Skip to content

Commit 479e076

Browse files
navnit-elasticnavnit-elastic
authored
google_workspace: add google keep data stream (elastic#13836)
This adds support for the Google Keep audit event type as a new data stream to enhance the overall visibility of data in the Google Workspace integration. This changes includes updating navigation links in to the relevant dashboards. Sanitized test case inputs were obtained from live Google Workspace instance using the Admin SDK for Reports API[1]. [1] https://developers.google.com/workspace/admin/reports/reference/rest
1 parent 5cf7dfc commit 479e076

27 files changed

+2313
-228
lines changed

‎packages/google_workspace/_dev/build/docs/README.md

+10-1
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ It is compatible with a subset of applications under the [Google Reports API v1]
3232
| [Chat](https://developers.google.com/admin-sdk/reports/v1/appendix/activity/chat) | The Chat activity report returns information about how your account's users use and manage Spaces. |
3333
| [Vault](https://developers.google.com/admin-sdk/reports/v1/appendix/activity/vault) | The Vault activity report returns information about various types of Vault Audit activity events. |
3434
| [Meet](https://developers.google.com/admin-sdk/reports/v1/appendix/activity/meet) | The Meet activity report returns information about various aspects of call events. |
35+
| [Keep](https://developers.google.com/admin-sdk/reports/v1/appendix/activity/keep) | The Keep activity report returns information about how your account's users manage and modify their notes. |
3536

3637
## Requirements
3738

@@ -48,7 +49,7 @@ This integration will make use of the following *oauth2 scope*:
4849

4950
Once you have downloaded your service account credentials as a JSON file, you are ready to set up your integration.
5051

51-
Click the Advanced option of Google Workspace Audit Reports. The default value of "API Host" is `https://www.googleapis.com`. The API Host will be used for collecting `access_transparency`, `admin`, `calendar`, `chat`, `chrome`, `context_aware_access`, `data_studio`, `device`, `drive`, `gcp`, `groups`, `group_enterprise`, `login`, `meet`, `rules`, `saml`, `token`, `user accounts` and `vault` logs.
52+
Click the Advanced option of Google Workspace Audit Reports. The default value of "API Host" is `https://www.googleapis.com`. The API Host will be used for collecting `access_transparency`, `admin`, `calendar`, `chat`, `chrome`, `context_aware_access`, `data_studio`, `device`, `drive`, `gcp`, `groups`, `group_enterprise`, `keep`, `login`, `meet`, `rules`, `saml`, `token`, `user accounts` and `vault` logs.
5253

5354
> NOTE: The `Delegated Account` value in the configuration, is expected to be the email of the administrator account, and not the email of the ServiceAccount.
5455
@@ -310,3 +311,11 @@ This is the `meet` dataset.
310311
{{event "meet"}}
311312

312313
{{fields "meet"}}
314+
315+
### Keep
316+
317+
This is the `keep` dataset.
318+
319+
{{event "keep"}}
320+
321+
{{fields "keep"}}

