Skip to content

Commit 81ec723

Browse files
moxarth-rathodmoxarth-rathod
committed
[Google Workspace] Update mappings for recent admin log event changes
1 parent 6c676bc commit 81ec723

File tree

7 files changed

+596
-3
lines changed

7 files changed

+596
-3
lines changed

‎packages/google_workspace/changelog.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,12 @@
11
# newer versions go on top
2+
- version: "2.48.0"
3+
changes:
4+
- description: >-
5+
Add support for `setting.metadata.*` fields.
6+
Move `user_defined_setting.name` under `setting.metadata` as per the schema changes.
7+
Add ECS categorization support for event name changes for the admin data stream.
8+
type: enhancement
9+
link: https://github.com/elastic/integrations/pull/1
210
- version: "2.47.2"
311
changes:
412
- description: Discard events that are missing the `items[]` field during the split operation and are returned as the root object.

‎packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-updated.log‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{"kind": "admin#reports#activity", "id": {"time": "2025-11-14T12:37:29.480Z", "uniqueQualifier": "-7581660077956046741", "applicationName": "admin", "customerId": "C03puekhd"}, "etag": "'-32B5c-szzq9P80azZLmOKjSXpE6qfu_OL8y_VCsE1U/iGs6DCSL-U-KDZqLqnWajp5rxPs'", "actor": {"callerType": "USER", "email": "user@email.io", "profileId": "113316239944706535444"}, "ipAddress": "175.16.199.0", "networkInfo": {"ipAsn": [55256], "regionCode": "IN", "subdivisionCode": "IN-MH"}, "events": {"type": "APPLICATION_SETTINGS", "name": "CREATE_APPLICATION_SETTING", "parameters": [{"name": "APPLICATION_NAME", "value": "Gmail"}, {"name": "ORG_UNIT_NAME", "value": "email.io"}, {"name": "SETTING_NAME", "value": "ContentCompliance rules[7] content_compliance_info"}, {"name": "NEW_VALUE", "value": "REDACTED"}, {"name": "APPLICATION_EDITION", "value": "business_starter_2021"}, {"name": "SETTING_METADATA", "messageValue": {"parameter": [{"name": "rule_key", "value": "e92d7-02gajno12i4pluu:00gjdgxs1pxezwc"}, {"name": "DESCRIPTION", "value": "demo"}]}}]}}
2+
{"kind": "admin#reports#activity", "id": {"time": "2025-11-14T12:37:29.480Z", "uniqueQualifier": "-7581660077956046741", "applicationName": "admin", "customerId": "C03puekhd"}, "etag": "'-32B5c-szzq9P80azZLmOKjSXpE6qfu_OL8y_VCsE1U/iGs6DCSL-U-KDZqLqnWajp5rxPs'", "actor": {"callerType": "USER", "email": "user@email.io", "profileId": "113316239944706535444"}, "ipAddress": "175.16.199.0", "networkInfo": {"ipAsn": [55256], "regionCode": "IN", "subdivisionCode": "IN-MH"}, "events": {"type": "APPLICATION_SETTINGS", "name": "CREATE_APPLICATION_SETTING", "parameters": [{"name": "APPLICATION_NAME", "value": "Gmail"}, {"name": "ORG_UNIT_NAME", "value": "email.io"}, {"name": "SETTING_NAME", "value": "RuleState rule_state[14] enabled"}, {"name": "NEW_VALUE", "value": "true"}, {"name": "APPLICATION_EDITION", "value": "business_starter_2021"}, {"name": "SETTING_METADATA", "messageValue": {"parameter": [{"name": "rule_key", "value": "e92d7-02gajno12i4pluu:00gjdgxs1pxezwc"}, {"name": "rule_type", "value": "CONTENT_COMPLIANCE"}]}}]}}
3+
