Google Workspace app and Dashboards

This page demonstrates how to install the Google Workspace app and enable documents shared outside your organization. This page also provides descriptions, use cases, and examples for each of the Google Workspace app dashboards.

Installing the Google Workspace app

To install the app, do the following:

1. From the Sumo Logic navigation, select App Catalog.
2. In the Search Apps field, search for and then select your app.
   Optionally, you can scroll down to preview the dashboards included with the app.
3. To install the app, click Install App.
4. Click Next in the Setup Data section.
5. In the Configure section of the respective app, complete the following fields.
   1. Key. Select either of these options for the data source.
      • Choose Source Category, and select a source category from the list for Default Value.
      • Choose Custom, and enter a custom metadata field. Insert its value in Default Value.
6. Click Next. You will be redirected to the Preview & Done section.

Your app will be installed in the Installed Apps folder and dashboard panels will start to fill automatically.

Each panel slowly fills with data matching the time range query and received since the panel was created. Results will not immediately be available, updating with full graphs and charts over time.

Viewing Google Workspace dashboards​

All dashboards have a set of filters that you can apply to the entire dashboard. Use these filters to drill down and examine the data to a granular level.

• You can change the time range for a dashboard or panel by selecting a predefined interval from a drop-down list, choosing a recently used time range, or specifying custom dates and times. Learn more.
• You can use template variables to drill down and examine the data on a granular level. For more information, see Filter with template variables.
• Most Next-Gen apps allow you to provide the scope at the installation time and are comprised of a key (_sourceCategory by default) and a default value for this key. Based on your input, the app dashboards will be parameterized with a dashboard variable, allowing you to change the dataset queried by all panels. This eliminates the need to create multiple copies of the same dashboard with different queries.

Filters

Each dashboard has a set of filters that you can apply to the entire dashboard, as shown in the following example. Click the funnel icon in the top dashboard menu bar to display a scrollable list of filters that are applied across the entire dashboard.

You can use filters to drill down and examine the data on a granular level.

Each panel has a set of filters that are applied to the results for that panel only, as shown in the following example. Click the funnel icon in the top panel menu bar to display a list of panel-specific filters.

Overview

The Google Workspace - Overview Dashboard provides a high-level overview of up-to-date activities throughout Google Workspace, including information on login failures, logins from multiple IPs, changes in ACL, login failures by the user, top apps, and top events by event type.

Use this dashboard to:

• Monitor the number of compromised devices and users.
• Use the panels to navigate to alert center detail dashboards.

Admin

The Google Workspace - Admin Dashboard provides at-a-glance graphs paired with detailed analytics to give you a comprehensive view of up-to-date administrative activities in Google Workspace. This includes information on users and groups that have been created or deleted, app token actions, admin action count, and actions by admins and users.

Use this dashboard to:

• Monitor alerts associated with admin users.
• Track creation and deletion activities by admin users.
• Monitor user content transfer activity.

Drive

The Google Workspace - Drive Dashboard provides at-a-glance graphs and detailed analytics on Google Drive activity. The up-to-date Google Workspace Drive information includes drive activity by location, trends in drive activity by country, ACL changes, counts of primary actions, recent uploads, document types, documents viewed, and documents shared.

Use this dashboard to:

• Monitor documents shared both inside and outside of the organization.
• Track user geographic locations and their drive activities including ACL changes, uploads, and downloads.

User Activity

The Google Workspace - User Activity Dashboard provides detailed information on Google Drive activity by users. A breakdown of user activity information includes most active users, most active IP addresses, and top users for downloading, uploading, creating, and sharing content.

Use this dashboard to:

• Monitor content sharing by compromised users to identify potential data leak issues.
• Determine most active users and active IP addresses.
• Track top users by the number of activities on Google Drive.

Login

The Google Workspace - Login Dashboard provides high-level graphs and detailed information for Google Workspace apps login data. Login information includes geographic locations, logins by state, successful logins, login failures by the user, IP address, and type; login failure outliers, login activity trends, and logins from multiple IP addresses.

Use this dashboard to:

• Identify abnormal spikes in login failures.
• Monitor successful logins by compromised users.
• Track user login trends and their geographic locations.

Alert Center - Overview Dashboard

The Google Workspace - Alert Center - Overview Dashboard provides a high-level view of Google Workspace alert data by source and type, suspicious IP and email addresses, compromised devices and credentials, recent alerts, and alert trends over time.

Use this dashboard to:

• Determine potential threats.
• Monitor abnormal spikes and recent alerts.
• Monitor credentials breaches and compromised devices

Alert Center - Investigations

The Google Workspace - Alert Center - Investigations Dashboard provides easily accessible analytics on compromised credentials, including Google Workspace activity of users with compromised credentials. This dashboard also provides data on Google Workspace activity from compromised devices.

Use this dashboard to:

• Track credential breaches and compromised devices.
• Monitor user activities after credentials have been breached or after a device has been compromised
• Track potential threats by email, IP address, and domain.

Alert Center - Google Identity

The Google Workspace - Alert Center - Google Identity dashboard provides detailed information on suspicious logins and suspended users. This dashboard also provides information on the number and location of suspicious logins and suspended users.

Use this dashboard to:

• Monitor suspicious activity and its locations.
• Identify suspended users and suspicious logins.

Alert Center - Gmail Phishing

The Google Workspace - Alert Center - Gmail Phishing dashboard provides detailed information on phishing attacks and spam activity on Google Workspace applications. This dashboard also provides information on the affected users and the top attackers responsible for the attacks.

Use this dashboard to:

• Monitor users affected by phishing attacks.
• Identify top attackers by volume and breadth.
• Track recent attacks.

Alert Center - Other Alerts

The Google Workspace - Other Alerts Dashboard provides a high-level view paired with detailed information on Google Workspace operations for security and privacy issues, potential government-backed attacks, recent customer takeout initiated alerts, and Mobile device management-based alerts.

Use this dashboard to:

• Identify compromised devices and monitor suspicious activity.
• Determine which users are exporting data from your domain.
• Track government-backed attacks.
• Monitor security and privacy issues affecting your organization's Google Workspace services.