‎packages/google_workspace/_dev/deploy/docker/config.yml

+166
Original file line numberDiff line numberDiff line change
@@ -1482,6 +1482,172 @@ rules:
14821482
]
14831483
}
14841484
`}}
1485+
- path: /admin/reports/v1/activity/users/all/applications/keep
1486+
methods: ['GET']
1487+
query_params:
1488+
maxResults: 1
1489+
pageToken: page-3
1490+
request_headers:
1491+
Authorization:
1492+
- "Bearer 1/fFAGRNJru1FTz70BzhT3Zg"
1493+
responses:
1494+
- status_code: 200
1495+
headers:
1496+
Content-Type:
1497+
- "application/json"
1498+
body: |-
1499+
{{ minify_json `
1500+
{
1501+
"kind": "admin#reports#activities",
1502+
"items": [
1503+
{
1504+
"kind": "admin#reports#activity",
1505+
"id": {
1506+
"time": "2025-03-27T12:46:57.714Z",
1507+
"uniqueQualifier": "0",
1508+
"applicationName": "keep",
1509+
"customerId": "1"
1510+
},
1511+
"etag": "abcdefgh-SHfJfeOMlTPu983WfVweBonaAPdmU",
1512+
"actor": {
1513+
"callerType": "USER",
1514+
"email": "[email protected]",
1515+
"profileId": "1"
1516+
},
1517+
"events": [
1518+
{
1519+
"type": "user_action",
1520+
"name": "modified_acl",
1521+
"parameters": [
1522+
{
1523+
"name": "owner_email",
1524+
"value": "[email protected]"
1525+
},
1526+
{
1527+
"name": "note_name",
1528+
"value": "https://keep.googleapis.com/v1/notes/abc-xyz"
1529+
}
1530+
]
1531+
}
1532+
]
1533+
}
1534+
]
1535+
}
1536+
`}}
1537+
- path: /admin/reports/v1/activity/users/all/applications/keep
1538+
methods: ['GET']
1539+
query_params:
1540+
maxResults: 1
1541+
pageToken: page-2
1542+
request_headers:
1543+
Authorization:
1544+
- "Bearer 1/fFAGRNJru1FTz70BzhT3Zg"
1545+
responses:
1546+
- status_code: 200
1547+
headers:
1548+
Content-Type:
1549+
- "application/json"
1550+
body: |-
1551+
{{ minify_json `
1552+
{
1553+
"kind": "admin#reports#activities",
1554+
"nextPageToken": "page-3",
1555+
"items": [
1556+
{
1557+
"kind": "admin#reports#activity",
1558+
"id": {
1559+
"time": "2025-03-27T12:46:29.430Z",
1560+
"uniqueQualifier": "1",
1561+
"applicationName": "keep",
1562+
"customerId": "1"
1563+
},
1564+
"etag": "abcdefgh-SHfJfeOMlTPu983WfVweBonaAPdmU",
1565+
"actor": {
1566+
"callerType": "USER",
1567+
"email": "[email protected]",
1568+
"profileId": "1"
1569+
},
1570+
"events": [
1571+
{
1572+
"type": "user_action",
1573+
"name": "deleted_attachment",
1574+
"parameters": [
1575+
{
1576+
"name": "owner_email",
1577+
"value": "[email protected]"
1578+
},
1579+
{
1580+
"name": "note_name",
1581+
"value": "https://keep.googleapis.com/v1/notes/abc-xyz"
1582+
},
1583+
{
1584+
"name": "attachment_name",
1585+
"value": "https://keep.googleapis.com/v1/notes/abc-xyz/attachments/abcdefgh"
1586+
}
1587+
]
1588+
}
1589+
]
1590+
}
1591+
]
1592+
}
1593+
`}}
1594+
- path: /admin/reports/v1/activity/users/all/applications/keep
1595+
methods: ['GET']
1596+
query_params:
1597+
maxResults: 1
1598+
pageToken: null
1599+
request_headers:
1600+
Authorization:
1601+
- "Bearer 1/fFAGRNJru1FTz70BzhT3Zg"
1602+
responses:
1603+
- status_code: 200
1604+
headers:
1605+
Content-Type:
1606+
- "application/json"
1607+
body: |-
1608+
{{ minify_json `
1609+
{
1610+
"kind": "admin#reports#activities",
1611+
"nextPageToken": "page-2",
1612+
"items": [
1613+
{
1614+
"kind": "admin#reports#activity",
1615+
"id": {
1616+
"time": "2025-03-27T12:45:08.310Z",
1617+
"uniqueQualifier": "0",
1618+
"applicationName": "keep",
1619+
"customerId": "1"
1620+
},
1621+
"etag": "abcdefgh-SHfJfeOMlTPu983WfVweBonaAPdmU",
1622+
"actor": {
1623+
"callerType": "USER",
1624+
"email": "[email protected]",
1625+
"profileId": "1"
1626+
},
1627+
"events": [
1628+
{
1629+
"type": "user_action",
1630+
"name": "uploaded_attachment",
1631+
"parameters": [
1632+
{
1633+
"name": "owner_email",
1634+
"value": "[email protected]"
1635+
},
1636+
{
1637+
"name": "note_name",
1638+
"value": "https://keep.googleapis.com/v1/notes/abc-xyz"
1639+
},
1640+
{
1641+
"name": "attachment_name",
1642+
"value": "https://keep.googleapis.com/v1/notes/abc-xyz/attachments/abcdefgh"
1643+
}
1644+
]
1645+
}
1646+
]
1647+
}
1648+
]
1649+
}
1650+
`}}
14851651
- path: /admin/reports/v1/activity/users/all/applications/drive
14861652
methods: [GET]
14871653
query_params:

‎packages/google_workspace/changelog.yml

+5
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "2.41.0"
3+
changes:
4+
- description: Add support for Keep event type.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/13836
27
- version: "2.40.0"
38
changes:
49
- description: Add support for Meet event type.

