gws

Author: patel-bhavin

data_sources/google_workspace.yml

@@ -11,5 +11,91 @@ supported_TA:
   url: https://splunkbase.splunk.com/app/5556
   version: 3.0.2
 fields:
+- action
+- actor.callerType
+- actor.email
+- actor.profileId
+- app
+- change_type
+- command
+- date_hour
+- date_mday
+- date_minute
+- date_month
+- date_second
+- date_wday
+- date_year
+- date_zone
+- dest
+- dest_name
+- dest_url
+- dvc
+- email
+- etag
+- event.name
+- event.parameters{}.name
+- event.parameters{}.value
+- event.type
+- eventtype
+- filter_action
+- host
+- id.applicationName
+- id.customerId
+- id.time
+- id.uniqueQualifier
+- index
+- internal_message_id
+- ipAddress
+- kind
+- linecount
+- message_id
+- object
+- object_attrs
+- object_category
+- object_id
+- object_path
+- owner
+- owner_email
+- protocol
+- punct
+- result
+- result_id
+- signature_extra
+- source
+- sourcetype
+- splunk_server
+- splunk_server_group
+- src
+- src_user
+- src_user_id
+- src_user_name
+- src_user_type
+- status
+- tag
+- tag::action
+- tag::app
+- tag::eventtype
+- tag::object_category
+- tenant_id
+- timeendpos
+- timestartpos
+- user
+- user_email
+- user_email_extracted
+- user_id
+- user_name
+- user_type
+- vendor_account
+- vendor_product
+- _bkt
+- _cd
+- _eventtype_color
+- _indextime
+- _raw
+- _serial
+- _si
+- _sourcetype
+- _subsecond
 - _time
 example_log: |-
+  "kind": "admin#reports#activity", "id": {"time": "2022-10-12T18:00:23.093Z", "uniqueQualifier": "-7844406841853338111", "applicationName": "admin", "customerId": "C046r85ir"}, "etag": "\"JCPRxFaiNR1s5TJ6ecIH8OpGdY4efiOYXbIB65itOzY/afZBU3WDeiuPqFyleWyTnwyU3fE\"", "actor": {"callerType": "USER", "email": "[email protected]", "profileId": "100059258581444193973"}, "ipAddress": "22.33.111.55", "event": {"type": "USER_SETTINGS", "name": "UNENROLL_USER_FROM_STRONG_AUTH", "parameters": [{"name": "USER_EMAIL", "value": "[email protected]"}]}}

detections/cloud/gcp_multi_factor_authentication_disabled.yml

@@ -14,7 +14,7 @@ description: The following analytic detects an attempt to disable multi-factor a
   layers, potentially leading to unauthorized access, data exfiltration, or further
   exploitation of the compromised account.
 data_source:
-- Google Workspace
+- Google Workspace 
 search: '`gws_reports_admin` command=UNENROLL_USER_FROM_STRONG_AUTH | stats count
   min(_time) as firstTime max(_time) as lastTime by user, command, actor.email, status,
   id.applicationName, event.name, vendor_account, action | `security_content_ctime(firstTime)`