Prerequisites to Configure the Gmail BigQuery Cloud Collector

Before you configure the Gmail BigQuery Cloud Collector you must complete the following prerequisites:

Make sure a person with G Suite super-admin rights is present when onboarding the Gmail BigQuery Cloud Collector.
Verify your Google Workspace edition is either Business or Enterprise. Your G Suite administrator can verify the edition type in the Billing tab of the Google Apps admin console (https://admin.google.com). For more information about the Google Apps for Work editions go to: https://apps.google.com/intx/en/pricing.html.
Prepare an authorization file for use during the collector configuration for Service account authentication, as a G Suite administrator. For more information, see Authorize the Gmail BigQuery Cloud Collector to Retrieve Events.
Obtain a Service Credentials JSON file – Create a JSON key for the service account on your Google Cloud Platform. You must enter the JSON file content in the SERVICE CREDENTIALS JSON field while adding a new sharable Google account in Cloud Collectors console during the Cloud Collector configuration.
Enable Collection of Gmail Logs – Requires Google Workspace Enterprise edition; Education Standard or Plus. Assign the BigQuery Data Viewer and the BigQuery Job User roles to the service account that you created.

Authorize the Gmail BigQuery Cloud Collector to Retrieve Events

For Service-Account authentication, a G Suite administrator will need to create a file (called Service-Credentials-Json) that authorizes the Gmail BigQuery Cloud Collector (or anyone else who possess it) to communicate with the G Suite account and retrieve relevant logs, events and data for the security monitoring.

To create the Service-Credentials-Json JSON file, ask the G Suite administrator to follow the instructions mentioned here Create a Service-Credentials-Json File for the Gmail BigQuery Cloud Collector.

Use your preferred secured method of transport to send the JSON file to the Exabeam Cloud Collectors administrator to configure the Gmail BigQuery Cloud Collector.

Create a Service-Credentials-Json File for the Gmail BigQuery Cloud Collector

If you use the service-account authentication method, you need to set up communication between the cloud collector and the G-Suite account. To facilitate communication and enable to retrieve audit events, you must create a service-credentials-json file.

Log in to the Google Developers Console with an account that has super-admin permissions.
Select a Google Cloud project from which you want to collect Gmail logs.
Create the service account and download service account JSON file.
1. In the top-left corner of the console, click Menu.
2. Click IAM & Admin.
3. Click Create service account and in the Service account name field, enter a name for the service account.
4. Select the Furnish a new private key box and ensure the key type is set to JSON.
5. Select the Enable Domain-wide Delegation box and enter a name in the Product name for the consent screen field.
6. Click Create. You'll see a message that the service account JSON file has been downloaded to your computer.
7. Click Close.

Enable Collection of Gmail Logs

To enable collection of Gmail logs, you must have Google Workspace Enterprise edition; Education Standard or Plus. To make changes to permissions and roles, you must also have super-admin access.

Set up service log exports to Workspace BigQuery because Google has merged Gmail logs in BigQuery with Workspace logs and reports in BigQuery.
Assign the BigQuery Data Viewer and the BigQuery Job User roles to the service account.
To assign these roles, from the GCP Admin console, select project > IAM, and then select a service account that you created > edit permissions.

CollectorsCloud Collectors Administration Guide

Table of ContentsTable of Contents