--- title: "Google Workspace Reports collector" canonical: "https://docs.devo.com/space/latest/94656117/Google%20Workspace%20Reports%20collector" format: markdown --- > Macro (excerpt-include) > Macro (toc) ## Purpose An analyst wants to detect suspicious activities in [Google Workspace](https://workspace.google.com/). Using the Google Workspace Reports collector to send admin audit logs to Devo, the analyst will find unauthorized changes to user permissions. As a result, the analyst will revoke access to the compromised account, preventing attackers from escalating privileges in the organization. ## Example tables | **Table** | **Description** | | --- | --- | | cloud.gsuite.reports.access_transparency | Activity events from Google Workspace resources accessed by Google | | cloud.gsuite.reports.admin | Administrator console activities | | cloud.gsuite.reports.calendar | Calendar management and modification events | | cloud.gsuite.reports.chat | Google Chat and Spaces usage | | cloud.gsuite.reports.drive | Document management and sharing | | cloud.gsuite.reports.gcp | Google Cloud Platform interactions | | cloud.gsuite.reports.groups | Group management and modifications | | cloud.gsuite.reports.gplus | Google+ activity information | | cloud.gsuite.reports.groups_enterprise | Audit activity from moderator actions | | cloud.gsuite.reports.jamboard | Interactive whiteboard activity | | cloud.gsuite.reports.meet | Hangouts Meet audit activity events | | cloud.gsuite.reports.login | Login activity information | | cloud.gsuite.reports.mobile | Mobile device activities with Work accounts | | cloud.gsuite.reports.saml | SAML login events | | cloud.gsuite.reports.token | Third party website access grants | | cloud.gsuite.reports.rules | Admin console rule performance | | cloud.gsuite.reports.user_account | User account audit activity events | | cloud.gsuite.reports.data_studio | Data Studio activity information | ## Configuration requirements To run this collector, there are some configurations detailed below that you need to consider. | **Configuration** | **Requirements** | | --- | --- | | **User interface** | - Get a graphical user interface. | | **Python** | - Get Phyton 3.6 or greater. | | **Google Account** | - Collect data with administrator privileges. | | **Credentials** | - Get OAuth credentials to authenticate the collector | ### Flattening preprocessing | | | | | | --- | --- | --- | --- | | **Data Source** | **Collector Service** | **Optional** | **Flattening Details** | | all | all | `No` | When `events` is received as an event detail, the flattening is applied as shown:
Received data (an object):
``` { ... 'events' : [ {'type': 'ALERT_CENTER', 'name': 'ALERT_CENTER_VIEW', 'parameters': [...] }, {'type': 'ALERT_CENTER', 'name': 'EXAMPLE_NAME', 'parameters': [...] } ] } ```
Flattened message 1:
``` { ... 'event_type': 'ALERT_CENTER', 'event_name': 'ALERT_CENTER_VIEW', 'event_parameters': [...] } ```
Flattened message 2:
``` { ... 'event_type': 'ALERT_CENTER', 'event_name': 'EXAMPLE_NAME', 'event_parameters': [...] } ```
For each event a flattened message is generated. | ## Authorize it 1. Login to **Google APIs** console. 2. Create a **Project** or select an existing one (search for "Create a Project" if needed). 3. Enable the **Admin SDK API** by searching for "Admin SDK API" and clicking **"Enable"**. 4. Activate the **OAuth Consent Screen** by searching for "Credentials" and clicking on **"Credentials (APIs & Services)"**. 5. Click on the **"OAuth Consent Screen"** tab in the left menu. 6. Select "Internal" for User Type and click **"Create"**. 7. Fill in the required fields and click **"Save and continue"**. Skip the Scopes section by clicking **"Save and continue"**. 8. Create OAuth credentials by going to the **"Credentials"** tab. 9. Click **"+ Create credentials"** and select** "OAuth client ID"**. 10. Select "Desktop app" as the Application type. 11. Enter a name like "Google Workspace Reports Collector" and click **"Create"**. 12. **Download the JSON** file when prompted. 13. Rename the downloaded file to `credentials.json`. 