In this section:
Feedback:

Google Workspace

Anomali supports the ingestion of Google Workspace logs through the Google Workspace Reports API and AWS S3.

Google Workspace API

You can use your existing Google Cloud service account or create a new service account to add a new log source in the Anomali platform.

Onboarding steps

Prerequisites

Your Google user must be authorized to read your organization's activity records. If your user does not have this privilege, follow Google Workspace instructions to create a new role with Reports access and assign the role to your user.

Step 1: Create Google Cloud Project

See Google's guide to Creating and managing projects to learn how you can create a Google Cloud project.

Step 2: Create service account

See Google's guide to Creating a service account.

Step 3: Enable Workspace Admin SDK API

Google Workspace Admin SDK API contains the following APIs:

To enable these APIs:

  1. Navigate to the APIs Library and select APIs and Services > Library.

  2. Search for Admin SDK API and select Admin SDK API.

  3. Click Enable to enable the Admin SDK API.

  4. Similarly, search for Alert Center API and click Enable to enable the Alert Center API.

Step 4: Create API credentials

  1. Navigate to API Credentials > APIs and Services > Credentials.

  2. Click Create Credentials > Service Account.

  3. Enter a service account name. This also populates a service account ID.

  4. (Optional) Enter a service account description.

  5. Click Done.

  6. From the Service Accounts table, select the service account that was created.

  7. Securely save the Unique ID value displayed. This ID will be necessary for Google Workspace .

  8. From the Keys menu, click Add Key > Create new key.

  9. Select JSON as the key type.

  10. Click Create. This saves a JSON file to your local filesystem containing the secure access credentials for this service acount.

Step 5: Delegate domain-wide authority

  1. Log in to the Google Admin Console.

  2. Navigate to API Controls > Security > Access and data control > API controls.

  3. Click Manage Domain Wide Delegation.

  4. Click Add new.

  5. In the Client ID field, enter the Unique ID from Google Workspace .

  6. In the OAuth scopes, enter the following:

  7. Click Authorize.

Step 6: Create new role for new or existing user

  1. Log in to the Google Admin Console.

  2. Click Create New Role.

  3. Enter a Name and Description for the role info, then click Continue.

  4. From the Services section, select the Reports privilege. Additionally, in the Alert Center section, select View access privilege.

  5. Click Continue.
  6. Click Create Role.
  7. Then, either add a user by clicking Add new user or use an existing user. This page includes the primary email address for the user to sign in.
  8. Click Assign roles from Admin roles and privileges.
  9. Select the role you created and toggle the Assigned state switch to assign the role.
  10. Click Save.

Securely save the email address of this user for Google Workspace .

Step 7: Add Google Workspace as new log source

To add Google Workspace as a new log source on the Anomali platform:

  1. Navigate to Search > Log Source Management.

  2. Click New to add a new log source.

  3. Enter a name for the log source.

  4. (Optional) Enter a description for the source type.

  5. Select Google Workspace as the log source.

  6. Select API as the ingestion method.

  7. Provide the Basic Configuration details:

    1. Google User: Enter the email address of the Google Workspace user from Google Workspace .

    2. GCP Service Account Credentials: Enter the password of the Google service account.

  8. (Optional) Next to the Basic Configuration section, click on the Advanced Options link to provide additional information about the event log data:

    1. Enter one or more parameters that provide additional context about the data. For example, "File format" indicates the format of the event log data being shipped, or "File extension" that indicates the extension of the logs.

    2. Enter the corresponding value of the parameter. For example, CSV is a file format. Similarly, ".gzip" is a file extension.

  9. Click Save to add the log source.

Step 8: Configure permissions

You can set permissions to decide which roles can view, add, or edit log sources. To do so, configure the following parameters:

  1. Owner: Select an owner of the view from the list of users. This is the email address of the owner.

  2. Type: Select the type of permission assigned to the view:

    1. Private: Only the owner has read and write privileges, that is, no other user can access or edit the view.

    2. Shared: Allows you to set the read-write privileges for a role that is mapped to different users, granting read-write permissions to all users assigned that role. You can also assign read or write permissions to everyone in your organization.

