category: IT Services
provider: Google
commonfields:
  id: GSuiteAuditor
  version: -1
configuration:
- display: Admin email
  displaypassword: User's Service Account JSON
  name: credentials
  type: 9
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
description: G Suite Auditor is an integration that receives Audit logs from G Suite's different applications - admin, drive, calender, and more.
display: G Suite Auditor
name: GSuiteAuditor
script:
  commands:
  - arguments:
    - description: Profile ID or the user email for which the data should be filtered. Can be 'all' for all information, or 'userKey' for a user's unique Google Workspace profile ID or their primary email address.
      name: user_key
    - auto: PREDEFINED
      description: Application name for which the events are to be retrieved.
      name: application_name
      predefined:
      - access_transparency
      - admin
      - calendar
      - chat
      - drive
      - gcp
      - gplus
      - groups
      - groups_enterprise
      - jamboard
      - login
      - meet
      - mobile
      - rules
      - saml
      - token
      - user_accounts
      - context_aware_access
      - chrome
      - data_studio
      - keep
      required: true
    - description: The name of the event being queried. For a list of event names for each application, see the integration documentation.
      name: event_name
    - description: |-
        A comma-separated list of event parameters and relational operators. For example-
        'API_CLIENT_NAME==111,API_SCOPES=aaa'.
        The relevant 'event name' argument must be supplied to use this argument.
      name: filters
    - description: ID of the organizational unit to report on. Activity records will be shown only for users who belong to the specified organizational unit.
      name: org_unit_id
    - description: "Comma-separated group IDs on which user activities are filtered. \nThe response will contain activities for only those users who are a part of \nat least one of the group IDs mentioned here. For example: \"id:abc123,id:xyz456\".\nTo retrieve a group ID, use the 'gsuite-get-group' command in the 'G Suite Admin' Pack."
      name: group_id
    - description: IP address of the host where the event was performed.
      name: actor_ip_address
    - description: Sets the beginning of the time range shown in the report. For example - 2010-10-28T10:26:35.000Z.
      name: start_time
    - description: Sets the end of the time range shown in the report. For example - 2010-10-28T10:26:35.000Z.
      name: end_time
    - defaultValue: '50'
      description: Maximum number of results to return.
      name: max_results
    - description: The token to specify the next page.
      name: page_token
    - description: Email address of the G Suite domain admin. The request is preformed based on this user's permissions.
      name: admin_email
    description: Retrieves a list of activities for a specific customer's account and application.
    name: gsuite-activity-search
    outputs:
    - contextPath: GSuite.ActivitySearch.items.id.time
      description: Time the activity occurred.
      type: Date
    - contextPath: GSuite.ActivitySearch.items.id.uniqueQualifier
      description: Unique qualifier if multiple events have the same time.
      type: String
    - contextPath: GSuite.ActivitySearch.items.id.applicationName
      description: Application name to which the event belongs.
      type: String
    - contextPath: GSuite.ActivitySearch.items.id.customerId
      description: The unique identifier for a Google Workspace account.
      type: String
    - contextPath: GSuite.ActivitySearch.items.actor.callerType
      description: The type of actor.
      type: String
    - contextPath: GSuite.ActivitySearch.items.actor.key
      description: Can be the consumer_key of the requestor for OAuth 2LO API requests or an identifier for robot accounts.
      type: String
    - contextPath: GSuite.ActivitySearch.items.events.type
      description: Type of event.
      type: String
    - contextPath: GSuite.ActivitySearch.items.events.name
      description: Name of the event.
      type: String
    - contextPath: GSuite.ActivitySearch.items.events.parameters.name
      description: The name of the parameter.
      type: String
    - contextPath: GSuite.ActivitySearch.items.events.parameters.value
      description: String value of the parameter.
      type: String
    - contextPath: GSuite.ActivitySearch.items.actor.email
      description: The primary email address of the actor.
      type: String
    - contextPath: GSuite.ActivitySearch.items.actor.profileId
      description: The unique Google Workspace profile ID of the actor.
      type: String
    - contextPath: GSuite.ActivitySearch.items.ipAddress
      description: IP address of the user performing the action.
      type: String
    - contextPath: GSuite.ActivitySearch.items.events.parameters.boolValue
      description: Boolean value of the parameter.
      type: Boolean
    - contextPath: GSuite.ActivitySearch.items.events.parameters.multiValue
      description: String values of the parameter.
      type: String
    - contextPath: GSuite.PageToken.ActivitySearch.nextPageToken
      description: Token to specify the next page in the list.
      type: String
  dockerimage: demisto/googleapi-python3:1.0.0.115338
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests (auto formatted)
fromversion: 5.5.0