Google Workspace 集成

{
    "@timestamp": "2021-10-02T15:00:00.000Z",
    "agent": {
        "ephemeral_id": "21bc9c22-c07c-4d9e-be7d-d847757ace52",
        "id": "c43b6bca-79fe-44a7-b837-da9db4bf7be4",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.13.0"
    },
    "data_stream": {
        "dataset": "google_workspace.saml",
        "namespace": "42924",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "c43b6bca-79fe-44a7-b837-da9db4bf7be4",
        "snapshot": false,
        "version": "8.13.0"
    },
    "event": {
        "action": "login_failure",
        "agent_id_status": "verified",
        "category": [
            "authentication",
            "session"
        ],
        "created": "2024-08-01T22:01:50.429Z",
        "dataset": "google_workspace.saml",
        "id": "1",
        "ingested": "2024-08-01T22:02:02Z",
        "kind": "event",
        "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"[email protected]\",\"profileId\":1},\"events\":{\"name\":\"login_failure\",\"parameters\":[{\"name\":\"application_name\",\"value\":\"app\"},{\"name\":\"failure_type\",\"value\":\"failure_app_not_configured_for_user\"},{\"name\":\"initiated_by\",\"value\":\"idp\"},{\"name\":\"orgunit_path\",\"value\":\"ounit\"},{\"name\":\"saml_second_level_status_code\",\"value\":\"SUCCESS_URI\"},{\"name\":\"saml_status_code\",\"value\":\"SUCCESS_URI\"}],\"type\":\"login\"},\"id\":{\"applicationName\":\"saml\",\"customerId\":\"1\",\"time\":\"2021-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"98.235.162.24\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}",
        "outcome": "failure",
        "provider": "saml",
        "type": [
            "start"
        ]
    },
    "google_workspace": {
        "actor": {
            "type": "USER"
        },
        "event": {
            "type": "login"
        },
        "kind": "admin#reports#activity",
        "organization": {
            "domain": "elastic.com"
        },
        "saml": {
            "application_name": "app",
            "failure_type": "failure_app_not_configured_for_user",
            "initiated_by": "idp",
            "orgunit_path": "ounit",
            "second_level_status_code": "SUCCESS_URI",
            "status_code": "SUCCESS_URI"
        }
    },
    "input": {
        "type": "httpjson"
    },
    "organization": {
        "id": "1"
    },
    "related": {
        "ip": [
            "98.235.162.24"
        ],
        "user": [
            "foo"
        ]
    },
    "source": {
        "as": {
            "number": 7922,
            "organization": {
                "name": "Comcast Cable Communications, Inc."
            }
        },
        "ip": "98.235.162.24",
        "user": {
            "domain": "bar.com",
            "email": "[email protected]",
            "id": "1",
            "name": "foo"
        }
    },
    "tags": [
        "preserve_original_event",
        "forwarded",
        "google_workspace-saml"
    ],
    "user": {
        "domain": "bar.com",
        "email": "[email protected]",
        "id": "1",
        "name": "foo"
    }
}

{
    "@timestamp": "2020-10-02T15:00:00.000Z",
    "agent": {
        "ephemeral_id": "65179230-7468-4b71-9b2b-a2cd4f778866",
        "id": "c43b6bca-79fe-44a7-b837-da9db4bf7be4",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.13.0"
    },
    "data_stream": {
        "dataset": "google_workspace.user_accounts",
        "namespace": "10103",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "c43b6bca-79fe-44a7-b837-da9db4bf7be4",
        "snapshot": false,
        "version": "8.13.0"
    },
    "event": {
        "action": "2sv_disable",
        "agent_id_status": "verified",
        "category": [
            "iam"
        ],
        "created": "2024-08-01T22:03:58.977Z",
        "dataset": "google_workspace.user_accounts",
        "id": "1",
        "ingested": "2024-08-01T22:04:10Z",
        "kind": "event",
        "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"[email protected]\",\"profileId\":1},\"events\":{\"name\":\"2sv_disable\",\"type\":\"2sv_change\"},\"id\":{\"applicationName\":\"user_accounts\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"98.235.162.24\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}",
        "provider": "user_accounts",
        "type": [
            "change",
            "user"
        ]
    },
    "google_workspace": {
        "actor": {
            "type": "USER"
        },
        "event": {
            "type": "2sv_change"
        },
        "kind": "admin#reports#activity",
        "organization": {
            "domain": "elastic.com"
        }
    },
    "input": {
        "type": "httpjson"
    },
    "organization": {
        "id": "1"
    },
    "related": {
        "ip": [
            "98.235.162.24"
        ],
        "user": [
            "foo"
        ]
    },
    "source": {
        "as": {
            "number": 7922,
            "organization": {
                "name": "Comcast Cable Communications, Inc."
            }
        },
        "ip": "98.235.162.24",
        "user": {
            "domain": "bar.com",
            "email": "[email protected]",
            "id": "1",
            "name": "foo"
        }
    },
    "tags": [
        "preserve_original_event",
        "forwarded",
        "google_workspace-user_accounts"
    ],
    "user": {
        "domain": "bar.com",
        "email": "[email protected]",
        "id": "1",
        "name": "foo"
    }
}

{
    "@timestamp": "2022-05-04T15:04:05.000Z",
    "agent": {
        "ephemeral_id": "8d5b6a07-b1e1-4397-982f-9223504ae534",
        "id": "c43b6bca-79fe-44a7-b837-da9db4bf7be4",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.13.0"
    },
    "data_stream": {
        "dataset": "google_workspace.login",
        "namespace": "61171",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "c43b6bca-79fe-44a7-b837-da9db4bf7be4",
        "snapshot": false,
        "version": "8.13.0"
    },
    "event": {
        "action": "account_disabled_password_leak",
        "agent_id_status": "verified",
        "category": [
            "iam"
        ],
        "created": "2024-08-01T21:59:36.067Z",
        "dataset": "google_workspace.login",
        "id": "1",
        "ingested": "2024-08-01T21:59:48Z",
        "kind": "event",
        "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"[email protected]\",\"profileId\":1},\"events\":{\"name\":\"account_disabled_password_leak\",\"parameters\":[{\"name\":\"affected_email_address\",\"value\":\"[email protected]\"}],\"type\":\"account_warning\"},\"id\":{\"applicationName\":\"login\",\"customerId\":\"1\",\"time\":\"2022-05-04T15:04:05Z\",\"uniqueQualifier\":1},\"ipAddress\":\"98.235.162.24\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}",
        "provider": "login",
        "type": [
            "user",
            "info"
        ]
    },
    "google_workspace": {
        "actor": {
            "type": "USER"
        },
        "event": {
            "type": "account_warning"
        },
        "kind": "admin#reports#activity",
        "login": {
            "affected_email_address": "[email protected]"
        },
        "organization": {
            "domain": "elastic.com"
        }
    },
    "input": {
        "type": "httpjson"
    },
    "organization": {
        "id": "1"
    },
    "related": {
        "ip": [
            "98.235.162.24"
        ],
        "user": [
            "foo",
            "foo"
        ]
    },
    "source": {
        "as": {
            "number": 7922,
            "organization": {
                "name": "Comcast Cable Communications, Inc."
