G Suite Security Alert Center

G Suite Security Alert Center allows users to fetch different alert types such as Suspicious login, Device compromised, Leaked password, and more. Users can delete or recover a single alert or a batch of alerts and retrieve the alert's metadata. This integration allows users to provide feedback for alerts and fetch existing feedback for a particular alert.

Data Enrichment & Threat Intelligence · G Suite Security Alert Center

Details

IDG Suite Security Alert Center
ProviderGoogle
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/googleapi-python3:1.0.0.10182333
Supported ModulesAgentix XSIAM

README

G Suite Security Alert Center allows users to fetch different alert types such as Suspicious login, Device compromised, Leaked password, and more. Users can delete or recover a single alert or a batch of alerts and retrieve the alert’s metadata.
This integration allows users to provide feedback for alerts and fetch existing feedback for a particular alert.
This integration was integrated and tested with version v1beta1 dated Oct 15, 2018 of Google Workspace Alert Center.
Supported Cortex XSOAR versions: 5.0.0 and later.

Configure Service Account for G Suite Security Alert Center

  1. Go to https://console.developers.google.com.

  2. Select or create a project:

    Setup Account

  3. Enable the G Suite Alert Center API:

    1. Under the main menu, select APIs & Services > Library:
      Setup Account

    2. Search for Google Workspace Alert Center API in Search for APIs & Services:
      Setup Account

    3. Enable Google Workspace Alert Center API:
      Setup Account

    4. Select the project and click OPEN:
      Setup Account

  4. Create a service account with the correct restricted permissions:

    1. Under the main menu, select IAM & Admin > Service Accounts:
      Setup Account

    2. In the top bar, select CREATE SERVICE ACCOUNT:
      Setup Account

    3. Under the main menu, select IAM & Admin > Service Accounts and open the account you just created.

    4. Generate new credentials:

      1. On the Service account details page, under Keys, click ADD KEY and select Create new key:
        Setup Account

      2. Under Key type, select JSON, and click CREATE.
        Save the credentials in a secure location. You will need the generated credentials.json file when you configure the instance in Cortex XSOAR:
        Setup Account

      3. The service account JSON will be automatically downloaded.

Add Scopes in G Suite Security Alert Center

  1. Go to https://admin.google.com

  2. Click Menu and select Security > API Controls:
    Setup Account

  3. Under the Domain wide delegation tab, Click MANAGE DOMAIN WIDE DELEGATION:
    Setup Account

  4. Click Add new. Enter the Client ID from your credentials.json file and the required scopes from the integration tips.
    Setup Account

  5. Click AUTHORIZE.

Configure G Suite Security Alert Center on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for G Suite Security Alert Center.

  3. Click Add instance to create and configure a new integration instance.

    Parameter Description Required
    Fetch incidents   False
    Incident type   False
    Service Account JSON User’s Service Account JSON key. True
    Admin Email G Suite domain administrator’s email ID that acts on behalf of the end-user True
    Maximum number of incidents per fetch The maximum allowed value is 1000. True
    First fetch time interval The time range to consider for the initial data fetch. Formats accepted: YYYY-MM-dd, YYYY-MM-ddTHH:mm:ss, 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years. Accepted timezone: UTC. False
    Alert Type Add a new type or choose existing multiple alert types. Fetches all types of alerts if left empty.  
    Note: If type is present in the Filter parameter this value will be overwritten. False  
    Filter An advanced filter to fetch the list of alerts. For example: source:”Google” AND type=”Suspicious login”. Note: This value takes precedence over any filter arguments. To fetch alerts using createTime, use the first fetch time interval parameter. False
    Fetch feedback Fetches the latest type of feedback for each alert. False
    Trust any certificate (not secure)   False
    Use system proxy settings   False
  4. Click Test to validate the URLs, token, and connection.

Supported query filters

  • To see supported query filters, refer to the link mentioned here.
  • To see the syntax of the filters, refer to the link mentioned here.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

gsac-alert-list

Lists the alerts. Use the filter to filter the list by various alert types.
Note: The alerts that have been marked for deletion in the past 30 days will still be visible.

Base Command

gsac-alert-list

Input

Argument Name Description Required
page_size The requested page size. Optional
page_token A token identifying a page of results the server should return. Optional
filter A query string for filtering alert results. For example: createTime >= “2020-10-28T20:43:34.381Z” AND type=”Suspicious login”. Optional
order_by The sort order of the list results. Possible values are: createTime asc, createTime desc, updateTime asc, updateTime desc. Optional