‎packages/google_workspace/data_stream/keep/_dev/test/pipeline/test-common-config.yml

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
fields:
2+
tags:
3+
- preserve_duplicate_custom_fields

‎packages/google_workspace/data_stream/keep/_dev/test/pipeline/test-keep.log

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
{"kind": "admin#reports#activity", "id": {"time": "2025-03-27T12:46:57.714Z", "uniqueQualifier": "0", "applicationName": "keep", "customerId": "1"}, "etag": "abcdefgh-SHfJfeOMlTPu983WfVweBonaAPdmU", "actor": {"callerType": "USER", "email": "[email protected]", "profileId": "1"}, "events": {"type": "user_action", "name": "modified_acl", "parameters": [{"name": "owner_email", "value": "[email protected]"}, {"name": "note_name", "value": "https://keep.googleapis.com/v1/notes/abc-xyz"}]}}
2+
{"kind": "admin#reports#activity", "id": {"time": "2025-03-27T12:46:29.430Z", "uniqueQualifier": "1", "applicationName": "keep", "customerId": "1"}, "etag": "abcdefgh-SHfJfeOMlTPu983WfVweBonaAPdmU", "actor": {"callerType": "USER", "email": "[email protected]", "profileId": "1"}, "events": {"type": "user_action", "name": "deleted_attachment", "parameters": [{"name": "owner_email", "value": "[email protected]"}, {"name": "note_name", "value": "https://keep.googleapis.com/v1/notes/abc-xyz"}, {"name": "attachment_name", "value": "https://keep.googleapis.com/v1/notes/abc-xyz/attachments/abcdefgh"}]}}
3+
{"kind": "admin#reports#activity", "id": {"time": "2025-03-27T12:45:08.310Z", "uniqueQualifier": "0", "applicationName": "keep", "customerId": "1"}, "etag": "abcdefgh-SHfJfeOMlTPu983WfVweBonaAPdmU", "actor": {"callerType": "USER", "email": "[email protected]", "profileId": "1"}, "events": {"type": "user_action", "name": "uploaded_attachment", "parameters": [{"name": "owner_email", "value": "[email protected]"}, {"name": "note_name", "value": "https://keep.googleapis.com/v1/notes/abc-xyz"}, {"name": "attachment_name", "value": "https://keep.googleapis.com/v1/notes/abc-xyz/attachments/abcdefgh"}]}}
4+
{"kind": "admin#reports#activity", "id": {"time": "2025-03-25T10:13:35.077Z", "uniqueQualifier": "0", "applicationName": "keep", "customerId": "1"}, "etag": "abcdefgh-SHfJfeOMlTPu983WfVweBonaAPdmU", "actor": {"callerType": "USER", "email": "[email protected]", "profileId": "1"}, "events": {"type": "user_action", "name": "edited_note_content", "parameters": [{"name": "owner_email", "value": "[email protected]"}, {"name": "note_name", "value": "https://keep.googleapis.com/v1/notes/abc-xyz"}]}}
5+
{"kind": "admin#reports#activity", "id": {"time": "2025-03-25T09:32:46.784Z", "uniqueQualifier": "0", "applicationName": "keep", "customerId": "1"}, "etag": "abcdefgh-SHfJfeOMlTPu983WfVweBonaAPdmU", "actor": {"callerType": "USER", "email": "[email protected]", "profileId": "1"}, "events": {"type": "user_action", "name": "created_note", "parameters": [{"name": "owner_email", "value": "[email protected]"}, {"name": "note_name", "value": "https://keep.googleapis.com/v1/notes/abc-xyz"}]}}

0 commit comments

Comments
 (0)