            }
        },
        "ip": "98.235.162.24",
        "user": {
            "domain": "bar.com",
            "email": "[email protected]",
            "id": "1",
            "name": "foo"
        }
    },
    "tags": [
        "preserve_original_event",
        "forwarded",
        "google_workspace-login"
    ],
    "user": {
        "domain": "bar.com",
        "email": "[email protected]",
        "id": "1",
        "name": "foo",
        "target": {
            "domain": "elastic.co",
            "name": "foo"
        }
    }
}

{
    "@timestamp": "2020-10-02T15:00:00.000Z",
    "agent": {
        "ephemeral_id": "5c6a871e-fa71-4f56-b30d-46922ca4e836",
        "id": "c43b6bca-79fe-44a7-b837-da9db4bf7be4",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.13.0"
    },
    "data_stream": {
        "dataset": "google_workspace.rules",
        "namespace": "88921",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "c43b6bca-79fe-44a7-b837-da9db4bf7be4",
        "snapshot": false,
        "version": "8.13.0"
    },
    "event": {
        "action": "rule_match",
        "agent_id_status": "verified",
        "created": "2024-08-01T22:00:43.194Z",
        "dataset": "google_workspace.rules",
        "id": "1",
        "ingested": "2024-08-01T22:00:55Z",
        "kind": "event",
        "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"[email protected]\",\"profileId\":1},\"events\":{\"name\":\"rule_match\",\"parameters\":[{\"boolValue\":\"true\",\"name\":\"has_alert\"},{\"name\":\"actor_ip_address\",\"value\":\"127.0.0.0\"},{\"intValue\":\"1234\",\"name\":\"resource_recipients_omitted_count\"},{\"multiValue\":[\"managers\"],\"name\":\"rule_name\"},{\"multiIntValue\":[\"12\"],\"name\":\"rule_id\"}],\"type\":\"rule_match_type\"},\"id\":{\"applicationName\":\"rules\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}",
        "provider": "rules"
    },
    "google_workspace": {
        "actor": {
            "email": "[email protected]",
            "profile": {
                "id": "1"
            },
            "type": "USER"
        },
        "event": {
            "name": "rule_match",
            "type": "rule_match_type"
        },
        "id": {
            "application_name": "rules",
            "customer": {
                "id": "1"
            },
            "time": "2020-10-02T15:00:00.000Z",
            "unique_qualifier": "1"
        },
        "ip_address": "67.43.156.13",
        "kind": "admin#reports#activity",
        "organization": {
            "domain": "elastic.com"
        },
        "rules": {
            "actor_ip_address": "127.0.0.0",
            "has_alert": true,
            "id": [
                "12"
            ],
            "name": [
                "managers"
            ],
            "resource": {
                "recipients_omitted_count": 1234
            }
        }
    },
    "input": {
        "type": "httpjson"
    },
    "organization": {
        "id": "1"
    },
    "related": {
        "hosts": [
            "bar.com",
            "elastic.com"
        ],
        "ip": [
            "67.43.156.13",
            "127.0.0.0"
        ],
        "user": [
            "foo"
        ]
    },
    "rule": {
        "id": [
            "12"
        ],
        "name": [
            "managers"
        ]
    },
    "source": {
        "as": {
            "number": 35908
        },
        "geo": {
            "continent_name": "Asia",
            "country_iso_code": "BT",
            "country_name": "Bhutan",
            "location": {
                "lat": 27.5,
                "lon": 90.5
            }
        },
        "ip": "67.43.156.13",
        "user": {
            "domain": "bar.com",
            "email": "[email protected]",
            "id": "1",
            "name": "foo"
        }
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "google_workspace-rules"
    ],
    "user": {
        "domain": "bar.com",
        "email": "[email protected]",
        "id": "1",
        "name": "foo"
    }
}

{
    "@timestamp": "2022-04-04T15:04:05.000Z",
    "agent": {
        "ephemeral_id": "e64e710c-e02b-4997-bb7e-83b936dd6aa5",
        "id": "c43b6bca-79fe-44a7-b837-da9db4bf7be4",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.13.0"
    },
    "data_stream": {
        "dataset": "google_workspace.admin",
        "namespace": "62273",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "c43b6bca-79fe-44a7-b837-da9db4bf7be4",
        "snapshot": false,
        "version": "8.13.0"
    },
    "event": {
        "action": "CHANGE_APPLICATION_SETTING",
        "agent_id_status": "verified",
        "category": [
            "iam",
            "configuration"
        ],
        "created": "2024-08-01T21:51:15.529Z",
        "dataset": "google_workspace.admin",
        "id": "1",
        "ingested": "2024-08-01T21:51:27Z",
        "kind": "event",
        "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"[email protected]\",\"profileId\":1},\"events\":{\"name\":\"CHANGE_APPLICATION_SETTING\",\"parameters\":[{\"name\":\"APPLICATION_EDITION\",\"value\":\"basic\"},{\"name\":\"APPLICATION_NAME\",\"value\":\"drive\"},{\"name\":\"GROUP_EMAIL\",\"value\":\"[email protected]\"},{\"name\":\"NEW_VALUE\",\"value\":\"new\"},{\"name\":\"OLD_VALUE\",\"value\":\"old\"},{\"name\":\"ORG_UNIT_NAME\",\"value\":\"org\"},{\"name\":\"SETTING_NAME\",\"value\":\"setting\"}],\"type\":\"APPLICATION_SETTINGS\"},\"id\":{\"applicationName\":\"admin\",\"customerId\":\"1\",\"time\":\"2022-04-04T15:04:05Z\",\"uniqueQualifier\":1},\"ipAddress\":\"98.235.162.24\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}",
        "provider": "admin",
        "type": [
            "change"
        ]
    },
    "google_workspace": {
        "actor": {
            "type": "USER"
        },
        "admin": {
            "application": {
                "edition": "basic",
                "name": "drive"
            },
            "group": {
                "email": "[email protected]"
            },
            "new_value": "new",
            "old_value": "old",
            "org_unit": {
                "name": "org"
            },
            "setting": {
                "name": "setting"
            }
        },
        "event": {
            "type": "APPLICATION_SETTINGS"
        },
        "kind": "admin#reports#activity",
        "organization": {
            "domain": "elastic.com"
        }
    },
    "group": {
        "domain": "example.com",
        "name": "group"
    },
    "input": {
        "type": "httpjson"
    },
    "organization": {
        "id": "1"
    },
    "related": {
        "ip": [
            "98.235.162.24"
        ],
        "user": [
            "foo"
        ]
    },
    "source": {
        "as": {
            "number": 7922,
            "organization": {
                "name": "Comcast Cable Communications, Inc."
