Skip to content

Commit ee23e3c

Browse files
jmikell821jrodewig
jmikell821
and
jrodewig
authored
[7.12] [DOCS] Fix links to filebeat Google Workspace module (#1441) (#1461)
* [DOCS] Fix links to filebeat Google Workspace module (#1441) Updates links to the [Filebeat Google Workspace module](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-gsuite.html) so they don't break when we change the current Stack version to 8.0. Relates to elastic/docs#2312 # Conflicts: # docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-google-workspace-mfa-enforcement-disabled.asciidoc # docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-google-workspace-password-policy-modified.asciidoc # docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-mfa-disabled-for-google-workspace-organization.asciidoc # docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-application-added-to-google-workspace-domain.asciidoc # docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-domain-added-to-google-workspace-trusted-domains.asciidoc # docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-admin-role-assigned-to-a-user.asciidoc # docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-admin-role-deletion.asciidoc # docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-api-access-granted-via-domain-wide-delegation-of-authority.asciidoc # docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-custom-admin-role-created.asciidoc # docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-mfa-enforcement-disabled.asciidoc # docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-password-policy-modified.asciidoc # docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-google-workspace-role-modified.asciidoc # docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-mfa-disabled-for-google-workspace-organization.asciidoc # docs/detections/prebuilt-rules/rule-details/application-added-to-google-workspace-domain.asciidoc # docs/detections/prebuilt-rules/rule-details/domain-added-to-google-workspace-trusted-domains.asciidoc # docs/detections/prebuilt-rules/rule-details/google-workspace-admin-role-assigned-to-a-user.asciidoc # docs/detections/prebuilt-rules/rule-details/google-workspace-admin-role-deletion.asciidoc # docs/detections/prebuilt-rules/rule-details/google-workspace-api-access-granted-via-domain-wide-delegation-of-authority.asciidoc # docs/detections/prebuilt-rules/rule-details/google-workspace-custom-admin-role-created.asciidoc # docs/detections/prebuilt-rules/rule-details/google-workspace-mfa-enforcement-disabled.asciidoc # docs/detections/prebuilt-rules/rule-details/google-workspace-password-policy-modified.asciidoc # docs/detections/prebuilt-rules/rule-details/google-workspace-role-modified.asciidoc # docs/detections/prebuilt-rules/rule-details/mfa-disabled-for-google-workspace-organization.asciidoc * Fix build errors. * Fix build errors take 2. * Fix build errors take 3. Co-authored-by: James Rodewig <[email protected]>
1 parent d512f0d commit ee23e3c

File tree

23 files changed

+1122
-19
lines changed

23 files changed

+1122
-19
lines changed

‎docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-google-workspace-mfa-enforcement-disabled.asciidoc

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
[[prebuilt-rule-0-13-3-google-workspace-mfa-enforcement-disabled]]
2+
=== Google Workspace MFA Enforcement Disabled
3+
4+
Detects when multi-factor authentication (MFA) enforcement is disabled for Google Workspace users. An adversary may disable MFA enforcement in order to weaken an organization’s security controls.
5+
6+
*Rule type*: query
7+
8+
*Rule indices*:
9+
10+
* filebeat-*
11+
* logs-google_workspace*
12+
13+
*Severity*: medium
14+
15+
*Risk score*: 47
16+
17+
*Runs every*: 10m
18+
19+
*Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
20+
21+
*Maximum alerts per execution*: 100
22+
23+
*References*:
24+
25+
* https://support.google.com/a/answer/9176657?hl=en#
26+
27+
*Tags*:
28+
29+
* Elastic
30+
* Cloud
31+
* Google Workspace
32+
* Continuous Monitoring
33+
* SecOps
34+
* Configuration Audit
35+
36+
*Version*: 5
37+
38+
*Rule authors*:
39+
40+
* Elastic
41+
42+
*Rule license*: Elastic License v2
43+
44+
45+
==== Investigation guide
46+
47+
48+
[source, markdown, subs="attributes"]
49+
----------------------------------
50+
## Config
51+
52+
The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
53+
54+
### Important Information Regarding Google Workspace Event Lag Times
55+
- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
56+
- This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
57+
- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
58+
- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m).
59+
- See the following references for further information.
60+
- https://support.google.com/a/answer/7061566
61+
- https://www.elastic.co/guide/en/beats/filebeat/{branch}/filebeat-module-google_workspace.html
62+
----------------------------------
63+
64+
==== Rule query
65+
66+
67+
[source, js]
68+
----------------------------------
69+
event.dataset:(gsuite.admin or google_workspace.admin) and event.provider:admin and event.category:iam and event.action:ENFORCE_STRONG_AUTHENTICATION and (gsuite.admin.new_value:false or google_workspace.admin.new_value:false)
70+
71+
----------------------------------

