{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"maxLevel":{"value":"2"},"_parentId":{"value":"120919360"},"type":{"value":"flat"}},"macroMetadata":{"macroId":{"value":"ef598e04-6757-4b70-b36e-1b0e3b47ee45"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"508ff330-4fcb-4215-9819-c512d9962715"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Service description","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"G Suite Reports API","type":"text","marks":[{"type":"link","attrs":{"href":"https://developers.google.com/admin-sdk/reports/v1/get-start/getting-started?hl=es"}}]},{"text":" is used to gain insights on content management with Google activity, audit administrator actions, and generate customer and user usage reports.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Data source description","type":"text","marks":[{"type":"textColor","attrs":{"color":"#202124"}}]}]},{"type":"paragraph","content":[{"text":"The G Suite API generates account activities for these applications and sources.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]},{"text":" The collector process the Google API responses and send them to Devo platform that will categorize all information received on tables along rows and columns on your Devo domain.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#091e42"}}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"G Suite Reports","type":"text"}]},{"type":"paragraph","content":[{"text":"Listed in the table below are some application names, details and how Devo platform treats the data.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#202124"}}]}]},{"type":"table","attrs":{"layout":"full-width","localId":"8c65184f-13fe-4284-a3e3-192e33717ad7"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Application name","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Details","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Devo data tables","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Access Transparency","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Activity events from a G Suite resource accessed by Google.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#202124"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"cloud.gsuite.reports.access_transparency","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Admin","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Report returns information on the Admin console activities of all of your account's administrators.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"cloud.gsuite.reports.admin","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Calendar","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Report returns information about how your account's users manage and modify their Google Calendar events.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"cloud.gsuite.reports.calendar","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Google Drive","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Report returns information about how your account's users manage, modify, and share their Google Drive documents.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"cloud.gsuite.reports.drive","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Google Cloud Platform","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Activity events Interaction with the Cloud OS Login API.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"cloud.gsuite.reports.gcp","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Groups","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Activity report returns information about how your account's users manage and modify their groups.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"cloud.gsuite.reports.groups","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Google+","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Activity report returns information about the Google+ activity of all of your account's users.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"cloud.gsuite.reports.gplus","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Enterprise Groups","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Audit activity events from a","type":"text"},{"text":"ctions performed by the moderator.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#202124"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"cloud.gsuite.reports.cloud.gsuite.reports.groups_enterprise","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Jamboard","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"A","type":"text"},{"text":"ctivity of interactive whiteboard.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#222222"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"cloud.gsuite.reports.jamboard","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Meet","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Hangouts Meet Audit activity events describing a single Hangouts endpoint.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#202124"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"cloud.gsuite.reports.meet","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Logins","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Activity report returns information about the login activity of all of your account's users.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"cloud.gsuite.reports.login","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Mobile Audit","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Activity report returns information on all activities in a mobile device with a Work account, managed by Google Mobile Management.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"cloud.gsuite.reports.mobile","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"SAML","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Audit activity events from login event type. ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#202124"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"cloud.gsuite.reports.saml","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Authorization Tokens","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Activity report returns information about third-party websites and applications your users have granted access to.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"cloud.gsuite.reports.token","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Rules","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Activity report returns information about how the rules (that have been set up in Admin console) are performing.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"cloud.gsuite.reports.rules","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Users Account","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"User Accounts Audit activity events.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#202124"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"cloud.gsuite.reports.users_account","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"Each report uses the basic endpoint request with report-specific parameters or event type. The maximum time period for each report is the last 180 days. For more references about G Suite Reports, visit the ","type":"text"},{"text":"Google API Reference documentation","type":"text","marks":[{"type":"link","attrs":{"href":"https://developers.google.com/admin-sdk/reports/v1/reference"}}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Setup","type":"text"}]},{"type":"paragraph","content":[{"text":"The GSuite Reports collector requires that the Google Admin ADK API is enabled, a set of Google Oauth credentials and a ","type":"text"},{"text":"token.json","type":"text","marks":[{"type":"strong"}]},{"text":" file for authorizing requests to the GSuite Reports API.","type":"text"}]},{"type":"paragraph","content":[{"text":"The following steps must be completed:","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Enable the Google Admin SDK","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Login to ","type":"text"},{"text":"Google API console.","type":"text","marks":[{"type":"link","attrs":{"href":"https://console.developers.google.com/"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select ","type":"text"},{"text":"Enable APIs and Services.","type":"text","marks":[{"type":"strong"}]},{"type":"hardBreak"},{"type":"hardBreak"},{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"inline-media-image","parameters":{"width":"524","id":"bf127543-723a-477d-962d-00b5efbb3499","collection":"contentId-120919360","height":""}}},{"type":"hardBreak"},{"type":"hardBreak"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the search box enter “","type":"text"},{"text":"Admin SDK API","type":"text","marks":[{"type":"strong"}]},{"text":"“.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select the ","type":"text"},{"text":"Admin SDK API","type":"text","marks":[{"type":"strong"}]},{"text":" card in the search results.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Enable","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Create credentials ","type":"text"}]},{"type":"paragraph","content":[{"text":"Follow these steps to create credentials:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"While logged in ","type":"text"},{"text":"Google API console","type":"text","marks":[{"type":"link","attrs":{"href":"https://console.developers.google.com/"}}]},{"text":". Verify that you are in the correct Google project for your GSuite account.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Go to ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]},{"text":"Security > +Create Credentials > Oath Client ID","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}},{"type":"strong"}]},{"text":".","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]},{"type":"hardBreak"},{"type":"hardBreak"},{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"inline-media-image","parameters":{"width":"","id":"78994dc5-e036-43fc-917c-441d55a9b523","collection":"contentId-120919360","height":"250"}}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select ","type":"text"},{"text":"Desktop app","type":"text","marks":[{"type":"strong"}]},{"text":" as the application type. Set any value in the ","type":"text"},{"text":"Name","type":"text","marks":[{"type":"strong"}]},{"text":" field and click on the ","type":"text"},{"text":"Create","type":"text","marks":[{"type":"strong"}]},{"text":" button.","type":"text"},{"type":"hardBreak"},{"type":"hardBreak"},{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"inline-media-image","parameters":{"width":"552","id":"86d49d52-20a0-4fe1-ba16-b22ab9553ca1","collection":"contentId-120919360","height":""}}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A popup opens, click ","type":"text"},{"text":"OK","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"},{"type":"hardBreak"},{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"inline-media-image","parameters":{"width":"322","id":"920262e7-14ef-4581-9f99-2fc8d442bbb5","collection":"contentId-120919360","height":""}}}]}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Download the credentials.json file for the API Client","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Download the credentials in ","type":"text"},{"text":"JSON","type":"text","marks":[{"type":"strong"}]},{"text":" format by clicking on the","type":"text"},{"text":" downward black arrow","type":"text","marks":[{"type":"strong"}]},{"text":" in the right corner.","type":"text"},{"type":"hardBreak"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":60.0},"content":[{"type":"media","attrs":{"__fileSize":17288,"__fileMimeType":"image/png","width":1541,"id":"5fc8e75f-436a-4fa9-8a84-5d3b153b8b96","collection":"contentId-120919360","type":"file","__fileName":"G Suite Reports collector_50.png","height":126}}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Renate the file to credentials.json. You will need it for the next steps.