Detection rules › By event

GoogleWorkspace-admin

Event	Rules
ADD_APPLICATION	3
ADD_GROUP_MEMBER	2
ADD_PRIVILEGE	1
ADD_TRUSTED_DOMAINS	3
ALLOW_STRONG_AUTHENTICATION	4
ASSIGN_ROLE	2
AUTHORIZE_API_CLIENT_ACCESS	3
CHANGE_APPLICATION_SETTING	12
CHANGE_GMAIL_SETTING	2
CREATE_APPLICATION_SETTING	4
CREATE_DATA_TRANSFER_REQUEST	2
CREATE_GMAIL_SETTING	2
CREATE_ROLE	3
CUSTOMER_TAKEOUT_CREATED	2
DELETE_ROLE	2
ENFORCE_STRONG_AUTHENTICATION	4
GRANT_ADMIN_PRIVILEGE	2
GRANT_DELEGATED_ADMIN_PRIVILEGES	1
MOVE_USER_TO_ORG_UNIT	2
REMOVE_APPLICATION	1
REMOVE_APPLICATION_FROM_WHITELIST	1
REMOVE_PRIVILEGE	1
RENAME_ROLE	1
SAML2_SERVICE_PROVIDER_CONFIG	1
TOGGLE_OUTBOUND_RELAY	1
TURN_OFF_2_STEP_VERIFICATION	1
UNSUSPEND_USER	2
UPDATE_ROLE	2
CHANGE_CALENDAR_SETTING	1
REMOVE_TRUSTED_DOMAINS	1
DELETE_GMAIL_SETTING	1
ADD_MOBILE_APPLICATION_TO_WHITELIST	1
UNENROLL_USER_FROM_STRONG_AUTH	1

ADD_APPLICATION

3 detection rules reference this event. View event page.

Elastic (1)

Application Added to Google Workspace Domain severity high T1098, T1098.001

YARA-L (1)

Google Workspace Application Added severity high

Panther (1)

Google Workspace Apps Marketplace New Domain Application severity medium

ADD_GROUP_MEMBER

2 detection rules reference this event. View event page.

Elastic (1)

External User Added to Google Workspace Group severity medium T1078, T1078.004, T1098

YARA-L (1)

Google Workspace External User Added To Group severity medium T1078, T1078.004

ADD_PRIVILEGE

1 detection rules reference this event. View event page.

Elastic (1)

Google Workspace Role Modified severity high T1098

ADD_TRUSTED_DOMAINS

3 detection rules reference this event. View event page.

Elastic (1)

Domain Added to Google Workspace Trusted Domains severity high T1484, T1484.002, T1685, T1686.001

YARA-L (1)

Google Workspace New Trusted Domain Added severity high T1685, T1686.001

Panther (1)

GSuite Workspace Trusted Domain Allowlist Modified severity medium T1098

ALLOW_STRONG_AUTHENTICATION

4 detection rules reference this event. View event page.

Sigma (1)

Google Workspace MFA Disabled severity medium

Elastic (2)

Deprecated - MFA Disabled for Google Workspace Organization severity high T1556
Google Workspace MFA Enforcement Disabled For Organization severity high T1531, T1556, T1556.006

YARA-L (1)

Google Workspace MFA Disabled severity high T1556

ASSIGN_ROLE

2 detection rules reference this event. View event page.

Elastic (1)

Google Workspace Admin Role Assigned to a User or Group severity high T1098, T1098.003

YARA-L (1)

Google Workspace Admin Role Assignment severity high T1098, T1098.003

AUTHORIZE_API_CLIENT_ACCESS

3 detection rules reference this event. View event page.

Sigma (1)

Google Workspace Granted Domain API Access severity medium T1098

Elastic (1)

Google Workspace API Access Granted via Domain-Wide Delegation severity high T1098

Kusto (1)

GWorkspace - API Access Granted severity medium T1550

CHANGE_APPLICATION_SETTING

12 detection rules reference this event. View event page.

Sigma (1)

Google Workspace Application Access Level Modified severity medium T1098, T1098.003

Elastic (5)

Application Removed from Blocklist in Google Workspace severity medium T1484, T1685
Google Workspace Bitlocker Setting Disabled severity medium T1484, T1685
Google Workspace Gmail Routing or Forwarding Rule Created or Modified severity high T1114, T1114.003
Google Workspace Password Policy Modified severity medium T1098, T1484
Google Workspace Restrictions for Marketplace Modified to Allow Any App severity medium T1484, T1685

YARA-L (2)

Google Workspace Marketplace Allowlist Configuration severity low T1685
Google Workspace Password Policy Changed severity low T1098

Panther (4)

GSuite Workspace Gmail Pre-Delivery Message Scanning Disabled severity medium T1566
GSuite Workspace Gmail Security Sandbox Disabled severity medium T1566
GSuite Workspace Password Reuse Has Been Enabled severity high T1110
GSuite Workspace Strong Password Enforcement Has Been Disabled severity high T1110

CHANGE_GMAIL_SETTING

2 detection rules reference this event. View event page.

Elastic (1)

Google Workspace Gmail Routing or Forwarding Rule Created or Modified severity high T1114, T1114.003

Panther (1)

GSuite Workspace Gmail Default Routing Rule Modified severity high T1098

CREATE_APPLICATION_SETTING

4 detection rules reference this event. View event page.