‎docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-google-workspace-password-policy-modified.asciidoc

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
[[prebuilt-rule-0-13-3-google-workspace-password-policy-modified]]
2+
=== Google Workspace Password Policy Modified
3+
4+
Detects when a Google Workspace password policy is modified. An adversary may attempt to modify a password policy in order to weaken an organization’s security controls.
5+
6+
*Rule type*: query
7+
8+
*Rule indices*:
9+
10+
* filebeat-*
11+
* logs-google_workspace*
12+
13+
*Severity*: medium
14+
15+
*Risk score*: 47
16+
17+
*Runs every*: 10m
18+
19+
*Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
20+
21+
*Maximum alerts per execution*: 100
22+
23+
*References*: None
24+
25+
*Tags*:
26+
27+
* Elastic
28+
* Cloud
29+
* Google Workspace
30+
* Continuous Monitoring
31+
* SecOps
32+
* Identity and Access
33+
34+
*Version*: 5
35+
36+
*Rule authors*:
37+
38+
* Elastic
39+
40+
*Rule license*: Elastic License v2
41+
42+
43+
==== Investigation guide
44+
45+
46+
[source, markdown, subs="attributes"]
47+
----------------------------------
48+
## Config
49+
50+
The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
51+
52+
### Important Information Regarding Google Workspace Event Lag Times
53+
- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
54+
- This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
55+
- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
56+
- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m).
57+
- See the following references for further information.
58+
- https://support.google.com/a/answer/7061566
59+
- https://www.elastic.co/guide/en/beats/filebeat/{branch}/filebeat-module-google_workspace.html
60+
----------------------------------
61+
62+
==== Rule query
63+
64+
65+
[source, js]
66+
----------------------------------
67+
event.dataset:(gsuite.admin or google_workspace.admin) and
68+
event.provider:admin and event.category:iam and
69+
event.action:(CHANGE_APPLICATION_SETTING or CREATE_APPLICATION_SETTING) and
70+
gsuite.admin.setting.name:(
71+
"Password Management - Enforce strong password" or
72+
"Password Management - Password reset frequency" or
73+
"Password Management - Enable password reuse" or
74+
"Password Management - Enforce password policy at next login" or
75+
"Password Management - Minimum password length" or
76+
"Password Management - Maximum password length"
77+
) or
78+
google_workspace.admin.setting.name:(
79+
"Password Management - Enforce strong password" or
80+
"Password Management - Password reset frequency" or
81+
"Password Management - Enable password reuse" or
82+
"Password Management - Enforce password policy at next login" or
83+
"Password Management - Minimum password length" or
84+
"Password Management - Maximum password length"
85+
)
86+
87+
----------------------------------

‎docs/detections/prebuilt-rules/downloadable-packages/0-13-3/prebuilt-rule-0-13-3-mfa-disabled-for-google-workspace-organization.asciidoc

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
[[prebuilt-rule-0-13-3-mfa-disabled-for-google-workspace-organization]]
2+
=== MFA Disabled for Google Workspace Organization
3+
4+
Detects when multi-factor authentication (MFA) is disabled for a Google Workspace organization. An adversary may attempt to modify a password policy in order to weaken an organization’s security controls.
5+
6+
*Rule type*: query
7+
8+
*Rule indices*:
9+
10+
* filebeat-*
11+
* logs-google_workspace*
12+
13+
*Severity*: medium
14+
15+
*Risk score*: 47
16+
17+
*Runs every*: 10m
18+
19+
*Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
20+
21+
*Maximum alerts per execution*: 100
22+
23+
*References*: None
24+
25+
*Tags*:
26+
27+
* Elastic
28+
* Cloud
29+
* Google Workspace
30+
* Continuous Monitoring
31+
* SecOps
32+
* Identity and Access
33+
34+
*Version*: 5
35+
36+
*Rule authors*:
37+
38+
* Elastic
39+
40+
*Rule license*: Elastic License v2
41+
42+
43+
==== Investigation guide
44+
45+
46+
[source, markdown, subs="attributes"]
47+
----------------------------------
48+
## Config
49+
50+
The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
51+
52+
### Important Information Regarding Google Workspace Event Lag Times
53+
- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
54+
- This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
55+
- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
56+
- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m).
57+
- See the following references for further information.
58+
- https://support.google.com/a/answer/7061566
59+
- https://www.elastic.co/guide/en/beats/filebeat/{branch}/filebeat-module-google_workspace.html
60+
----------------------------------
61+
62+
==== Rule query
63+
64+
65+
[source, js]
66+
----------------------------------
67+
event.dataset:(gsuite.admin or google_workspace.admin) and event.provider:admin and event.category:iam and event.action:(ENFORCE_STRONG_AUTHENTICATION or ALLOW_STRONG_AUTHENTICATION) and (gsuite.admin.new_value:false or google_workspace.admin.new_value:false)
68+
69+
----------------------------------

