Calendar
| eventName | Description | Sample | Rule |
|---|---|---|---|
| any | Source-only rules that filter on applicationName 'calendar' without specifying an eventName attribute here. | N | N |
| change_ | Access control settings for a calendar were changed. | N | Y |
| create_ | A new calendar was created. | Y | N |
| delete_ | A calendar was deleted. | N | N |
| create_ | A calendar event was created. | N | N |
| delete_ | A calendar event was deleted. | N | N |
| add_ | A guest was added to a calendar event. | N | N |
| remove_ | A guest was removed from a calendar event. | N | N |
| export_ | A calendar was exported. | N | N |
| add_ | A user subscribed to a calendar. | Y | N |
| delete_ | A user unsubscribed from a calendar. | N | N |
| change_ | A guest's response to a calendar event invitation was changed. | N | N |
| notification_ | A calendar notification was triggered. | N | N |
any: Calendar (any event)
#Description
Source-only rules that filter on applicationName 'calendar' without specifying an eventName attribute here.
References #
change_calendar_acls: Change Calendar ACLs
#Description
Access control settings for a calendar were changed.
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Panther #
T1087
References #
create_calendar: Create Calendar
#Description
A new calendar was created.
Example Audit Activity #
{
"kind": "admin#reports#activity",
"id": {
"time": "2022-07-21T13:40:53.794Z",
"uniqueQualifier": "-6782823658469990544",
"applicationName": "calendar",
"customerId": "C00mpaiwz"
},
"etag": "\"_ZVRqe-BUDYcYeOIPo-gm6Eh1QaGne4ACjHHI6qsr6A/5mkU4egiM5liwfIcNDWXr554axw\"",
"actor": {
"email": "suspicious@cloud-response.com",
"profileId": "102509620547980436027"
},
"ownerDomain": "cloud-response.com",
"ipAddress": "80.114.222.200",
"events": [
{
"type": "calendar_change",
"name": "create_calendar",
"parameters": [
{
"name": "calendar_id",
"value": "workspace@cloud-response.com"
},
{
"name": "target_calendar_id",
"value": "workspace@cloud-response.com"
},
{
"name": "user_agent",
"value": "Mozilla/5.0"
}
]
}
]
}
References #
remove_event_guest: Remove Event Guest
#Description
A guest was removed from a calendar event.
References #
add_subscription: Add Subscription
#Description
A user subscribed to a calendar.
Example Audit Activity #
{
"kind": "admin#reports#activity",
"id": {
"time": "2022-07-21T13:40:54.384Z",
"uniqueQualifier": "-3423840045468797090",
"applicationName": "calendar",
"customerId": "C00mpaiwz"
},
"etag": "\"_ZVRqe-BUDYcYeOIPo-gm6Eh1QaGne4ACjHHI6qsr6A/R2REK3zHN6JRbMbXygki_D47fFs\"",
"actor": {
"email": "suspicious@cloud-response.com",
"profileId": "102509620547980436027"
},
"ownerDomain": "cloud-response.com",
"ipAddress": "80.114.222.200",
"events": [
{
"type": "subscription_change",
"name": "add_subscription",
"parameters": [
{
"name": "subscriber_calendar_id",
"value": "workspace@cloud-response.com"
},
{
"name": "calendar_id",
"value": "workspace@cloud-response.com"
},
{
"name": "target_calendar_id",
"value": "workspace@cloud-response.com"
},
{
"name": "notification_type",
"value": "event_reminder"
},
{
"name": "notification_method",
"value": "alert"
},
{
"name": "user_agent",
"value": "Mozilla/5.0"
}
]
},
{
"type": "subscription_change",
"name": "add_subscription",
"parameters": [
{
"name": "subscriber_calendar_id",
"value": "workspace@cloud-response.com"
},
{
"name": "calendar_id",
"value": "workspace@cloud-response.com"
},
{
"name": "target_calendar_id",
"value": "workspace@cloud-response.com"
},
{
"name": "notification_type",
"value": "new_event"
},
{
"name": "notification_method",
"value": "email"
},
{
"name": "user_agent",
"value": "Mozilla/5.0"
}
]
},
{
"type": "subscription_change",
"name": "add_subscription",
"parameters": [
{
"name": "subscriber_calendar_id",
"value": "workspace@cloud-response.com"
},
{
"name": "calendar_id",
"value": "workspace@cloud-response.com"
},
{
"name": "target_calendar_id",
"value": "workspace@cloud-response.com"
},
{
"name": "notification_type",
"value": "changed_event"
},
{
"name": "notification_method",
"value": "email"
},
{
"name": "user_agent",
"value": "Mozilla/5.0"
}
]
},
{
"type": "subscription_change",
"name": "add_subscription",
"parameters": [
{
"name": "subscriber_calendar_id",
"value": "workspace@cloud-response.com"
},
{
"name": "calendar_id",
"value": "workspace@cloud-response.com"
},
{
"name": "target_calendar_id",
"value": "workspace@cloud-response.com"
},
{
"name": "notification_type",
"value": "cancelled_event"
},
{
"name": "notification_method",
"value": "email"
},
{
"name": "user_agent",
"value": "Mozilla/5.0"
}
]
},
{
"type": "subscription_change",
"name": "add_subscription",
"parameters": [
{
"name": "subscriber_calendar_id",
"value": "workspace@cloud-response.com"
},
{
"name": "calendar_id",
"value": "workspace@cloud-response.com"
},
{
"name": "target_calendar_id",
"value": "workspace@cloud-response.com"
},
{
"name": "notification_type",
"value": "reply_received"
},
{
"name": "notification_method",
"value": "email"
},
{
"name": "user_agent",
"value": "Mozilla/5.0"
}
]
}
]
}
References #
delete_subscription: Delete Subscription
#Description
A user unsubscribed from a calendar.
References #
change_event_guest_response: Change Event Guest Response
#Description
A guest's response to a calendar event invitation was changed.