Elastic (2)

Google Workspace Gmail Routing or Forwarding Rule Created or Modified severity high T1114, T1114.003
Google Workspace Password Policy Modified severity medium T1098, T1484

YARA-L (1)

Google Workspace Password Policy Changed severity low T1098

Panther (1)

Google Workspace Advanced Protection Program severity medium

CREATE_DATA_TRANSFER_REQUEST

2 detection rules reference this event. View event page.

Elastic (1)

Google Workspace Drive Data Transfer or Takeout Export Initiated severity medium T1074, T1074.002, T1537

YARA-L (1)

Google Workspace Ownership Transferred On Google Drive severity high T1074, T1074.002

CREATE_GMAIL_SETTING

2 detection rules reference this event. View event page.

Elastic (1)

Google Workspace Gmail Routing or Forwarding Rule Created or Modified severity high T1114, T1114.003

Panther (1)

GSuite Workspace Gmail Default Routing Rule Modified severity high T1098

CREATE_ROLE

3 detection rules reference this event. View event page.

Elastic (1)

Google Workspace Custom Admin Role Created severity medium T1098, T1098.003

YARA-L (1)

Google Workspace Custom Admin Role Created severity high T1098, T1098.003

Panther (1)

Google Workspace Admin Custom Role severity medium

CUSTOMER_TAKEOUT_CREATED

2 detection rules reference this event. View event page.

Elastic (1)

Google Workspace Drive Data Transfer or Takeout Export Initiated severity medium T1074, T1074.002, T1537

Panther (1)

GSuite Workspace Data Export Has Been Created severity medium

DELETE_ROLE

2 detection rules reference this event. View event page.

Sigma (1)

Google Workspace Role Modified or Deleted severity medium

Elastic (1)

Google Workspace Admin Role Deletion severity medium T1484, T1531

ENFORCE_STRONG_AUTHENTICATION

4 detection rules reference this event. View event page.

Sigma (1)

Google Workspace MFA Disabled severity medium

Elastic (2)

Deprecated - MFA Disabled for Google Workspace Organization severity high T1556
Google Workspace MFA Enforcement Disabled For Organization severity high T1531, T1556, T1556.006

YARA-L (1)

Google Workspace MFA Disabled severity high T1556

GRANT_ADMIN_PRIVILEGE

2 detection rules reference this event. View event page.

Sigma (1)

Google Workspace User Granted Admin Privileges severity medium T1098

Kusto (1)

GWorkspace - Admin permissions granted severity high T1098

GRANT_DELEGATED_ADMIN_PRIVILEGES

1 detection rules reference this event. View event page.

Sigma (1)

Google Workspace User Granted Admin Privileges severity medium T1098

MOVE_USER_TO_ORG_UNIT

2 detection rules reference this event. View event page.

Elastic (1)

Google Workspace User Organizational Unit Changed severity low T1098, T1098.003

YARA-L (1)

Google Workspace User Ou Changed severity high T1098, T1098.003

REMOVE_APPLICATION

1 detection rules reference this event. View event page.

Sigma (1)

Google Workspace Application Removed severity medium

REMOVE_APPLICATION_FROM_WHITELIST

1 detection rules reference this event. View event page.

Sigma (1)

Google Workspace Application Removed severity medium

REMOVE_PRIVILEGE

1 detection rules reference this event. View event page.

Sigma (1)

Google Workspace Role Privilege Deleted severity medium

RENAME_ROLE

1 detection rules reference this event. View event page.

Sigma (1)

Google Workspace Role Modified or Deleted severity medium

SAML2_SERVICE_PROVIDER_CONFIG

1 detection rules reference this event. View event page.

YARA-L (1)

Google Workspace SAML IDP Configuration Change severity high T1078

TOGGLE_OUTBOUND_RELAY

1 detection rules reference this event. View event page.

Kusto (1)

GWorkspace - An Outbound Relay has been added to a G Suite Domain severity medium T1114

TURN_OFF_2_STEP_VERIFICATION

1 detection rules reference this event. View event page.

Kusto (1)

GWorkspace - Two-step authentification disabled for a user severity medium T1111

UNSUSPEND_USER

2 detection rules reference this event. View event page.

Elastic (1)

Google Workspace Suspended User Account Renewed severity high T1078, T1078.004, T1098

YARA-L (1)

Google Workspace User Unsuspended severity medium T1078, T1078.004

UPDATE_ROLE

2 detection rules reference this event. View event page.

Sigma (1)

Google Workspace Role Modified or Deleted severity medium

Elastic (1)

Google Workspace Role Modified severity high T1098

CHANGE_CALENDAR_SETTING

1 detection rules reference this event. View event page.

Panther (1)

GSuite Workspace Calendar External Sharing Setting Change severity medium T1087

REMOVE_TRUSTED_DOMAINS

1 detection rules reference this event. View event page.

Panther (1)

GSuite Workspace Trusted Domain Allowlist Modified severity medium T1098

DELETE_GMAIL_SETTING

1 detection rules reference this event. View event page.

Panther (1)

GSuite Workspace Gmail Default Routing Rule Modified severity high T1098

ADD_MOBILE_APPLICATION_TO_WHITELIST

1 detection rules reference this event. View event page.

Panther (1)

Google Workspace Apps New Mobile App Installed severity medium

UNENROLL_USER_FROM_STRONG_AUTH

1 detection rules reference this event. View event page.

Splunk (1)

GCP Multi-Factor Authentication Disabled severity medium T1556, T1556.006, T1586, T1586.003