id
31-
- parameters.owner
32-
- parameters.owner_is_shared_drive
33-
- parameters.owner_is_team_drive
34-
- parameters.primary_event
35-
- parameters.target_user
36-
- parameters.visibility
37-
- parameters.visibility_change
38-
- punct
39-
- source
40-
- sourcetype
41-
- splunk_server
42-
- timestamp
43-
- type
44-
- unique_id
45-
example_log: '{"type": "acl_change", "name": "change_user_access", "parameters": {"primary_event":
14+
- _time
15+
- email
16+
- host
17+
- index
18+
- ip_address
19+
- linecount
20+
- name
21+
- parameters.actor_is_collaborator_account
22+
- parameters.billable
23+
- parameters.doc_id
24+
- parameters.doc_title
25+
- parameters.doc_type
26+
- parameters.is_encrypted
27+
- parameters.new_value{}
28+
- parameters.old_value{}
29+
- parameters.old_visibility
30+
- parameters.originating_app_id
31+
- parameters.owner
32+
- parameters.owner_is_shared_drive
33+
- parameters.owner_is_team_drive
34+
- parameters.primary_event
35+
- parameters.target_user
36+
- parameters.visibility
37+
- parameters.visibility_change
38+
- punct
39+
- source
40+
- sourcetype
41+
- splunk_server
42+
- timestamp
43+
- type
44+
- unique_id
45+
example_log:
46+
'{"type": "acl_change", "name": "change_user_access", "parameters": {"primary_event":
4647
true, "billable": true, "visibility_change": "none", "target_user": "alberto@internal_test_email.com",
4748
"old_value": ["none"], "new_value": ["can_edit"], "old_visibility": "private", "doc_id":
4849
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "doc_type": "spreadsheet", "is_encrypted":