14. Using a Python environment, install required packages: ``` pip install --upgrade google-api-python-client google-auth-httplib2 google-auth-oauthlib ``` 15. Run the `quickstart.py` script in the same directory as the `credentials.json` file to generate the `token.json` file: ``` from __future__ import print_function import os.path from google.auth.transport.requests import Request from google.oauth2.credentials import Credentials from google_auth_oauthlib.flow import InstalledAppFlow from googleapiclient.discovery import build import base64 # If modifying these scopes, delete the file token.json. SCOPES = ['https://www.googleapis.com/auth/admin.reports.audit.readonly', 'https://www.googleapis.com/auth/admin.reports.usage.readonly'] def main(): """Shows basic usage of the Admin SDK Reports API. Prints the time, email, and name of the last 10 login events in the domain. """ creds = None # The file token.json stores the user's access and refresh tokens, and is # created automatically when the authorization flow completes for the first # time. if os.path.exists('token.json'): creds = Credentials.from_authorized_user_file('token.json', SCOPES) # If there are no (valid) credentials available, let the user log in. if not creds or not creds.valid: if creds and creds.expired and creds.refresh_token: creds.refresh(Request()) else: flow = InstalledAppFlow.from_client_secrets_file( 'credentials.json', SCOPES) creds = flow.run_local_server(port=0) # Save the credentials for the next run with open('token.json', 'w') as token: token.write(creds.to_json()) creds_as_bytes = creds.to_json().encode('utf-8') base64creds = base64.b64encode(creds_as_bytes).decode("utf-8") print(f'Base64 encoded token.json: {base64creds}') service = build('admin', 'reports_v1', credentials=creds) # Call the Admin SDK Reports API print('Getting the last 10 login events') results = service.activities().list(userKey='all', applicationName='login', maxResults=10).execute() activities = results.get('items', []) if not activities: print('No logins found.') else: print('Logins:') for activity in activities: print(u'{0}: {1} ({2})'.format(activity['id']['time'], activity['actor']['email'], activity['events'][0]['name'])) if __name__ == '__main__': main() ``` 16. When prompted, follow the instructions in the browser window to **authorize the scopes**. ``` $ python quickstart.py ``` 16. Copy the **base64-encoded token** value output by the script for your collector configuration. ## Run it In the Cloud Collector App, [create](https://devodocs.atlassian.net/wiki/spaces/latest/pages/409305131) a **Google Workspace Reports** collector instance. Insert this parameters template, replacing the values enclosed in `< >`. The `id` must be a unique [five digit number](https://www.random.org/integers/?num=1&min=10000&max=99999&col=5&base=10&format=html&rnd=new). ``` { "inputs": { "gsuite_reports": { "id": "", "enabled": true, "credentials": { "token_pickle_filename": "credentials.json", "token_pickle_content_base64": "" }, "services": { "access_transparency": {}, "admin": {}, "calendar": {}, "login": {}, "chat": {}, "drive": {}, "gcp": {}, "gplus": {}, "groups": {}, "groups_enterprise": {}, "jamboard": {}, "meet": {}, "mobile": {}, "rules": {}, "saml": {}, "token": {}, "user_accounts": {}, "data_studio": {}, "chrome": {}, "vault": {}, "gmail": {}, "gemini_in_workspace_apps": {}, "context_aware_access": {} } } } } ``` ## Secure it Devo [Exchange](https://docs.devo.com/space/latest/158236705/Devo+Exchange+repository) provides these resources: - Alert Pack: Google Workspace - Activeboard: Cloud GSuite Reports ### Misuse of Gemini Chats with [Gemini](https://developers.google.com/workspace/admin/reports/v1/appendix/activity/gemini-in-workspace-apps) are being misused by an unknown user. To identify the user, retrieve a list of email addresses and IP addresses that have accessed Gemini chats. ``` from cloud.gsuite.workspace.gemini where "chat_with_gemini" in event_parameters_value_array group by event_parameters_value_array, actor_email, ip_address ``` ## Monitor it Create an [inactivity alert](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126785) to detect interruptions of transfer of data from the source using the query: ``` from cloud.gsuite.reports.login where toktains(hostchain,"collector-") select split(hostchain,"-",1) as collector_id ``` Set the inactivity alert to keep track of the `collector_id`. ## Parameters ### Example ``` { "global_overrides": { "debug": }, "inputs": { "gsuite_reports": { "id": "", "enabled": , "requests_per_second": , "environment": "" "credentials": { "token_pickle_filename": "", "token_pickle_content_base64": "" }, "services": { "": { "request_period_in_seconds": "", "max_request_period_in_seconds: "", "max_lag_time_in_minutes": "", "start_time": "", "tag": "" } } } } } ``` ### Details | **Parameter** | **Data Type** | **Type** | **Details** | | --- | --- | --- | --- | | `debug` | boolean | Mandatory | If the value is `true`, the debug logging traces will be enabled when running the collector. If the value is `false`, only the `info`, `warning` and `error` logging levels will be printed. | | `id` | string | Mandatory | Unique id to this input service.
