Google Workspace

Google Workspace

The Dropzone AI platform integrates with Google Workspace APIs for ingesting alerts such as phishing reports and enriching investigations with data from Google Workspace such as directory information. This document describes how to set up API credentials and install them into the Dropzone platform.

Integration Overview

To enable these integrations you will perform the following actions:

• Enable domain-wide delegation in Google Workspace

• Create a Google Workspace admin role

• Select integration parameters, such as which alert types to sync

The Dropzone platform has a dedicated service account for your organization. This service account uses domain-wide delegation to gain access to specific API scopes within your organization.

Enable Domain-Wide Delegation

To grant access to the Google service account used by your Dropzone platform, do the following:

• Navigate to your Dropzone AI tenant home page e.g. https://mycompany.dropzone.app

• In the bottom left hand corner, navigate to Settings > Integrations

• Click "Available"

• In the Search bar, search Google Workspace, then click "Configure"

• Record the "CLIENT ID" field which will be used in the Google Admin interface

Next, enable the Dropzone AI application domain-wide delegation access to your Google Workspace environment.

As a full Google Workspace admin, do the following:

• Navigate to your admin workspace

• In the sidebar, navigate to Security > Access and Data Control > API Controls

• At the bottom, click Manage Domain Wide Delegation

• Click "Add New" API Client

• Enter the Client ID in the pop up

  • This is the ~21 digit number you recorded from the Dropzone UI earlier

• Grant access to the following scopes by copy/pasting them into the "OAuth Scopes" line one-by-one

  • https://www.googleapis.com/auth/apps.alerts

  • https://www.googleapis.com/auth/gmail.readonly

  • https://www.googleapis.com/auth/drive.readonly

    • Required when enabling the optional Google Drive Query feature

  • https://www.googleapis.com/auth/admin.directory.user.readonly

  • https://www.googleapis.com/auth/admin.reports.audit.readonly

  • https://www.googleapis.com/auth/admin.reports.usage.readonly

  • https://www.googleapis.com/auth/admin.directory.group.readonly

• Click "Authorize" to finish

Choose or Create a Google Workspace Admin Account

Dropzone uses the Google Workspace Admin API to find information from your environment using a user within your org that has an Admin Role with necessary privileges.

Note that Dropzone may request more permissions in the future as we add features.

To create and associate the new role, do the following:

• Go to Account > Admin Roles > Create New Role

• Name the role something memorable, such as "Dropzone AI Role." Input a description, such as "Dropzone AI integrations," then click "Continue"

• You'll now be on the "Select Privileges" page

• On this page enable the following:

  • Admin console privileges

    • Organizational Units > Read

    • Users > Read

    • Google Vault > Manage Audits

    • Gmail > Email log search

    • Gmail > Access Admin Quarantine

    • Gmail > Access Restricted Quarantines

    • Security Center > "This user has full ..." > Audit and Investigation > View

    • Security Center > "This user has full ..." > Audit and Investigation > View sensitive content

    • Security Center > Activity Rules > View

    • Security Center > Activity Rules > Manage

    • Alert Center > Full access

    • DLP > View DLP rule

    • DLP > Manage DLP rule

    • Reports

  • Admin API privileges

    • Organizational Units > Read

    • Users > Read

    • Groups > Read

    • Reports

• Once done, click "Continue"

• Assign the new role to a Google Workspace user:

  • Go to https://admin.google.com

  • In the sidebar, navigate to Account > Admin Roles

  • Hover over the role you created and click "Assign Admin"

• Click "Assign Members" to add the role to the user you want for the Dropzone integration

  • Pick an existing admin or an account you created specifically for the Dropzone integration

Enable Google Workspace

The Data source integration allows Dropzone AI to interact with Google Workspace to gather information for use in investigation analysis and interactive chat.

To enable the Data source integration, you'll need the following information:

The Customer ID can be found can be found at admin.google.com > Account > Account Settings (https://admin.google.com/ac/accountsettings) or in the output of gam info domain. It's typically a ~9 character string starting with C.

To enable the Data Source integration, do the following:

• Navigate to your Dropzone AI tenant home page e.g. https://mycompany.dropzone.app

• In the bottom left hand corner, navigate to Settings > Integrations

• Click "Available"

• In the Search bar, search Google Workspace, then click "Configure"

• Under the Data Source heading, input the "Admin Email" and "Customer ID"

  • Click "Google Drive Query Enabled" to provide Drive investigation support

• Click "Test & Save" to finish

If you have any errors engage your Dropzone AI support representative.

Enable the Remediator Integration

The Remediator integration allows Dropzone to initiate Containment Actions during investigations. See the GCP Remediator documentation for more information.