New Detections: Google Workspace Threat Coverage
New Release
We have added over a dozen new detections for Google Workspace, expanding coverage of the identity and application threats that matter most in a Workspace environment: privilege escalation, security control weakening, and data exfiltration.
Key coverage areas
- Privilege escalation: admin role assignments and domain-wide delegation grants that give an account tenant-wide reach.
- Security control weakening: MFA enforcement changes and degradations to Gmail security settings.
- Marketplace policy changes: relaxations that open the door to unvetted third-party applications.
- Data exfiltration vectors: activity patterns associated with data leaving the tenant.
- Google threat signals: government-backed attack warnings and access transparency events surfaced as findings.
Google Workspace audit logs are ingested and normalized to OCSF like any other source, so these detections produce high-fidelity OCSF findings alongside your cloud, application, network, and endpoint telemetry.