​
Overview

The Google Workspace integration polls the Admin SDK Reports API and ingests activity feeds including:
  • login: user sign-in events, MFA outcomes, suspicious logins
  • admin: admin console actions, role and policy changes
  • drive: file create, edit, share, and download events
  • token: OAuth token grants and revocations
  • groups, calendar, chat, and other Workspace apps

​
Prerequisites

  • A Google Workspace tenant with a Super Admin account.
  • A Google Cloud project where you can create a service account.
  • The Workspace primary domain (for example, yourcompany.com).

​
Step 1: Create a service account in Google Cloud

  1. Open the Google Cloud Console and select (or create) a project to host the service account.
  2. Go to IAM & Admin → Service Accounts → Create service account.
  3. Name it atatus-siem and click Create and Continue, then Done (no project roles are required).
  4. Open the new service account, go to the Keys tab, and click Add Key → Create new key → JSON. Download and store the JSON file securely.
  5. Open the Details tab and copy the Unique ID, which you’ll need for domain-wide delegation.

​
Step 2: Enable the Admin SDK API

  1. In the same Google Cloud project, go to APIs & Services → Library.
  2. Search for Admin SDK API and click Enable.

​
Step 3: Grant domain-wide delegation in the Workspace admin console

  1. Sign in to the Google Workspace Admin Console as a Super Admin.
  2. Go to Security → Access and data control → API controls → Manage Domain-Wide Delegation.
  3. Click Add new and paste the service account Unique ID (Client ID).
  4. Add the following OAuth scopes (read-only):
    • https://www.googleapis.com/auth/admin.reports.audit.readonly
    • https://www.googleapis.com/auth/admin.reports.usage.readonly
  5. Click Authorize.

​
Step 4: Connect Google Workspace in Atatus

  1. In Atatus, go to Security → Cloud SIEM → Integrations.
  2. Locate the Google Workspace card and click Connect.
  3. Fill in the form:
  1. Click Connect.

​
Verification

  • The Google Workspace card shows Configured.
  • Activity events appear in Security → Cloud SIEM → Audit Logs → Events with source google_workspace.