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Authorize Oauth scopes and generate a token.json file","type":"text"}]},{"type":"paragraph","content":[{"text":"This step is completed using a Google-provided script. You can run this script from any computer.","type":"text"}]},{"type":"codeBlock","content":[{"text":"from __future__ import print_function\n\nimport base64\nimport os.path\nfrom googleapiclient.discovery import build\nfrom google_auth_oauthlib.flow import InstalledAppFlow\nfrom google.auth.transport.requests import Request\nfrom google.oauth2.credentials import Credentials\n\n# If modifying these scopes, delete the file token.json.\nSCOPES = ['https://www.googleapis.com/auth/admin.reports.audit.readonly',\n 'https://www.googleapis.com/auth/admin.reports.usage.readonly']\n\ndef main():\n \"\"\"Shows basic usage of the Admin SDK Reports API.\n Prints the time, email, and name of the last 10 login events in the domain.\n \"\"\"\n creds = None\n # The file token.json stores the user's access and refresh tokens, and is\n # created automatically when the authorization flow completes for the first\n # time.\n if os.path.exists('token.json'):\n creds = Credentials.from_authorized_user_file('token.json', SCOPES)\n # If there are no (valid) credentials available, let the user log in.\n if not creds or not creds.valid:\n if creds and creds.expired and creds.refresh_token:\n creds.refresh(Request())\n else:\n flow = InstalledAppFlow.from_client_secrets_file(\n 'credentials.json', SCOPES)\n creds = flow.run_local_server(port=0)\n # Save the credentials for the next run\n with open('token.json', 'w') as token:\n token.write(creds.to_json())\n creds_as_bytes = creds.to_json().encode('utf-8')\n base64creds = base64.b64encode(creds_as_bytes).decode(\"utf-8\")\n print(f'Base64 encoded token.json: {base64creds}')\n\n service = build('admin', 'reports_v1', credentials=creds)\n\n # Call the Admin SDK Reports API\n print('Getting the last 10 login events')\n results = service.activities().list(userKey='all', applicationName='login',\n maxResults=10).execute()\n activities = results.get('items', [])\n\n if not activities:\n print('No logins found.')\n else:\n print('Logins:')\n for activity in activities:\n print(u'{0}: {1} ({2})'.format(activity['id']['time'],\n activity['actor']['email'], activity['events'][0]['name']))\n\nif __name__ == '__main__':\n main()","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"To run this script, you'll need:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A graphical user interface (the script opens a browser to complete authorization)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Python 3.6 or greater","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"A Google account in the domain you want to collect data from with ","type":"text"},{"text":"administrator privileges","type":"text","marks":[{"type":"link","attrs":{"href":"https://support.google.com/a/answer/2406043?topic=2785005&ctx=topic"}}]}]}]}]}]},{"type":"paragraph","content":[{"text":"Follow these steps:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Get the above script.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Save the script to","type":"text"},{"text":" /devo-collectors/gsuite-reports/credentials","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Copy the ","type":"text"},{"text":"credentials.json ","type":"text","marks":[{"type":"strong"}]},{"text":"file downloaded previously to ","type":"text"},{"text":"/devo-collectors/gsuite-reports/credentials","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Install the Google Auth API library in the python interpreter being used on your computer.","type":"text"}]},{"type":"codeBlock","content":[{"text":"$ pip install --upgrade google-api-python-client google-auth-httplib2 google-auth-oauthlib","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Run the command below in the ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]},{"text":"/devo-collectors/gsuite-reports/credentials","type":"text","marks":[{"type":"code"}]},{"text":" directory to create the ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]},{"text":"token.json","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}},{"type":"strong"}]},{"text":" file. A Google consent window will prompt asking for permission scopes to be accepted, follow the instructions in the browser, and allow the application.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"codeBlock","content":[{"text":"$ python quickstart.py","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The script will output a line starting with ","type":"text"},{"text":"Base64","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"},{"text":"enconded token.json:","type":"text","marks":[{"type":"code"}]},{"text":" Copy the base64 value as this will be required for the collector configuration. This script was originally developed by Google and has been adapted by Devo.