Skip to main content

Responses are generated using AI and may contain mistakes.

CollectorsCloud Collectors Administration Guide

Prerequisites to Configure Google Workspace Context Cloud Collector

Before you configure the Google Workspace Context Cloud Collector you must complete the following prerequisites:

Authorize the Google Workspace Cloud Collector to Retrieve Events

For Service-Account authentication, a G Suite administrator will need to create a file (called Service-Credentials-Json) that authorizes the Google Workspace Cloud Collector (or anyone else who possess it) to communicate with the G Suite account and retrieve relevant logs, events and data for the security monitoring.

To create the Service-Credentials-Json JSON file, ask the G Suite administrator to follow the instructions mentioned here Create a Service-Credentials-Json File for the Google Workspace Cloud Collector .

Use your preferred secured method of transport to send the JSON file to the Exabeam Cloud Collectors administrator to configure the Google Workspace Cloud Collector.

Create a Service-Credentials-Json File for the Google Workspace Cloud Collector

If you use the service-account authentication method, you need to set up communication between the cloud collector and the G-Suite account. To facilitate communication and enable to retrieve audit events, you must create a service-credentials-json file.

Note

To use the service account you are required to have a Domain-Wide Delegation of Authority. Since you need this delegation of authority to read reports about admin activity, the user, whose authority is being used, must have super-admin privileges to view admin report activity and read user and groups information. The service account is still bound by the permissions granted and thus cannot perform any action other than read access on the specified scopes.

To create the JSON file, use the following steps.

Note

While configuring the Google Workspace Cloud Collector, you must provide the email address of a Google Workspace super-admin user. The service account impersonate this email address via domain-wide delegation.

This email serves as the API call "subject"; if this email is not specified, the collector encounters a 401 Unauthorized error. Additionally, note that the super-admin account is required for Google Workspace and not for GCP.

  1. Log in to the Google Cloud Console with an account that has super-admin permissions.

  2. Create a new project or select an existing project by navigating to Select a Project > New Project.

  3. Enter a project name and click Create.

  4. Use the following steps to enable the Admin SDK API. Each project uses its own set of APIs. To use service-account authentication with the Google Workspace Cloud Collector, you must enable the Admin SDK API for your project.

    1. Navigate to APIs & Services > Library.

    2. Search for Admin SDK API using the search box and click Admin SDK API.

    3. Click Enable.

  5. Create the service account and enable Domain-wide Delegation.

    1. Navigate to IAM & Admin > Service Accounts.

    2. Click Create Service Account and enter a name and description for the account.

    3. Click Create and Continue.

    4. Click Done. Granting roles to the service account to define its permissions is optional. No specific role is required for domain-wide delegation.

    5. Note the email address for the service account. For more information, see Service account credentials section in the Google Workspace Documentation.

    6. On the Service accounts page, find and click the email address of the service account you just created.

    7. Expand Show advanced settings.

    8. Under Show domain-wide delegation, select the check box for Enable Google Workspace Domain-wide Delegation.

    9. Copy the Client ID which is a unique ID represented by a long numeric string. Record the client ID for later use.

  6. Create a JSON Key.

    1. On the Service Accounts page of your project, navigate to Keys > Add Key.

    2. Click Create new key.

    3. Select JSON as the key type and click Create.

      The JSON file containing the private key is downloaded.

    4. Save the downloaded JSON file in a secure folder.

  7. Configure Domain-Wide Delegation Scopes in Google Workspace Admin Console.

    To configure domain-wide delegation scopes in the Google Workspace Admin Console, ensure that you log in as a Super Administrator.

    1. On the Google Admin Console and navigate to Security > Access and data control > API controls.

    2. In the Domain wide delegation pane, click Manage Domain Wide Delegation.

    3. Click Add new.

    4. Enter the Client ID of your service account. You obtained this unique ID from your service account by navigating to IAM & Admin > Service Accounts.

    5. In OAuth scopes, enter the following comma-separated list of the specific API scopes that your application requires.

      https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly,https://www.googleapis.com/auth/admin.directory.orgunit.readonly,https://www.googleapis.com/auth/admin.reports.audit.readonly,https://www.googleapis.com/auth/admin.reports.usage.readonly,https://www.googleapis.com/auth/apps.alerts

    6. Click Authorize.

Add Context-Aware Access (CAA) in Google Workspace

To add Context-Aware Access (CAA) in Google Workspace, first define the context rules, then assign the context rules to specific applications.

Use the following steps to add Context-Aware Access (CAA) in Google Workspace.

Set Access Levels

By defining the access levels, specify certain security requirements users should meet, such as connecting from an authorized IP range or using an encrypted device.

  1. Log in to the Google Cloud Console with an account that has super-admin permissions.

  2. Navigate to Security > Access and data control > Context-Aware Access.

  3. Click Assign Access Levels.

  4. Click Create Access Level and enter a name and description.

  5. Add the required attributes in the basic mode and define access levels in the advanced mode using Common Expression Language (CEL).

    For more information, see Create Context-Aware access levels in Google documentation.

  6. Click Save.

Assign Access Levels

After you set the Context-Aware Access levels (rules), apply the access levels to the applications you want to protect.

  1. Log in to the Google Cloud Console with an account that has super-admin permissions.

  2. Navigate to Security > Access and data control > Context-Aware Access.

  3. Click Assign Access Levels.

  4. Select a specific application and select the Organizational Unit or Configuration Group for the assignment.

  5. Select the action Monitor to assign access level without blocking users or Active to enforce the access levels or rules and block non-compliant access.

    For more information, see Assign Context-Aware Access levels to apps in Google documentation.

    Note

    While setting access levels and rules for admin console, to prevent a permanent lockout, ensure that you have a a backup Super Admin account, and apply levels or rules to a specific Security Group and not the entire organization at once. Double-check the Access Levels.

  6. Click Save.