Google Workspace
Google Workspace audit logs record what your users do, logins, file sharing, administrative actions. Sending them to Coralogix makes that activity searchable next to the rest of your telemetry, and lets you alert on it, so unusual behavior surfaces rather than sitting in a console nobody checks.
What you need
- Super admin permissions in Google Cloud.
- An existing Google Cloud project.
- Coralogix permissions to view or manage integrations.
| Resource | Action | Grants |
|---|---|---|
integrations | ReadConfig | View deployed integration packages |
integrations | Manage | Deploy, undeploy, and update integrations |
See roles and permissions for how these are assigned.
Prepare the Google Cloud side
Set up domain-wide delegation so the service account can read user data. It needs two OAuth scopes:
https://www.googleapis.com/auth/admin.directory.user.readonly
https://www.googleapis.com/auth/admin.reports.audit.readonly
Select APIs & Services, then Library, then Admin SDK API, and confirm it is enabled.
Create the integration in Coralogix
Select Data Flow, then Integrations, then Google Workspace, then Add new.
Select Account key or Impersonation, then Next. Both are available from version 0.2.0 onward.
If you have not created a key file yet, select Go to GCP account and create one. Then select Select file, upload it, and select Next once the upload is confirmed.
Complete the fields below.
| Field | What to enter |
|---|---|
| Integration name | Populated automatically; change it if you want |
| Application name | The application name the logs are filed under |
| Subsystem name | Defaults to Google Workspace; change it if you want |
| Applications | The Google Workspace applications whose audit logs you want |
| Impersonated email | A valid super admin address for the integration to impersonate |
| GCP Project ID | Impersonation flow only. The project you are setting up |
| GCP Billing Project Id | The project charged for quota. The caller needs serviceusage.services.use on it |
| Service Account Email | Impersonation flow only. The service account you created earlier |
Select Next and copy the Coralogix principal's email. Select Go to GCP account, open the service account you created, go to its Permissions tab, select Grant access, paste the email into New principal, assign the Service Account Token Creator role, and select Save. Then return to Coralogix.
Select Complete. The integration takes several minutes to take effect before user data appears.
A GCP IAM role change can take a few minutes to propagate. If the integration fails immediately after granting access, wait and retry before changing anything.
Monitor the logs
See what one user did
To review everything [email protected] did in Google Drive over the past week, select the application and subsystem names for the integration in the Explore screen, set the timeframe to 7 days, and query:
ActorEmail:"[email protected]" AND ApplicationName:"drive"
Alert on unusual downloads
To catch a user pulling an unusual number of files out of Drive, create a standard alert on this query, set the condition to more than 5 occurrences in 10 minutes, and group by ActorEmail.
ApplicationName:"drive" AND Event.Name:"download"
Shows the query, subsystem scope, and threshold that together define the alert.
See which applications are busiest
Create a horizontal bar chart widget in Custom Dashboards and group by Application.Name.
Shows relative usage across the Workspace applications sending audit logs.
Limitations
- Audit logs from the Reports API are not real time. Allow up to 24 hours before all log data is available.
- Logs older than 24 hours from their original event time are dropped and never processed.