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Run the collector","type":"text"}]},{"type":"paragraph","content":[{"text":"Once the data source is configured, you can either send us the required information if you want us to host and manage the collector for you (","type":"text"},{"text":"Cloud collector","type":"text","marks":[{"type":"underline"}]},{"text":"), or deploy and host the collector in your own machine using a Docker image (","type":"text"},{"text":"On-premise collector","type":"text","marks":[{"type":"underline"}]},{"text":").","type":"text"}]},{"type":"bodiedExtension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-ui-tabs-macro","parameters":{"macroParams":{"_parentId":{"value":"120919360"}},"macroMetadata":{"macroId":{"value":"18fb61e8-d5a9-4d4c-ab9e-21acc6779131"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/tab-container.png"}}],"title":"Refined Tab Container"}},"localId":"1338be80-6f07-4991-b942-f3456412c92f"},"content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-tab","parameters":{"macroParams":{"_parentId":{"value":"120919360"},"title":{"value":"Cloud collector"}},"macroMetadata":{"macroId":{"value":"19a8f366-9add-4eac-86c4-4216eebbaf21"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/tab.png"}}],"title":"Refined Tab"}},"localId":"91f2e7f4-35bd-4749-a363-1d1a3cc8cd4b"}},{"type":"paragraph","content":[{"text":"We use a piece of software called Collector Server to host and manage all our available collectors. If you want us to host this collector for you, ","type":"text"},{"text":"get in touch with us","type":"text","marks":[{"type":"link","attrs":{"href":"mailto:support@devo.com"}}]},{"text":" and we will guide you through the configuration.","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-tab","parameters":{"macroParams":{"_parentId":{"value":"120919360"},"title":{"value":"On-premise collector"}},"macroMetadata":{"macroId":{"value":"c445d875-3208-4127-9169-36d84d822dfa"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/tab.png"}}],"title":"Refined Tab"}},"localId":"b962e3bf-c3e0-4b9f-9596-e1fbf214e98b"}},{"type":"paragraph","content":[{"text":"This data collector can be run in any machine that has the Docker service available because it should be executed as a docker container. The following sections explain how to prepare all the required setup for having the data collector running.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#282828"}}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Structure","type":"text","marks":[{"type":"textColor","attrs":{"color":"#282828"}}]}]},{"type":"paragraph","content":[{"text":"The following directory structure should be created for ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#282828"}}]},{"text":"G Suite collector","type":"text","marks":[{"type":"textColor","attrs":{"color":"#282828"}},{"type":"strong"}]},{"text":":","type":"text","marks":[{"type":"textColor","attrs":{"color":"#282828"}}]}]},{"type":"codeBlock","content":[{"text":"\n└── devo-collectors/\n └── gsuite-reports/\n ├── certs/\n │ ├── chain.crt\n │ ├── .key\n │ └── .crt\n ├── credentials/\n │ └── credentials-gsuite-reports.json\n │ └── token.pickle\n └── config/\n └── config-gsuite-reports.yaml","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"devocredentials"},"legacyAnchorId":{"value":"GSuiteReportscollector-devocredentials"},"_parentId":{"value":"120919360"}},"macroMetadata":{"macroId":{"value":"6a603d39-ab22-43af-84a5-00940a7fba0b"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"17256241-db3c-43db-a187-e0f79d057288"}},{"text":"Devo credentials","type":"text"}]},{"type":"paragraph","content":[{"text":"In Devo, go to ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#282828"}}]},{"text":"Administration → Credentials → X.509 Certificates","type":"text","marks":[{"type":"strong"}]},{"text":", download the ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#282828"}}]},{"text":"Certificate","type":"text","marks":[{"type":"strong"}]},{"text":", ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#282828"}}]},{"text":"Private key","type":"text","marks":[{"type":"strong"}]},{"text":" and ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#282828"}}]},{"text":"Chain CA","type":"text","marks":[{"type":"strong"}]},{"text":" and save them in ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#282828"}}]},{"text":"/devo-collectors/gsuite-reports/certs/","type":"text","marks":[{"type":"code"}]},{"text":". Learn more about security credentials in Devo ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#282828"}}]},{"text":"here","type":"text","marks":[{"type":"link","attrs":{"__confluenceMetadata":{"spaceKey":"latest","isRenamedTitle":true,"linkType":"page","contentTitle":"Security credentials","versionAtSave":"2"},"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/94763701"}}]},{"text":".","type":"text","marks":[{"type":"textColor","attrs":{"color":"#282828"}}]},{"text":" ","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":60.0},"content":[{"type":"media","attrs":{"__fileSize":102602,"__fileMimeType":"image/png","width":1840,"id":"610555f1-1dc5-45cc-b96c-76b64ffa14fc","collection":"contentId-120919360","type":"file","__fileName":"G Suite Reports collector_60.png","height":414}}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Editing the config-gsuite-reports.yaml file","type":"text"}]},{"type":"paragraph","content":[{"text":"In the ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#282828"}}]},{"text":"config-gsuite-reports.yaml","type":"text","marks":[{"type":"textColor","attrs":{"color":"#282828"}},{"type":"strong"}]},{"text":" file, replace the ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#282828"}}]},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" placeholder by the required value, which in this case can be any value you choose.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#282828"}}]}]},{"type":"codeBlock","content":[{"text":"globals:\n debug: false # <- Setup as True or False for debugging mode\n id: not_used\n name: gsuite\n persistence: # <- Persistence setup filesystem\n type: filesystem\n config:\n directory_name: state # <- Persistence directory\noutputs:\n devo_1:\n type: devo_platform\n config:\n address: eu.elb.relay.logtrust.net # <- Devo platform address EU/US\n port: 443\n type: SSL\n chain: chain.crt\n cert: .crt # <- Please, replace with the certificate from your Devo domain (Administration>Credentials>x.509)\n key: .key # <- Please, replace with the certificate from your Devo domain (Administration>Credentials>x.509)\ninputs:\n gsuite_reports:\n id: # The value of this field will be used internally for having independent persistence areas\n enabled: false # <- As the G Suite reports shares the same config as G Suite alerts, in order to use the config only for alerts. Reports is disabled.