Google Accessed a GSuite Resource

Description

Google accessed one of your GSuite resources directly, most likely in response to a support incident.

Query · python

def rule(event):
    if event.deep_get("id", "applicationName") != "access_transparency":
        return False

    return bool(event.get("type") == "GSUITE_RESOURCE")

Analyst notes

Your GSuite Super Admin can visit the Access Transparency report in the GSuite Admin Dashboard to see more details about the access.

Raw source Google Accessed a GSuite Resource · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Filename: gsuite_google_access.py
RuleID: "GSuite.GoogleAccess"
DisplayName: "Google Accessed a GSuite Resource"
Enabled: true
LogTypes:
  - GSuite.ActivityEvent
Tags:
  - GSuite
Severity: Low
Description: >
  Google accessed one of your GSuite resources directly, most likely in response to a support incident.
Reference: https://support.google.com/a/answer/9230474?hl=en
Runbook: >
  Your GSuite Super Admin can visit the Access Transparency report in the GSuite Admin Dashboard to see more details about the access.
SummaryAttributes:
  - actor:email
Tests:
  - Name: Normal Login Event
    ExpectedResult: false
    Log: { "id": { "applicationName": "login" }, "type": "login" }
  - Name: Resource Accessed by Google
    ExpectedResult: true
    Log:
      {
        "id": { "applicationName": "access_transparency" },
        "type": "GSUITE_RESOURCE",
      }


# ------ paired body: gsuite_google_access.py ------

def rule(event):
    if event.deep_get("id", "applicationName") != "access_transparency":
        return False

    return bool(event.get("type") == "GSUITE_RESOURCE")

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.