This parameter is used to build the persistence address, do not use the same value for multiple collectors. It could cause a collision. | | `inputs` | boolean | Mandatory | Use this param to enable or disable the given input logic when running the collector. If the value is `true`, the input will be run. If the value is `false`, it will be ignored. | | `requests_per_second` | integer | Optional | Customize the maximum number of API requests per second. If not used, the default setting will be used: `100000` requests/sec.
This parameter should be removed if it is not used. | | `environment` | string | Optional | It corresponds to the sixth level of the Devo tag: `cloud.gsuite.reports...`. If this parameter is removed, the sixth level of the tag will have the value `unknown`. | | `token_pickle_filename` | string | Mandatory | This parameter is the name that you want to give to the token generated by the Collector. For example: `token.pickle` | | `token_pickle_content_base64` | string | Mandatory | This parameter is the credentials in base64 format. Obtain it during authorizing process. | | `collector_service_name` | string | Mandatory | This parameter can be set to any collector service name described in the Data sources section.
For example:
``` "services": { "admin": { "request_period_in_seconds": 60 }, "calendar": { "request_period_in_seconds": 60 } } ``` | | `request_period_in_seconds` | integer | Optional | Period in seconds used between each data pulling, this value will overwrite the default value (60 seconds) | | `max_request_period_in_seconds` | integer | Optional | It is used to generate the time ranges, it indicates the size of the time ranges. The default value is 3600 seconds. | | `max_lag_time_in_minutes` | integer | Optional | This is the maximum time it takes for events to appear in Gsuite Reports. The default values are the following:
- `access_transparency -> 60` - `admin -> 60` - `calendar-> 180` - `chat -> 4320` - `drive -> 10` - `gcp -> 4320` - `groups -> 180` - `gplus -> 4320` - `groups_enterprise -> 4320` - `jamboard -> 4320` - `meet -> 3` - `login -> 1440` - `mobile -> 4320` - `saml -> 1440` - `token -> 180` - `rules -> 1` - `user_accounts -> 60` - `data_studio -> 3`
Retrieving report or audit log data for older dates or a wide time range might take so long that, by the time results are available, the most recent log data might no longer be fresh. For tools that require real-time monitoring, use a short time range. | | `start_time_override` | string | Optional | > This allows downloading historical data (1 month back for example) before downloading new events. Format: `YYYY-mm-ddTHH:MM:SS.sssZ` > **Note: start_time cannot be older than 180 days.** | | `custom_tag` | string | Optional | This parameter is used to override the default tag with a new customer defined tag. | ## Troubleshooting This collector has different security layers that detect both an invalid configuration and abnormal operation. This table will help you detect and resolve the most common errors. | **ErrorType** | **Error Id** | **Error Message** | **Cause** | **Solution** | | --- | --- | --- | --- | --- | | `GSuiteReportsPullerCredentialsException` | `2` | `File does not exist. Please, learn how to generate a token pickle on: https://docs.devo.com/confluence/ndt/v7.9.0/sending-data-to-devo/collectors/g-suite-collectors/g-suite-reports-collector` | This error is raised when token.pickle does not exist. | Regenerate the token.json and save it in the file devo-`collector-gsuite-google-workspace-reports/credentials/.` | | `3` | `Access token object does not exists` | This error is raised when token.pickle does not exist. | Regenerate the token.json and save it in the file devo-`collector-gsuite-google-workspace-reports/credentials/.` | | `4` | `The access token is not valid but not expired` | This error is raised when the token is invalid | Regenerate the token.json and save it in the file devo-`collector-gsuite-google-workspace-reports/credentials/.` | | `5` | `Property "refresh_token" does not exists so it is not possible to refresh the access token` | This error is raised when the token cannot be refreshed. The reason may be that it has been deleted. | Regenerate the token.json and save it in the file devo-`collector-gsuite-google-workspace-reports/credentials/.