Google Workspace APIs

Hi,

I’m trying to use insightconnect to feed in alerts etc from Google Workspace…
Such as users sharing external docs, docs shared with emails outside of our domain… etc.

I would like to be able to utilise there
SuspiciousActivity  |  Alert Center API  |  Google Developers and most of these apis Google Workspace Admin SDK  |  Google Developers

I cant seem to find a plugin in order to utilise this. (Also a decent way of feeding into IDR except syslog forwarder)

What are you recommendations for doing these? I thought about the python module but not sure if you can import libraries required for the initial authentication.

1 Like

Probably want to make this a plugin request (I would be interested too)

That said, you can export your workspace logs to BigQuery… I have a custom plugin that polls bigquery every N minutes; if results > 0 , do the action.

Thats exactly what Im doing at the moment, just think theres a better way of getting these events into IDR