Overview

The Google Workspace integration polls the Admin SDK Reports API and ingests activity feeds including:

  • login — user sign-in events, MFA outcomes, suspicious logins
  • admin — admin console actions, role and policy changes
  • drive — file create, edit, share, and download events
  • token — OAuth token grants and revocations
  • groups, calendar, chat, and other Workspace apps

Prerequisites

  • A Google Workspace tenant with a Super Admin account.
  • A Google Cloud project where you can create a service account.
  • The Workspace primary domain (for example, yourcompany.com).

Step 1: Create a service account in Google Cloud

  1. Open the Google Cloud Console and select (or create) a project to host the service account.
  2. Go to IAM & Admin → Service Accounts → Create service account.
  3. Name it atatus-siem and click Create and Continue, then Done (no project roles are required).
  4. Open the new service account, go to the Keys tab, and click Add Key → Create new key → JSON. Download and store the JSON file securely.
  5. Open the Details tab and copy the Unique ID — you'll need it for domain-wide delegation.

Step 2: Enable the Admin SDK API

  1. In the same Google Cloud project, go to APIs & Services → Library.
  2. Search for Admin SDK API and click Enable.

Step 3: Grant domain-wide delegation in the Workspace admin console

  1. Sign in to the Google Workspace Admin Console as a Super Admin.
  2. Go to Security → Access and data control → API controls → Manage Domain-Wide Delegation.
  3. Click Add new and paste the service account Unique ID (Client ID).
  4. Add the following OAuth scopes (read-only):
    • https://www.googleapis.com/auth/admin.reports.audit.readonly
    • https://www.googleapis.com/auth/admin.reports.usage.readonly
  5. Click Authorize.

Step 4: Connect Google Workspace in Atatus

  1. In Atatus, go to Security → Cloud SIEM → Integrations.
  2. Locate the Google Workspace card and click Connect.
  3. Fill in the form:
Field Description Example
Service Account JSON Paste the entire JSON key file from Step 1. { "type": "service_account", ... }
Workspace Domain Your primary Workspace domain. yourcompany.com
Admin Email A Super Admin email used for impersonation by the service account. admin@yourcompany.com
Poll Interval (minutes) How often to fetch new events. 5
Enabled Turn collection on. true
  1. Click Connect.

Verification

  • The Google Workspace card shows Configured.
  • Activity events appear in Security → Cloud SIEM → Audit Logs → Events with source google_workspace.