Context Output

Path Type Description
GSuiteSecurityAlert.PageToken.Alert.nextPageToken String The token for the next page.
GSuiteSecurityAlert.PageToken.Alert.name String Command name.
GSuiteSecurityAlert.Alert.customerId String The unique identifier of the Google account of the customer.
GSuiteSecurityAlert.Alert.alertId String The unique identifier for the alert.
GSuiteSecurityAlert.Alert.createTime Date The time the alert was created.
GSuiteSecurityAlert.Alert.startTime Date The time the event that caused the alert was started or detected.
GSuiteSecurityAlert.Alert.endTime Date The time the event that caused the alert ceased being active.
GSuiteSecurityAlert.Alert.type String The type of the alert.
GSuiteSecurityAlert.Alert.source String A unique identifier for the system that reported the alert.
GSuiteSecurityAlert.Alert.deleted Boolean True if the alert is marked for deletion.
GSuiteSecurityAlert.Alert.securityInvestigationToolLink String An optional Security Investigation Tool query for the alert.
GSuiteSecurityAlert.Alert.updateTime Date The time the alert was last updated.
GSuiteSecurityAlert.Alert.etag String ETag is used for optimistic concurrency control as a way to help prevent simultaneous updates of an alert from overwriting each other.
GSuiteSecurityAlert.Alert.metadata.customerId String The unique identifier of the Google account of the customer.
GSuiteSecurityAlert.Alert.metadata.alertId String The unique identifier of the alert.
GSuiteSecurityAlert.Alert.metadata.status String The current status of the alert.
GSuiteSecurityAlert.Alert.metadata.assignee String The email address of the user assigned to the alert.
GSuiteSecurityAlert.Alert.metadata.updateTime String The time the metadata was last updated.
GSuiteSecurityAlert.Alert.metadata.severity String The severity value of the alert.
GSuiteSecurityAlert.Alert.metadata.etag String ETag is used for optimistic concurrency control as a way to help prevent simultaneous updates of an alert metadata from overwriting each other.
GSuiteSecurityAlert.Alert.data.@type String Alert data of the alert types.
GSuiteSecurityAlert.Alert.data.takeoutRequestId String The takeout request ID.
GSuiteSecurityAlert.Alert.data.email String The email of the associated event. Domain wide takeout initiated applies to the email of the admin who initiated the takeout. Google identity applies to the email of the user who the event belongs to. Mobile device management/State Sponsored Attack applies to the email of the user the alert was created for.
GSuiteSecurityAlert.Alert.data.domainId.customerPrimaryDomain String The primary domain for the customer.
GSuiteSecurityAlert.Alert.data.maliciousEntity.entity.emailAddress String Email address of the user.
GSuiteSecurityAlert.Alert.data.maliciousEntity.entity.displayName String Display name of the user.
GSuiteSecurityAlert.Alert.data.maliciousEntity.fromHeader String The sender email address.
GSuiteSecurityAlert.Alert.data.maliciousEntity.displayName String The header from the display name.
GSuiteSecurityAlert.Alert.data.messages.messageId String The message ID.
GSuiteSecurityAlert.Alert.data.messages.md5HashMessageBody String The hash of the message body text.
GSuiteSecurityAlert.Alert.data.messages.messageBodySnippet String The snippet of the message body text (only available for reported emails).
GSuiteSecurityAlert.Alert.data.messages.md5HashSubject String The MD5 hash of the email’s subject (only available for reported emails).
GSuiteSecurityAlert.Alert.data.messages.subjectText String The email subject text (only available for reported emails).
GSuiteSecurityAlert.Alert.data.messages.attachmentsSha256Hash Unknown The list of SHA256 hashes of the email’s attachment and all MIME parts.
GSuiteSecurityAlert.Alert.data.messages.recipient String The recipient of the email.
GSuiteSecurityAlert.Alert.data.messages.date Date The date the malicious email was sent.
GSuiteSecurityAlert.Alert.data.isInternal Boolean If true, the email originated from within the organization.
GSuiteSecurityAlert.Alert.data.systemActionType String System actions on the messages.
GSuiteSecurityAlert.Alert.data.sourceIp String The source IP address of the malicious email, for example, 127.0.0.1.
GSuiteSecurityAlert.Alert.data.loginDetails.loginTime Date The successful login time that is associated with the warning event. This is not present for blocked login attempts.
GSuiteSecurityAlert.Alert.data.loginDetails.ipAddress String The human-readable IP address (for example, 11.22.33.44) that is associated with the warning event.
GSuiteSecurityAlert.Alert.data.title String A one-line incident description.
GSuiteSecurityAlert.Alert.data.description String Description of the associated alert type.
GSuiteSecurityAlert.Alert.data.affectedUserEmails Unknown The list of emails that correspond to the users directly affected by the incident.
GSuiteSecurityAlert.Alert.data.attachmentData.csv.headers Unknown The list of headers for the data columns in a CSV file.
GSuiteSecurityAlert.Alert.data.attachmentData.csv.dataRows.entries Unknown The data entries in a CSV file row, as a string array rather than a single comma-separated string.
GSuiteSecurityAlert.Alert.data.events.deviceId String The device ID.
GSuiteSecurityAlert.Alert.data.events.serialNumber String The serial number of the device.
GSuiteSecurityAlert.Alert.data.events.deviceType String The type of the device.
GSuiteSecurityAlert.Alert.data.events.deviceModel String The model of the device.
GSuiteSecurityAlert.Alert.data.events.resourceId String The device resource ID.
GSuiteSecurityAlert.Alert.data.events.iosVendorId String iOS vendor ID. Required for iOS, empty for others.
GSuiteSecurityAlert.Alert.data.events.deviceCompromisedState String The device compromised state. Possible values are “Compromised” or “Not Compromised”.
GSuiteSecurityAlert.Alert.data.events.deviceProperty String The device property that was changed.
GSuiteSecurityAlert.Alert.data.events.oldValue String The old value of the device property before the change.
GSuiteSecurityAlert.Alert.data.events.newValue String The new value of the device property after the change.
GSuiteSecurityAlert.Alert.data.requestInfo.appKey String The application that requires the SQL setup.
GSuiteSecurityAlert.Alert.data.requestInfo.appDeveloperEmail Unknown List of app developers who triggered notifications for the application.
GSuiteSecurityAlert.Alert.data.requestInfo.numberOfRequests String Number of requests sent for the application to set up default SQL instances.
GSuiteSecurityAlert.Alert.data.ruleViolationInfo.ruleInfo.resourceName String Resource name that uniquely identifies the rule.
GSuiteSecurityAlert.Alert.data.ruleViolationInfo.ruleInfo.displayName String User provided name of the rule.
GSuiteSecurityAlert.Alert.data.ruleViolationInfo.dataSource String Source of the data.
GSuiteSecurityAlert.Alert.data.ruleViolationInfo.trigger String Trigger of the rule.
GSuiteSecurityAlert.Alert.data.ruleViolationInfo.triggeringUserEmail String Email of the user who caused the violation.
GSuiteSecurityAlert.Alert.data.ruleViolationInfo.recipients Unknown Resource recipients.
GSuiteSecurityAlert.Alert.data.ruleViolationInfo.resourceInfo.resourceTitle String Title of the resource, for example email subject, or document title.
GSuiteSecurityAlert.Alert.data.ruleViolationInfo.resourceInfo.documentId String Drive file ID.
GSuiteSecurityAlert.Alert.data.ruleViolationInfo.matchInfo.userDefinedDetector.resourceName String Resource name that uniquely identifies the detector.
GSuiteSecurityAlert.Alert.data.ruleViolationInfo.matchInfo.userDefinedDetector.displayName String Display name of the detector.
GSuiteSecurityAlert.Alert.data.ruleViolationInfo.matchInfo.predefinedDetector.detectorName String Name that uniquely identifies the detector.
GSuiteSecurityAlert.Alert.data.ruleViolationInfo.triggeredActionTypes Unknown Actions applied as a consequence of the rule being triggered.
GSuiteSecurityAlert.Alert.data.ruleViolationInfo.suppressedActionTypes Unknown Actions suppressed due to other actions with higher priority.
GSuiteSecurityAlert.Alert.data.name String Rule name.
GSuiteSecurityAlert.Alert.data.displayName String Alert display name.
GSuiteSecurityAlert.Alert.data.windowSize String Rule window size. Possible values are 1 hour or 24 hours.
GSuiteSecurityAlert.Alert.data.threshold String Alert threshold, for example “COUNT > 5”.
GSuiteSecurityAlert.Alert.data.createTime Date The timestamp indicating when the rule was created.
GSuiteSecurityAlert.Alert.data.updateTime Date The timestamp indicating when the rule was last updated.
GSuiteSecurityAlert.Alert.data.triggerSource String The trigger sources for the rule.
GSuiteSecurityAlert.Alert.data.supersededAlerts Unknown List of alert IDs superseded by the alert.
GSuiteSecurityAlert.Alert.data.supersedingAlerts String Alert ID superseding the alert.
GSuiteSecurityAlert.Alert.data.actionNames Unknown List of action names associated with the rule threshold.
GSuiteSecurityAlert.Alert.data.query String Query that is used to get the data from the associated source.

