Open ebeahan opened 8 months ago
For the login data stream. the [Logs Google Workspace] Login dashboard (source) contains two panels using the same filters:
login
[Logs Google Workspace] Login
Total Successful Login [Logs Google Workspace]
Successful Logins by Compromised Users [Logs Google Workspace]
Filter: data_stream.dataset: "google_workspace.login" AND "event_action: "login_success"
data_stream.dataset: "google_workspace.login" AND "event_action: "login_success"
The Compromised Users panel shows all successful logins and is missing additional filters to limit only to compromised accounts.
Compromised Users
Pinging @elastic/security-external-integrations (Team:Security-External Integrations)
For the
login
data stream. the[Logs Google Workspace] Login
dashboard (source) contains two panels using the same filters:Total Successful Login [Logs Google Workspace]
Successful Logins by Compromised Users [Logs Google Workspace]
Filter:
data_stream.dataset: "google_workspace.login" AND "event_action: "login_success"
The
Compromised Users
panel shows all successful logins and is missing additional filters to limit only to compromised accounts.