Integrating with Google Workspace

Overview

Blumira integrates with the Google Workspace productivity suite to stream security event logs and alerts to Blumira for threat detection and actionable response.

Required: Google Workspace licensing above Free Tier and an Admin user account.

Before you begin

This integration requires a Blumira sensor to be installed before you can complete the steps below. Ensure that you complete the steps in Building a Blumira sensor with Ubuntu before you continue.

Create a GCP Project

1. With Google Workspace Admin permissions, go to the GCP Console: https://console.cloud.google.com.
2. Create a GCP Project:
   1. Next to the Google Cloud Platform header, select New Project – Dropdown.
   2. Click New Project.
   3. In the New Project window, type a unique project name.
   4. Select the Organization you want to use (typically, the default is best).
   5. Enter the parent organization in the Location box if it is not pre-populated (usually matches the organization domain).
   6. Click Create.
3. Create a GCP Service Account in the newly created project for fetching logs:
   
   1. In the Project dropdown menu, select the project you created.
   2. On the left toolbar, select IAM & Admin > Service Accounts.
   3. Select +Create Service Account at the top of the page.
   4. Type a unique service account name.
   5. Type a unique service account ID
   6. Type a service description.
   7. Click Create and continue.
   8. Select the dropdown Select A Role, then choose Service Account in the left column and Service Account Token Creator in the right column.
   9. Click Continue.
   10. Click Done at the bottom.
   11. Select your new service account from the list.
   12. Click the KEYS tab.
   13. Click Add Key > Create New Key.
   14. Select JSON format for the key. The JSON file should automatically download from your browser.
4. Find your Client_ID:
   1. Open the JSON Key file on your local machine in a plain text editor (Notepad, Wordpad, Notepad++).
   2. Find the Client_ID and copy the number.
   3. Save the File to use it in later steps.

Enable Google APIs

1. Enable the Google Admin SDK API:
   1. From the GCP Main Console Page, select the project you created in previous steps on the top left.
   2. Navigate to APIs & Services > Library.
   3. In the search bar, type Admin SDK.
   4. Select the Admin SDK API.
   5. Click Enable.
2. Enable the Identity and Access Management (IAM) API:
   1. Return to the same API Library page as shown in the previous section.
   2. In the search bar, type IAM API.
   3. Select the Identity and Access Management (IAM) API.
   4. Click Enable.

Link APIs to Google Workspace

• Go to https://admin.google.com and log in as a global admin.
• In the left side toolbar, go to Security > Access and data control > API Controls.
• Scroll to the bottom section called “Domain-Wide Delegation”.
• Click Manage Domain Wide Delegation.
• Click Add New.
• In the Add a new Client ID window, enter the Client_ID number saved from the JSON file in previous steps.
• Copy and paste the following into the OAuth Scopes section: https://www.googleapis.com/auth/admin.reports.audit.readonly,https://www.googleapis.com/auth/iam
• Click Authorize.
  Note: Per Google's Delegation of Authority documentation, “Only users with access to the Admin APIs can access the Admin SDK Reports API, therefore your service account needs to impersonate one of those users to access the Admin SDK Reports API.” In other words, you must provide the email address of one of your Workspace users with admin console access so that the module can use the account to fetch your Google logs.

Configuring Blumira

To add a module on an existing sensor and provide credentials:

1. In Blumira, click Settings.
2. Click Sensors.
3. Click the sensor on which you want to add a module.
4. On the detail page for the sensor, scroll down and click Add Module.
5. In the Add New Module window, select the newest version of this integration's module. Note: For the best stability and performance, Blumira will update the module version when old versions are deprecated.
6. Enter the credentials that you gathered in the "Before you begin" section above.
7. (Optional) Type a name for this log deployment in the Log Source Name box. This name is what will appear in the "device_address" column in the results of your event data queries. If you might have additional modules collect logs for different integrations in the future, this will help you distinguish them. Note: The name can only contain alphanumeric characters, periods, and hyphens; no spaces or underscores are allowed.
8. Click Install.