Command Example

!gsac-alert-list page_size=2

Context Example

{
    "GSuiteSecurityAlert": {
        "Alert": [
            {
                "alertId": "dummy_alert_id1",
                "createTime": "2021-01-21T13:49:06.315483Z",
                "customerId": "dummy_customer_id",
                "data": {
                    "@type": "type.googleapis.com/google.apps.alertcenter.type.MailPhishing",
                    "domainId": {
                        "customerPrimaryDomain": "abc.io"
                    },
                    "maliciousEntity": {
                        "fromHeader": "dummyemail@xyz.com"
                    },
                    "messages": [
                        {
                            "attachmentsSha256Hash": [
                                "74bb828bcab5aedba8264369f791613cf01f5d42eb76d1bfe620fa4ca1d371c1",
                                "7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6",
                                "fcad4ae0f38b600395ab04055b273f14b6cdc504837ed0b69da962268e6fa268"
                            ],
                            "date": "2021-01-21T13:08:58.759929Z",
                            "md5HashSubject": "16258756be9e9c233f60b4dad7e4f4ae",
                            "messageId": "dummy1@mail.gmail.com",
                            "recipient": "dummy@abc.io",
                            "subjectText": "Token file"
                        },
                        {
                            "attachmentsSha256Hash": [
                                "e7df42ca778bc244404bf53c4898d970cc5e79f92d2323b03cd58623b165b73c",
                                "80e3e740713f373fcb66787e960bb47d040b1c3d20ea6dd78522988660bcee89"
                            ],
                            "date": "2021-01-21T13:11:11.615314Z",
                            "md5HashSubject": "6ac92bbad6c6204e0427a71cc5f008a8",
                            "messageBodySnippet": " 8c06b05c 91c2 45d8 8b83 a9cf6b5dad3a",
                            "messageId": "dummy2@mail.gmail.com",
                            "recipient": "dummy@abc.io",
                            "subjectText": "Phishing mail"
                        }
                    ]
                },
                "endTime": "2021-01-21T13:48:44.235359Z",
                "etag": "eVE19krfYNU=",
                "metadata": {
                    "alertId": "dummy_alert_id1",
                    "customerId": "dummy_customer_id",
                    "etag": "eVE19krfYNU=",
                    "severity": "HIGH",
                    "status": "NOT_STARTED",
                    "updateTime": "2021-01-21T13:49:06.315483Z"
                },
                "source": "Gmail phishing",
                "startTime": "2021-01-21T13:08:58.759929Z",
                "type": "User reported phishing",
                "updateTime": "2021-01-21T13:49:06.315483Z"
            },
            {
                "alertId": "dummy_alert_id2",
                "createTime": "2020-12-30T09:50:22.824822Z",
                "customerId": "dummy_customer_id",
                "data": {
                    "@type": "type.googleapis.com/google.apps.alertcenter.type.MailPhishing",
                    "domainId": {
                        "customerPrimaryDomain": "abc.io"
                    },
                    "maliciousEntity": {
                        "fromHeader": "dummyemail2@xyz.com"
                    },
                    "messages": [
                        {
                            "attachmentsSha256Hash": [
                                "32531ceff787967cc8ce01a7a0f4e4726f08d6bd1fb908ab5e3a3ce75eaddcef",
                                "3d1ee332859dae7253fbfa3030c396e8a14aaf08d418b50ee9b0dd07bc4a5f0b",
                                "552e99644f06425564b80bef0113b458d56a8ec2146e611be2333def6b176627"
                            ],
                            "date": "2020-12-30T09:12:03.571179Z",
                            "md5HashSubject": "bfa0c70e989f15ec0da8b52e5430371c",
                            "messageBodySnippet": "dummy message snippet",
                            "messageId": "dummy3@mail.gmail.com",
                            "recipient": "dummy@abc.io",
                            "subjectText": "Fwd: Script"
                        }
                    ]
                },
                "endTime": "2020-12-30T09:47:32.789447Z",
                "etag": "2Bgl3kK2ozA=",
                "metadata": {
                    "alertId": "dummy_alert_id2",
                    "customerId": "dummy_customer_id",
                    "etag": "2Bgl3kK2ozA=",
                    "severity": "HIGH",
                    "status": "NOT_STARTED",
                    "updateTime": "2020-12-30T09:50:22.824822Z"
                },
                "source": "Gmail phishing",
                "startTime": "2020-12-30T09:12:03.571179Z",
                "type": "User reported phishing",
                "updateTime": "2020-12-30T09:50:22.824822Z"
            }
        ],
        "PageToken": {
            "Alert": {
                "name": "gsac-alert-list",
                "nextPageToken": "ChAKDmIMCIKp9IAGEIjg2ABCDxNaWNJbmNpZGVudHMiADoIMDNwdWVraGQ"
            }
        }
    }
}

Human Readable Output

Alerts

Alert Id Alert Type Source Severity Status Create Time Update Time
dummy_alert_id1 User reported phishing Gmail phishing HIGH NOT_STARTED 2021-01-21T13:49:06.315483Z 2021-01-21T13:49:06.315483Z
dummy_alert_id2 User reported phishing Gmail phishing HIGH NOT_STARTED 2020-12-30T09:50:22.824822Z 2020-12-30T09:50:22.824822Z

Next Page Token

ChAKDmIMCIKp9IAGEIjg2ABCDxNaWNJbmNpZGVudHMiADoIMDNwdWVraGQ

gsac-alert-get

Gets the specified alert.
Note: To get the alert_id, execute the gsac-alert-list command.

Base Command

gsac-alert-get

Input

Argument Name Description Required
alert_id The identifier of the alert to retrieve. Required