Step 9: Check log source status

Once added, the status of the log source becomes Create Requested. See Log Source Statuses to understand the different types statuses assigned to log sources.

Step 10: Receive confirmation email

You will receive a notification email from Anomali once you have created a new log source request. The Log Source Management page will show the status as Create Requested.

Once the log source has been provisioned and is ready for use, Anomali will send you another email and the Log Source Management page status for the log source will change to Active.

AWS S3

If your logs are already in S3, you can proceed directly to Step 2: Set up SQS queue. If not, Anomali recommends following Step 1: Ship data to S3 using NXLog to use NXLog to first ship the logs to S3. After S3 receives the data, it sends updates to an Amazon SQS queue you designate, enabling Anomali to automatically pull the logs from S3 whenever it receives a new notification from the queue.

Onboarding Steps

Step 1: Ship data to S3 using NXLog

See Using NXLog to Ship Data to set up NXLog to send data into S3.

Step 2: Set up SQS queue

Once your data is in S3, you can send it to Anomali using Amazon SQS. See Setting up Amazon SQS queue for more information.

Step 3: Enable AWS S3 notifications

Enable AWS S3 notifications for Amazon SQS to receive change notifications when you add logs. See Amazon's guide to configuring AWS S3 notification for SQS for more information.

Step 4: Add Google Workspace as new log source

On the Anomali platform, add Google Workspace as a new log source, as follows:

  1. Navigate to Search > Log Source Management.

  2. Click New to add a new log source.

  3. Enter a name for the log source.

  4. (Optional) Enter a description for the log source.

  5. Select it as the log source.

  6. Select AWS S3 as the ingest method.

  7. Ensure S3 notification are enabled. See Step 2: Enable AWS S3 notifications for more information.

  8. Provide the Basic Configuration details:

    1. AWS SQS Queue URL: Enter the URL of your AWS SQS queue. See Setting up Amazon SQS queue for more information.

    2. AWS Secret Access Key: Provide the AWS secret access key.

    3. AWS Access Key ID: Enter the AWS Access ID.

    4. File Selector: Provide the path to the event log data files. Anomali recommends the following practices for the path:

          • Sourcetype must be the path prefix, as follows:
            <sourcetype>/year=2025/month=04/day=05/path/to/file.
            For example: google_workspace/year=2025/month=03/day=22/events/event_data_logs/.
          • Sourcetype name must not contain any spaces: For example, "google_workspace" is correct, however "google workspace" is incorrect.

  1. (Optional) Next to the Basic Configuration section, click on the Advanced Options link to provide additional information about the event log data:

    1. Enter one or more parameters that provide additional context about the data. For example, "File format" indicates the format of the event log data being shipped, or "File extension" that indicates the extension of the logs.
    2. Enter the corresponding value of the parameter. For example, CSV is a file format. Similarly, ".gzip" is a file extension.

  2. Click Save to add the log source.

Step 5: Configure permissions

You can set permissions to decide which roles can view, add, or edit log sources. To do so, configure the following parameters:

  1. Owner: Select an owner of the view from the list of users. This is the email address of the owner.

  2. Type: Select the type of permission assigned to the view:

    1. Private: Only the owner has read and write privileges, that is, no other user can access or edit the view.

    2. Shared: Allows you to set the read-write privileges for a role that is mapped to different users, granting read-write permissions to all users assigned that role. You can also assign read or write permissions to everyone in your organization.

Step 6: Check log source status

Once added, the status of the log source becomes Create Requested. See Log Source Statuses to understand the different types statuses assigned to log sources.

Step 7: Receive confirmation email

You will receive a notification email from Anomali once you have created a new log source request. The Log Source Management page will show the status as Create Requested.

Once the log source has been provisioned and is ready for use, Anomali will send you another email and the Log Source Management page status for the log source will change to Active.