Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions docs/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,7 @@ If you use our provided Terraform modules, specific instructions that you can pa
| Google Chat | [data](https://github.com/Worklytics/psoxy/tree/main/docs/sources/google-workspace/google-chat/example-api-responses) - [rules](https://github.com/Worklytics/psoxy/tree/main/docs/sources/google-workspace/google-chat/google-chat.yaml) | `admin.reports.audit.readonly` |
| Google Directory | [data](https://github.com/Worklytics/psoxy/tree/main/docs/sources/google-workspace/directory/example-api-responses) - [rules](https://github.com/Worklytics/psoxy/tree/main/docs/sources/google-workspace/directory/directory.yaml) | `admin.directory.user.readonly admin.directory.domain.readonly admin.directory.group.readonly admin.directory.orgunit.readonly` |
| Google Drive | [data](https://github.com/Worklytics/psoxy/tree/main/docs/sources/google-workspace/gdrive/example-api-responses) - [rules](https://github.com/Worklytics/psoxy/tree/main/docs/sources/google-workspace/gdrive/gdrive.yaml) | `drive.readonly` |
| Google Drive Audit Log (**beta**) | [data](https://github.com/Worklytics/psoxy/tree/main/docs/sources/google-workspace/gdrive-log/example-api-responses) - [rules](https://github.com/Worklytics/psoxy/tree/main/docs/sources/google-workspace/gdrive-log/gdrive-log.yaml) | `admin.reports.audit.readonly` |
| GMail | [data](https://github.com/Worklytics/psoxy/tree/main/docs/sources/google-workspace/gmail/example-api-responses) - [rules](https://github.com/Worklytics/psoxy/tree/main/docs/sources/google-workspace/gmail/gmail.yaml) | `gmail.metadata` |
| Google Meet | [data](https://github.com/Worklytics/psoxy/tree/main/docs/sources/google-workspace/meet/example-api-responses) - [rules](https://github.com/Worklytics/psoxy/tree/main/docs/sources/google-workspace/meet/meet.yaml) | `admin.reports.audit.readonly` |
| Gemini Bulk (**deprecated**) | [docs](https://github.com/Worklytics/psoxy/tree/main/docs/sources/google-workspace/gemini-usage-bulk) | n/a; bulk export of Gemini logs |
Expand Down
1 change: 1 addition & 0 deletions docs/SUMMARY.md
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,7 @@
* [Google Chat](sources/google-workspace/google-chat/README.md)
* [Google Directory](sources/google-workspace/directory/README.md)
* [Google Drive](sources/google-workspace/gdrive/README.md)
* [Google Drive Audit Log](sources/google-workspace/gdrive-log/README.md)
* [Google Meet](sources/google-workspace/meet/README.md)
* [Gmail](sources/google-workspace/gmail/README.md)
* [Gemini in Workspace Apps](sources/google-workspace/gemini-in-workspace-apps/README.md)
Expand Down
1 change: 1 addition & 0 deletions docs/sources/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ To add a source, add its Connector ID to the `enabled_connectors` list in your `
| `gcal` | [Google Calendar](google-workspace/calendar/README.md) | API | GA |
| `gdirectory` | [Google Directory](google-workspace/directory/README.md) | API | GA |
| `gdrive` | [Google Drive](google-workspace/gdrive/README.md) | API | GA |

