Google Workspace integration
You can integrate Google Workspace with Sophos Central so that it sends alerts to Sophos for analysis.
This page gives you an overview of the integration.
Google Workspace product overview
Google Workspace is a comprehensive suite of cloud-based productivity and collaboration tools designed to empower businesses and individuals. It facilitates seamless collaboration and efficient work management through a range of applications, including Gmail, Google Drive, Google Docs, Google Sheets, Google Slides, and more. Google Workspace enables users to access their work anytime, anywhere, fostering a flexible and collaborative work environment while ensuring data security and integrity through advanced security features and compliance standards.
Sophos documents
What we ingest
Sample alerts seen by Sophos:
- User reported phishing
- Gmail potential employee spoofing
- Malware reclassification
- Suspicious logins
- Suspicious programmatic logins
Filtering
We filter the results to remove irrelevant alert types including the following:
- Certificate expiry
- Status updates (for example, outages)
- Account configuration issues
- Google Service Announcements (MSAs)
- Report logging
Sample threat mappings
The alert type is defined by the field "type" - ("value": "{{fields.type}}",)
Here are examples mapped to MITRE ATT&CK.
{"alertType": "Leaked password", "threatId": "T1078", "threatName": "Valid Accounts"}
{"alertType": "User granted Admin privilege", "threatId": "TA0004", "threatName": "Privilege Escalation"}
{"alertType": "Device compromised", "threatId": "TA0001", "threatName": "Initial Access"}