Google Workspace

The gworkspace log type monitors Google Workspace log entries, such as the following:

  • Admin actions
  • Group and group membership actions
  • Events related to logins

The following code snippet contains all the raw_field and ecs mappings for this log type:

  1.   "mappings": [
  2.     {
  3.       "raw_field":"eventSource",
  4.       "ecs":"google_workspace.admin.service.name"
  5.     },
  6.     {
  7.       "raw_field":"eventName",
  8.       "ecs":"google_workspace.event.name"
  9.     },
  10.     {
  11.       "raw_field":"new_value",
  12.       "ecs":"google_workspace.admin.new_value"
  13.     }
  14.   ]