Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[New hunt] Sensitive file access by user in Google Workspace #4123

Closed
brokensound77 opened this issue Oct 2, 2024 · 1 comment
Closed

[New hunt] Sensitive file access by user in Google Workspace #4123

brokensound77 opened this issue Oct 2, 2024 · 1 comment

Comments

@brokensound77
Copy link
Contributor

Description

Explore all sensitive files accessed by users, based on defined parameters

Target Huntset

google_workspace

Target hunt Type

ES|QL

Query

from logs-google_workspace* 
| where file.name == "*" or file.name is not null and event.action in ("view", "download") and 
  (
    //expand to known patterns
    to_lower(file.name) like "*password*" or
    to_lower(file.name) like "*sensitive*" or
    to_lower(file.name) like "*cred*" or
    to_lower(file.name) like "*private*" or
    to_lower(file.name) like "*secret*"
  )
| stats files=count(*) by file.name, user.email, event.action

Related issues or PRs

#4121

References

No response

Redacted Example Data

No response

@brokensound77
Copy link
Contributor Author

unintentional duplicate

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant