Google Workspace #

Log sources

Workspace timestamps 101: Reports API returns each event with id.time (ISO-8601 UTC, ms) = event-time at the service; the API itself has ingestion lag typically 1-4 hours, up to a few days for some rare streams. Retention is 6 months for most applicationNames via Reports API; longer via Vault or SIEM export. Drive events are notoriously laggy - the download event can arrive hours after the download.

  • Admin audit log (admin.googleapis.com / Admin SDK Reports API applicationName=admin) - org config changes. ts: id.time UTC ms.
  • Login audit (applicationName=login) - successes, failures, suspicious login, 2SV change, logout. ts: id.time UTC ms; login_timestamp parameter may also appear for some events.
  • Drive audit - view, download, copy, edit, change_user_access, change_document_visibility (anyone-with-link vs. public), external share. ts: id.time UTC ms. Expect multi-hour lag; always re-pull a window a day later for completeness.
  • Gmail log events - email_log_search (basic trace); BigQuery Gmail log export for full fidelity. ts: BigQuery export timestamp is UTC µs. BigQuery delivery lag typically ≤30 min.
  • Token audit (applicationName=token) - OAuth grants to third-party apps. ts: id.time UTC; authorize is grant time, revoke is explicit revoke. Token expiry is on the OAuth client, not here.
  • Groups, Calendar, Chat, Meet, User Accounts, SAML, Context-Aware Access - each a separate applicationName.
  • Alert Center - curated alerts; integrate with Chronicle (now Google SecOps). ts: createTime, updateTime, startTime, endTime UTC per alert.
  • Vault (ediscovery/retention) for preservation and export. ts: each exported item carries native workload ts; holds applied at createTime.

What to hunt

  • OAuth third-party app grants with Drive/Gmail scope - authorize events in token log.
  • Mail forwarding filters - Gmail setting CREATE_FILTER with forward/skip inbox/delete; also POP/IMAP forwarding.
  • Super Admin role grants.
  • Suspicious login flags, less-secure-app sign-ins (legacy, mostly killed), app passwords.
  • Context-Aware Access policy weakening.
  • Takeout export abuse - DOWNLOAD_USER_DATA.
  • Shared drive external membership adds.
Google Workspace tooling: GAM / GAMADV-XTD3 (Jay Lee, the Swiss army knife for Workspace admin + log pulls), Admin SDK Reports API directly, Chronicle / Google SecOps (native Google logs ingest), Vault API for eDiscovery, Grimoire Workspace playbooks, gwap (GoodBye Workspace Audit Pack), Takeout for custodian export, goose (Google Workspace investigation tooling, variant of CISA's Untitled Goose Tool).