Google Workspace Audit Logs source plugin - Cortex XCOR Documentation

This information is for Palo Alto Networks Telemetry Pipeline, which is a standalone product separate from Palo Alto Networks Cortex XCOR.

The Google Workspace Audit Logs source plugin (name: gsuite-reporter) lets you retrieve data from Google Workspace and ingest it into a telemetry pipeline. This is a pull-based source plugin.

This plugin doesn’t support the use of a descriptive metadata name in the Pipeline Builder interface.

This plugin doesn’t support duplicates of itself within the same pipeline.

Supported telemetry types

The Google Workspace Audit Logs source plugin for Palo Alto Networks Telemetry Pipeline supports these telemetry types:

Logs	Metrics	Traces

Configuration parameters

Use the parameters in this section to configure the Google Workspace Audit Logs source plugin. The Palo Alto Networks Telemetry Pipeline web interface uses the items in the Name column to describe these parameters. Pipeline configuration files use the items in the Key column as YAML keys.

API Key

Name	Key	Description	Default
API Key	`access_token`	Either an API key or a service account file for authentication.	none

Options

Name	Key	Description	Default
Enable Telemetry	`telemetry`	If `true`, enables telemetry through the Google API. Accepted values: `true`, `false`.	`false`
Pull Interval	`pull_interval`	The time between calls to the Google API. Minimum of `1s`.	`30s`
Data Directory	`data_dir`	The storage path to allow resuming data collection.	`/data/storage/gsuite-reporter`
Application Name	`application_name`	The application name you want to get reports from. See ApplicationName.	`admin`
User Key	`user_key`	The user you want to get reports from.	`all`
Memory Buffer Limit	`mem_buf_limit`	Sets a limit for how much buffered data the plugin can write to memory, which affects backpressure. This value must follow Fluent Bit’s rules for unit sizes. If unspecified, no limit is enforced. For v2 pipelines, this parameter affects only pipelines with the Deployment or DaemonSet workload type. To learn more, see the v2 backpressure guide. For v3 pipelines, this parameter is independent from the OpenTelemetry `memory_limiter` and `batch` processors.	none

​Supported telemetry types

​Configuration parameters

​API Key

​Options

Supported telemetry types

Configuration parameters

API Key

Options