Following the Trail of Threat Actors in Google Workspace Audit Logs

When approaching incident response in an environment you may not be very familiar with, the biggest challenge is often knowing what to look for. This is especially true when you’re facing dozens of data sources with hundreds of event types. As an incident responder, it’s your job to determine what is legitimate and what is not among a sea of activity, which is easier said than done. This blog post and its accompanying cheat sheet provide guidance on some key …

audit challenge data data sources environment event facing google google workspace incident incident responder incident response job logs may responder response threat threat actors types workspace