g_suite_drive.yml

name: G Suite Drive
id: 5f79120f-a235-4468-bd0d-55203758ac22
version: 1
date: '2024-07-18'
author: Patrick Bareiss, Splunk
description: Data source object for G Suite Drive
source: http:gsuite
sourcetype: gsuite:drive:json
supported_TA:
- name: Splunk Add-on for Google Workspace
  url: https://splunkbase.splunk.com/app/5556
  version: 3.0.2
fields:
- _time
- email
- host
- index
- ip_address
- linecount
- name
- parameters.actor_is_collaborator_account
- parameters.billable
- parameters.doc_id
- parameters.doc_title
- parameters.doc_type
- parameters.is_encrypted
- parameters.new_value{}
- parameters.old_value{}
- parameters.old_visibility
- parameters.originating_app_id
- parameters.owner
- parameters.owner_is_shared_drive
- parameters.owner_is_team_drive
- parameters.primary_event
- parameters.target_user
- parameters.visibility
- parameters.visibility_change
- punct
- source
- sourcetype
- splunk_server
- timestamp
- type
- unique_id
example_log: '{"type": "acl_change", "name": "change_user_access", "parameters": {"primary_event":
  true, "billable": true, "visibility_change": "none", "target_user": "alberto@internal_test_email.com",
  "old_value": ["none"], "new_value": ["can_edit"], "old_visibility": "private", "doc_id":
  "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "doc_type": "spreadsheet", "is_encrypted":
  false, "doc_title": "Invoice-11111 FedEx - Delivery - Dummy Detection POC", "visibility":
  "shared_internally", "originating_app_id": "000000000001", "actor_is_collaborator_account":
  false, "owner": "peter@external_test_email.com", "owner_is_shared_drive": false,
  "owner_is_team_drive": false}, "email": "peter@external_test_email.com", "unique_id":
  "123456789", "ip_address": "null", "timestamp": "2021-08-23T09:19:08.200Z"}'