Before
Security teams would likely retrieve Google Workspace login activity, review or organize the records, and manually transfer relevant event details into a centralized security environment. This process could require repeated data handling between the workspace reporting system and the analysis platform.
How it works
- Retrieve login activity for all users from the Google Workspace reporting environment.
- Iterate through the available login events and prepare their event, IP address, and actor details for forwarding.
- Send each prepared record to the centralized security analysis endpoint, stopping the run if the forwarding action fails.
Workflow details
- Login activity collection: A playbook run requests login activity for all users through the Google Workspace Admin Reports service, with a configured limit of up to 1,000 records.
- Event iteration: The workflow is configured to process login activity events one at a time with a maximum concurrency of one. The current definition uses an empty collection as the iteration source, so no events will be processed unless that collection is populated.
- Record preparation: Each processed event is structured with event details, an IP address, and actor information including the profile identifier and email address.
- Central forwarding: The prepared login record is sent to the configured Elastic Security endpoint so it can be available in a centralized environment for further analysis and alerting.
- Failure handling: If the forwarding action fails, the playbook stops execution rather than continuing with subsequent iterations.
What changed
Login activity collection and forwarding are organized into one automated workflow, with event details prepared consistently and failures stopping the run for visibility. The current configuration still requires the iteration collection to be populated before any records are forwarded.
Work removed
Retrieving login activity records, reviewing or handling events one by one, copying event and actor details, and manually submitting records to the centralized security environment.
Expected outcome
The configured workflow can support centralized handling of up to 1,000 login activity records per run, although the current empty iteration source means no records will be sent until it is populated.
