Google Workspace (formerly G Suite) is one of the easiest, free and low-barrier-to-entry ways for startups and other small-to-medium-sized companies to leverage their collaboration and email tools.
Now Google Workspace log monitoring, threat detection and response is available for free with Blumira’s Free SIEM edition. Free SIEM users can choose up to 3 cloud integrations, including Microsoft 365, Duo Security, SentinelOne, Cisco Umbrella, Webroot, Mimecast and now Google Workspace.
Earlier this year, we also doubled the length of data retention for Free SIEM users from one week to two weeks.
Every Free SIEM user gets:
Our Free SIEM is a great first step toward securing your organization. However, you will want to upgrade to our advanced editions if you meet any of the following criteria:
You can find additional capabilities for these use cases and more in Blumira’s other paid editions, including SIEM Pro, SIEM+ and XDR Platform.
All paid users have access to all cloud and on-prem integrations, including the following Cloud Connectors:
Google Workspace, like any cloud application, is not immune to security risks. Some of the top threats to look for include:
Data Exfiltration, Leaks or Exposure
This is when internal data is copied or transmitted out of your company’s domain, which can be done for malicious purposes. Blumira detects whenever a new Google document is shared externally, providing information about the user account, document file name, and shared email address. A finding is sent to your team via phone call, email or text. With that finding, Blumira provides a playbook, or a set of recommendations from our security engineering team on what next steps you can take to prevent future events.
How Blumira Detects Data Exfiltration>
Insider Attacks
A malicious insider is a legitimate or approved administrator or user within your domain who intentionally leaks sensitive information outside of your organization. Blumira detects when a user downloaded an item from Google Drive, which could expose internal documents and files to external entities through other methods of transporting data. Blumira notifies your team of this event and provides security advice and instructions on what to do next.
Account or User Breaches
This is when an unauthorized user gains access or attempts to gain access to a legitimate user’s account. One way this can happen is if an attacker steals a user’s login credentials. Blumira detects whenever a user has account login failures, including a large number of failures within a short period of time. While it could be due to legitimate user login failures, it could also indicate an attacker is maliciously attempting to access the user’s Google Drive account. Blumira notifies your team and sends playbook instructions on how to verify if the attempts were valid or not, and advice on how to remediate.
Elevation of Privileges
This refers to an attacker who already has access to a legitimate user account and is trying to change their access permissions to gain administrative access. Blumira detects when there’s been an administrative change in your company’s Google Workspace portal, and sends you instructions on how to verify if this was an authorized change or steps to take if you cannot verify.
Setting up an integration to collect Google Workspace logs, then send them to Blumira’s platform for advanced detection and response is quick and easy using Cloud Connectors (no sensor required).
On the Google Workspace side, you’ll need to create a Google Cloud Platform (GCP) project for your organization’s workspace, then create a service account and gather the JSON key file. Then you’ll enable admin SDK and IAM APIs for the project, and link your APIs to the service account. We provide more detailed instructions on how to complete this preliminary configuration in our documentation.
On the Cloud Connectors screen under Current Status, you can view the configuration’s progress. When the configuration completes, the status changes to Online (green dot).
Important: If you previously deployed a sensor module for this integration, then you must remove it via the Sensors page (Settings > Sensors) to avoid log duplication.
See the full set of instructions.
Sign up for our free SIEM and set up three cloud integrations in minutes today. Our managed detection rules are automatically deployed and work right out of the box, ideal for organizations with small teams. Every finding comes with instructions on how to respond to guide your team through faster resolution. See how easy it is to protect your organization with our Free SIEM.
