Skip to content

Commit

Permalink
Merge pull request #1396 from SEKOIA-IO/update-intake-documentation
Browse files Browse the repository at this point in the history
Refresh intakes documentation
  • Loading branch information
squioc authored Oct 23, 2023
2 parents 6419dda + 3c4b798 commit 8f8ee09
Show file tree
Hide file tree
Showing 112 changed files with 35,257 additions and 35,136 deletions.

Large diffs are not rendered by default.

Large diffs are not rendered by default.

Large diffs are not rendered by default.

Large diffs are not rendered by default.

Original file line number Diff line number Diff line change
Expand Up @@ -35,20 +35,22 @@ Find below few samples of events and how they are normalized by Sekoia.io.
{
"message": "{\"kind\":\"audit#activity\",\"id\":{\"time\":\"2014-03-17T15:39:18.460Z\",\"uniqQualifier\":\"reports unique ID\",\"applicationName\":\"drive\",\"customerId\":\"ABC123xyz\"},\"actor\":{\"callerType\":\"USER\",\"email\":\"[email protected]\",\"profileId\":\"users unique Google Workspace profile ID\",\"key\":\"consumer key of requestor in an OAuth 2LO request\"},\"ownerDomain\":\"domain of the source owner\",\"ipAddress\":\"1.2.3.4\",\"events\":[{\"type\":\"access\",\"name\":\"edit\",\"parameters\":[{\"name\":\"primary_event\",\"boolValue\":true},{\"name\":\"billable\",\"boolValue\":true},{\"name\":\"owner_is_shared_drive\",\"boolValue\":true},{\"name\":\"owner_team_drive_id\",\"value\":\"AAAAAALLLLLL\"},{\"name\":\"owner\",\"value\":\"RH \"},{\"name\":\"doc_id\",\"value\":\"5555763535\"},{\"name\":\"doc_type\",\"value\":\"folder\"},{\"name\":\"is_encrypted\",\"boolValue\":false},{\"name\":\"doc_title\",\"value\":\"Divers\"},{\"name\":\"visibility\",\"value\":\"shared_internally\"},{\"name\":\"shared_drive_id\",\"value\":\"112-EIUBHDIUBEBUD\"},{\"name\":\"originating_app_id\",\"value\":\"691301496089\"},{\"name\":\"actor_is_collaborator_account\",\"boolValue\":false},{\"name\":\"owner_is_team_drive\",\"boolValue\":true},{\"name\":\"team_drive_id\",\"value\":\"111-EIUBHDIUBEBUD\"}]}]}",
"event": {
"kind": "event",
"action": "edit",
"category": [
"file"
],
"dataset": "audit#activity",
"kind": "event",
"type": [
"change"
],
"action": "edit",
"dataset": "audit#activity"
]
},
"@timestamp": "2014-03-17T15:39:18.460000Z",
"user": {
"id": "ABC123xyz",
"email": "[email protected]"
"file": {
"gid": "AAAAAALLLLLL",
"name": "Divers",
"owner": "RH ",
"type": "folder"
},
"google": {
"report": {
Expand All @@ -63,23 +65,21 @@ Find below few samples of events and how they are normalized by Sekoia.io.
"network": {
"application": "drive"
},
"source": {
"ip": "1.2.3.4",
"address": "1.2.3.4"
},
"file": {
"gid": "AAAAAALLLLLL",
"owner": "RH ",
"type": "folder",
"name": "Divers"
},
"related": {
"user": [
"RH "
],
"ip": [
"1.2.3.4"
],
"user": [
"RH "
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4"
},
"user": {
"email": "[email protected]",
"id": "ABC123xyz"
}
}
Expand All @@ -93,20 +93,21 @@ Find below few samples of events and how they are normalized by Sekoia.io.
{
"message": "{\"kind\":\"audit#activity\",\"id\":{\"time\":\"2014-03-17T15:39:18.460Z\",\"uniqQualifier\":\"reports unique ID\",\"applicationName\":\"drive\",\"customerId\":\"ABC123xyz\"},\"actor\":{\"callerType\":\"USER\",\"email\":\"[email protected]\",\"profileId\":\"users unique Google Workspace profile ID\",\"key\":\"consumer key of requestor in an OAuth 2LO request\"},\"ownerDomain\":\"domain of the source owner\",\"ipAddress\":\"1.2.3.4\",\"events\":[{\"type\":\"access\",\"name\":\"edit\",\"parameters\":[{\"name\":\"primary_event\",\"boolValue\":true},{\"name\":\"owner_is_shared_drive\",\"boolValue\":false},{\"name\":\"doc_id\",\"value\":\"1DWuYM3ot_sAyEQqOz0xWJ9bVMSYzOmRNeBqbgtSwuK8\"},{\"name\":\"doc_title\",\"value\":\"Meeting notes\"},{\"name\":\"doc_type\",\"value\":\"document\"},{\"name\":\"owner\",\"value\":\"[email protected]\"}]}]}",
