search

elastic / detection-rules

https://www.elastic.co/guide/en/security/current/detection-engine-overview.html
Other
1.92k stars 492 forks source link

[New hunt] All files accessed by user in Google Workspace #4121

Open brokensound77 opened 6 days ago

brokensound77 commented 6 days ago

Description

Explore all files accessed via view or download by a user, within google workspace.

Target Huntset

google_workspace

Target hunt Type

ES|QL

Query

from logs-google_workspace*
| where file.name == "*" or file.name is not null and event.action in ("view", "download")
| stats files=count(*) by file.name, user.email
| sort files asc

Could potentially scope further to drive if needed

Related issues or PRs

No response

References

No response

Redacted Example Data

No response