‎data_sources/g_suite_gmail.yml‎

Lines changed: 76 additions & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -1,87 +1,88 @@
11
name: G Suite Gmail
22
id: 706c3978-41de-406b-b6e0-75bd01e12a5d
33
version: 1
4-
date: '2024-07-18'
4+
date: "2024-07-18"
55
author: Patrick Bareiss, Splunk
66
description: Data source object for G Suite Gmail
77
source: http:gsuite
88
sourcetype: gsuite:gmail:bigquery
99
supported_TA:
10-
- name: Splunk Add-on for Google Workspace
11-
url: https://splunkbase.splunk.com/app/5556
12-
version: 3.0.2
10+
- name: Splunk Add-on for Google Workspace
11+
url: https://splunkbase.splunk.com/app/5556
12+
version: 3.0.3
1313
fields:
14-
- _time
15-
- action_type
16-
- attachment{}.file_extension_type
17-
- attachment{}.malware_family
18-
- attachment{}.sha256
19-
- connection_info.authenticated_domain{}.name
20-
- connection_info.authenticated_domain{}.type
21-
- connection_info.client_host_zone
22-
- connection_info.client_ip
23-
- connection_info.dkim_pass
24-
- connection_info.dmarc_pass
25-
- connection_info.dmarc_published_domain
26-
- connection_info.ip_geo_city
27-
- connection_info.ip_geo_country
28-
- connection_info.is_internal
29-
- connection_info.is_intra_domain
30-
- connection_info.smtp_in_connect_ip
31-
- connection_info.smtp_out_connect_ip
32-
- connection_info.smtp_out_remote_host
33-
- connection_info.smtp_reply_code
34-
- connection_info.smtp_response_reason
35-
- connection_info.smtp_tls_cipher
36-
- connection_info.smtp_tls_state
37-
- connection_info.smtp_tls_version
38-
- connection_info.smtp_user_agent_ip
39-
- connection_info.spf_pass
40-
- connection_info.tls_required_but_unavailable
41-
- description
42-
- destination{}.address
43-
- destination{}.rcpt_response
44-
- destination{}.selector
45-
- destination{}.service
46-
- destination{}.smime_decryption_success
47-
- destination{}.smime_extraction_success
48-
- destination{}.smime_parsing_success
49-
- destination{}.smime_signature_verification_success
50-
- eventtype
51-
- flattened_destinations
52-
- flattened_triggered_rule_info
53-
- host
54-
- index
55-
- is_policy_check_for_sender
56-
- is_spam
57-
- linecount
58-
- message_set{}.type
59-
- num_message_attachments
60-
- payload_size
61-
- punct
62-
- rfc2822_message_id
63-
- smime_content_type
64-
- smime_encrypt_message
65-
- smime_extraction_success
66-
- smime_packaging_success
67-
- smime_sign_message
68-
- smtp_relay_error
69-
- source
70-
- source.address
71-
- source.from_header_address
72-
- source.from_header_displayname
73-
- source.selector
74-
- source.service
75-
- sourcetype
76-
- spam_info
77-
- splunk_server
78-
- structured_policy_log_info
79-
- subject
80-
- tag
81-
- tag::eventtype
82-
- timestamp
83-
- upload_error_category
84-
example_log: '{"action_type": 10, "rfc2822_message_id": "<CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC@mail.gmail.com>",
14+
- _time
15+
- action_type
16+
- attachment{}.file_extension_type
17+
- attachment{}.malware_family
18+
- attachment{}.sha256
19+
- connection_info.authenticated_domain{}.name
20+
- connection_info.authenticated_domain{}.type
21+
- connection_info.client_host_zone
22+
- connection_info.client_ip
23+
- connection_info.dkim_pass
24+
- connection_info.dmarc_pass
25+
- connection_info.dmarc_published_domain
26+
- connection_info.ip_geo_city
27+
- connection_info.ip_geo_country
28+
- connection_info.is_internal
29+
- connection_info.is_intra_domain
30+
- connection_info.smtp_in_connect_ip
31+
- connection_info.smtp_out_connect_ip
32+
- connection_info.smtp_out_remote_host
33+
- connection_info.smtp_reply_code
34+
- connection_info.smtp_response_reason
35+
- connection_info.smtp_tls_cipher
36+
- connection_info.smtp_tls_state
37+
- connection_info.smtp_tls_version
38+
- connection_info.smtp_user_agent_ip
39+
- connection_info.spf_pass
40+
- connection_info.tls_required_but_unavailable
41+
- description
42+
- destination{}.address
43+
- destination{}.rcpt_response
44+
- destination{}.selector
45+
- destination{}.service
46+
- destination{}.smime_decryption_success
47+
- destination{}.smime_extraction_success
48+
- destination{}.smime_parsing_success
49+
- destination{}.smime_signature_verification_success
50+
- eventtype
51+
- flattened_destinations
52+
- flattened_triggered_rule_info
53+
- host
54+
- index
55+
- is_policy_check_for_sender
56+
- is_spam
57+
- linecount
58+
- message_set{}.type
59+
- num_message_attachments
60+
- payload_size
61+
- punct
62+
- rfc2822_message_id
63+
- smime_content_type
64+
- smime_encrypt_message
65+
- smime_extraction_success
66+
- smime_packaging_success
67+
- smime_sign_message
68+
- smtp_relay_error
69+
- source
70+
- source.address
71+
- source.from_header_address
72+
- source.from_header_displayname
73+
- source.selector
74+
- source.service
75+
- sourcetype
76+
- spam_info
77+
- splunk_server
78+
- structured_policy_log_info
79+
- subject
80+
- tag
81+
- tag::eventtype
82+
- timestamp
83+
- upload_error_category
84+
example_log:
85+
'{"action_type": 10, "rfc2822_message_id": "<CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC@mail.gmail.com>",
8586
"subject": "New Order DHL0000001 - Dummy email for Detection Development", "payload_size":
8687
6733, "source": {"address": "john@external_test_email.com", "service": "gmail-for-work",
8788
"selector": "policy", "from_header_address": "john@external_test_email.com", "from_header_displayname":

0 commit comments

Comments
 (0)