"event": {
"kind": "event",
"action": "edit",
"category": [
"file"
],
"dataset": "audit#activity",
"kind": "event",
"type": [
"change"
],
"action": "edit",
"dataset": "audit#activity"
]
},
"@timestamp": "2014-03-17T15:39:18.460000Z",
"user": {
"id": "ABC123xyz",
"email": "[email protected]"
"file": {
"name": "Meeting notes",
"owner": "[email protected]",
"type": "document"
},
"google": {
"report": {
Expand All @@ -118,22 +119,21 @@ Find below few samples of events and how they are normalized by Sekoia.io.
"network": {
"application": "drive"
},
"source": {
"ip": "1.2.3.4",
"address": "1.2.3.4"
},
"file": {
"owner": "[email protected]",
"type": "document",
"name": "Meeting notes"
},
"related": {
"user": [
"[email protected]"
],
"ip": [
"1.2.3.4"
],
"user": [
"[email protected]"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4"
},
"user": {
"email": "[email protected]",
"id": "ABC123xyz"
}
}
Expand All @@ -147,19 +147,22 @@ Find below few samples of events and how they are normalized by Sekoia.io.
{
"message": "{\n \"kind\": \"admin#reports#activity\",\n \"id\": {\n \"time\": \"2023-09-04T08:42:51.615Z\",\n \"uniqueQualifier\": \"-2222222222222222222\",\n \"applicationName\": \"drive\",\n \"customerId\": \"111111111\"\n },\n \"actor\": {\n \"email\": \"[email protected]\",\n \"profileId\": \"444444444444444444444\"\n },\n \"ipAddress\": \"1.2.3.4\",\n \"events\": [\n {\n \"type\": \"access\",\n \"name\": \"view\",\n \"parameters\": [\n {\n \"name\": \"primary_event\",\n \"boolValue\": true\n },\n {\n \"name\": \"billable\",\n \"boolValue\": true\n },\n {\n \"name\": \"owner_is_shared_drive\",\n \"boolValue\": true\n },\n {\n \"name\": \"owner_team_drive_id\",\n \"value\": \"DDD_111111111111111\"\n },\n {\n \"name\": \"owner\",\n \"value\": \"J.DOE\"\n },\n {\n \"name\": \"doc_id\",\n \"value\": \"333333333333333333333333333333333\"\n },\n {\n \"name\": \"doc_type\",\n \"value\": \"folder\"\n },\n {\n \"name\": \"is_encrypted\",\n \"boolValue\": false\n },\n {\n \"name\": \"doc_title\",\n \"value\": \"MyDocs\"\n },\n {\n \"name\": \"visibility\",\n \"value\": \"people_within_domain_with_link\"\n },\n {\n \"name\": \"shared_drive_id\",\n \"value\": \"DDD_222222222222222\"\n },\n {\n \"name\": \"originating_app_id\",\n \"value\": \"666666666666\"\n },\n {\n \"name\": \"actor_is_collaborator_account\",\n \"boolValue\": false\n },\n {\n \"name\": \"owner_is_team_drive\",\n \"boolValue\": true\n },\n {\n \"name\": \"team_drive_id\",\n \"value\": \"DDD_888888888888888\"\n }\n ]\n }\n ]\n}\n",
"event": {
"kind": "event",
"action": "view",
"category": [
"file"
],
"dataset": "admin#reports#activity",
"kind": "event",
"type": [
"access"
],
"action": "view",
"dataset": "admin#reports#activity"
]
},
"@timestamp": "2023-09-04T08:42:51.615000Z",
"user": {
"id": "111111111"
"file": {
"gid": "DDD_111111111111111",
"name": "MyDocs",
"owner": "J.DOE",
"type": "folder"
},
"google": {
"report": {
Expand All @@ -174,23 +177,20 @@ Find below few samples of events and how they are normalized by Sekoia.io.
"network": {
"application": "drive"
},
"source": {
"ip": "1.2.3.4",
"address": "1.2.3.4"
},
"file": {
"gid": "DDD_111111111111111",
"owner": "J.DOE",
"type": "folder",
"name": "MyDocs"
},
"related": {
"user": [
"J.DOE"
],
"ip": [
"1.2.3.4"
],
"user": [
"J.DOE"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4"
},
"user": {
"id": "111111111"
}
}
Expand Down
Loading

0 comments on commit 8f8ee09

Please sign in to comment.