            }
        },
        "ip": "98.235.162.24",
        "user": {
            "domain": "bar.com",
            "email": "[email protected]",
            "id": "1",
            "name": "foo"
        }
    },
    "tags": [
        "preserve_original_event",
        "forwarded",
        "google_workspace-admin"
    ],
    "user": {
        "domain": "bar.com",
        "email": "[email protected]",
        "id": "1",
        "name": "foo",
        "target": {
            "group": {
                "domain": "example.com",
                "name": "group"
            }
        }
    }
}

{
    "@timestamp": "2022-05-04T15:04:05.000Z",
    "agent": {
        "ephemeral_id": "afd0c297-d853-427a-96bc-20af38e5b145",
        "id": "c43b6bca-79fe-44a7-b837-da9db4bf7be4",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.13.0"
    },
    "data_stream": {
        "dataset": "google_workspace.drive",
        "namespace": "99832",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "c43b6bca-79fe-44a7-b837-da9db4bf7be4",
        "snapshot": false,
        "version": "8.13.0"
    },
    "event": {
        "action": "add_to_folder",
        "agent_id_status": "verified",
        "category": [
            "file"
        ],
        "created": "2024-08-01T21:55:29.295Z",
        "dataset": "google_workspace.drive",
        "id": "1",
        "ingested": "2024-08-01T21:55:41Z",
        "kind": "event",
        "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"[email protected]\",\"profileId\":1},\"events\":{\"name\":\"add_to_folder\",\"parameters\":[{\"boolValue\":false,\"name\":\"billable\"},{\"name\":\"destination_folder_id\",\"value\":\"1234\"},{\"name\":\"destination_folder_title\",\"value\":\"folder title\"},{\"name\":\"doc_id\",\"value\":\"1234\"},{\"name\":\"doc_title\",\"value\":\"document title\"},{\"name\":\"doc_type\",\"value\":\"document\"},{\"name\":\"originating_app_id\",\"value\":\"1234\"},{\"name\":\"owner\",\"value\":\"[email protected]\"},{\"boolValue\":false,\"name\":\"owner_is_shared_drive\"},{\"boolValue\":true,\"name\":\"primary_event\"},{\"name\":\"visibility\",\"value\":\"people_with_link\"}],\"type\":\"access\"},\"id\":{\"applicationName\":\"drive\",\"customerId\":\"1\",\"time\":\"2022-05-04T15:04:05Z\",\"uniqueQualifier\":1},\"ipAddress\":\"98.235.162.24\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}",
        "provider": "drive",
        "type": [
            "change"
        ]
    },
    "file": {
        "name": "document title",
        "owner": "owner",
        "type": "file"
    },
    "google_workspace": {
        "actor": {
            "type": "USER"
        },
        "drive": {
            "billable": false,
            "destination_folder_id": "1234",
            "destination_folder_title": "folder title",
            "file": {
                "id": "1234",
                "owner": {
                    "email": "[email protected]",
                    "is_shared_drive": false
                },
                "type": "document"
            },
            "originating_app_id": "1234",
            "primary_event": true,
            "visibility": "people_with_link"
        },
        "event": {
            "type": "access"
        },
        "kind": "admin#reports#activity",
        "organization": {
            "domain": "elastic.com"
        }
    },
    "input": {
        "type": "httpjson"
    },
    "organization": {
        "id": "1"
    },
    "related": {
        "ip": [
            "98.235.162.24"
        ],
        "user": [
            "owner",
            "foo"
        ]
    },
    "source": {
        "as": {
            "number": 7922,
            "organization": {
                "name": "Comcast Cable Communications, Inc."
            }
        },
        "ip": "98.235.162.24",
        "user": {
            "domain": "bar.com",
            "email": "[email protected]",
            "id": "1",
            "name": "foo"
        }
    },
    "tags": [
        "preserve_original_event",
        "forwarded",
        "google_workspace-drive"
    ],
    "user": {
        "domain": "bar.com",
        "email": "[email protected]",
        "id": "1",
        "name": "foo"
    }
}

{
    "@timestamp": "2022-05-04T15:04:05.000Z",
    "agent": {
        "ephemeral_id": "786aaf54-461f-4190-adaf-05ab3174ad01",
        "id": "c43b6bca-79fe-44a7-b837-da9db4bf7be4",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.13.0"
    },
    "data_stream": {
        "dataset": "google_workspace.groups",
        "namespace": "35359",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "c43b6bca-79fe-44a7-b837-da9db4bf7be4",
        "snapshot": false,
        "version": "8.13.0"
    },
    "event": {
        "action": "change_acl_permission",
        "agent_id_status": "verified",
        "category": [
            "iam"
        ],
        "created": "2024-08-01T21:58:26.973Z",
        "dataset": "google_workspace.groups",
        "id": "1",
        "ingested": "2024-08-01T21:58:38Z",
        "kind": "event",
        "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"[email protected]\",\"profileId\":1},\"events\":{\"name\":\"change_acl_permission\",\"parameters\":[{\"name\":\"acl_permission\",\"value\":\"can_add_members\"},{\"name\":\"group_email\",\"value\":\"[email protected]\"},{\"multiValue\":[\"managers\",\"members\"],\"name\":\"new_value_repeated\"},{\"multiValue\":[\"managers\"],\"name\":\"old_value_repeated\"}],\"type\":\"acl_change\"},\"id\":{\"applicationName\":\"groups\",\"customerId\":\"1\",\"time\":\"2022-05-04T15:04:05Z\",\"uniqueQualifier\":1},\"ipAddress\":\"98.235.162.24\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"elastic.com\"}",
        "provider": "groups",
        "type": [
            "group",
            "change"
        ]
    },
    "google_workspace": {
        "actor": {
            "type": "USER"
        },
        "event": {
            "type": "acl_change"
        },
        "groups": {
            "acl_permission": "can_add_members",
            "email": "[email protected]",
            "new_value": [
                "managers",
                "members"
            ],
            "old_value": [
                "managers"
            ]
        },
        "kind": "admin#reports#activity",
        "organization": {
            "domain": "elastic.com"
        }
    },
    "group": {
        "domain": "example.com",
        "name": "group"
    },
    "input": {
        "type": "httpjson"
    },
    "organization": {
        "id": "1"
    },
    "related": {
        "ip": [
            "98.235.162.24"
        ],
        "user": [
            "foo"
        ]
    },
    "source": {
        "as": {
            "number": 7922,
            "organization": {
                "name": "Comcast Cable Communications, Inc."