` | | `6` | `` | This error is raised when an HTTP error appears during setup. | The solution depends on the type of error. Contact [Devo Support](https://devo.my.site.com/support/login?ec=302&startURL=%2Fsupport%2Fs%2F). | | `21` | ` property must be a dictionary` | This error is raised when the required property `input_config_key_path` is not found in the `config` file. | Add `input_config_key_path` to `config `file, for example: `gsuit_alerts:` | | `22` | ` mandatory property is missing or empty` | This error is raised when the required property `credentials` is not found in the `config` file. | Add `credentials` dictionary in config. | | `23` | ` property must be a dictionary` | This error is raised when `credentials` is defined in the `config`file but the format is not `dict`. | Edit the value of `credentials` in `config `file, so it is of valid `dict` format. | | `24` | `.token_pickle_filename" mandatory property is missing or empty` | This error is raised when the required property `token_pickle_filename` is not found in the `config` file, into `credentials` dictionary. | Add `token_pickle_filename` property in `config` file, into `credentials` dictionary. | | `25` | `.token_pickle_filename" property must be a string` | This error is raised when `token_pickle_filename` is defined in the `config`file but the format is not `str`. | Edit the value of `token_pickle_filename` in `config `file, so it is of valid `str` format. | | `26` | `.token_pickle_content_base64" property must be a string` | This error is raised when `token_pickle_content_base64` is defined in the `config`file but the format is not `str`. | Edit the value of `token_pickle_content_base64` in `config `file, so it is of valid `str` format. | | `27` | `.token_pickle_content_base64"must be in a valid base64 format` | This error is raised when `token_pickle_content_base64` is defined in the `config`file but the format is not `base64 string`. | Edit the value of `token_pickle_content_base64` in `config `file, so it is of valid `base64 string` format. | | `GSuiteReportsSetupException` | `1` | `Error loading token pickle file: ` | This error is raised when the token is invalid | Regenerate the token.json and save it in the file devo-`collector-gsuite-google-workspace-reports/credentials/.` | | `GSuiteReportsPullerRetrieveException` | `50` | `Unexpected error` | This error is raised when the persistence could not be loaded. | Contact the internal team or restart persistence by changing the `start_time` parameter in the configuration file. | | `51` | `Unexpected status persistence date should always exists at this point` | This error is raised when the persistence could not be loaded. | Contact the internal team or restart persistence by changing the `start_time` parameter in the configuration file. | | `52` | `Unexpected status "event_last_timestamp" key should should always exists at this point` | This error is raised when `event_last_timestamp` is not in the persistence. | Contact the internal team or restart persistence by changing the `start_time` parameter in the configuration file. | | `53` | `Error processing messages: ` | This error is raised when messages could not be processed for some unknown reason. | This is an internal issue. Contact the [Devo Support](https://devo.my.site.com/support/login?ec=302&startURL=%2Fsupport%2Fs%2F). | | `54` | `timestamp must be not empty` | This error is raised when `timestamp` is empty. | This is an internal issue. Contact [Support](https://devo.my.site.com/support/login?ec=302&startURL=%2Fsupport%2Fs%2F). | | `55` | `"timestamp" must be follow the regex: ` | This error is raised when the `timestamp` variable does not match the regex: `'\d{4}-(?:0\d|1[0-2])-(?:[0-2]\d|3[0-1])T(?:2[0-3]|[01]\d):[0-5]\d:[0-5]\d\.