Context Output

Path Type Description
GSuiteSecurityAlert.Alert.customerId String The unique identifier of the Google account of the customer.
GSuiteSecurityAlert.Alert.alertId String The unique identifier for the alert.
GSuiteSecurityAlert.Alert.createTime Date The time the alert was created.
GSuiteSecurityAlert.Alert.startTime Date The time the event that caused the alert was started or detected.
GSuiteSecurityAlert.Alert.endTime Date The time the event that caused the alert ceased being active.
GSuiteSecurityAlert.Alert.type String The type of the alert.
GSuiteSecurityAlert.Alert.source String A unique identifier for the system that reported the alert.
GSuiteSecurityAlert.Alert.deleted Boolean True if the alert is marked for deletion.
GSuiteSecurityAlert.Alert.securityInvestigationToolLink String An optional Security Investigation Tool query for the alert.
GSuiteSecurityAlert.Alert.updateTime Date The time the alert was last updated.
GSuiteSecurityAlert.Alert.etag String ETag is used for optimistic concurrency control as a way to help prevent simultaneous updates of an alert from overwriting each other.
GSuiteSecurityAlert.Alert.metadata.customerId String The unique identifier of the Google account of the customer.
GSuiteSecurityAlert.Alert.metadata.alertId String The unique identifier of the alert.
GSuiteSecurityAlert.Alert.metadata.status String The current status of the alert.
GSuiteSecurityAlert.Alert.metadata.assignee String The email address of the user assigned to the alert.
GSuiteSecurityAlert.Alert.metadata.updateTime String The time the metadata was last updated.
GSuiteSecurityAlert.Alert.metadata.severity String The severity value of the alert.
GSuiteSecurityAlert.Alert.metadata.etag String ETag is used for optimistic concurrency control as a way to help prevent simultaneous updates of an alert metadata from overwriting each other.
GSuiteSecurityAlert.Alert.data.@type String Alert data of the alert types.
GSuiteSecurityAlert.Alert.data.takeoutRequestId String The takeout request ID.
GSuiteSecurityAlert.Alert.data.email String The email of the associated event. Domain wide takeout initiated applies to the email of the admin who initiated the takeout. Google identity applies to the email of the user who the event belongs to. Mobile device management/State Sponsored Attack applies to the email of the user the alert was created for.
GSuiteSecurityAlert.Alert.data.domainId.customerPrimaryDomain String The primary domain for the customer.
GSuiteSecurityAlert.Alert.data.maliciousEntity.entity.emailAddress String Email address of the user.
GSuiteSecurityAlert.Alert.data.maliciousEntity.entity.displayName String Display name of the user.
GSuiteSecurityAlert.Alert.data.maliciousEntity.fromHeader String The sender email address.
GSuiteSecurityAlert.Alert.data.maliciousEntity.displayName String The header from the display name.
GSuiteSecurityAlert.Alert.data.messages.messageId String The message ID.
GSuiteSecurityAlert.Alert.data.messages.md5HashMessageBody String The hash of the message body text.
GSuiteSecurityAlert.Alert.data.messages.messageBodySnippet String The snippet of the message body text (only available for reported emails).
GSuiteSecurityAlert.Alert.data.messages.md5HashSubject String The MD5 hash of the email’s subject (only available for reported emails).
GSuiteSecurityAlert.Alert.data.messages.subjectText String The email subject text (only available for reported emails).
GSuiteSecurityAlert.Alert.data.messages.attachmentsSha256Hash Unknown The list of SHA256 hashes of the email’s attachment and all MIME parts.
GSuiteSecurityAlert.Alert.data.messages.recipient String The recipient of the email.
GSuiteSecurityAlert.Alert.data.messages.date Date The date the malicious email was sent.
GSuiteSecurityAlert.Alert.data.isInternal Boolean If true, the email originated from within the organization.
GSuiteSecurityAlert.Alert.data.systemActionType String System actions on the messages.
GSuiteSecurityAlert.Alert.data.sourceIp String The source IP address of the malicious email, for example, 127.0.0.1.
GSuiteSecurityAlert.Alert.data.loginDetails.loginTime Date The successful login time that is associated with the warning event. This is not present for blocked login attempts.
GSuiteSecurityAlert.Alert.data.loginDetails.ipAddress String The human-readable IP address (for example, 11.22.33.44) that is associated with the warning event.
GSuiteSecurityAlert.Alert.data.title String A one-line incident description.
GSuiteSecurityAlert.Alert.data.description String Description of the associated alert type.
GSuiteSecurityAlert.Alert.data.affectedUserEmails Unknown The list of emails that correspond to the users directly affected by the incident.
GSuiteSecurityAlert.Alert.data.attachmentData.csv.headers Unknown The list of headers for the data columns in a CSV file.
GSuiteSecurityAlert.Alert.data.attachmentData.csv.dataRows.entries Unknown The data entries in a CSV file row, as a string array rather than a single comma-separated string.
GSuiteSecurityAlert.Alert.data.events.deviceId String The device ID.
GSuiteSecurityAlert.Alert.data.events.serialNumber String The serial number of the device.
GSuiteSecurityAlert.Alert.data.events.deviceType String The type of the device.
GSuiteSecurityAlert.Alert.data.events.deviceModel String The model of the device.
GSuiteSecurityAlert.Alert.data.events.resourceId String The device resource ID.
GSuiteSecurityAlert.Alert.data.events.iosVendorId String iOS vendor ID. Required for iOS, empty for others.
GSuiteSecurityAlert.Alert.data.events.deviceCompromisedState String The device compromised state. Possible values are “Compromised” or “Not Compromised”.
GSuiteSecurityAlert.Alert.data.events.deviceProperty String The device property that was changed.
GSuiteSecurityAlert.Alert.data.events.oldValue String The old value of the device property before the change.
GSuiteSecurityAlert.Alert.data.events.newValue String The new value of the device property after the change.
GSuiteSecurityAlert.Alert.data.requestInfo.appKey String The application that requires the SQL setup.
GSuiteSecurityAlert.Alert.data.requestInfo.appDeveloperEmail Unknown List of app developers who triggered notifications for the application.
GSuiteSecurityAlert.Alert.data.requestInfo.numberOfRequests String Number of requests sent for the application to set up default SQL instances.
GSuiteSecurityAlert.Alert.data.ruleViolationInfo.ruleInfo.resourceName String Resource name that uniquely identifies the rule.
GSuiteSecurityAlert.Alert.data.ruleViolationInfo.ruleInfo.displayName String User provided name of the rule.
GSuiteSecurityAlert.Alert.data.ruleViolationInfo.dataSource String Source of the data.
GSuiteSecurityAlert.Alert.data.ruleViolationInfo.trigger String Trigger of the rule.
GSuiteSecurityAlert.Alert.data.ruleViolationInfo.triggeringUserEmail String Email of the user who caused the violation.
GSuiteSecurityAlert.Alert.data.ruleViolationInfo.recipients Unknown Resource recipients.
GSuiteSecurityAlert.Alert.data.ruleViolationInfo.resourceInfo.resourceTitle String Title of the resource, for example email subject, or document title.
GSuiteSecurityAlert.Alert.data.ruleViolationInfo.resourceInfo.documentId String Drive file ID.
GSuiteSecurityAlert.Alert.data.ruleViolationInfo.matchInfo.userDefinedDetector.resourceName String Resource name that uniquely identifies the detector.
GSuiteSecurityAlert.Alert.data.ruleViolationInfo.matchInfo.userDefinedDetector.displayName String Display name of the detector.
GSuiteSecurityAlert.Alert.data.ruleViolationInfo.matchInfo.predefinedDetector.detectorName String Name that uniquely identifies the detector.
GSuiteSecurityAlert.Alert.data.ruleViolationInfo.triggeredActionTypes Unknown Actions applied as a consequence of the rule being triggered.
GSuiteSecurityAlert.Alert.data.ruleViolationInfo.suppressedActionTypes Unknown Actions suppressed due to other actions with higher priority.
GSuiteSecurityAlert.Alert.data.name String Rule name.
GSuiteSecurityAlert.Alert.data.displayName String Alert display name.
GSuiteSecurityAlert.Alert.data.windowSize String Rule window size. Possible values are 1 hour or 24 hours.
GSuiteSecurityAlert.Alert.data.threshold String Alert threshold, for example “COUNT > 5”.
GSuiteSecurityAlert.Alert.data.createTime Date The timestamp indicating when the rule was created.
GSuiteSecurityAlert.Alert.data.updateTime Date The timestamp indicating when the rule was last updated.
GSuiteSecurityAlert.Alert.data.triggerSource String The trigger sources for the rule.
GSuiteSecurityAlert.Alert.data.supersededAlerts Unknown List of alert IDs superseded by the alert.
GSuiteSecurityAlert.Alert.data.supersedingAlerts String Alert ID superseding the alert.
GSuiteSecurityAlert.Alert.data.actionNames Unknown List of action names associated with the rule threshold.
GSuiteSecurityAlert.Alert.data.query String Query that is used to get the data from the associated source.

Command Example

!gsac-alert-get alert_id=dummy_alert_id4

Context Example

{
    "GSuiteSecurityAlert": {
        "Alert": {
            "alertId": "dummy_alert_id4",
            "createTime": "2020-10-28T20:43:34.381Z",
            "customerId": "dummy_customer_id",
            "data": {
                "@type": "type.googleapis.com/google.apps.alertcenter.type.AccountWarning",
                "email": "dummy@abc.io",
                "loginDetails": {
                    "ipAddress": "2570:ab56:c548:85a0:2567:7025:3963:183"
                }
            },
            "endTime": "2020-10-28T20:13:33Z",
            "etag": "dummyetag=",
            "metadata": {
                "alertId": "dummy_alert_id4",
                "customerId": "dummy_customer_id",
                "etag": "dummyetag=",
                "severity": "LOW",
                "status": "NOT_STARTED",
                "updateTime": "2020-10-28T20:43:34.381Z"
            },
            "source": "Google identity",
            "startTime": "2020-10-28T20:13:33Z",
            "type": "Suspicious login",
            "updateTime": "2020-10-28T20:43:34.381Z"
        }
    }
}

Human Readable Output

Alert

Alert Id Alert Type Source Severity Status Create Time Update Time
dummy_alert_id4 Suspicious login Google identity LOW NOT_STARTED 2020-10-28T20:43:34.381Z 2020-10-28T20:43:34.381Z

gsac-alert-feedback-create

Creates new feedback for an alert.

Base Command

gsac-alert-feedback-create

Input

Argument Name Description Required
alert_id The identifier of the alert the feedback belongs to. Required
feedback_type The type of alert feedback. Possible values are: ALERT_FEEDBACK_TYPE_UNSPECIFIED, NOT_USEFUL, SOMEWHAT_USEFUL, VERY_USEFUL. Required

Context Output

Path Type Description
GSuiteSecurityAlert.Feedback.customerId String The unique identifier of the Google account of the customer.
GSuiteSecurityAlert.Feedback.alertId String The alert identifier.
GSuiteSecurityAlert.Feedback.feedbackId String The unique identifier for the feedback.
GSuiteSecurityAlert.Feedback.createTime String The time the feedback was created.
GSuiteSecurityAlert.Feedback.type String The type of the feedback.
GSuiteSecurityAlert.Feedback.email String The email of the user who provided the feedback.

Command Example

!gsac-alert-feedback-create alert_id=dummy_alert_id4 feedback_type=VERY_USEFUL

Context Example

{
    "GSuiteSecurityAlert": {
        "Feedback": {
            "alertId": "dummy_alert_id4",
            "createTime": "2021-02-01T11:56:27.455114Z",
            "customerId": "dummy_customer_id",
            "email": "dummy@abc.io",
            "feedbackId": "dummy_feedback_id",
            "type": "VERY_USEFUL"
        }
    }
}

Human Readable Output

Feedback details

Feedback ID Alert ID Create Time Feedback Type Email
dummy_feedback_id dummy_alert_id4 2021-02-01T11:56:27.455114Z VERY_USEFUL dummy@abc.io

gsac-alert-feedback-list

Lists all the feedback for an alert.