            }
        },
        "ip": "98.235.162.24",
        "user": {
            "domain": "bar.com",
            "email": "[email protected]",
            "id": "1",
            "name": "foo"
        }
    },
    "tags": [
        "preserve_original_event",
        "forwarded",
        "google_workspace-groups"
    ],
    "user": {
        "domain": "bar.com",
        "email": "[email protected]",
        "id": "1",
        "name": "foo",
        "target": {
            "group": {
                "domain": "example.com",
                "name": "group"
            }
        }
    }
}

{
    "@timestamp": "2022-07-01T10:49:29.436Z",
    "agent": {
        "ephemeral_id": "245194a8-7787-44f7-ac57-201f8c49a9a0",
        "id": "c43b6bca-79fe-44a7-b837-da9db4bf7be4",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.13.0"
    },
    "data_stream": {
        "dataset": "google_workspace.alert",
        "namespace": "62301",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "c43b6bca-79fe-44a7-b837-da9db4bf7be4",
        "snapshot": false,
        "version": "8.13.0"
    },
    "email": {
        "attachments": {
            "file": {
                "hash": {
                    "sha256": [
                        "50d858e0985ecc7f60418aaf0cc5ab587f42c2570a884095a9e8ccacd0f6545c",
                        "228b48a56dbc2ecf10393227ac9c9dc943881fd7a55452e12a09107476bef2b2",
                        "5fb1679e08674059b72e271d8902c11a127bb5301b055dc77fa03932ada56a56"
                    ]
                }
            }
        },
        "delivery_timestamp": [
            "2022-07-01T10:38:13.194Z"
        ],
        "message_id": [
            "[email protected]",
            "[email protected]"
        ],
        "subject": [
            "Sales",
            "RE: Example salesorderspca JSON request"
        ],
        "to": {
            "address": [
                "[email protected]"
            ]
        }
    },
    "event": {
        "action": "Gmail phishing",
        "agent_id_status": "verified",
        "category": [
            "email",
            "threat",
            "malware"
        ],
        "created": "2024-08-01T21:52:26.588Z",
        "dataset": "google_workspace.alert",
        "end": "2022-07-01T10:47:04.530Z",
        "id": "91840a82-3af0-46d7-95ec-625c1cf0c3f7",
        "ingested": "2024-08-01T21:52:38Z",
        "kind": "alert",
        "original": "{\"alertId\":\"91840a82-3af0-46d7-95ec-625c1cf0c3f7\",\"createTime\":\"2022-07-01T10:49:29.436394Z\",\"customerId\":\"02umwv6u\",\"data\":{\"@type\":\"type.googleapis.com/google.apps.alertcenter.type.MailPhishing\",\"domainId\":{\"customerPrimaryDomain\":\"example.com\"},\"isInternal\":true,\"maliciousEntity\":{\"displayName\":\"string\",\"entity\":{\"displayName\":\"example\",\"emailAddress\":\"[email protected]\"},\"fromHeader\":\"[email protected]\"},\"messages\":[{\"attachmentsSha256Hash\":[\"50d858e0985ecc7f60418aaf0cc5ab587f42c2570a884095a9e8ccacd0f6545c\",\"228b48a56dbc2ecf10393227ac9c9dc943881fd7a55452e12a09107476bef2b2\"],\"date\":\"2022-07-01T10:38:13.194711Z\",\"md5HashMessageBody\":\"d29343907090dff4cec4a9a0efb80d20\",\"md5HashSubject\":\"a3708f8228384d932237f85980ff8283\",\"messageBodySnippet\":\" hi greetings from sales \",\"messageId\":\"[email protected]\",\"recipient\":\"[email protected]\",\"subjectText\":\"Sales\"},{\"attachmentsSha256Hash\":[\"5fb1679e08674059b72e271d8902c11a127bb5301b055dc77fa03932ada56a56\"],\"md5HashMessageBody\":\"d29343907090dff4cec4a9a0efb80d20\",\"md5HashSubject\":\"a3708f8228384d932237f85980ff8283\",\"messageBodySnippet\":\" hi greetings \",\"messageId\":\"[email protected]\",\"recipient\":\"[email protected]\",\"subjectText\":\"RE: Example salesorderspca JSON request\"}],\"systemActionType\":\"NO_OPERATION\"},\"deleted\":false,\"endTime\":\"2022-07-01T10:47:04.530834Z\",\"etag\":\"wF2Ix2DWDv8=\",\"metadata\":{\"alertId\":\"91840a82-3af0-46d7-95ec-625c1cf0c3f7\",\"assignee\":\"[email protected]\",\"customerId\":\"02umwv6u\",\"etag\":\"wF2Ix2DWDv8=\",\"severity\":\"HIGH\",\"status\":\"NOT_STARTED\",\"updateTime\":\"2022-07-01T10:49:29.436394Z\"},\"securityInvestigationToolLink\":\"string\",\"source\":\"Gmail phishing\",\"startTime\":\"2022-07-01T10:38:13.194711Z\",\"type\":\"User reported phishing\",\"updateTime\":\"2022-07-01T10:49:29.436394Z\"}",
        "start": "2022-07-01T10:38:13.194Z",
        "type": [
            "info"
        ]
    },
    "google_workspace": {
        "alert": {
            "create_time": "2022-07-01T10:49:29.436Z",
            "customer": {
                "id": "02umwv6u"
            },
            "data": {
                "domain_id": {
                    "customer_primary_domain": "example.com"
                },
                "is_internal": true,
                "malicious_entity": {
                    "display_name": "string",
                    "entity": {
                        "display_name": "example",
                        "email_address": "[email protected]"
                    },
                    "from_header": "[email protected]"
                },
                "messages": [
                    {
                        "attachments_sha256_hash": [
                            "50d858e0985ecc7f60418aaf0cc5ab587f42c2570a884095a9e8ccacd0f6545c",
                            "228b48a56dbc2ecf10393227ac9c9dc943881fd7a55452e12a09107476bef2b2"
                        ],
                        "date": "2022-07-01T10:38:13.194Z",
                        "id": "[email protected]",
                        "md5": {
                            "hash": {
                                "message_body": "d29343907090dff4cec4a9a0efb80d20",
                                "subject": "a3708f8228384d932237f85980ff8283"
                            }
                        },
                        "message_body_snippet": " hi greetings from sales ",
                        "recipient_email": "[email protected]",
                        "subject_text": "Sales"
                    },
                    {
                        "attachments_sha256_hash": [
                            "5fb1679e08674059b72e271d8902c11a127bb5301b055dc77fa03932ada56a56"
                        ],
                        "id": "[email protected]",
                        "md5": {
                            "hash": {
                                "message_body": "d29343907090dff4cec4a9a0efb80d20",
                                "subject": "a3708f8228384d932237f85980ff8283"
                            }
                        },
                        "message_body_snippet": " hi greetings ",
                        "recipient_email": "[email protected]",
                        "subject_text": "RE: Example salesorderspca JSON request"
                    }
                ],
                "system_action_type": "NO_OPERATION",
                "type": "type.googleapis.com/google.apps.alertcenter.type.MailPhishing"
            },
            "deleted": false,
            "end_time": "2022-07-01T10:47:04.530Z",
            "etag": "wF2Ix2DWDv8=",
            "id": "91840a82-3af0-46d7-95ec-625c1cf0c3f7",
            "metadata": {
                "alert": {
                    "id": "91840a82-3af0-46d7-95ec-625c1cf0c3f7"
                },
                "assignee": "[email protected]",
                "customer": {
                    "id": "02umwv6u"
                },
                "etag": "wF2Ix2DWDv8=",
                "severity": "HIGH",
                "status": "NOT_STARTED",
                "update_time": "2022-07-01T10:49:29.436Z"
            },
            "security_investigation_tool_link": "string",