\n requests_per_second: 5 # <- Setting up requests per second. 5 recommended.\n autoconfig:\n enabled: false \n refresh_interval_in_seconds: 600 # <- Time wait in second between requests - 600s recommended.\n credentials:\n token_pickle_filename: token.pickle # <- token.pickle file name\n services: # <- List with the Alerts that you want to collect\n # Request frequency values are in seconds\n # Default values recommended. \n access_transparency:\n request_period_in_seconds: 60 # <- Controls waiting time for to the next request\n start_time: \"9999-12-31T23:59:59.999Z\"\n admin:\n request_period_in_seconds: 60\n start_time: \"9999-12-31T23:59:59.999Z\" # <- Setting a start time for data collection. Format sample supportted \"YYYY-mm-ddTHH:MM:SS.sssZ\"\n calendar:\n request_period_in_seconds: 3600\n start_time: \"9999-12-31T23:59:59.999Z\"\n login:\n request_period_in_seconds: 3600\n start_time: \"9999-12-31T23:59:59.999Z\"\n chat:\n request_period_in_seconds: 3600\n start_time: \"9999-12-31T23:59:59.999Z\"\n drive:\n request_period_in_seconds: 60\n start_time: \"9999-12-31T23:59:59.999Z\"\n gcp:\n request_period_in_seconds: 3600\n start_time: \"9999-12-31T23:59:59.999Z\"\n gplus:\n request_period_in_seconds: 3600\n start_time: \"9999-12-31T23:59:59.999Z\"\n groups:\n request_period_in_seconds: 3600\n start_time: \"9999-12-31T23:59:59.999Z\"\n groups_enterprise:\n request_period_in_seconds: 3600\n start_time: \"9999-12-31T23:59:59.999Z\"\n jamboard:\n request_period_in_seconds: 3600\n start_time: \"9999-12-31T23:59:59.999Z\"\n meet:\n request_period_in_seconds: 60\n start_time: \"9999-12-31T23:59:59.999Z\"\n mobile:\n request_period_in_seconds: 3600\n start_time: \"9999-12-31T23:59:59.999Z\"\n rules:\n request_period_in_seconds: 3600\n start_time: \"9999-12-31T23:59:59.999Z\"\n saml:\n request_period_in_seconds: 3600\n start_time: \"9999-12-31T23:59:59.999Z\"\n token:\n request_period_in_seconds: 3600\n start_time: \"9999-12-31T23:59:59.999Z\"\n user_accounts:\n request_period_in_seconds: 3600\n start_time: \"9999-12-31T23:59:59.999Z\"","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"The ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]},{"text":"start_time","type":"text","marks":[{"type":"code"}]},{"text":" fields are optional. If you would like to establish any value, the required format is ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]},{"text":"0000-00-00T00:00:00.000Z","type":"text","marks":[{"type":"em"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Download the Docker image","type":"text"}]},{"type":"paragraph","content":[{"text":"The collector should be deployed as a Docker container. Download the Docker image of the collector as a .tgz file by clicking the link in the following table:","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"64919b11-affb-4ca0-a10e-af3fdb8ba367"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"#c8e9f2","rowspan":1,"colwidth":[340.0]},"content":[{"type":"paragraph","content":[{"text":"Collector Docker image","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"#c8e9f2","rowspan":1,"colwidth":[340.0]},"content":[{"type":"paragraph","content":[{"text":"SHA-256 hash","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[340.0]},"content":[{"type":"paragraph","content":[{"text":"collector-gsuite-docker-image-1.2.0.tgz","type":"text","marks":[{"type":"link","attrs":{"href":"https://drive.google.com/file/d/1kJ7FW_4R1AE_Aylfzo7ZQmYB9bVIBbnI/view?usp=sharing"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[340.0]},"content":[{"type":"paragraph","content":[{"text":"e0e0f60d58c265f1e7f1d16976fe547caa0e38d830f5a7182131bc9adfcb7ed0","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"Use the following command to add the Docker image to the system:","type":"text"}]},{"type":"codeBlock","content":[{"text":"gunzip -c collector-gsuite-docker-image-.tgz | docker load","type":"text"}]},{"type":"paragraph","content":[{"text":"After the Docker image is imported, it will show the real name of the Docker image (including version info).","type":"text"}]},{"type":"paragraph","content":[{"text":"The Docker image can be deployed on the following services:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Docker","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Docker Compose","type":"text"}]}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Docker","type":"text"}]},{"type":"paragraph","content":[{"text":"Execute the following command on the root directory ","type":"text"},{"text":"/devo-collectors/gsuite-reports/","type":"text","marks":[{"type":"code"}]}]},{"type":"codeBlock","content":[{"text":"docker run \\\n--name collector-gsuite-reports \\\n--volume $PWD/certs:/devo-collector/certs \\\n--volume $PWD/config:/devo-collector/config \\\n--volume $PWD/state:/devo-collector/state \\\n--env CONFIG_FILE=config-gsuite-reports.yaml \\\n--rm -it docker.devo.internal/collector/gsuite:","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the proper version.","type":"text"}]}]},{"type":"heading","attrs":{"level":4},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"dockercompose"},"legacyAnchorId":{"value":"GSuiteReportscollector-dockercompose"},"_parentId":{"value":"120919360"}},"macroMetadata":{"macroId":{"value":"fedab885-2433-4f2b-b118-653c8624e0e9"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"a0b5d2a7-6c92-477b-9b50-dff7942889a5"}},{"text":"Docker Compose","type":"text"}]},{"type":"paragraph","content":[{"text":"The following Docker Compose file can be used to execute the Docker container. It must be created in the ","type":"text"},{"text":"/devo-collectors/gsuite-reports/","type":"text","marks":[{"type":"code"}]},{"text":" directory.","type":"text"}]},{"type":"codeBlock","content":[{"text":"version: '3'\nservices:\n collector-gsuite-reports:\n build:\n context: .