Skip to content

Commit 6102d4f

Browse files
jmikell821jrodewig
jmikell821
and
jrodewig
authored
[DOCS] Fix links to filebeat Google Workspace module (#1441) (#1460)
Updates links to the [Filebeat Google Workspace module](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-gsuite.html) so they don't break when we change the current Stack version to 8.0. Relates to elastic/docs#2312 # Conflicts: # docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-application-added-to-google-workspace-domain.asciidoc # docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-domain-added-to-google-workspace-trusted-domains.asciidoc # docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-admin-role-assigned-to-a-user.asciidoc # docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-admin-role-deletion.asciidoc # docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-api-access-granted-via-domain-wide-delegation-of-authority.asciidoc # docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-custom-admin-role-created.asciidoc # docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-mfa-enforcement-disabled.asciidoc # docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-password-policy-modified.asciidoc # docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-role-modified.asciidoc # docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-mfa-disabled-for-google-workspace-organization.asciidoc # docs/detections/prebuilt-rules/rule-details/application-added-to-google-workspace-domain.asciidoc # docs/detections/prebuilt-rules/rule-details/domain-added-to-google-workspace-trusted-domains.asciidoc # docs/detections/prebuilt-rules/rule-details/google-workspace-admin-role-assigned-to-a-user.asciidoc # docs/detections/prebuilt-rules/rule-details/google-workspace-admin-role-deletion.asciidoc # docs/detections/prebuilt-rules/rule-details/google-workspace-api-access-granted-via-domain-wide-delegation-of-authority.asciidoc # docs/detections/prebuilt-rules/rule-details/google-workspace-custom-admin-role-created.asciidoc # docs/detections/prebuilt-rules/rule-details/google-workspace-mfa-enforcement-disabled.asciidoc # docs/detections/prebuilt-rules/rule-details/google-workspace-password-policy-modified.asciidoc # docs/detections/prebuilt-rules/rule-details/google-workspace-role-modified.asciidoc # docs/detections/prebuilt-rules/rule-details/mfa-disabled-for-google-workspace-organization.asciidoc Co-authored-by: James Rodewig <[email protected]>
1 parent fa4f24e commit 6102d4f

File tree

23 files changed

+844
-36
lines changed

23 files changed

+844
-36
lines changed

‎docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-google-workspace-mfa-enforcement-disabled.asciidoc

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ Detects when multi-factor authentication (MFA) enforcement is disabled for Googl
4545
==== Investigation guide
4646

4747

48-
[source, markdown]
48+
[source, markdown, subs="attributes"]
4949
----------------------------------
5050
## Config
5151
@@ -58,7 +58,7 @@ The Google Workspace Fleet integration, Filebeat module, or similarly structured
5858
- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m).
5959
- See the following references for further information.
6060
- https://support.google.com/a/answer/7061566
61-
- https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-gsuite.html
61+
- https://www.elastic.co/guide/en/beats/filebeat/{branch}/filebeat-module-google_workspace.html
6262
----------------------------------
6363

6464
==== Rule query

‎docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-google-workspace-password-policy-modified.asciidoc

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ Detects when a Google Workspace password policy is modified. An adversary may at
4343
==== Investigation guide
4444

4545

46-
[source, markdown]
46+
[source, markdown, subs="attributes"]
4747
----------------------------------
4848
## Config
4949
@@ -56,7 +56,7 @@ The Google Workspace Fleet integration, Filebeat module, or similarly structured
5656
- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m).
5757
- See the following references for further information.
5858
- https://support.google.com/a/answer/7061566
59-
- https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-gsuite.html
59+
- https://www.elastic.co/guide/en/beats/filebeat/{branch}/filebeat-module-google_workspace.html
6060
----------------------------------
6161

6262
==== Rule query

‎docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-mfa-disabled-for-google-workspace-organization.asciidoc

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ Detects when multi-factor authentication (MFA) is disabled for a Google Workspac
4343
==== Investigation guide
4444

4545

46-
[source, markdown]
46+
[source, markdown, subs="attributes"]
4747
----------------------------------
4848
## Config
4949
@@ -56,7 +56,7 @@ The Google Workspace Fleet integration, Filebeat module, or similarly structured
5656
- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m).
5757
- See the following references for further information.
5858
- https://support.google.com/a/answer/7061566
59-
- https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-gsuite.html
59+
- https://www.elastic.co/guide/en/beats/filebeat/{branch}/filebeat-module-google_workspace.html
6060
----------------------------------
6161