Base Command

gsac-alert-feedback-list

Input

Argument Name Description Required
alert_id The identifier of the alert the feedbacks belong to. The “-“ wildcard can be used to represent all alerts. Required
filter A query string for filtering alert results. For example: alert_id = alertId01 AND feedback_id = feedbackId01. Optional
page_size The requested page size. Default is 50. Optional

Context Output

Path Type Description
GSuiteSecurityAlert.Feedback.customerId String The unique identifier of the Google account of the customer.
GSuiteSecurityAlert.Feedback.alertId String The alert identifier.
GSuiteSecurityAlert.Feedback.feedbackId String The unique identifier for the feedback.
GSuiteSecurityAlert.Feedback.createTime String The time the feedback was created.
GSuiteSecurityAlert.Feedback.type String The type of the feedback.
GSuiteSecurityAlert.Feedback.email String The email of the user who provided the feedback.

Command Example

!gsac-alert-feedback-list alert_id=dummy_alert_id5

Context Example

{
    "GSuiteSecurityAlert": {
        "Feedback": [
            {
                "alertId": "dummy_alert_id5",
                "createTime": "2021-01-21T12:06:22.350408Z",
                "customerId": "dummy_customer_id",
                "email": "dummy@abc.io",
                "feedbackId": "dummy_feedback_id1",
                "type": "NOT_USEFUL"
            },
            {
                "alertId": "dummy_alert_id5",
                "createTime": "2021-01-21T11:56:53.489471Z",
                "customerId": "dummy_customer_id",
                "email": "dummy@abc.io",
                "feedbackId": "dummy_feedback_id2",
                "type": "NOT_USEFUL"
            },
            {
                "alertId": "dummy_alert_id5",
                "createTime": "2021-01-20T20:11:20.343391Z",
                "customerId": "dummy_customer_id",
                "email": "dummy@abc.io",
                "feedbackId": "dummy_feedback_id3",
                "type": "VERY_USEFUL"
            }
        ]
    }
}

Human Readable Output

Feedback details

Feedback ID Alert ID Create Time Feedback Type Email
dummy_feedback_id1 dummy_alert_id5 2021-01-21T12:06:22.350408Z NOT_USEFUL dummy@abc.io
dummy_feedback_id2 dummy_alert_id5 2021-01-21T11:56:53.489471Z NOT_USEFUL dummy@abc.io
dummy_feedback_id3 dummy_alert_id5 2021-01-20T20:11:20.343391Z VERY_USEFUL dummy@abc.io

gsac-alert-delete

Performs delete operation on alerts.
Note: The alerts that are marked for deletion will be removed from the Alert Center after 30 days.

Base Command

gsac-alert-delete

Input

Argument Name Description Required
alert_id Comma-separated list of alert IDs to be marked for deletion. Required

Context Output

Path Type Description
GSuiteSecurityAlert.Delete.successAlerts.id Unknown The list of alert IDs successfully marked for deletion.
GSuiteSecurityAlert.Delete.failedAlerts.id Unknown The list of alert IDs failed to be marked for deletion.
GSuiteSecurityAlert.Delete.failedAlerts.code Number The status code of the failed alerts.
GSuiteSecurityAlert.Delete.failedAlerts.message String A developer-facing error message.
GSuiteSecurityAlert.Delete.failedAlerts.status String Status of the failed alert deletion.
GSuiteSecurityAlert.Delete.successAlerts.status String Status of the successful alert deletion.

Note: The gsac-alert-delete command returns a custom context that contains the status key that shows the status of the alert ID marked for deletion.

Command Example

!gsac-alert-delete alert_id="dummy_alert_id1,dummy_alert_id2"

Context Example

{
    "GSuiteSecurityAlert": {
        "Delete": {
            "failedAlerts": {
                "code": 5,
                "id": "dummy_alert_id2",
                "message": "NOT_FOUND",
                "status": "Fail"
            },
            "successAlerts": {
                "id": "dummy_alert_id1",
                "status": "Success"
            }
        }
    }
}

Human Readable Output

Delete Alerts

Alert ID Status
dummy_alert_id1 Success
dummy_alert_id2 Fail (NOT_FOUND)

gsac-alert-recover

Performs a recover operation on alerts.
Note: Recovers the alerts that were marked for deletion within the past 30 days.

Base Command

gsac-alert-recover

Input

Argument Name Description Required
alert_id Comma-separated list of alert IDs to be recovered. Required

Context Output

Path Type Description
GSuiteSecurityAlert.Recover.successAlerts.id Unknown The list of alert IDs successfully marked for recovery.
GSuiteSecurityAlert.Recover.failedAlerts.id Unknown The list of alert IDs failed to be marked for recovery.
GSuiteSecurityAlert.Recover.failedAlerts.code Number The status code of the failed alerts to be recovered.
GSuiteSecurityAlert.Recover.failedAlerts.message String A developer-facing error message for the failed alerts.
GSuiteSecurityAlert.Recover.successAlerts.status String Status of the successful alert recovery.
GSuiteSecurityAlert.Recover.failedAlerts.status String Status of the failed alert recovery.

Note: The gsac-alert-recover command returns a custom context that contains the status key that shows the status of the alert ID marked for recovery.

Command Example

!gsac-alert-recover alert_id="dummy_alert_id1,dummy_alert_id2"

Context Example

{
    "GSuiteSecurityAlert": {
        "Recover": {
            "failedAlerts": {
                "code": 5,
                "id": "dummy_alert_id2",
                "message": "NOT_FOUND",
                "status": "Fail"
            },
            "successAlerts": {
                "id": "dummy_alert_id1",
                "status": "Success"
            }
        }
    }
}

Human Readable Output

Recover Alerts

Alert ID Status
dummy_alert_id1 Success
dummy_alert_id2 Fail (NOT_FOUND)

Configuration parameters

  • isFetch — Fetch incidents
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • user_service_account_json — Service Account JSON
  • admin_email_creds — Admin Email
  • admin_email — Admin Email
  • max_fetch — Maximum number of incidents per fetch (required)
  • first_fetch — First fetch time interval
  • alert_type — Alert Type
  • filter — Filter
  • fetch_feedback — Fetch feedback
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (6)

  • gsac-alert-delete

    Performs delete operation on alerts. Note: The alerts that are marked for deletion will be removed from the Alert Center after 30 days.

  • gsac-alert-feedback-create

    Creates new feedback for an alert.

  • gsac-alert-feedback-list

    Lists all the feedback for an alert.

  • gsac-alert-get

    Gets the specified alert. Note: To get the alert_id, execute the gsac-alert-list command.

  • gsac-alert-list

    Lists the alerts. Use the filter to filter the list by various alert types. Note: The alerts that have been marked for deletion in the past 30 days will still be visible.

  • gsac-alert-recover

    Performs a recover operation on alerts. Note: Recovers the alerts that were marked for deletion within the past 30 days.

Source

GSuiteSecurityAlertCenter.py GSuiteSecurityAlertCenter_test.py GSuiteSecurityAlertCenter.yml GSuiteSecurityAlertCenter_description.md
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: Google
sectionorder:
- Connect
- Collect
commonfields:
  id: G Suite Security Alert Center
  version: -1
configuration:
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- defaultvalue: G Suite Security Alert Center
  display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- additionalinfo: User's Service Account JSON key.
  display: Service Account JSON
  name: user_service_account_json
  type: 4
  section: Connect
  hidden: true
  required: false
- display: Admin Email
  name: admin_email_creds
  type: 9
  section: Connect
  displaypassword: Service Account JSON
  required: false
- additionalinfo: G Suite domain administrator's email ID that acts on behalf of the end-user
  display: Admin Email
  name: admin_email
  type: 0
  section: Connect
  hidden: true
  required: false
- additionalinfo: |-
    The maximum allowed value is 1000.
  defaultvalue: '15'
  display: Maximum number of incidents per fetch
  name: max_fetch
  required: true
  type: 0
  section: Collect
- additionalinfo: 'The time range to consider for the initial data fetch.

    Formats accepted: YYYY-MM-dd, YYYY-MM-ddTHH:mm:ss, 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years.