{"kind": "admin#reports#activity", "id": {"time": "2025-10-06T09:00:40.802Z", "uniqueQualifier": "-5906342141811925274", "applicationName": "admin", "customerId": "C03puekhd"}, "etag": "'-32B5c-szzq9P80azZLmOKjSXpE6qfu_OL8y_VCsE1U/yXd2XXgjpFDy4ZsCImw693Egd_U'", "actor": {"callerType": "USER", "email": "user@email.io", "profileId": "113316239944706535444"}, "ipAddress": "175.16.199.0", "networkInfo": {"ipAsn": [55256], "regionCode": "IN", "subdivisionCode": "IN-MH"}, "events": {"type": "APPLICATION_SETTINGS", "name": "CHANGE_APPLICATION_SETTING", "parameters": [{"name": "APPLICATION_NAME", "value": "Drive and Docs"}, {"name": "ORG_UNIT_NAME", "value": "email.io"}, {"name": "SETTING_NAME", "value": "ExternalSharing external_sharing_mode"}, {"name": "OLD_VALUE", "value": "ALLOWED"}, {"name": "NEW_VALUE", "value": "ALLOWLISTED_DOMAINS"}]}}
4+
{"kind": "admin#reports#activity", "id": {"time": "2025-10-06T09:00:40.802Z", "uniqueQualifier": "-5906342141811925274", "applicationName": "admin", "customerId": "C03puekhd"}, "etag": "'-32B5c-szzq9P80azZLmOKjSXpE6qfu_OL8y_VCsE1U/yXd2XXgjpFDy4ZsCImw693Egd_U'", "actor": {"callerType": "USER", "email": "user@email.io", "profileId": "113316239944706535444"}, "ipAddress": "175.16.199.0", "networkInfo": {"ipAsn": [55256], "regionCode": "IN", "subdivisionCode": "IN-MH"}, "events": {"type": "APPLICATION_SETTINGS", "name": "CHANGE_APPLICATION_SETTING", "parameters": [{"name": "APPLICATION_NAME", "value": "Drive and Docs"}, {"name": "ORG_UNIT_NAME", "value": "email.io"}, {"name": "SETTING_NAME", "value": "ExternalSharing external_sharing_mode"}, {"name": "OLD_VALUE", "value": "ALLOWED"}, {"name": "NEW_VALUE", "value": "ALLOWLISTED_DOMAINS"}, {"name": "APPLICATION_EDITION", "value": "business_starter_2021"}]}}
5+
{"kind": "admin#reports#activity", "id": {"time": "2025-11-14T12:37:29.480Z", "uniqueQualifier": "-7581660077956046741", "applicationName": "admin", "customerId": "C03puekhd"}, "etag": "'-32B5c-szzq9P80azZLmOKjSXpE6qfu_OL8y_VCsE1U/iGs6DCSL-U-KDZqLqnWajp5rxPs'", "actor": {"callerType": "USER", "email": "user@email.io", "profileId": "113316239944706535444"}, "ipAddress": "175.16.199.0", "networkInfo": {"ipAsn": [55256], "regionCode": "IN", "subdivisionCode": "IN-MH"}, "events": {"type": "APPLICATION_SETTINGS", "name": "CREATE_APPLICATION_SETTING", "parameters": [{"name": "APPLICATION_NAME", "value": "Gmail"}, {"name": "ORG_UNIT_NAME", "value": "email.io"}, {"name": "SETTING_NAME", "value": "ContentCompliance rules[7] content_compliance_info"}, {"name": "NEW_VALUE", "value": "REDACTED"}, {"name": "APPLICATION_EDITION", "value": "business_starter_2021"}, {"name": "SETTING_METADATA", "messageValue": {"parameter": [{"name": "rule_key", "value": "e92d7-02gajno12i4pluu:00gjdgxs1pxezwc"}, {"name": "DESCRIPTION", "value": "demo"}]}}]}}
6+
{"kind": "admin#reports#activity", "id": {"time": "2025-11-14T12:37:29.480Z", "uniqueQualifier": "-7581660077956046741", "applicationName": "admin", "customerId": "C03puekhd"}, "etag": "'-32B5c-szzq9P80azZLmOKjSXpE6qfu_OL8y_VCsE1U/iGs6DCSL-U-KDZqLqnWajp5rxPs'", "actor": {"callerType": "USER", "email": "user@email.io", "profileId": "113316239944706535444"}, "ipAddress": "175.16.199.0", "networkInfo": {"ipAsn": [55256], "regionCode": "IN", "subdivisionCode": "IN-MH"}, "events": {"type": "APPLICATION_SETTINGS", "name": "CREATE_APPLICATION_SETTING", "parameters": [{"name": "APPLICATION_NAME", "value": "Gmail"}, {"name": "ORG_UNIT_NAME", "value": "email.io"}, {"name": "SETTING_NAME", "value": "RuleState rule_state[14] enabled"}, {"name": "NEW_VALUE", "value": "true"}, {"name": "APPLICATION_EDITION", "value": "business_starter_2021"}, {"name": "SETTING_METADATA", "messageValue": {"parameter": [{"name": "rule_key", "value": "e92d7-02gajno12i4pluu:00gjdgxs1pxezwc"}, {"name": "rule_type", "value": "CONTENT_COMPLIANCE"}]}}]}}

0 commit comments

Comments
 (0)