Looker Studio (Data Studio)
| eventName | Description | Sample | Rule |
|---|---|---|---|
| any | Source-only rules that filter on applicationName 'data_studio' without specifying an eventName attribute here. | N | N |
| CREATE | A Looker Studio asset (report or data source) was created. | N | N |
| VIEW | A Looker Studio report or data source was viewed. | N | N |
| EDIT | A Looker Studio report or data source was edited. | N | N |
| DELETE | A Looker Studio asset was deleted. | N | N |
| CHANGE_ | A user's access to a Looker Studio asset was changed. | N | Y |
| DATA_ | Data was exported from a Looker Studio report. | N | N |
| CHANGE_ | The link-sharing visibility of a Looker Studio asset was changed. | N | N |
| DOWNLOAD_ | A Looker Studio report was downloaded. | N | N |
| TRASH | A Looker Studio asset was moved to trash. | N | Y |
| RESTORE | A Looker Studio asset was restored from trash. | N | N |
any: Looker Studio (Data Studio) (any event)
#Description
Source-only rules that filter on applicationName 'data_studio' without specifying an eventName attribute here.
References #
CHANGE_USER_ACCESS: Change User Access
#Description
A user's access to a Looker Studio asset was changed.
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Kusto #
T1098
References #
CHANGE_ASSET_LINK_SHARING_VISIBILITY: Change Asset Link Sharing Visibility
#Description
The link-sharing visibility of a Looker Studio asset was changed.
References #
TRASH: Trash
#Description
A Looker Studio asset was moved to trash.
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Panther #