detection.wiki

GWS coverage

147 GWS detection rules across 6 vendors covering 77 (application, eventName) pairs.

Attributed to a specific Workspace event

74 rules that name a specific Google Workspace event, mapped to that event's catalog entry.

admin 44 rules, 20 events

ADD_APPLICATION 2 rules
ADD_GROUP_MEMBER 2 rules
ADD_PRIVILEGE 1 rule
ADD_TRUSTED_DOMAINS 2 rules
ALLOW_STRONG_AUTHENTICATION 3 rules
ASSIGN_ROLE 2 rules
AUTHORIZE_API_CLIENT_ACCESS 1 rule
CHANGE_APPLICATION_SETTING 11 rules
CHANGE_GMAIL_SETTING 1 rule
CREATE_APPLICATION_SETTING 3 rules
CREATE_DATA_TRANSFER_REQUEST 2 rules
CREATE_GMAIL_SETTING 1 rule
CREATE_ROLE 2 rules
CUSTOMER_TAKEOUT_CREATED 1 rule
DELETE_ROLE 1 rule
ENFORCE_STRONG_AUTHENTICATION 3 rules
MOVE_USER_TO_ORG_UNIT 2 rules
UNENROLL_USER_FROM_STRONG_AUTH 1 rule
UNSUSPEND_USER 2 rules
UPDATE_ROLE 1 rule

chrome 4 rules, 4 events

badNavigationEvent 1 rule
contentTransferEvent 1 rule
dangerousDownloadEvent 1 rule
unscannedFileEvent 1 rule

drive 30 rules, 13 events

authorize 1 rule
change_acl_editors 2 rules
change_document_access_scope 2 rules
change_document_visibility 3 rules
change_user_access 4 rules
copy 4 rules
delete 1 rule
download 5 rules
email_as_attachment 1 rule
login_success 2 rules
source_copy 1 rule
trash 2 rules
view 2 rules

groups_enterprise 1 rule, 1 event

ban_user_with_moderation 1 rule

login 27 rules, 19 events

2sv_disable 1 rule
account_disabled_generic 1 rule
account_disabled_hijacked 1 rule
account_disabled_password_leak 1 rule
account_disabled_spamming 1 rule
account_disabled_spamming_through_relay 1 rule
authorize 1 rule
change_acl_editors 1 rule
change_document_access_scope 1 rule
change_document_visibility 1 rule
change_user_access 1 rule
download 1 rule
email_forwarding_out_of_domain 1 rule
gov_attack_warning 1 rule
login_failure 4 rules
login_success 6 rules
suspicious_login 1 rule
suspicious_login_less_secure_app 1 rule
suspicious_programmatic_login 1 rule

mobile 5 rules, 5 events

authorize 1 rule
DEVICE_COMPROMISED_EVENT 1 rule
DEVICE_REGISTER_UNREGISTER_EVENT 1 rule
FAILED_PASSWORD_ATTEMPTS_EVENT 1 rule
SUSPICIOUS_ACTIVITY_EVENT 1 rule

token 8 rules, 3 events

authorize 6 rules
copy 1 rule
login_success 1 rule

user_accounts 4 rules, 3 events

2sv_disable 2 rules
email_forwarding_out_of_domain 1 rule
titanium_unenroll 1 rule

Attributed to an application, not a specific event

19 rules that name a Workspace application but no single event, mapped to that application's catch-all event.

access_transparency 1 rule, 1 event

(any) 1 rule

admin 1 rule, 1 event

(any) 1 rule

alert 1 rule, 1 event

(any) 1 rule

drive 5 rules, 1 event

(any) 5 rules

gmail 8 rules, 1 event

(any) 8 rules

Google Workspace Alerts 1 rule, 1 event

(any) 1 rule

login 1 rule, 1 event

(any) 1 rule

rules 1 rule, 1 event

(any) 1 rule

Not attributed to a Workspace event

54 rules that resolve to no Google Workspace event (no application discriminator in the query, notably Kusto rules).

(unattributed) 54 rules, 1 event

(any) 54 rules