6262
==== Rule query

‎docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-application-added-to-google-workspace-domain.asciidoc

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
[[prebuilt-rule-0-14-1-application-added-to-google-workspace-domain]]
2+
=== Application Added to Google Workspace Domain
3+
4+
Detects when a Google marketplace application is added to the Google Workspace domain. An adversary may add a malicious application to an organization’s Google Workspace domain in order to maintain a presence in their target’s organization and steal data.
5+
6+
*Rule type*: query
7+
8+
*Rule indices*:
9+
10+
* filebeat-*
11+
* logs-google_workspace*
12+
13+
*Severity*: medium
14+
15+
*Risk score*: 47
16+
17+
*Runs every*: 10m
18+
19+
*Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
20+
21+
*Maximum alerts per execution*: 100
22+
23+
*References*:
24+
25+
* https://support.google.com/a/answer/6328701?hl=en#
26+
27+
*Tags*:
28+
29+
* Elastic
30+
* Cloud
31+
* Google Workspace
32+
* Continuous Monitoring
33+
* SecOps
34+
* Configuration Audit
35+
36+
*Version*: 5
37+
38+
*Rule authors*:
39+
40+
* Elastic
41+
42+
*Rule license*: Elastic License v2
43+
44+
45+
==== Investigation guide
46+
47+
48+
[source, markdown, subs="attributes"]
49+
----------------------------------
50+
## Config
51+
52+
The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
53+
54+
### Important Information Regarding Google Workspace Event Lag Times
55+
- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
56+
- This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
57+
- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
58+
- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m).
59+
- See the following references for further information:
60+
- https://support.google.com/a/answer/7061566
61+
- https://www.elastic.co/guide/en/beats/filebeat/{branch}/filebeat-module-google_workspace.html
62+
----------------------------------
63+
64+
==== Rule query
65+
66+
67+
[source, js]
68+
----------------------------------
69+
event.dataset:(gsuite.admin or google_workspace.admin) and event.provider:admin and event.category:iam and event.action:ADD_APPLICATION
70+
71+
----------------------------------

‎docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-domain-added-to-google-workspace-trusted-domains.asciidoc

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
[[prebuilt-rule-0-14-1-domain-added-to-google-workspace-trusted-domains]]
2+
=== Domain Added to Google Workspace Trusted Domains
3+
4+
Detects when a domain is added to the list of trusted Google Workspace domains. An adversary may add a trusted domain in order to collect and exfiltrate data from their target’s organization with less restrictive security controls.
5+
6+
*Rule type*: query
7+
8+
*Rule indices*:
9+
10+
* filebeat-*
11+
* logs-google_workspace*
12+
13+
*Severity*: high
14+
15+
*Risk score*: 73
16+
17+
*Runs every*: 10m
18+
19+
*Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
20+
21+
*Maximum alerts per execution*: 100
22+
23+
*References*:
24+
25+
* https://support.google.com/a/answer/6160020?hl=en
26+
27+
*Tags*:
28+
29+
* Elastic
30+
* Cloud
31+
* Google Workspace
32+
* Continuous Monitoring
33+
* SecOps
34+
* Configuration Audit
35+
36+
*Version*: 5
37+
38+
*Rule authors*:
39+
40+
* Elastic
41+
42+
*Rule license*: Elastic License v2
43+
44+
45+
==== Investigation guide
46+
47+
48+
[source, markdown, subs="attributes"]
49+
----------------------------------
50+
## Config
51+
52+
The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
53+
54+
### Important Information Regarding Google Workspace Event Lag Times
55+
- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
56+
- This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
57+
- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
58+
- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m).
59+
- See the following references for further information:
60+
- https://support.google.com/a/answer/7061566
61+
- https://www.elastic.co/guide/en/beats/filebeat/{branch}/filebeat-module-google_workspace.html
62+
----------------------------------
63+
64+
==== Rule query
65+
66+
67+
[source, js]
68+
----------------------------------
69+
event.dataset:(gsuite.admin or google_workspace.admin) and event.provider:admin and event.category:iam and event.action:ADD_TRUSTED_DOMAINS
70+
71+
----------------------------------

‎docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-admin-role-assigned-to-a-user.asciidoc