            "source": "Gmail phishing",
            "start_time": "2022-07-01T10:38:13.194Z",
            "type": "User reported phishing",
            "update_time": "2022-07-01T10:49:29.436Z"
        }
    },
    "input": {
        "type": "httpjson"
    },
    "organization": {
        "id": "02umwv6u"
    },
    "related": {
        "hash": [
            "a3708f8228384d932237f85980ff8283",
            "50d858e0985ecc7f60418aaf0cc5ab587f42c2570a884095a9e8ccacd0f6545c",
            "228b48a56dbc2ecf10393227ac9c9dc943881fd7a55452e12a09107476bef2b2",
            "5fb1679e08674059b72e271d8902c11a127bb5301b055dc77fa03932ada56a56"
        ],
        "user": [
            "example"
        ]
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "google_workspace-alert"
    ],
    "user": {
        "domain": "example.com",
        "email": [
            "[email protected]"
        ],
        "name": "example"
    }
}

{
    "@timestamp": "2020-10-02T15:00:00.000Z",
    "agent": {
        "ephemeral_id": "9875ab07-088d-4ff3-8cfe-daa3a497cf78",
        "id": "c43b6bca-79fe-44a7-b837-da9db4bf7be4",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.13.0"
    },
    "data_stream": {
        "dataset": "google_workspace.device",
        "namespace": "89096",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "c43b6bca-79fe-44a7-b837-da9db4bf7be4",
        "snapshot": false,
        "version": "8.13.0"
    },
    "event": {
        "action": "APPLICATION_EVENT",
        "agent_id_status": "verified",
        "created": "2024-08-01T21:54:32.984Z",
        "dataset": "google_workspace.device",
        "id": "1",
        "ingested": "2024-08-01T21:54:44Z",
        "kind": [
            "event"
        ],
        "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"[email protected]\",\"profileId\":1},\"events\":{\"name\":\"APPLICATION_EVENT\",\"parameters\":[{\"name\":\"ACCOUNT_STATE\",\"value\":\"REGISTERED\"},{\"name\":\"ACTION_EXECUTION_STATUS\",\"value\":\"ACTION_REJECTED_BY_USER\"},{\"name\":\"ACTION_ID\",\"value\":\"asd1234\"},{\"name\":\"ACTION_TYPE\",\"value\":\"ACCOUNT_WIPE\"},{\"name\":\"APK_SHA256_HASH\",\"value\":\"af2bdbe1aa9b6ec1e2ade1d694f41fc71a831d0268e9891562113d8a62add1bf\"},{\"name\":\"APPLICATION_ID\",\"value\":\"af2bdbe1aa9f\"},{\"name\":\"APPLICATION_MESSAGE\",\"value\":\"message\"},{\"name\":\"APPLICATION_REPORT_KEY\",\"value\":\"sda21\"},{\"name\":\"APPLICATION_REPORT_SEVERITY\",\"value\":\"ERROR\"},{\"name\":\"APPLICATION_REPORT_TIMESTAMP\",\"value\":\"2020-10-03T15:00:00Z\"},{\"name\":\"APPLICATION_STATE\",\"value\":\"INSTALLED\"},{\"name\":\"BASIC_INTEGRITY\",\"value\":\"integrity\"},{\"name\":\"CTS_PROFILE_MATCH\",\"value\":\"profile\"},{\"name\":\"DEVICE_COMPLIANCE\",\"value\":\"COMPLIANT\"},{\"name\":\"DEVICE_COMPROMISED_STATE\",\"value\":\"COMPROMISED\"},{\"name\":\"DEVICE_DEACTIVATION_REASON\",\"value\":\"CAMERA_NOT_DISABLED\"},{\"name\":\"DEVICE_ID\",\"value\":\"asdqwe12e\"},{\"name\":\"DEVICE_MODEL\",\"value\":\"model\"},{\"name\":\"DEVICE_OWNERSHIP\",\"value\":\"COMPANY_OWNED\"},{\"name\":\"DEVICE_PROPERTY\",\"value\":\"BASIC_INTEGRITY\"},{\"name\":\"DEVICE_SETTING\",\"value\":\"DEVELOPER_OPTIONS\"},{\"name\":\"DEVICE_STATUS_ON_APPLE_PORTAL\",\"value\":\"ADDED\"},{\"name\":\"DEVICE_TYPE\",\"value\":\"ANDROID\"},{\"name\":\"FAILED_PASSWD_ATTEMPTS\",\"value\":20},{\"name\":\"IOS_VENDOR_ID\",\"value\":\"asfdwer23\"},{\"name\":\"NEW_DEVICE_ID\",\"value\":\"asfwr5tg\"},{\"name\":\"NEW_VALUE\",\"value\":\"DEVICE_ADMINISTRATOR\"},{\"name\":\"OLD_VALUE\",\"value\":\"DEVICE_OWNER\"},{\"name\":\"OS_EDITION\",\"value\":\"edition\"},{\"name\":\"OS_PROPERTY\",\"value\":\"property\"},{\"name\":\"OS_VERSION\",\"value\":\"os11\"},{\"name\":\"PHA_CATEGORY\",\"value\":\"BACKDOOR\"},{\"name\":\"POLICY_NAME\",\"value\":\"policy name\"},{\"name\":\"POLICY_SYNC_RESULT\",\"value\":\"POLICY_SYNC_ABORTED\"},{\"name\":\"POLICY_SYNC_TYPE\",\"value\":\"POLICY_APPLIED_TYPE\"},{\"name\":\"REGISTER_PRIVILEGE\",\"value\":\"DEVICE_OWNER\"},{\"name\":\"RESOURCE_ID\",\"value\":\"sads324\"},{\"name\":\"RISK_SIGNAL\",\"value\":\"BASIC_INTEGRITY\"},{\"name\":\"SECURITY_EVENT_ID\",\"value\":2323523},{\"name\":\"SECURITY_PATCH_LEVEL\",\"value\":\"patch level\"},{\"name\":\"SERIAL_NUMBER\",\"value\":\"asdsad1234\"},{\"name\":\"USER_EMAIL\",\"value\":\"[email protected]\"},{\"name\":\"VALUE\",\"value\":\"value\"},{\"name\":\"WINDOWS_SYNCML_POLICY_STATUS_CODE\",\"value\":\"200\"}],\"type\":\"device_applications\"},\"id\":{\"applicationName\":\"device\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}",
        "provider": "device"
    },
    "google_workspace": {
        "actor": {
            "email": "[email protected]",
            "profile": {
                "id": "1"
            },
            "type": "USER"
        },
        "device": {
            "account_state": "REGISTERED",
            "action": {
                "execution_status": "ACTION_REJECTED_BY_USER",
                "id": "asd1234",
                "type": "ACCOUNT_WIPE"
            },
            "apk_sha256_hash": "af2bdbe1aa9b6ec1e2ade1d694f41fc71a831d0268e9891562113d8a62add1bf",
            "application": {
                "id": "af2bdbe1aa9f",
                "message": "message",
                "report": {
                    "key": "sda21",
                    "severity": "ERROR",
                    "timestamp": "2020-10-03T15:00:00.000Z"
                },
                "state": "INSTALLED"
            },
            "basic_integrity": "integrity",
            "compliance": "COMPLIANT",
            "compromised_state": "COMPROMISED",
            "cts_profile_match": "profile",
            "deactivation_reason": "CAMERA_NOT_DISABLED",
            "failed_passwd_attempts": 20,
            "id": "asdqwe12e",
            "ios_vendor_id": "asfdwer23",
            "model": "model",
            "new_device_id": "asfwr5tg",
            "new_value": "DEVICE_ADMINISTRATOR",
            "old_value": "DEVICE_OWNER",
            "os": {
                "edition": "edition",
                "property": "property",
                "version": "os11"
            },
            "ownership": "COMPANY_OWNED",
            "pha_category": "BACKDOOR",
            "policy": {
                "name": "policy name",
                "sync": {
                    "result": "POLICY_SYNC_ABORTED",
                    "type": "POLICY_APPLIED_TYPE"
                }
            },
            "property": "BASIC_INTEGRITY",
            "register_privilege": "DEVICE_OWNER",
            "resource": {
                "id": "sads324"
            },
            "risk_signal": "BASIC_INTEGRITY",
            "security": {
                "event_id": 2323523,
                "patch_level": "patch level"
            },
            "serial_number": "asdsad1234",
            "setting": "DEVELOPER_OPTIONS",
            "status_on_apple_portal": "ADDED",
            "type": "ANDROID",
            "user_email": "[email protected]",
            "value": "value",
            "windows_syncml_policy_status_code": "200"
        },
        "event": {
            "name": "APPLICATION_EVENT",
            "type": "device_applications"
        },
        "id": {
            "application_name": "device",
            "customer": {
                "id": "1"
            },
            "time": "2020-10-02T15:00:00.000Z",
            "unique_qualifier": "1"
        },
        "ip_address": "67.43.156.13",
        "kind": "admin#reports#activity",
        "organization": {
            "domain": "example.com"
        }
    },
    "host": {
        "os": {
            "version": "os11"
        }
    },
    "input": {
        "type": "httpjson"