    Accepted timezone: UTC'
  display: First fetch time interval
  name: first_fetch
  type: 0
  section: Collect
  defaultvalue: 3 days
  required: false
- additionalinfo: 'Add a new type or choose existing multiple alert types. Fetches all types of alerts if left empty.

    Note: If type is present in the Filter parameter this value will be overwritten.'
  display: Alert Type
  name: alert_type
  type: 16
  section: Collect
  advanced: true
  options:
  - Customer takeout initiated
  - Malware reclassification
  - Misconfigured whitelist
  - Phishing reclassification
  - Suspicious message reported
  - User reported phishing
  - User reported spam spike
  - Leaked password
  - Suspicious login
  - Suspicious login (less secure app)
  - Suspicious programmatic login
  - User suspended
  - User suspended (spam)
  - User suspended (spam through relay)
  - User suspended (suspicious activity)
  - Google Operations
  - Government attack warning
  - Device compromised
  - Suspicious activity
  - AppMaker Default Cloud SQL setup
  - Activity Rule
  - Data Loss Prevention
  required: false
- additionalinfo: 'An advanced filter to fetch the list of alerts.

    For example: source:"Google" AND type="Suspicious login".

    Note: This value takes precedence over any filter arguments. To fetch alerts using createTime, use the first fetch time interval parameter.'
  display: Filter
  name: filter
  type: 12
  section: Collect
  advanced: true
  required: false
- display: Fetch feedback
  name: fetch_feedback
  type: 8
  section: Collect
  advanced: true
  additionalinfo: Fetches the latest type of feedback for each alert.
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- advanced: true
  display: Use system proxy settings
  name: proxy
  section: Connect
  type: 8