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

DEPRECATED

| `gdrive-log` | [Google Drive Audit Log](google-workspace/gdrive-log/README.md) | API | BETA |
| `gemini-in-workspace-apps` | [Google Gemini in Workspace Apps](google-workspace/gemini-in-workspace-apps/README.md) | API | BETA |
| `gemini-usage` | [Gemini Usage](google-workspace/gemini-usage-bulk/README.md) | Bulk | DEPRECATED |
| `github` | [GitHub Enterprise](github/github/README.md) | API | GA |
Expand Down
1 change: 1 addition & 0 deletions docs/sources/gdrive-log
4 changes: 3 additions & 1 deletion docs/sources/google-workspace/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ Within those, the `google-workspace.tf` and `google-workspace-variables.tf` file
- [calendar](calendar/README.md) (Google Calendar™)
- [directory](directory/README.md) (Google Workspace™ Directory)
- [gdrive](gdrive/README.md) (Google Drive™)
- [gdrive-log](gdrive-log/README.md) (Google Drive™ Audit Log)
- [gemini-in-workspace-apps](gemini-in-workspace-apps/README.md)
- [gemini-usage-bulk](gemini-usage-bulk/README.md)
- [gmail](gmail/README.md) (Gmail™)
Expand All @@ -30,6 +31,7 @@ Each connector page includes the full comma-separated OAuth scope string to past
| [google-chat](google-chat/README.md) | `google-chat` | `admin.googleapis.com` | `admin.reports.audit.readonly` |
| [directory](directory/README.md) | `gdirectory` | `admin.googleapis.com` | `admin.directory.user.readonly` `admin.directory.domain.readonly` `admin.directory.group.readonly` `admin.directory.orgunit.readonly` |
| [gdrive](gdrive/README.md) | `gdrive` | `drive.googleapis.com` | `drive.readonly` (v0.7.0+; see [gdrive README](gdrive/README.md#scope-change-in-v070-action-required)) |
| [gdrive-log](gdrive-log/README.md) | `gdrive-log` | `admin.googleapis.com` | `admin.reports.audit.readonly` |
| [gmail](gmail/README.md) | `gmail` | `gmail.googleapis.com` | `gmail.metadata` |
| [meet](meet/README.md) | `google-meet` | `admin.googleapis.com` | `admin.reports.audit.readonly` |
| [gemini-in-workspace-apps](gemini-in-workspace-apps/README.md) | `gemini-in-workspace-apps` | `admin.googleapis.com` | `admin.reports.audit.readonly` |
Expand Down Expand Up @@ -88,7 +90,7 @@ Assign the account a sufficiently privileged role. At minimum, the role must gra
| **Groups** → Read | Yes | Directory group membership |
| **Organizational Units** → Read | Optional | Org-unit segmentation |
| **Domain Management** | Optional | List of internal domains |
| **Reports** | Only if using [Google Chat](google-chat/README.md), [Google Meet](meet/README.md), or other audit-log connectors | Audit / usage reports |
| **Reports** | Only if using [Google Chat](google-chat/README.md), [Google Meet](meet/README.md), [Google Drive Audit Log](gdrive-log/README.md), or other audit-log connectors | Audit / usage reports |

All of the above are found under **Admin settings privileges** in the Custom Role editor. Google reorganized administrator privileges in 2025; expand each category and enable only the **Read** sub-action where available. See Google's [privilege definitions](https://knowledge.workspace.google.com/admin/users/administrator-privilege-definitions) for the full list.

Expand Down
48 changes: 48 additions & 0 deletions docs/sources/google-workspace/gdrive-log/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,48 @@
# Google Drive Audit Log

**Connector ID:** `gdrive-log`

**Availability:** Beta

Please review the [Google Workspace™ README](../README.md) for general information applicable to
all Google Workspace connectors.
Comment on lines +7 to +8

This connector pulls Drive events from the Google Workspace audit log (Reports API), rather than the Drive files API used by the [`gdrive`](../gdrive/README.md) connector.

## Caveats

Relative to [`gdrive`](../gdrive/README.md), this source includes additional activity types that the Drive files API does not expose as an event stream — for example views, comments, downloads, and previews, in addition to creates, edits, and sharing changes.

The tradeoff is lookback. Google retains Drive audit-log events for about **6 months** (180 days). Older activity is not available from the Reports API, even if the files themselves still exist. Historical collaboration that predates that window is better covered by the files API connector.

Activity records can include the actor's client IP, which is often a residential address. Those values are hashed with the `hashIp` transform (emitted as `t~...` tokens), not passed through in the clear.

See Google's [Drive activity report](https://developers.google.com/workspace/admin/reports/v1/guides/manage-audit-drive) and [data retention](https://support.google.com/a/answer/7061566) documentation.

## Required OAuth Scopes

- `admin.reports.audit.readonly`

For Domain-wide Delegation in the Google Workspace Admin console, paste the following comma-separated list into the **Scopes** field:

```
https://www.googleapis.com/auth/admin.reports.audit.readonly
```

## Required GCP APIs

Enable the following API in the GCP project where you provision the OAuth client:

- `admin.googleapis.com` (Admin SDK API)

## Examples

- [Example Rules](gdrive-log.yaml)
- Example Data:
- [original/drive-activities.json](example-api-responses/original/drive-activities.json) |
[sanitized/drive-activities.json](example-api-responses/sanitized/drive-activities.json)


---
Google Workspace™ and related marks are trademarks of Google LLC.
Worklytics™ is a trademark of Worklytics, Corp.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Worklytics, Co.

Loading
Loading