    },
    "organization": {
        "id": "1"
    },
    "related": {
        "hash": [
            "af2bdbe1aa9b6ec1e2ade1d694f41fc71a831d0268e9891562113d8a62add1bf"
        ],
        "hosts": [
            "bar.com",
            "example.com"
        ],
        "ip": [
            "67.43.156.13"
        ],
        "user": [
            "1",
            "foo",
            "[email protected]",
            "[email protected]"
        ]
    },
    "source": {
        "as": {
            "number": 35908
        },
        "geo": {
            "continent_name": "Asia",
            "country_iso_code": "BT",
            "country_name": "Bhutan",
            "location": {
                "lat": 27.5,
                "lon": 90.5
            }
        },
        "ip": "67.43.156.13",
        "user": {
            "domain": "bar.com",
            "email": "[email protected]",
            "id": "1",
            "name": "foo"
        }
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "google_workspace-device"
    ],
    "user": {
        "domain": "bar.com",
        "email": [
            "[email protected]",
            "[email protected]"
        ],
        "id": "1",
        "name": "foo"
    }
}

{
    "@timestamp": "2020-10-02T15:00:00.000Z",
    "agent": {
        "ephemeral_id": "9405bd92-9ad6-4271-9f8f-10d1dc3bae86",
        "id": "c43b6bca-79fe-44a7-b837-da9db4bf7be4",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.13.0"
    },
    "data_stream": {
        "dataset": "google_workspace.group_enterprise",
        "namespace": "26916",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "c43b6bca-79fe-44a7-b837-da9db4bf7be4",
        "snapshot": false,
        "version": "8.13.0"
    },
    "event": {
        "action": "add_info_setting",
        "agent_id_status": "verified",
        "created": "2024-08-01T21:57:32.529Z",
        "dataset": "google_workspace.group_enterprise",
        "id": "1",
        "ingested": "2024-08-01T21:57:44Z",
        "kind": [
            "event"
        ],
        "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"[email protected]\",\"profileId\":1},\"events\":{\"name\":\"add_info_setting\",\"parameters\":[{\"name\":\"dynamic_group_query\",\"value\":\"query\"},{\"name\":\"group_id\",\"value\":\"asd123d\"},{\"name\":\"info_setting\",\"value\":\"setting\"},{\"name\":\"member_id\",\"value\":\"mem12w3\"},{\"name\":\"member_role\",\"value\":\"owner\"},{\"name\":\"member_type\",\"value\":\"user\"},{\"name\":\"membership_expiry\",\"value\":\"2020-10-02T15:00:00Z\"},{\"name\":\"namespace\",\"value\":\"namespace\"},{\"name\":\"new_value\",\"value\":\"new\"},{\"name\":\"old_value\",\"value\":\"old\"},{\"name\":\"security_setting\",\"value\":\"group setting\"},{\"name\":\"security_setting_state\",\"value\":\"group setting state\"},{\"name\":\"value\",\"value\":\"group setting value\"}],\"type\":\"moderator_action\"},\"id\":{\"applicationName\":\"group_enterprise\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}",
        "provider": "group_enterprise"
    },
    "google_workspace": {
        "actor": {
            "email": "[email protected]",
            "profile": {
                "id": "1"
            },
            "type": "USER"
        },
        "event": {
            "name": "add_info_setting",
            "type": "moderator_action"
        },
        "group_enterprise": {
            "dynamic_group_query": "query",
            "group": {
                "id": "asd123d"
            },
            "info_setting": "setting",
            "member": {
                "id": "mem12w3",
                "role": "owner",
                "type": "user"
            },
            "membership_expiry": "2020-10-02T15:00:00.000Z",
            "namespace": "namespace",
            "new_value": "new",
            "old_value": "old",
            "security_setting": {
                "state": "group setting state",
                "value": "group setting"
            },
            "value": "group setting value"
        },
        "id": {
            "application_name": "group_enterprise",
            "customer": {
                "id": "1"
            },
            "time": "2020-10-02T15:00:00.000Z",
            "unique_qualifier": "1"
        },
        "ip_address": "67.43.156.13",
        "kind": "admin#reports#activity",
        "organization": {
            "domain": "example.com"
        }
    },
    "group": {
        "id": "asd123d"
    },
    "input": {
        "type": "httpjson"
    },
    "organization": {
        "id": "1"
    },
    "related": {
        "hosts": [
            "bar.com",
            "example.com"
        ],
        "ip": [
            "67.43.156.13"
        ],
        "user": [
            "1",
            "foo",
            "[email protected]"
        ]
    },
    "source": {
        "as": {
            "number": 35908
        },
        "geo": {
            "continent_name": "Asia",
            "country_iso_code": "BT",
            "country_name": "Bhutan",
            "location": {
                "lat": 27.5,
                "lon": 90.5
            }
        },
        "ip": "67.43.156.13",
        "user": {
            "domain": "bar.com",
            "email": "[email protected]",
            "id": "1",
            "name": "foo"
        }
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "google_workspace-group_enterprise"
    ],
    "user": {
        "domain": "bar.com",
        "email": "[email protected]",
        "id": "1",
        "name": "foo"
    }
}

{
    "@timestamp": "2020-10-02T15:00:00.000Z",
    "agent": {
        "ephemeral_id": "22e6154c-9c10-4cb9-b17b-41f429c22724",
        "id": "c43b6bca-79fe-44a7-b837-da9db4bf7be4",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.13.0"
    },
    "data_stream": {
        "dataset": "google_workspace.token",
        "namespace": "16418",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "c43b6bca-79fe-44a7-b837-da9db4bf7be4",
        "snapshot": false,
        "version": "8.13.0"
    },
    "event": {
        "action": "authorize",
        "agent_id_status": "verified",
        "category": [
            "iam"
        ],
        "created": "2024-08-01T22:03:00.693Z",
        "dataset": "google_workspace.token",
        "id": "1",
        "ingested": "2024-08-01T22:03:12Z",
        "kind": [
            "event"
        ],
        "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"[email protected]\",\"profileId\":1},\"events\":{\"name\":\"authorize\",\"parameters\":[{\"name\":\"client_id\",\"value\":\"923474483785-sqf6uk8vq1rqe853il0g2h4m98ji2fq6.apps.googleusercontent.com\"},{\"name\":\"app_name\",\"value\":\"Gmail Add-on\"},{\"name\":\"api_name\",\"value\":\"token\"},{\"name\":\"method_name\",\"value\":\"oauth\"},{\"name\":\"num_response_bytes\",\"value\":1223},{\"name\":\"client_type\",\"value\":\"WEB\"},{\"multiMessageValue\":[{\"parameter\":[{\"name\":\"scope_name\",\"value\":\"https://www.googleapis.com/auth/gmail.addons.current.message.readonly\"},{\"multiValue\":[\"GMAIL\"],\"name\":\"product_bucket\"}]},{\"parameter\":[{\"name\":\"scope_name\",\"value\":\"https://www.googleapis.com/auth/gmail.addons.execute\"},{\"multiValue\":[\"GMAIL\"],\"name\":\"product_bucket\"}]},{\"parameter\":[{\"name\":\"scope_name\",\"value\":\"https://www.googleapis.com/auth/script.external_request\"},{\"multiValue\":[\"APPS_SCRIPT_RUNTIME\"],\"name\":\"product_bucket\"}]},{\"parameter\":[{\"name\":\"scope_name\",\"value\":\"https://www.googleapis.com/auth/script.storage\"},{\"multiValue\":[\"APPS_SCRIPT_RUNTIME\"],\"name\":\"product_bucket\"}]},{\"parameter\":[{\"name\":\"scope_name\",\"value\":\"https://www.googleapis.com/auth/userinfo.email\"},{\"multiValue\":[\"IDENTITY\",\"OTHER\"],\"name\":\"product_bucket\"}]}],\"name\":\"scope_data\"},{\"multiValue\":[\"https://www.googleapis.com/auth/gmail.addons.current.message.readonly\",\"https://www.googleapis.com/auth/gmail.addons.execute\",\"https://www.googleapis.com/auth/script.external_request\",\"https://www.googleapis.com/auth/script.storage\",\"https://www.googleapis.com/auth/userinfo.email\"],\"name\":\"scope\"}]},\"id\":{\"applicationName\":\"token\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}",