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
[[prebuilt-rule-0-14-1-google-workspace-admin-role-assigned-to-a-user]]
2+
=== Google Workspace Admin Role Assigned to a User
3+
4+
Detects when an admin role is assigned to a Google Workspace user. An adversary may assign an admin role to a user in order to elevate the permissions of another user account and persist in their target’s environment.
5+
6+
*Rule type*: query
7+
8+
*Rule indices*:
9+
10+
* filebeat-*
11+
* logs-google_workspace*
12+
13+
*Severity*: medium
14+
15+
*Risk score*: 47
16+
17+
*Runs every*: 10m
18+
19+
*Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
20+
21+
*Maximum alerts per execution*: 100
22+
23+
*References*:
24+
25+
* https://support.google.com/a/answer/172176?hl=en
26+
27+
*Tags*:
28+
29+
* Elastic
30+
* Cloud
31+
* Google Workspace
32+
* Continuous Monitoring
33+
* SecOps
34+
* Identity and Access
35+
36+
*Version*: 5
37+
38+
*Rule authors*:
39+
40+
* Elastic
41+
42+
*Rule license*: Elastic License v2
43+
44+
45+
==== Investigation guide
46+
47+
48+
[source, markdown, subs="attributes"]
49+
----------------------------------
50+
## Config
51+
52+
The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
53+
54+
### Important Information Regarding Google Workspace Event Lag Times
55+
- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
56+
- This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
57+
- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
58+
- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m).
59+
- See the following references for further information:
60+
- https://support.google.com/a/answer/7061566
61+
- https://www.elastic.co/guide/en/beats/filebeat/{branch}/filebeat-module-google_workspace.html
62+
----------------------------------
63+
64+
==== Rule query
65+
66+
67+
[source, js]
68+
----------------------------------
69+
event.dataset:(gsuite.admin or google_workspace.admin) and event.provider:admin and event.category:iam and event.action:ASSIGN_ROLE
70+
71+
----------------------------------
72+
73+
*Framework*: MITRE ATT&CK^TM^
74+
75+
* Tactic:
76+
** Name: Persistence
77+
** ID: TA0003
78+
** Reference URL: https://attack.mitre.org/tactics/TA0003/
79+
* Technique:
80+
** Name: Account Manipulation
81+
** ID: T1098
82+
** Reference URL: https://attack.mitre.org/techniques/T1098/

‎docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-admin-role-deletion.asciidoc

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
[[prebuilt-rule-0-14-1-google-workspace-admin-role-deletion]]
2+
=== Google Workspace Admin Role Deletion
3+
4+
Detects when a custom admin role is deleted. An adversary may delete a custom admin role in order to impact the permissions or capabilities of system administrators.
5+
6+
*Rule type*: query
7+
8+
*Rule indices*:
9+
10+
* filebeat-*
11+
* logs-google_workspace*
12+
13+
*Severity*: medium
14+
15+
*Risk score*: 47
16+
17+
*Runs every*: 10m
18+
19+
*Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
20+
21+
*Maximum alerts per execution*: 100
22+
23+
*References*:
24+
25+
* https://support.google.com/a/answer/2406043?hl=en
26+
27+
*Tags*:
28+
29+
* Elastic
30+
* Cloud
31+
* Google Workspace
32+
* Continuous Monitoring
33+
* SecOps
34+
* Identity and Access
35+
36+
*Version*: 5
37+
38+
*Rule authors*:
39+
40+
* Elastic
41+
42+
*Rule license*: Elastic License v2
43+
44+
45+
==== Investigation guide
46+
47+
48+
[source, markdown, subs="attributes"]
49+
----------------------------------
50+
## Config
51+
52+
The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
53+
54+
### Important Information Regarding Google Workspace Event Lag Times
55+
- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
56+
- This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
57+
- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
58+
- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m).
59+
- See the following references for further information:
60+
- https://support.google.com/a/answer/7061566
61+
- https://www.elastic.co/guide/en/beats/filebeat/{branch}/filebeat-module-google_workspace.html
62+
----------------------------------
63+
64+
==== Rule query
65+
66+
67+
[source, js]
68+
----------------------------------
69+
event.dataset:(gsuite.admin or google_workspace.admin) and event.provider:admin and event.category:iam and event.action:DELETE_ROLE
70+
71+
----------------------------------

0 commit comments

Comments
 (0)