\n dockerfile: Dockerfile\n image: docker.devo.internal/collector/gsuite:${IMAGE_VERSION:-latest}\n container_name: collector-gsuite-reports\n volumes:\n - ./certs:/devo-collector/certs\n - ./config:/devo-collector/config\n - ./state:/devo-collector/state\n environment:\n - CONFIG_FILE=${CONFIG_FILE:-config-gsuite-reports.yaml}","type":"text"}]},{"type":"paragraph","content":[{"text":"To run the container using docker-compose, execute the following command from the ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#091e42"}}]},{"text":"/devo-collectors/gsuite-reports/","type":"text","marks":[{"type":"code"}]},{"text":" directory:","type":"text","marks":[{"type":"textColor","attrs":{"color":"#091e42"}}]}]},{"type":"codeBlock","content":[{"text":"IMAGE_VERSION= docker-compose up -d","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"G Suite Report lag times","type":"text"}]},{"type":"paragraph","content":[{"text":"The lag times in this table show how long it can take before data for specific Admin console reports and audit logs are available.","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","localId":"1309a738-2243-4f15-9b8b-8631a55b1d5c"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"Item name","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Report name","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"Lag time","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":3,"rowspan":1,"colwidth":[248.51,422.96,607.39]},"content":[{"type":"paragraph","content":[{"text":"Highlights","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"Gmail","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Gmail report","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"1-3 days","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"Drive","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Drive report","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"1-3 days","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"Hangouts","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Hangouts report","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"1-3 days","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"Google+","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Google+ report","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"1-3 days","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"Calendar","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Calendar report","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"1-3 days","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"Document Link Shared Status","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Drive report","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"1-3 days","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":3,"rowspan":1,"colwidth":[248.51,422.96,607.39]},"content":[{"type":"paragraph","content":[{"text":"Security","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"External Link Shared Files","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Drive report","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"1-3 days","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"External Link Shared Files","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Security report","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"1-3 days","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"Less Secure Apps Access","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Security report","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"1-3 days","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"2-Step Verification Enrollment","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"2SV report","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"1-3 days","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":3,"rowspan":1,"colwidth":[248.51,422.96,607.39]},"content":[{"type":"paragraph","content":[{"text":"Aggregate reports","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"Accounts","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Accounts report","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"1-3 days","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"Gmail","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Gmail report","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"1-3 days","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"Drive","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Drive report","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"1-3 days","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"Google+","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Google+ report","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"1-3 days","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"Mobile","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Mobile report","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"1-3 days","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":3,"rowspan":1,"colwidth":[248.51,422.96,607.39]},"content":[{"type":"paragraph","content":[{"text":"Apps usage activity","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"Files added","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Drive report","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"1-3 days","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"Total Emails","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Gmail report","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"1-3 days","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"Total Storage Used (MB)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Quota report","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"1-3 