Google Workspace / G-Suite Logs Integration with Wazuh

[Khul Sat]

Greetings!

Would like to know if there are any ways to integrate G-Suite logs with Wazuh.

Thanks,KS

[Md. Nazmur Sakib]

Hi Khul Sat,

Hope you are doing well. Thank you for using Wazuh.

Currently we do not have a direct integration with Gsuite or rules and decoders for these logs.

A workaround can be, you could route the audit logs for Google Workspace to Google Cloud following the following guide:

https://cloud.google.com/logging/docs/audit/configure-gsuite-audit-logs

and then use Wazuh to monitor GCP services: https://documentation.wazuh.com/current/gcp/index.html
Once you have everything configured, you would have to create your own rules and decoders. You have a guide on how to do it in our documentation: https://documentation.wazuh.com/current/user-manual/ruleset/custom.html

As you can see, this process is time consuming, so it has been decided to add Google Suite integration to Wazuh out of the box. Also, here's an issue in our repository where you can track the progress of this new feature and some implementations that different users have made.

I hope you find this information helpful. 

Regards

Md. Nazmur Sakib

[Khul Sat]

Thank you Md. Nazmur Sakib for your reply!

We are only using Google Workspace service. We are not on GCP. Our Wazuh is sitting at AWS and hence we wanted to have G-Suite logs forwarded to AWS.

Any thoughts on this pls?

Regards,KS

[Md. Nazmur Sakib]

Hi Khul Sat,

Sorry for the late response.

We do not have a direct integration with GSuite or rules and decoders for these logs. We have an issue in our roadmap to incorporate it: https://github.com/wazuh/wazuh/issues/10776

In this issue, you can track the progress of this new feature.

I hope you find this information helpful.

Regards

Md. Nazmur Sakib

[Khul Sat]

Thank you for the update!

[Ray Espinoza]

Anyone figure out how to get logs that go to the org level to the project level? I can see the logs in the log explorer at the organization but they aren't visible in the project I created. Also, is it better to send the events to a bucket?

Thanks

Ray

[Moshe Shvo]

joining this question - any news regarding this question?