KQL Search

This query is designed to monitor and detect when a super admin initiates a domain-wide data takeout in Google Workspace. This action involves exporting all users' data and is considered high-risk, as it can indicate potential account takeover or insider data exfiltration.

Here's a simplified breakdown of the query:

• Purpose: To identify and alert on domain-wide data takeout actions initiated by a super admin, which could be a sign of malicious activity.
• Severity: High, due to the potential for significant data exposure.
• Data Source: The query uses data from Google Workspace alerts, specifically looking at logs related to domain-wide takeouts.
• Frequency: The query runs every 10 minutes and looks back over the past hour for any relevant activity.
• Trigger: An alert is triggered if any such activity is detected (i.e., more than 0 occurrences).
• Tactics and Techniques: It is associated with the "Exfiltration" tactic and techniques T1567 (Data Transfer to Cloud Account) and T1530 (Data from Cloud Storage Object).
• Query Logic: It filters for alerts related to domain-wide takeouts, extracts relevant information such as the initiator's email, and projects key details like the time of the alert, alert ID, severity, and a link to the security investigation tool.
• Entity Mapping: It maps the initiator's email to an account entity and the investigation tool link to a URL entity.
• Incident Creation: If such an event is detected, an incident is automatically created for further investigation.

Overall, this query helps security teams quickly identify and respond to potentially unauthorized or suspicious data export activities within a Google Workspace environment.