Analytics BIOC
Informational
✕
A third-party application's access to the Google Workspace domain's resources was revoked
An identity removed a third-party application's access to Google Workspace domain's resources.
- Module:
- Identity Threat Detection (ITDR), SaaS Threat Detection
- Licensed by:
- Identity Threat Detection (ITDR)
- Data source:
- Google Workspace Audit Logs
ATT&CK tactics: Impact (TA0040)
ATT&CK techniques: Account Access Removal (T1531)
Detector tags: Google Workspace
Attacker's goals:
An attacker might remove an application to impair the environment.
Investigative actions:
Check the Google Workspace Application settings to determine which actions were triggered. Investigate the source of the request and the user associated with it. Review the access control policies to determine if the removal of the application is allowed.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days