        "provider": "token",
        "type": [
            "info",
            "user"
        ]
    },
    "google_workspace": {
        "actor": {
            "email": "[email protected]",
            "profile": {
                "id": "1"
            },
            "type": "USER"
        },
        "event": {
            "name": "authorize"
        },
        "id": {
            "application_name": "token",
            "customer": {
                "id": "1"
            },
            "time": "2020-10-02T15:00:00.000Z",
            "unique_qualifier": "1"
        },
        "ip_address": "67.43.156.13",
        "kind": "admin#reports#activity",
        "organization": {
            "domain": "example.com"
        },
        "token": {
            "api_name": "token",
            "app_name": "Gmail Add-on",
            "client": {
                "id": "923474483785-sqf6uk8vq1rqe853il0g2h4m98ji2fq6.apps.googleusercontent.com",
                "type": "WEB"
            },
            "method_name": "oauth",
            "num_response_bytes": 1223,
            "scope": {
                "data": [
                    {
                        "product_bucket": [
                            "GMAIL"
                        ],
                        "scope_name": "https://www.googleapis.com/auth/gmail.addons.current.message.readonly"
                    },
                    {
                        "product_bucket": [
                            "GMAIL"
                        ],
                        "scope_name": "https://www.googleapis.com/auth/gmail.addons.execute"
                    },
                    {
                        "product_bucket": [
                            "APPS_SCRIPT_RUNTIME"
                        ],
                        "scope_name": "https://www.googleapis.com/auth/script.external_request"
                    },
                    {
                        "product_bucket": [
                            "APPS_SCRIPT_RUNTIME"
                        ],
                        "scope_name": "https://www.googleapis.com/auth/script.storage"
                    },
                    {
                        "product_bucket": [
                            "IDENTITY",
                            "OTHER"
                        ],
                        "scope_name": "https://www.googleapis.com/auth/userinfo.email"
                    }
                ],
                "value": [
                    "https://www.googleapis.com/auth/gmail.addons.current.message.readonly",
                    "https://www.googleapis.com/auth/gmail.addons.execute",
                    "https://www.googleapis.com/auth/script.external_request",
                    "https://www.googleapis.com/auth/script.storage",
                    "https://www.googleapis.com/auth/userinfo.email"
                ]
            }
        }
    },
    "input": {
        "type": "httpjson"
    },
    "organization": {
        "id": "1"
    },
    "related": {
        "hosts": [
            "bar.com",
            "example.com"
        ],
        "ip": [
            "67.43.156.13"
        ],
        "user": [
            "1",
            "foo",
            "[email protected]"
        ]
    },
    "source": {
        "as": {
            "number": 35908
        },
        "geo": {
            "continent_name": "Asia",
            "country_iso_code": "BT",
            "country_name": "Bhutan",
            "location": {
                "lat": 27.5,
                "lon": 90.5
            }
        },
        "ip": "67.43.156.13",
        "user": {
            "domain": "bar.com",
            "email": "[email protected]",
            "id": "1",
            "name": "foo"
        }
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "google_workspace-token"
    ],
    "user": {
        "domain": "bar.com",
        "email": "[email protected]",
        "id": "1",
        "name": "foo"
    }
}

{
    "@timestamp": "2020-10-02T15:00:00.000Z",
    "agent": {
        "ephemeral_id": "e3f2296a-a4a2-4d03-9105-cee5b37c1408",
        "id": "c43b6bca-79fe-44a7-b837-da9db4bf7be4",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.13.0"
    },
    "data_stream": {
        "dataset": "google_workspace.access_transparency",
        "namespace": "83912",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "c43b6bca-79fe-44a7-b837-da9db4bf7be4",
        "snapshot": false,
        "version": "8.13.0"
    },
    "event": {
        "action": "APPLICATION_EVENT",
        "agent_id_status": "verified",
        "created": "2024-08-01T21:50:19.274Z",
        "dataset": "google_workspace.access_transparency",
        "id": "1",
        "ingested": "2024-08-01T21:50:31Z",
        "kind": [
            "event"
        ],
        "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"[email protected]\",\"profileId\":1},\"events\":{\"name\":\"APPLICATION_EVENT\",\"parameters\":[{\"name\":\"ACCESS_APPROVAL_ALERT_CENTER_IDS\",\"value\":\"alert123\"},{\"name\":\"ACCESS_APPROVAL_REQUEST_IDS\",\"value\":\"req12341\"},{\"name\":\"ACCESS_MANAGEMENT_POLICY\",\"value\":\"policy\"},{\"name\":\"ACTOR_HOME_OFFICE\",\"value\":\"actoroffice\"},{\"name\":\"GSUITE_PRODUCT_NAME\",\"value\":\"CALENDAR\"},{\"name\":\"JUSTIFICATIONS\",\"value\":\"justfy\"},{\"name\":\"LOG_ID\",\"value\":\"lg651667\"},{\"name\":\"ON_BEHALF_OF\",\"value\":\"[email protected]\"},{\"name\":\"OWNER_EMAIL\",\"value\":\"[email protected]\"},{\"name\":\"RESOURCE_NAME\",\"value\":\"foo\"},{\"name\":\"TICKETS\",\"value\":\"ticket\"}],\"type\":\"device_applications\"},\"id\":{\"applicationName\":\"device\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}",
        "provider": "device"
    },
    "google_workspace": {
        "access_transparency": {
            "access_approval": {
                "alert_center_ids": "alert123",
                "request_ids": "req12341"
            },
            "access_management": {
                "policy": "policy"
            },
            "actor_home_office": "actoroffice",
            "gsuite_product_name": "CALENDAR",
            "justifications": "justfy",
            "log_id": "lg651667",
            "on_behalf_of": "[email protected]",
            "owner_email": "[email protected]",
            "resource_name": "foo",
            "tickets": "ticket"
        },
        "actor": {
            "email": "[email protected]",
            "profile": {
                "id": "1"
            },
            "type": "USER"
        },
        "event": {
            "name": "APPLICATION_EVENT",
            "type": "device_applications"
        },
        "id": {
            "application_name": "device",
            "customer": {
                "id": "1"
            },
            "time": "2020-10-02T15:00:00.000Z",
            "unique_qualifier": "1"
        },
        "ip_address": "67.43.156.13",
        "kind": "admin#reports#activity",
        "organization": {
            "domain": "example.com"
        }
    },
    "input": {
        "type": "httpjson"
    },
    "organization": {
        "id": "1"
    },
    "related": {
        "hosts": [