days","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":3,"rowspan":1,"colwidth":[248.51,422.96,607.39]},"content":[{"type":"paragraph","content":[{"text":"Audit","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"Admin","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Admin audit","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"almost real-time (a couple of minutes)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"Login","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Login audit","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"1-2 days","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"Drive","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Drive audit","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"almost real-time (a couple of minutes)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"Calendar","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Calendar audit","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"tens of minutes (can also go up to a couple of hours)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"Jamboard","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Jamboard audit","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"1-3 days","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"Google+","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Google+ audit","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"1-3 days","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"Chat","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Chat audit","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"1-3 days","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"Meet","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Meet audit","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"almost real-time (a couple of minutes)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"Voice","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Voice audit","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"1-3 days","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"Mobile devices","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Devices audit","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"up to a few hours","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"SAML","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"SAML audit","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"up to a few hours","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"LDAP","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"LDAP audit","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"1-3 days","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"Token","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Token audit","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"a couple of hours","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"Groups","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Groups audit","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"tens of minutes (can also go up to a couple of hours)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"User accounts","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"User accounts audit","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"tens of minutes","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"Access Transparency","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Access Transparency audit","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"almost real-time (a couple of minutes)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[248.51]},"content":[{"type":"paragraph","content":[{"text":"Email log search","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[422.96]},"content":[{"type":"paragraph","content":[{"text":"Email audit","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[607.39]},"content":[{"type":"paragraph","content":[{"text":"1-3 days","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"Retrieving report or audit log data for older dates or a wide time range might take so long that, by the time results are available, the most recent log data might no longer be fresh. For tools that require real-time monitoring, use a short time range. Many products listed above (such as Gmail and Google Drive) are relevant for G Suite only, and not for other Google services, such as Cloud Identity.","type":"text"}]},{"type":"paragraph","content":[{"text":"Learn more about ","type":"text"},{"text":"limits and quotas","type":"text","marks":[{"type":"link","attrs":{"href":"https://developers.google.com/admin-sdk/reports/v1/limits"}}]},{"text":" and ","type":"text"},{"text":"lag times","type":"text","marks":[{"type":"link","attrs":{"href":"https://support.google.com/a/answer/7061566?hl=en"}}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Disclaimer","type":"text"}]},{"type":"paragraph","content":[{"text":"The API limits the number of requests for your APIs Console project. The API project's maximum number of requests per second (project QPS) is 5 QPS and the maximum number of requests per day (project QPD) is 150,000 QPD across the account. ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#202124"}}]},{"text":"If these limits are exceeded, the server returns an HTTP 503 status code.","type":"text"}]},{"type":"paragraph","content":[{"text":"You might find that your Admin console reports and audit logs don’t show the latest data, because reports don’t reflect real-time data. The lag times in the table below show how long it can take before data for specific Admin console reports and audit logs is available. Some reports might take longer to display updated information. ","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"There's a small chance that reports and audit logs for some events will be delayed beyond the specified times below. In very rare cases, events may not be reported.","type":"text"}]}]},{"type":"paragraph"}],"version":1}

Browser not supported