[google_workspace] - Updated google drive event schema and mappings to incorporate missing fields and avoid conflicts

[ShourieG]

Type of change

• Bug

Proposed commit message

WHAT: Updated google drive event schema and mappings to incorporate missing fields and avoid conflicts.
WHY: It seems that there are some drive events that contain certain fields which were unmapped. The fields in question are as follows: -

 1. actor_is_collaborator_account 2. is_encrypted 3. owner_is_team_drive 4. target_user 5. target

as defined here. The only exception is the field owner_is_team_drive, which seems to be present in certain events but does not have an explicit definition anywhere. This also creates a scenario where for certain logs the target_user and target are both present in the source event, where they have different meanings and are not the same, hence target has to be mapped conditionally on our end.

Sample Log:

{ "actor": { "email": "[john.doe@example.com](mailto:john.doe@example.com)", "profileId": "987654" }, "etag": "-xyz1234567890/abcdefg", "events": { "name": "email_as_attachment", "parameters": [ { "name": "target", "value": "[jane.smith@example.org](mailto:jane.smith@example.org)" }, { "name": "target_user", "value": "[manager@example.com](mailto:manager@example.com)" }, { "boolValue": true, "name": "primary_event" }, { "boolValue": true, "name": "billable" }, { "boolValue": false, "name": "owner_is_shared_drive" }, { "name": "owner", "value": "[admin@example.co](mailto:admin@example.co)" }, { "name": "doc_id", "value": "doc123-456" }, { "name": "doc_type", "value": "spreadsheet" }, { "boolValue": false, "name": "is_encrypted" }, { "name": "doc_title", "value": "Quarterly Report" }, { "name": "visibility", "value": "shared_externally" }, { "boolValue": false, "name": "actor_is_collaborator_account" }, { "boolValue": false, "name": "owner_is_team_drive" } ], "type": "access" }, "id": { "applicationName": "drive", "customerId": "customer12345", "time": "2024-07-29T12:34:56.789Z", "uniqueQualifier": "4567890" }, "kind": "admin#reports#activity" }

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• [ ]

How to test this PR locally

Related issues

Screenshots

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[ShourieG]

/test

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 74671d5

History

• 💔 Build #14084 failed cd43c1d

cc @ShourieG

[elastic-sonarqube]

Quality Gate failed

Failed conditions
78.3% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube

[kcreddy]

Minor clarification. LGTM

[elasticmachine]

Package google_workspace - 2.24.0 containing this change is available at https://epr.elastic.co/search?package=google_workspace