security_content/data_sources/google_workspace_login_success.yml at 08b89f51a99489eed3fc8ac9f01753f0ae8e5e37 · splunk/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
name: Google Workspace login_success
id: bffe8013-9cdf-4fe6-9c1b-6784391a4951
version: 3
creation_date: '2024-05-22'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
description: Logs successful login attempts to Google Workspace accounts, including details about the user, IP address, and session metadata.
mitre_components:
    - User Account Authentication
    - Logon Session Creation
    - User Account Metadata
    - Logon Session Metadata
source: gws:reports:admin
sourcetype: gws:reports:admin
separator: event.name
separator_value: login_success
supported_TA:
    - name: Splunk Add-on for Google Workspace
      url: https://splunkbase.splunk.com/app/5556
      version: 5.0.0
fields:
    - _time
    - actor.email
    - actor.profileId
    - date_hour
    - date_mday
    - date_minute
    - date_month
    - date_second
    - date_wday
    - date_year
    - date_zone
    - etag
    - event.name
    - event.parameters{}.boolValue
    - event.parameters{}.multiValue{}
    - event.parameters{}.name
    - event.parameters{}.value
    - event.type
    - host
    - id.applicationName
    - id.customerId
    - id.time
    - id.uniqueQualifier
    - index
    - ipAddress
    - kind
    - linecount
    - punct
    - source
    - sourcetype
    - splunk_server
    - timeendpos
    - timestartpos
example_log: '{"kind": "admin#reports#activity", "id": {"time": "2022-10-13T20:57:35.833Z", "uniqueQualifier": "437744618349", "applicationName": "login", "customerId": "C046r85ir"}, "etag": "\"JCPRxFaiNR1s5TJ6ecIH8OpGdY4efiOYXbIB65itOzY/OgAbD-Tz8hSD1vUJWw7NLiJ5SF4\"", "actor": {"email": "user1@splunkresearch.com", "profileId": "112184723778873345717"}, "ipAddress": "45.23.129.123", "event": {"type": "login", "name": "login_success", "parameters": [{"name": "login_type", "value": "google_password"}, {"name": "login_challenge_method", "multiValue": ["password", "password", "password", "password", "password"]}, {"name": "is_suspicious", "boolValue": false}]}}'