            "bar.com",
            "example.com"
        ],
        "ip": [
            "67.43.156.13"
        ],
        "user": [
            "1",
            "foo",
            "[email protected]",
            "[email protected]"
        ]
    },
    "source": {
        "as": {
            "number": 35908
        },
        "geo": {
            "continent_name": "Asia",
            "country_iso_code": "BT",
            "country_name": "Bhutan",
            "location": {
                "lat": 27.5,
                "lon": 90.5
            }
        },
        "ip": "67.43.156.13",
        "user": {
            "domain": "bar.com",
            "email": "[email protected]",
            "id": "1",
            "name": "foo"
        }
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "google_workspace-access_transparency"
    ],
    "user": {
        "domain": "bar.com",
        "email": "[email protected]",
        "id": "1",
        "name": "foo"
    }
}

{
    "@timestamp": "2020-10-02T15:00:00.000Z",
    "agent": {
        "ephemeral_id": "6fde0a21-1448-4531-a5c9-42751772e3a7",
        "id": "c43b6bca-79fe-44a7-b837-da9db4bf7be4",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.13.0"
    },
    "data_stream": {
        "dataset": "google_workspace.context_aware_access",
        "namespace": "14973",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "c43b6bca-79fe-44a7-b837-da9db4bf7be4",
        "snapshot": false,
        "version": "8.13.0"
    },
    "event": {
        "action": "APPLICATION_EVENT",
        "agent_id_status": "verified",
        "created": "2024-08-01T21:53:36.823Z",
        "dataset": "google_workspace.context_aware_access",
        "id": "1",
        "ingested": "2024-08-01T21:53:48Z",
        "kind": [
            "event"
        ],
        "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"[email protected]\",\"profileId\":1},\"events\":{\"name\":\"APPLICATION_EVENT\",\"parameters\":[{\"name\":\"CAA_ACCESS_LEVEL_APPLIED\",\"value\":\"applied\"},{\"name\":\"CAA_ACCESS_LEVEL_SATISFIED\",\"value\":\"satisfied\"},{\"name\":\"CAA_ACCESS_LEVEL_UNSATISFIED\",\"value\":\"unsatisfied\"},{\"name\":\"CAA_APPLICATION\",\"value\":\"app\"},{\"name\":\"CAA_DEVICE_ID\",\"value\":\"devic423\"},{\"name\":\"CAA_DEVICE_STATE\",\"value\":\"devstate\"}],\"type\":\"device_applications\"},\"id\":{\"applicationName\":\"device\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}",
        "provider": "device"
    },
    "google_workspace": {
        "actor": {
            "email": "[email protected]",
            "profile": {
                "id": "1"
            },
            "type": "USER"
        },
        "context_aware_access": {
            "access_level": {
                "applied": "applied",
                "satisfied": "satisfied",
                "unsatisfied": "unsatisfied"
            },
            "application": "app",
            "device": {
                "id": "devic423",
                "state": "devstate"
            }
        },
        "event": {
            "name": "APPLICATION_EVENT",
            "type": "device_applications"
        },
        "id": {
            "application_name": "device",
            "customer": {
                "id": "1"
            },
            "time": "2020-10-02T15:00:00.000Z",
            "unique_qualifier": "1"
        },
        "ip_address": "67.43.156.13",
        "kind": "admin#reports#activity",
        "organization": {
            "domain": "example.com"
        }
    },
    "input": {
        "type": "httpjson"
    },
    "organization": {
        "id": "1"
    },
    "related": {
        "hosts": [
            "bar.com",
            "example.com"
        ],
        "ip": [
            "67.43.156.13"
        ],
        "user": [
            "1",
            "foo",
            "[email protected]"
        ]
    },
    "source": {
        "as": {
            "number": 35908
        },
        "geo": {
            "continent_name": "Asia",
            "country_iso_code": "BT",
            "country_name": "Bhutan",
            "location": {
                "lat": 27.5,
                "lon": 90.5
            }
        },
        "ip": "67.43.156.13",
        "user": {
            "domain": "bar.com",
            "email": "[email protected]",
            "id": "1",
            "name": "foo"
        }
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "google_workspace-context_aware_access"
    ],
    "user": {
        "domain": "bar.com",
        "email": "[email protected]",
        "id": "1",
        "name": "foo"
    }
}

{
    "@timestamp": "2020-10-02T15:00:00.000Z",
    "agent": {
        "ephemeral_id": "73bd4e11-03bc-40dc-a0bc-1d9ca1aaa853",
        "id": "c43b6bca-79fe-44a7-b837-da9db4bf7be4",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.13.0"
    },
    "data_stream": {
        "dataset": "google_workspace.gcp",
        "namespace": "65228",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "c43b6bca-79fe-44a7-b837-da9db4bf7be4",
        "snapshot": false,
        "version": "8.13.0"
    },
    "event": {
        "action": "IMPORT_SSH_PUBLIC_KEY",
        "agent_id_status": "verified",
        "created": "2024-08-01T21:56:37.313Z",
        "dataset": "google_workspace.gcp",
        "id": "1",
        "ingested": "2024-08-01T21:56:49Z",
        "kind": [
            "event"
        ],
        "original": "{\"actor\":{\"callerType\":\"USER\",\"email\":\"[email protected]\",\"profileId\":1},\"events\":{\"name\":\"IMPORT_SSH_PUBLIC_KEY\",\"parameters\":[{\"name\":\"USER_EMAIL\",\"value\":\"[email protected]\"}],\"type\":\"CLOUD_OSLOGIN\"},\"id\":{\"applicationName\":\"device\",\"customerId\":\"1\",\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1},\"ipAddress\":\"67.43.156.13\",\"kind\":\"admin#reports#activity\",\"ownerDomain\":\"example.com\"}",
        "provider": "device"
    },
    "google_workspace": {
        "actor": {
            "email": "[email protected]",
            "profile": {
                "id": "1"
            },
            "type": "USER"
        },
        "event": {
            "name": "IMPORT_SSH_PUBLIC_KEY",
            "type": "CLOUD_OSLOGIN"
        },
        "gcp": {
            "user_email": "[email protected]"
        },
        "id": {
            "application_name": "device",
            "customer": {
                "id": "1"
            },
            "time": "2020-10-02T15:00:00.000Z",
            "unique_qualifier": "1"
        },
        "ip_address": "67.43.156.13",
        "kind": "admin#reports#activity",
        "organization": {
            "domain": "example.com"
        }
    },
    "input": {
        "type": "httpjson"
    },
    "organization": {
        "id": "1"
    },
    "related": {
        "hosts": [
            "bar.com",
            "example.com"
        ],
        "ip": [
            "67.43.156.13"
        ],
        "user": [
            "1",
            "foo",
            "[email protected]"
        ]
    },
    "source": {
        "as": {
            "number": 35908
        },
        "geo": {
            "continent_name": "Asia",
            "country_iso_code": "BT",
            "country_name": "Bhutan",
            "location": {
                "lat": 27.5,
                "lon": 90.5
            }
        },
        "ip": "67.43.156.13",
        "user": {
            "domain": "bar.com",
            "email": "[email protected]",
            "id": "1",
            "name": "foo"
        }
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "google_workspace-gcp"
    ],
    "user": {
        "domain": "bar.com",
        "email": "[email protected]",
        "id": "1",
        "name": "foo"
    }
}