Google Workspace administrator audit
Google Workspace administrator audit. Admin SDK Reports API administrative activity.
Source and collection
Product audit API or configured diagnostic export.
Use scoped audit-reading permissions; preserve pagination/cursors, tenant context and event identifiers.
Native example and provenance
upstream test fixture. Published example; no independent capture provenance claimed.
Original publisher / pinned upstream fixture — line 1
One complete record selected; values unchanged.
Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031
Download the exact sample · Offline research kit
SHA-256: 8bd00a0bc6c5bf217d53d47428e3a8a390eb3b848fa99dade85290680c2a345e
{"kind":"admin#reports#activity","id":{"time":"2020-10-02T15:00:00Z","uniqueQualifier":1,"applicationName":"admin","customerId":"1"},"actor":{"callerType":"USER","email":"foo@bar.com","profileId":1},"ownerDomain":"elastic.com","ipAddress":"67.43.156.13","events":{"type":"APPLICATION_SETTINGS","name":"CHANGE_APPLICATION_SETTING","parameters":[{"name":"APPLICATION_EDITION","value":"basic"},{"name":"APPLICATION_NAME","value":"drive"},{"name":"GROUP_EMAIL","value":"group@example.com"},{"name":"NEW_VALUE","value":"new"},{"name":"OLD_VALUE","value":"old"},{"name":"ORG_UNIT_NAME","value":"org"},{"name":"SETTING_NAME","value":"setting"}]}}
Structure and field interpretation
| Field/path | Serialized type |
|---|---|
kind | str |
id.time | str |
id.uniqueQualifier | int |
id.applicationName | str |
id.customerId | str |
actor.callerType | str |
actor.email | str |
actor.profileId | int |
ownerDomain | str |
ipAddress | str |
events.type | str |
events.name | str |
events.parameters | array |
events.parameters[0].name | str |
events.parameters[0].value | str |
- Event identity
- Use the source event ID and tenant scope to deduplicate.
- Event type
- Select the schema for this category/action.
- Timestamp
- Retain both event and ingestion time where available.
Investigation uses
- Review actor, action parameters and affected configuration.
- Compare actor and target context with approved changes and other authentication evidence.
Validation boundaries
Administrative activity does not include every application data-plane operation.
This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.
For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.
Related sources
Ecosystem connections
- Telemetry Library — ATT&CK data components
- Detection Rules — candidate detection content
- Threat hunting — from intelligence to validated defense
- Practical security learning paths
- AdversaryGraph — evidence-led investigation
References
Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.