Google Workspace incident response
After understanding the basics of an incident as we have discussed in the Initial scoping and response section, incident responders using Google Workspace face the challenge of identifying compromises and starting threat hunting. Google Workspace, unlike Microsoft 365, offers fewer tools for this purpose, focusing mainly on its audit and reporting features. These tools, while not as extensive, are crucial for collecting logs and spotting unusual activities. This means responders often need to supplement these tools with external resources and more hands-on analysis to effectively track and investigate potential security breaches in Google Workspace environments.
Tooling
In a similar vein to our discussion on Microsoft 365, let’s explore how incident responders can leverage audit logs in Google Workspace to investigate and understand the extent of compromises:
- Accessing the audit logs: In Google Workspace, the audit logs are accessible...
