Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-integration-google-workspace

Google Workspace

You can integrate Google Workspace with Sophos XDR so that it sends alerts to Sophos for analysis.

This page gives you an overview of the integration.

Google Workspace product overview

Google Workspace is a comprehensive suite of cloud-based productivity and collaboration tools designed to empower businesses and individuals. It facilitates seamless collaboration and efficient work management through a range of applications, including Gmail, Google Drive, Google Docs, Google Sheets, Google Slides, and more. Google Workspace enables users to access their work anytime, anywhere, fostering a flexible and collaborative work environment while ensuring data security and integrity through advanced security features and compliance standards.

What we ingest

Sample alerts seen by Sophos:

  • User-reported phishing
  • Gmail potential employee spoofing
  • Malware reclassification
  • Suspicious logins
  • Suspicious programmatic logins

Filtering

We filter the results to remove irrelevant alert types, including the following:

  • Certificate expiry
  • Status updates (for example, outages)
  • Account configuration issues
  • Google Service Announcements (MSAs)
  • Report logging

Data provided by this integration

Data provided by Google Workspace gets normalized to the following schemas:

  • auth
  • cloudaudit
  • http
  • thirdpartyalert

For more information about using schemas in Data Lake Search, see Schemas and logical types.

Vendor documentation