Google Workspace provides various communication, collaboration, and productivity applications for businesses of all sizes. Google Workspace audit logs provide data to help track "Who did what, where, an when?".
Google Workspace Audit logs can be ingested via a Google Cloud Platform, deploye as a cloud-to-cloud LimaCharlie Adapter. Events will be ingested and observed via the
Prior to ingesting Google Workspace Audit logs in LimaCharlie, you must first configure logs to be written to GCP. Afterwards, a cloud-to-cloud GCP Adapter can be deployed to ingest these events into LimaCharlie.
The following steps help prepare this:
Step 1: Enable Platform Sharing in Gogle Workspace
In the Google Workspace admin console navigate to Account -> Account Settings -> Legal and Compliance
Verify that under "Sharing options",
Google Cloud Platform Sharing Options is set to Enabled.
For further details, refer to Google's documentation on Audit logs for Google Workspace
Step 2: Verify logs appear in Google Cloud Platform
In the GCP Console go to the Logs Explorer. Ensure you're at the organization level (and not in a particular folder).
From the Resources drop-down, choose
Audited Resource, then press Apply.
You should see logging details related to Google Workspace, under the following log name(s):
Step 3: Create a cloud-to-cloud GCP Adapter