Forwarded Google Workspace Security Alert

 1[metadata]
 2creation_date = "2023/01/15"
 3integration = ["google_workspace"]
 4maturity = "production"
 5promotion = true
 6updated_date = "2026/09/18"
 7
 8[rule]
 9author = ["Elastic"]
10description = """
11Identifies the occurrence of a security alert from the Google Workspace alerts center. Google Workspace's security alert
12center provides an overview of actionable alerts that may be affecting an organization's domain. An alert is a warning
13of a potential security issue that Google has detected.
14"""
15false_positives = [
16    """
17    To tune this rule, add exceptions to exclude any google_workspace.alert.type or rule.name which should not trigger this rule.
18    """,
19    "For additional tuning, severity exceptions for google_workspace.alert.metadata.severity can be added.",
20]
21from = "now-130m"
22index = ["logs-google_workspace.alert-*"]
23interval = "5m"
24language = "kuery"
25license = "Elastic License v2"
26name = "Forwarded Google Workspace Security Alert"
27note = """## Setup
28
29## Triage and analysis
30
31This is a promotion rule for Google Workspace security events, which are alertable events per the vendor.
32Consult vendor documentation on interpreting specific events.
33"""
34references = [
35    "https://workspace.google.com/products/admin/alert-center/",
36    "https://www.elastic.co/security-labs/google-workspace-attack-surface-part-one",
37    "https://www.elastic.co/security-labs/google-workspace-attack-surface-part-two"
38]
39risk_score = 73
40rule_id = "f1a6d0f4-95b8-11ed-9517-f661ea17fbcc"
41rule_name_override = "google_workspace.alert.type"
42severity = "high"
43tags = [
44    "Domain: Cloud",
45    "Data Source: Google Workspace",
46    "Use Case: Log Auditing",
47    "Use Case: Threat Detection",
48    "Resources: Investigation Guide",
49    "Noise: Medium",
50    "Performance: Normal",
51    "Rule Type: Custom Query (KQL)",
52    "Platform: Google Workspace",
53    "Domain: SaaS",
54]
55timestamp_override = "event.ingested"
56type = "query"
57
58query = '''
59data_stream.dataset: google_workspace.alert
60'''
61
62
63[[rule.severity_mapping]]
64field = "google_workspace.alert.metadata.severity"
65operator = "equals"
66severity = "low"
67value = "LOW"
68
69[[rule.severity_mapping]]
70field = "google_workspace.alert.metadata.severity"
71operator = "equals"
72severity = "medium"
73value = "MEDIUM"
74
75[[rule.severity_mapping]]
76field = "google_workspace.alert.metadata.severity"
77operator = "equals"
78severity = "high"
79value = "HIGH"