  required: false
description: G Suite Security Alert Center allows users to fetch different alert types such as Suspicious login, Device compromised, Leaked password, and more. Users can delete or recover a single alert or a batch of alerts and retrieve the alert's metadata. This integration allows users to provide feedback for alerts and fetch existing feedback for a particular alert.
display: G Suite Security Alert Center
name: G Suite Security Alert Center
script:
  commands:
  - arguments:
    - description: The requested page size.
      name: page_size
    - description: A token identifying a page of results the server should return.
      name: page_token
    - description: |-
        A query string for filtering alert results.
        For example: createTime >= "2020-10-28T20:43:34.381Z" AND type="Suspicious login".
      name: filter
    - auto: PREDEFINED
      description: 'The sort order of the list results. Possible values: "createTime asc", "createTime desc", "updateTime asc", and "updateTime desc".'
      name: order_by
      predefined:
      - createTime asc
      - createTime desc
      - updateTime asc
      - updateTime desc
    description: |-
      Lists the alerts. Use the filter to filter the list by various alert types.
      Note: The alerts that have been marked for deletion in the past 30 days will still be visible.
    name: gsac-alert-list
    outputs:
    - contextPath: GSuiteSecurityAlert.PageToken.Alert.nextPageToken
      description: The token for the next page.
      type: String
    - contextPath: GSuiteSecurityAlert.PageToken.Alert.name
      description: Command name.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.customerId
      description: The unique identifier of the Google account of the customer.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.alertId
      description: The unique identifier for the alert.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.createTime
      description: The time the alert was created.
      type: Date
    - contextPath: GSuiteSecurityAlert.Alert.startTime
      description: The time the event that caused the alert was started or detected.
      type: Date
    - contextPath: GSuiteSecurityAlert.Alert.endTime
      description: The time the event that caused the alert ceased being active.
      type: Date
    - contextPath: GSuiteSecurityAlert.Alert.type
      description: The type of the alert.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.source
      description: A unique identifier for the system that reported the alert.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.deleted
      description: True if the alert is marked for deletion.
      type: Boolean
    - contextPath: GSuiteSecurityAlert.Alert.securityInvestigationToolLink
      description: An optional Security Investigation Tool query for the alert.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.updateTime
      description: The time the alert was last updated.
      type: Date
    - contextPath: GSuiteSecurityAlert.Alert.etag
      description: ETag is used for optimistic concurrency control as a way to help prevent simultaneous updates of an alert from overwriting each other.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.metadata.customerId
      description: The unique identifier of the Google account of the customer.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.metadata.alertId
      description: The unique identifier of the alert.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.metadata.status
      description: The current status of the alert.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.metadata.assignee
      description: The email address of the user assigned to the alert.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.metadata.updateTime
      description: The time the metadata was last updated.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.metadata.severity
      description: The severity value of the alert.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.metadata.etag
      description: ETag is used for optimistic concurrency control as a way to help prevent simultaneous updates of an alert metadata from overwriting each other.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.@type
      description: Alert data of the alert types.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.takeoutRequestId
      description: The takeout request ID.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.email
      description: "The email of the associated event. \nDomain wide takeout initiated applies to the email of the admin who initiated the takeout.\nGoogle identity applies to the email of the user who the event belongs to.\nMobile device management/State Sponsored Attack applies to the email of the user the alert was created for."
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.domainId.customerPrimaryDomain
      description: The primary domain for the customer.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.maliciousEntity.entity.emailAddress
      description: Email address of the user.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.maliciousEntity.entity.displayName
      description: Display name of the user.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.maliciousEntity.fromHeader
      description: The sender email address.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.maliciousEntity.displayName
      description: The header from the display name.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.messages.messageId
      description: The message ID.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.messages.md5HashMessageBody
      description: The hash of the message body text.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.messages.messageBodySnippet
      description: The snippet of the message body text (only available for reported emails).
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.messages.md5HashSubject
      description: The MD5 hash of the email's subject (only available for reported emails).
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.messages.subjectText
      description: The email subject text (only available for reported emails).
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.messages.attachmentsSha256Hash
      description: The list of SHA256 hashes of the email's attachment and all MIME parts.
      type: Unknown
    - contextPath: GSuiteSecurityAlert.Alert.data.messages.recipient
      description: The recipient of the email.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.messages.date
      description: The date the malicious email was sent.
      type: Date
    - contextPath: GSuiteSecurityAlert.Alert.data.isInternal
      description: If true, the email originated from within the organization.
      type: Boolean
    - contextPath: GSuiteSecurityAlert.Alert.data.systemActionType
      description: System actions on the messages.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.sourceIp
      description: The source IP address of the malicious email, for example, 127.0.0.1.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.loginDetails.loginTime
      description: The successful login time that is associated with the warning event. This is not present for blocked login attempts.
      type: Date
    - contextPath: GSuiteSecurityAlert.Alert.data.loginDetails.ipAddress
      description: The human-readable IP address (for example, 11.22.33.44) that is associated with the warning event.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.title
      description: A one-line incident description.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.description
      description: Description of the associated alert type.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.affectedUserEmails
      description: The list of emails that correspond to the users directly affected by the incident.
      type: Unknown
    - contextPath: GSuiteSecurityAlert.Alert.data.attachmentData.csv.headers
      description: The list of headers for the data columns in a CSV file.
      type: Unknown
    - contextPath: GSuiteSecurityAlert.Alert.data.attachmentData.csv.dataRows.entries
      description: The data entries in a CSV file row, as a string array rather than a single comma-separated string.
      type: Unknown
    - contextPath: GSuiteSecurityAlert.Alert.data.events.deviceId
      description: The device ID.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.events.serialNumber
      description: The serial number of the device.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.events.deviceType
      description: The type of the device.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.events.deviceModel
      description: The model of the device.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.events.resourceId
      description: The device resource ID.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.events.iosVendorId
      description: iOS vendor ID. Required for iOS, empty for others.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.events.deviceCompromisedState
      description: The device compromised state. Possible values are "Compromised" or "Not Compromised".
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.events.deviceProperty
      description: The device property that was changed.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.events.oldValue
      description: The old value of the device property before the change.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.events.newValue
      description: The new value of the device property after the change.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.requestInfo.appKey
      description: The application that requires the SQL setup.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.requestInfo.appDeveloperEmail
      description: List of app developers who triggered notifications for the application.
      type: Unknown
    - contextPath: GSuiteSecurityAlert.Alert.data.requestInfo.numberOfRequests
      description: Number of requests sent for the application to set up default SQL instances.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.ruleViolationInfo.ruleInfo.resourceName
      description: Resource name that uniquely identifies the rule.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.ruleViolationInfo.ruleInfo.displayName
      description: User provided name of the rule.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.ruleViolationInfo.dataSource
      description: Source of the data.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.ruleViolationInfo.trigger
      description: Trigger of the rule.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.ruleViolationInfo.triggeringUserEmail
      description: Email of the user who caused the violation.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.ruleViolationInfo.recipients
      description: Resource recipients.
      type: Unknown
    - contextPath: GSuiteSecurityAlert.Alert.data.ruleViolationInfo.resourceInfo.resourceTitle
      description: Title of the resource, for example email subject, or document title.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.ruleViolationInfo.resourceInfo.documentId
      description: Drive file ID.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.ruleViolationInfo.matchInfo.userDefinedDetector.resourceName
      description: Resource name that uniquely identifies the detector.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.ruleViolationInfo.matchInfo.userDefinedDetector.displayName
      description: Display name of the detector.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.ruleViolationInfo.matchInfo.predefinedDetector.detectorName
      description: Name that uniquely identifies the detector.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.ruleViolationInfo.triggeredActionTypes
      description: Actions applied as a consequence of the rule being triggered.
      type: Unknown
    - contextPath: GSuiteSecurityAlert.Alert.data.ruleViolationInfo.suppressedActionTypes
      description: Actions suppressed due to other actions with higher priority.
      type: Unknown
    - contextPath: GSuiteSecurityAlert.Alert.data.name
      description: Rule name.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.displayName
      description: Alert display name.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.windowSize
      description: Rule window size. Possible values are 1 hour or 24 hours.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.threshold
      description: Alert threshold, for example "COUNT > 5".
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.createTime
      description: The timestamp indicating when the rule was created.
      type: Date
    - contextPath: GSuiteSecurityAlert.Alert.data.updateTime
      description: The timestamp indicating when the rule was last updated.
      type: Date
    - contextPath: GSuiteSecurityAlert.Alert.data.triggerSource
      description: The trigger sources for the rule.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.supersededAlerts
      description: List of alert IDs superseded by the alert.
      type: Unknown
    - contextPath: GSuiteSecurityAlert.Alert.data.supersedingAlerts
      description: Alert ID superseding the alert.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.actionNames
      description: List of action names associated with the rule threshold.
      type: Unknown
    - contextPath: GSuiteSecurityAlert.Alert.data.query
      description: Query that is used to get the data from the associated source.
      type: String
  - arguments:
    - description: The identifier of the alert to retrieve.
      name: alert_id
      required: true
    description: "Gets the specified alert. \nNote: To get the alert_id, execute the gsac-alert-list  command."
    name: gsac-alert-get
    outputs:
    - contextPath: GSuiteSecurityAlert.Alert.customerId
      description: The unique identifier of the Google account of the customer.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.alertId
      description: The unique identifier for the alert.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.createTime
      description: The time the alert was created.
      type: Date
    - contextPath: GSuiteSecurityAlert.Alert.startTime
      description: The time the event that caused the alert was started or detected.
      type: Date
    - contextPath: GSuiteSecurityAlert.Alert.endTime
      description: The time the event that caused the alert ceased being active.
      type: Date
    - contextPath: GSuiteSecurityAlert.Alert.type
      description: The type of the alert.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.source
      description: A unique identifier for the system that reported the alert.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.deleted
      description: True if the alert is marked for deletion.
      type: Boolean
    - contextPath: GSuiteSecurityAlert.Alert.securityInvestigationToolLink
      description: An optional Security Investigation Tool query for the alert.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.updateTime
      description: The time the alert was last updated.
      type: Date
    - contextPath: GSuiteSecurityAlert.Alert.etag
      description: ETag is used for optimistic concurrency control as a way to help prevent simultaneous updates of an alert from overwriting each other.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.metadata.customerId
      description: The unique identifier of the Google account of the customer.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.metadata.alertId
