Skip to main content

Responses are generated using AI and may contain mistakes.

CollectorsCloud Collectors Administration Guide

Table of Contents

Prerequisites to Configure the Google Workspace Cloud Collector

Before you configure the Google Workspace Cloud Collector you must complete the following prerequisites:

  • Make sure a person with G Suite super-admin rights is present when onboarding the Google Workspace Cloud Collector.

  • Verify your Google Workspace edition is either Business or Enterprise. Your G Suite administrator can verify the edition type in the Billing tab of the Google Apps admin console. For more information about the Google Apps for Work editions access https://workspace.google.com/pricing.html.

  • Enable API access. As a G Suite administrator, navigate to Security > Access and data control > API controls in the Google Apps admin console.

  • Prepare an authorization file for use during the collector configuration for Service account authentication, as a G Suite administrator. For more information, see Authorize the Google Workspace Cloud Collector to Retrieve Events, and Create a Service-Credentials-Json File for the Google Workspace Cloud Collector.

Authorize the Google Workspace Cloud Collector to Retrieve Events

For Service-Account authentication, a G Suite administrator will need to create a file (called Service-Credentials-Json) that authorizes the Google Workspace Cloud Collector (or anyone else who possess it) to communicate with the G Suite account and retrieve relevant logs, events and data for the security monitoring.

To create the Service-Credentials-Json JSON file, ask the G Suite administrator to follow the instructions mentioned here Create a Service-Credentials-Json File for the Google Workspace Cloud Collector .

Use your preferred secured method of transport to send the JSON file to the Exabeam Cloud Collectors administrator to configure the Google Workspace Cloud Collector.

Create a Service-Credentials-Json File for the Google Workspace Cloud Collector

If you use the service-account authentication method, you need to set up communication between the cloud collector and the G-Suite account. To facilitate communication and enable to retrieve audit events, you must create a service-credentials-json file.

Note

To use the service account you are required to have a Domain-Wide Delegation of Authority. Since you need this delegation of authority to read reports about admin activity, the user, whose authority is being used, must have super-admin privileges to view admin report activity and read user and groups information. The service account is still bound by the permissions granted and thus cannot perform any action other than read access on the specified scopes.

To create the JSON file, use the following steps.

Note

While configuring the Google Workspace Cloud Collector, you must provide the email address of a Google Workspace super-admin user. The service account impersonate this email address via domain-wide delegation.

This email serves as the API call "subject"; if this email is not specified, the collector encounters a 401 Unauthorized error. Additionally, note that the super-admin account is required for Google Workspace and not for GCP.

  1. Log in to the Google Cloud Console with an account that has super-admin permissions.

  2. Create a new project or select an existing project by navigating to Select a Project > New Project.

  3. Enter a project name and click Create.

  4. Use the following steps to enable the Admin SDK API. Each project uses its own set of APIs. To use service-account authentication with the Google Workspace Cloud Collector, you must enable the Admin SDK API for your project.

    1. Navigate to APIs & Services > Library.

    2. Search for Admin SDK API using the search box and click Admin SDK API.

    3. Click Enable.

  5. Create the service account and enable Domain-wide Delegation.

    1. Navigate to IAM & Admin > Service Accounts.

    2. Click Create Service Account and enter a name and description for the account.

    3. Click Create and Continue.

    4. Click Done. Granting roles to the service account to define its permissions is optional. No specific role is required for domain-wide delegation.

    5. Note the email address for the service account. For more information, see Service account credentials section in the Google Workspace Documentation.

    6. On the Service accounts page, find and click the email address of the service account you just created.

    7. Expand Show advanced settings.

    8. Under Show domain-wide delegation, select the check box for Enable Google Workspace Domain-wide Delegation.

    9. Copy the Client ID which is a unique ID represented by a long numeric string. Record the client ID for later use.

  6. Create a JSON Key.

    1. On the Service Accounts page of your project, navigate to Keys > Add Key.

    2. Click Create new key.

    3. Select JSON as the key type and click Create.

      The JSON file containing the private key is downloaded.

    4. Save the downloaded JSON file in a secure folder.

  7. Configure Domain-Wide Delegation Scopes in Google Workspace Admin Console.

    To configure domain-wide delegation scopes in the Google Workspace Admin Console, ensure that you log in as a Super Administrator.

    1. On the Google Admin Console and navigate to Security > Access and data control > API controls.

    2. In the Domain wide delegation pane, click Manage Domain Wide Delegation.

    3. Click Add new.

    4. Enter the Client ID of your service account. You obtained this unique ID from your service account by navigating to IAM & Admin > Service Accounts.

    5. In OAuth scopes, enter the following comma-separated list of the specific API scopes that your application requires.

      https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly,https://www.googleapis.com/auth/admin.directory.orgunit.readonly,https://www.googleapis.com/auth/admin.reports.audit.readonly,https://www.googleapis.com/auth/admin.reports.usage.readonly,https://www.googleapis.com/auth/apps.alerts

    6. Click Authorize.