‎docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-application-added-to-google-workspace-domain.asciidoc

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
[[prebuilt-rule-0-14-1-application-added-to-google-workspace-domain]]
2+
=== Application Added to Google Workspace Domain
3+
4+
Detects when a Google marketplace application is added to the Google Workspace domain. An adversary may add a malicious application to an organization’s Google Workspace domain in order to maintain a presence in their target’s organization and steal data.
5+
6+
*Rule type*: query
7+
8+
*Rule indices*:
9+
10+
* filebeat-*
11+
* logs-google_workspace*
12+
13+
*Severity*: medium
14+
15+
*Risk score*: 47
16+
17+
*Runs every*: 10m
18+
19+
*Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
20+
21+
*Maximum alerts per execution*: 100
22+
23+
*References*:
24+
25+
* https://support.google.com/a/answer/6328701?hl=en#
26+
27+
*Tags*:
28+
29+
* Elastic
30+
* Cloud
31+
* Google Workspace
32+
* Continuous Monitoring
33+
* SecOps
34+
* Configuration Audit
35+
36+
*Version*: 5
37+
38+
*Rule authors*:
39+
40+
* Elastic
41+
42+
*Rule license*: Elastic License v2
43+
44+
45+
==== Investigation guide
46+
47+
48+
[source, markdown, subs="attributes"]
49+
----------------------------------
50+
## Config
51+
52+
The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
53+
54+
### Important Information Regarding Google Workspace Event Lag Times
55+
- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
56+
- This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
57+
- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
58+
- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m).
59+
- See the following references for further information:
60+
- https://support.google.com/a/answer/7061566
61+
- https://www.elastic.co/guide/en/beats/filebeat/{branch}/filebeat-module-google_workspace.html
62+
----------------------------------
63+
64+
==== Rule query
65+
66+
67+
[source, js]
68+
----------------------------------
69+
event.dataset:(gsuite.admin or google_workspace.admin) and event.provider:admin and event.category:iam and event.action:ADD_APPLICATION
70+
71+
----------------------------------

‎docs/detections/prebuilt-rules/downloadable-packages/0-14-1/prebuilt-rule-0-14-1-domain-added-to-google-workspace-trusted-domains.asciidoc

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
[[prebuilt-rule-0-14-1-domain-added-to-google-workspace-trusted-domains]]
2+
=== Domain Added to Google Workspace Trusted Domains
3+
4+
Detects when a domain is added to the list of trusted Google Workspace domains. An adversary may add a trusted domain in order to collect and exfiltrate data from their target’s organization with less restrictive security controls.
5+
6+
*Rule type*: query
7+
8+
*Rule indices*:
9+
10+
* filebeat-*
11+
* logs-google_workspace*
12+
13+
*Severity*: high
14+
15+
*Risk score*: 73
16+
17+
*Runs every*: 10m
18+
19+
*Searches indices from*: now-130m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
20+
21+
*Maximum alerts per execution*: 100
22+
23+
*References*:
24+
25+
* https://support.google.com/a/answer/6160020?hl=en
26+
27+
*Tags*:
28+
29+
* Elastic
30+
* Cloud
31+
* Google Workspace
32+
* Continuous Monitoring
33+
* SecOps
34+
* Configuration Audit
35+
36+
*Version*: 5
37+
38+
*Rule authors*:
39+
40+
* Elastic
41+
42+
*Rule license*: Elastic License v2
43+
44+
45+
==== Investigation guide
46+
47+
48+
[source, markdown, subs="attributes"]
49+
----------------------------------
50+
## Config
51+
52+
The Google Workspace Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
53+
54+
### Important Information Regarding Google Workspace Event Lag Times
55+
- As per Google's documentation, Google Workspace administrators may observe lag times ranging from minutes up to 3 days between the time of an event's occurrence and the event being visible in the Google Workspace admin/audit logs.
56+
- This rule is configured to run every 10 minutes with a lookback time of 130 minutes.
57+
- To reduce the risk of false negatives, consider reducing the interval that the Google Workspace (formerly G Suite) Filebeat module polls Google's reporting API for new events.
58+
- By default, `var.interval` is set to 2 hours (2h). Consider changing this interval to a lower value, such as 10 minutes (10m).
59+
- See the following references for further information:
60+
- https://support.google.com/a/answer/7061566
61+
- https://www.elastic.co/guide/en/beats/filebeat/{branch}/filebeat-module-google_workspace.html
62+
----------------------------------
63+
64+
==== Rule query
65+
66+
67+
[source, js]
68+
----------------------------------
69+
event.dataset:(gsuite.admin or google_workspace.admin) and event.provider:admin and event.category:iam and event.action:ADD_TRUSTED_DOMAINS
70+
71+
----------------------------------

0 commit comments

Comments
 (0)