      description: The unique identifier of the alert.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.metadata.status
      description: The current status of the alert.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.metadata.assignee
      description: The email address of the user assigned to the alert.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.metadata.updateTime
      description: The time the metadata was last updated.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.metadata.severity
      description: The severity value of the alert.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.metadata.etag
      description: ETag is used for optimistic concurrency control as a way to help prevent simultaneous updates of an alert metadata from overwriting each other.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.@type
      description: Alert data of the alert types.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.takeoutRequestId
      description: The takeout request ID.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.email
      description: "The email of the associated event. \nDomain wide takeout initiated applies to the email of the admin who initiated the takeout.\nGoogle identity applies to the email of the user who the event belongs to.\nMobile device management/State Sponsored Attack applies to the email of the user the alert was created for."
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.domainId.customerPrimaryDomain
      description: The primary domain for the customer.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.maliciousEntity.entity.emailAddress
      description: Email address of the user.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.maliciousEntity.entity.displayName
      description: Display name of the user.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.maliciousEntity.fromHeader
      description: The sender email address.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.maliciousEntity.displayName
      description: The header from the display name.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.messages.messageId
      description: The message ID.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.messages.md5HashMessageBody
      description: The hash of the message body text.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.messages.messageBodySnippet
      description: The snippet of the message body text (only available for reported emails).
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.messages.md5HashSubject
      description: The MD5 hash of the email's subject (only available for reported emails).
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.messages.subjectText
      description: The email subject text (only available for reported emails).
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.messages.attachmentsSha256Hash
      description: The list of SHA256 hashes of the email's attachment and all MIME parts.
      type: Unknown
    - contextPath: GSuiteSecurityAlert.Alert.data.messages.recipient
      description: The recipient of the email.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.messages.date
      description: The date the malicious email was sent.
      type: Date
    - contextPath: GSuiteSecurityAlert.Alert.data.isInternal
      description: If true, the email originated from within the organization.
      type: Boolean
    - contextPath: GSuiteSecurityAlert.Alert.data.systemActionType
      description: System actions on the messages.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.sourceIp
      description: The source IP address of the malicious email, for example, 127.0.0.1.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.loginDetails.loginTime
      description: The successful login time that is associated with the warning event. This is not present for blocked login attempts.
      type: Date
    - contextPath: GSuiteSecurityAlert.Alert.data.loginDetails.ipAddress
      description: The human-readable IP address (for example, 11.22.33.44) that is associated with the warning event.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.title
      description: A one-line incident description.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.description
      description: Description of the associated alert type.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.affectedUserEmails
      description: The list of emails that correspond to the users directly affected by the incident.
      type: Unknown
    - contextPath: GSuiteSecurityAlert.Alert.data.attachmentData.csv.headers
      description: The list of headers for the data columns in a CSV file.
      type: Unknown
    - contextPath: GSuiteSecurityAlert.Alert.data.attachmentData.csv.dataRows.entries
      description: The data entries in a CSV file row, as a string array rather than a single comma-separated string.
      type: Unknown
    - contextPath: GSuiteSecurityAlert.Alert.data.events.deviceId
      description: The device ID.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.events.serialNumber
      description: The serial number of the device.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.events.deviceType
      description: The type of the device.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.events.deviceModel
      description: The model of the device.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.events.resourceId
      description: The device resource ID.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.events.iosVendorId
      description: iOS vendor ID. Required for iOS, empty for others.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.events.deviceCompromisedState
      description: The device compromised state. Possible values are "Compromised" or "Not Compromised".
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.events.deviceProperty
      description: The device property that was changed.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.events.oldValue
      description: The old value of the device property before the change.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.events.newValue
      description: The new value of the device property after the change.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.requestInfo.appKey
      description: The application that requires the SQL setup.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.requestInfo.appDeveloperEmail
      description: List of app developers who triggered notifications for the application.
      type: Unknown
    - contextPath: GSuiteSecurityAlert.Alert.data.requestInfo.numberOfRequests
      description: Number of requests sent for the application to set up default SQL instances.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.ruleViolationInfo.ruleInfo.resourceName
      description: Resource name that uniquely identifies the rule.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.ruleViolationInfo.ruleInfo.displayName
      description: User provided name of the rule.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.ruleViolationInfo.dataSource
      description: Source of the data.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.ruleViolationInfo.trigger
      description: Trigger of the rule.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.ruleViolationInfo.triggeringUserEmail
      description: Email of the user who caused the violation.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.ruleViolationInfo.recipients
      description: Resource recipients.
      type: Unknown
    - contextPath: GSuiteSecurityAlert.Alert.data.ruleViolationInfo.resourceInfo.resourceTitle
      description: Title of the resource, for example email subject, or document title.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.ruleViolationInfo.resourceInfo.documentId
      description: Drive file ID.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.ruleViolationInfo.matchInfo.userDefinedDetector.resourceName
      description: Resource name that uniquely identifies the detector.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.ruleViolationInfo.matchInfo.userDefinedDetector.displayName
      description: Display name of the detector.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.ruleViolationInfo.matchInfo.predefinedDetector.detectorName
      description: Name that uniquely identifies the detector.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.ruleViolationInfo.triggeredActionTypes
      description: Actions applied as a consequence of the rule being triggered.
      type: Unknown
    - contextPath: GSuiteSecurityAlert.Alert.data.ruleViolationInfo.suppressedActionTypes
      description: Actions suppressed due to other actions with higher priority.
      type: Unknown
    - contextPath: GSuiteSecurityAlert.Alert.data.name
      description: Rule name.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.displayName
      description: Alert display name.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.windowSize
      description: Rule window size. Possible values are 1 hour or 24 hours.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.threshold
      description: Alert threshold, for example "COUNT > 5".
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.createTime
      description: The timestamp indicating when the rule was created.
      type: Date
    - contextPath: GSuiteSecurityAlert.Alert.data.updateTime
      description: The timestamp indicating when the rule was last updated.
      type: Date
    - contextPath: GSuiteSecurityAlert.Alert.data.triggerSource
      description: The trigger sources for the rule.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.supersededAlerts
      description: List of alert IDs superseded by the alert.
      type: Unknown
    - contextPath: GSuiteSecurityAlert.Alert.data.supersedingAlerts
      description: Alert ID superseding the alert.
      type: String
    - contextPath: GSuiteSecurityAlert.Alert.data.actionNames
      description: List of action names associated with the rule threshold.
      type: Unknown
    - contextPath: GSuiteSecurityAlert.Alert.data.query
      description: Query that is used to get the data from the associated source.
      type: String
  - arguments:
    - description: The identifier of the alert the feedback belongs to.
      name: alert_id
      required: true
    - auto: PREDEFINED
      description: 'The type of alert feedback. Possible values: "ALERT_FEEDBACK_TYPE_UNSPECIFIED", "NOT_USEFUL", "SOMEWHAT_USEFUL", and "VERY_USEFUL".'
      name: feedback_type
      predefined:
      - ALERT_FEEDBACK_TYPE_UNSPECIFIED
      - NOT_USEFUL
      - SOMEWHAT_USEFUL
      - VERY_USEFUL
      required: true
    description: Creates new feedback for an alert.
    name: gsac-alert-feedback-create
    outputs:
    - contextPath: GSuiteSecurityAlert.Feedback.customerId
      description: The unique identifier of the Google account of the customer.
      type: String
    - contextPath: GSuiteSecurityAlert.Feedback.alertId
      description: The alert identifier.
      type: String
    - contextPath: GSuiteSecurityAlert.Feedback.feedbackId
      description: The unique identifier for the feedback.
      type: String
    - contextPath: GSuiteSecurityAlert.Feedback.createTime
      description: The time the feedback was created.
      type: String
    - contextPath: GSuiteSecurityAlert.Feedback.type
      description: The type of the feedback.
      type: String
    - contextPath: GSuiteSecurityAlert.Feedback.email
      description: The email of the user who provided the feedback.
      type: String
  - arguments:
    - description: The identifier of the alert the feedbacks belong to. The "-" wildcard can be used to represent all alerts.
      name: alert_id
      required: true
    - description: |-
        A query string for filtering alert results.
        For example: alert_id = alertId01 AND feedback_id = feedbackId01.
      name: filter
    - defaultValue: '50'
      description: The requested page size. Default is 50.
      name: page_size
    description: Lists all the feedback for an alert.
    name: gsac-alert-feedback-list
    outputs:
    - contextPath: GSuiteSecurityAlert.Feedback.customerId
      description: The unique identifier of the Google account of the customer.
      type: String
    - contextPath: GSuiteSecurityAlert.Feedback.alertId
      description: The alert identifier.
      type: String
    - contextPath: GSuiteSecurityAlert.Feedback.feedbackId
      description: The unique identifier for the feedback.
      type: String
    - contextPath: GSuiteSecurityAlert.Feedback.createTime
      description: The time the feedback was created.
      type: String
    - contextPath: GSuiteSecurityAlert.Feedback.type
      description: The type of the feedback.
      type: String
    - contextPath: GSuiteSecurityAlert.Feedback.email
      description: The email of the user who provided the feedback.
      type: String
  - arguments:
    - description: Comma-separated list of alert IDs to be marked for deletion.
      isArray: true
      name: alert_id
      required: true
    description: |-
      Performs delete operation on alerts.
      Note: The alerts that are marked for deletion will be removed from the Alert Center after 30 days.
    name: gsac-alert-delete
    outputs:
    - contextPath: GSuiteSecurityAlert.Delete.successAlerts.id
      description: The list of alert IDs successfully marked for deletion.
      type: Unknown
    - contextPath: GSuiteSecurityAlert.Delete.failedAlerts.id
      description: The list of alert IDs failed to be marked for deletion.
      type: Unknown
    - contextPath: GSuiteSecurityAlert.Delete.failedAlerts.code
      description: The status code of the failed alerts.
      type: Number
    - contextPath: GSuiteSecurityAlert.Delete.failedAlerts.message
      description: A developer-facing error message.
      type: String
    - contextPath: GSuiteSecurityAlert.Delete.failedAlerts.status
      description: Status of the failed alert deletion.
      type: String
    - contextPath: GSuiteSecurityAlert.Delete.successAlerts.status
      description: Status of the successful alert deletion.
      type: String
  - arguments:
    - description: Comma-separated list of alert IDs to be recovered.
      isArray: true
      name: alert_id
      required: true
    description: |-
      Performs a recover operation on alerts.
      Note: Recovers the alerts that were marked for deletion within the past 30 days.
    name: gsac-alert-recover
    outputs:
    - contextPath: GSuiteSecurityAlert.Recover.successAlerts.id
      description: The list of alert IDs successfully marked for recovery.
      type: Unknown
    - contextPath: GSuiteSecurityAlert.Recover.failedAlerts.id
      description: The list of alert IDs failed to be marked for recovery.
      type: Unknown
    - contextPath: GSuiteSecurityAlert.Recover.failedAlerts.code
      description: The status code of the failed alerts to be recovered.
      type: Number
    - contextPath: GSuiteSecurityAlert.Recover.failedAlerts.message
      description: A developer-facing error message for the failed alerts.
      type: String
    - contextPath: GSuiteSecurityAlert.Recover.successAlerts.status
      description: Status of the successful alert recovery.
      type: String
    - contextPath: GSuiteSecurityAlert.Recover.failedAlerts.status
      description: Status of the failed alert recovery.
      type: String
  dockerimage: demisto/googleapi-python3:1.0.0.10182333
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- G Suite Security Alert Center-Test
defaultmapperin: G Suite Security Alert Center - Mapper
defaultclassifier: G Suite Security Alert Center - Classifier
fromversion: 5.0.0