G Suite Alerts collector
- Juan Tomás Alonso Nieto (Deactivated)
Service description
The G Suite Alert Center manages alerts on potential issues within your domain. Apps you develop can use the Alert Center API to retrieve alerts in order to respond to them. Apps can also use the API to create and retrieve alert feedback. For example, a monitoring app could retrieve new alerts, prioritize them, and then notify members of your organization when action is needed.
Data source description
The G Suite API generates account activities for these applications and sources. The G suite collector that we provide processes the Google API responses and sends them to the Devo platform. Data will be categorized in different tables in your Devo domain, as you can check in the following table.
G Suite Alert Center
Listed in the table below are the alerts sources, types, the data that G Suite classifies and how Devo platform treats it.
Alert source | Alert type | Devo data tables |
|---|---|---|
Domain wide takeout | Customer takeout initiated |
|
Gmail phishing | Malware reclassification |
|
Misconfigured whitelist |
| |
Phishing reclassification |
| |
Suspicious message reported |
| |
User reported phishing |
| |
User reported spam spike |
| |
Google identity | Leaked password |
|
Suspicious login |
| |
Suspicious login (less secure app) |
| |
Suspicious programmatic login |
| |
User suspended |
| |
User suspended (spam) |
| |
User suspended (spam through relay) |
| |
User suspended (suspicious activity) |
| |
Google Operations | Google Operations |
|
State Sponsored Attack | Government attack warning |
|
Mobile device management | Device compromised |
|
Suspicious activity |
| |
AppMaker Editor | AppMaker Default Cloud SQL setup |
|
Security Center rules | Activity Rule |
|
For more information about sources and types, visit the G Suite Alert Center API documentation.
Setup
The G Suite Alerts collector needs to be configured in the Google Cloud Platform APIs console and also in the Google Admin console.
In the Google Cloud Platform APIs console, you need to enable the Google Workspace Alert Center API (formerly G Suite Alert Center API) and create the proper credentials for the collector.
In the Google Admin console, you must give the proper permissions to the previously created credentials.
Follow the instructions below to learn how to configure the services and allow the required permissions:
Enabling Google Workspace Alert Center API and credentials creation
Follow the next steps to create the Service Account that will be used to collect the alerts and enable the necessary API and scopes to use it.
Go to the Google Cloud Platform APIs console.
Go to the Library section.
Search Google Workspace Alert Center API in the search box.
Click Enable.
Go to the Credentials section (You can type credentials api services on the search box or choose the section from the left panel).
Then, click Manage Service Accounts.
Click Create Service Account and fill in the required fields (the optional steps can be omitted).
Click on the previously created Service Account and make sure you are in the DETAILS section.
Click on SHOW DOMAIN-WIDE DELEGATION, then enable the option called Enable Google Workspace Domain-wide Delegation. Click Save and copy the value in the Client ID box (this value will be used in the Assigning proper permissions to credentials section).
Once saved, go to KEYS section, click ADD KEY → Create new key and choose the JSON file type. Then, click CREATE (a .json file will be downloaded).
Rename the downloaded file to
credentials-gsuite-alerts.jsonand move it to the collector credentials directory (<any_directory>/devo-collector/gsuite-alerts/credentials/).
Assigning the required permissions to the credentials
Now, you must be associate a scope to the previously created Client ID. Follow these steps to do it:
You must have the proper admin permissions to follow the next steps.
Go to the Google admin console.
From your Google Workspace domain’s Admin console, go to Main menu → Security → API Controls.
In the Domain wide delegation pane, select Manage Domain Wide Delegation.
Click Add new.
In the Client ID field, enter the service account's Client ID. You can find your service account's client ID in the Service accounts page.
In the OAuth scopes (comma-delimited) field, enter the next scope :
https://www.googleapis.com/auth/apps.alertsClick Authorize.
Run the collector
Once the data source is configured, you can either send us the required information if you want us to host and manage the collector for you (Cloud collector), or deploy and host the collector in your own machine using a Docker image (On-premise collector).
Disclaimer
The API limits the number of requests for your APIs Console project. The API project's maximum number of requests per second (project QPS) is 5 QPS and the maximum number of requests per day (project QPD) is 150,000 QPD across the account. If these limits are exceeded, the server returns an HTTP 503 status code.