\d{1,6}Z` | This is an internal issue. Contact [Support](https://devo.my.site.com/support/login?ec=302&startURL=%2Fsupport%2Fs%2F). | | `56` | `"timestamp" must be string or datetime, no other type is supported` | This error is raised when the `timestamp` variable is not of type `string` or `datetime`. | This is an internal issue. Contact [Support](https://devo.my.site.com/support/login?ec=302&startURL=%2Fsupport%2Fs%2F). | | `10` | `Uncontrolled code flow not expected to have an empty value of "initial_start_time_to_save"` | This error is raised when `initial_start_time_to_save` is empty. | This is an internal issue. Contact [Support](https://devo.my.site.com/support/login?ec=302&startURL=%2Fsupport%2Fs%2F). | | `GSuiteReportsPullerConnectionLostException` | `0` | `Operation timed out: ` | This error is raised when the maximum time to wait for the connection has been exceeded. | Check that the connection is working properly. | | `1` | `HTTP/1.1 503 Service Unavailable at moment - Retrying reconnection: ` | This error is raised when the service is not available. | This is an internal issue. Contact Support. | | `2` | `New connection failed. Retrying new connection: ` | This error is raised when the connection fails. | Wait until the maximum number of retries is reached, it is trying to automatically reconnect. | | `3` | `Retries limit reached: ` | The connection failed and the maximum number of unsuccessful retries has been reached. | Check that the connection is working properly. | | `4` | `DefaultCredentialsError: ` | This error is raised when credentials cannot be automatically determined. | This is an internal issue. Contact [Support](https://devo.my.site.com/support/login?ec=302&startURL=%2Fsupport%2Fs%2F). | | `7` | `Unable to refresh token or client Auth was deleted. Detail: ` | This error is raised when the token cannot be refreshed. The reason may be that it has been deleted. | Regenerate the token.json and save it in the file devo-`collector-gsuite-google-workspace-reports/credentials/.` | | `8` | `Operation timed out` | This error is raised when the maximum time to wait for the connection has been exceeded. | Check that the connection is working properly. | | `9` | `HTTP/1.1 503 Service Unavailable at moment - Retrying reconnection` | This error is raised when the service is not available. | This is an internal issue. Contact [Support](https://devo.my.site.com/support/login?ec=302&startURL=%2Fsupport%2Fs%2F). | | `10` | `DefaultCredentials: ` | This error is raised when credentials cannot be automatically determined. | This is an internal issue. Contact [Support](https://devo.my.site.com/support/login?ec=302&startURL=%2Fsupport%2Fs%2F)รง. | | `11` | `New connection failed. Retrying new connection` | This error is raised when the connection fails. | Wait until the maximum number of retries is reached, it is trying to automatically reconnect. | | `12` | `Retries limit reached: ` | The connection failed and the maximum number of unsuccessful retries has been reached. | Check that the connection is working properly. | | `ModuleDefinitionError` | `1` | ` mandatory property is missing or empty` | This error is raised when `module_properties` property is not found in `collector_definitions.yaml` | This is an internal issue. Contact [Support](https://devo.my.site.com/support/login?ec=302&startURL=%2Fsupport%2Fs%2F). | | `2` | ` property must be a dictionary` | This error is raised when `module_properties` is defined in the `collector_definitions.yaml` file but the format is not `dict`. | This is an internal issue. Contact [Support](https://devo.my.site.com/support/login?ec=302&startURL=%2Fsupport%2Fs%2F). | | `3` | `.alert_type mandatory property is missing or empty` | This error is raised when `application_name` property is not found in `collector_definitions.yaml` | This is an internal issue. Contact [Support](https://devo.my.site.com/support/login?ec=302&startURL=%2Fsupport%2Fs%2F). | | `4` | `.application_name" property must be a string` | This error is raised when `application_name` is defined in the `collector_definitions.yaml` file but the format is not `str`. | This is an internal issue. Contact [Support](https://devo.my.site.com/support/login?ec=302&startURL=%2Fsupport%2Fs%2F). | | `5` | `.tag_base" mandatory property is missing or empty'` | This error is raised when `tag_base` property is not found in `collector_definitions.yaml` | This is an internal issue. Contact [Support](https://devo.my.site.com/support/login?ec=302&startURL=%2Fsupport%2Fs%2F). | | `6` | `.tag_base property must be a string` | This error is raised when `tag_base` is defined in the `collector_definitions.yaml` file but the format is not `str`. | This is an internal issue. Contact [Support](https://devo.my.site.com/support/login?ec=302&startURL=%2Fsupport%2Fs%2F). | | `7` | `.start_time_regex" mandatory property is missing or empty` | This error is raised when `start_time_regex` property is not found in `collector_definitions.yaml` | This is an internal issue. Contact [Support](https://devo.my.site.com/support/login?ec=302&startURL=%2Fsupport%2Fs%2F). | | `8` | `.start_time_regex" property must be a string` | This error is raised when `start_time_regex` is defined in the `collector_definitions.yaml` file but the format is not `str`. | This is an internal issue. Contact [Support](https://devo.my.site.com/support/login?ec=302&startURL=%2Fsupport%2Fs%2F). | | `9` | `.start_time_regex" property is not a valid regular expression` | This error is raised when `start_time_regex` is defined in the `collector_definitions.yaml` file but is not a valid regular expresion. | This is an internal issue. Contact [Support](https://devo.my.site.com/support/login?ec=302&startURL=%2Fsupport%2Fs%2F). | | `10` | `.max_request_period_in_seconds" mandatory property is missing or empty` | This error is raised when `max_request_period_in_seconds` property is not found in `collector_definitions.yaml` | This is an internal issue. Contact [Support](https://devo.my.site.com/support/login?ec=302&startURL=%2Fsupport%2Fs%2F). | | `11` | `.max_request_period_in_seconds" property must be a string` | This error is raised when `max_request_period_in_seconds` is defined in the `collector_definitions.yaml` file but the format is not `str`. | This is an internal issue. Contact [Support](https://devo.my.site.com/support/login?ec=302&startURL=%2Fsupport%2Fs%2F). | | `12` | `.max_request_period_in_seconds" property must be greater or equal to 60` | This error is raised when `max_request_period_in_seconds` is defined in the `collector_definitions.yaml` file but the value is not greater or equal to `60`. | This is an internal issue. Contact [Support](https://devo.my.site.com/support/login?ec=302&startURL=%2Fsupport%2Fs%2F). | | `13` | `.max_lag_time_in_minutes" mandatory property is missing or empty` | This error is raised when `max_lag_time_in_minutes` property is not found in `collector_definitions.yaml` | This is an internal issue. Contact [Support](https://devo.my.site.com/support/login?ec=302&startURL=%2Fsupport%2Fs%2F). | | `14` | `.max_lag_time_in_minutes" property must be an integer` | This error is raised when `max_lag_time_in_minutes` is defined in the `collector_definitions.yaml` file but the format is not `integer`. | This is an internal issue. Contact [Support](https://devo.my.site.com/support/login?ec=302&startURL=%2Fsupport%2Fs%2F). | | `15` | `.max_lag_time_in_minutes" property must be between 0 and 72` | This error is raised when `max_lag_time_in_minutes` is defined in the `collector_definitions.yaml` file but the value is not in the range [0-72] | This is an internal issue. Contact [Support](https://devo.my.site.com/support/login?ec=302&startURL=%2Fsupport%2Fs%2F). | | `36` | `.max_request_period_in_seconds" property must be a string` | This error is raised when optional value `max_request_period_in_seconds` is defined in the config file but is not in the str format. | Edit the value of `max_request_period_in_seconds` in the configuration file so it is of valid str format. | | `37` | `.max_request_period_in_seconds" 'f'property must be between 60 and 3600 seconds` | This error is raised when optional value `max_request_period_in_seconds` is defined in the config file but is not in the range [60-3600]. | Edit the value of `max_request_period_in_seconds` in the configuration file so it is between `60` and `3600` | | `38` | `.max_lag_time_in_minutes" property must be an integer` | This error is raised when optional value `max_lag_time_in_minutes` is defined in the config file but is not in the str format. | Edit the value of `max_lag_time_in_minutes` in the configuration file so it is of valid int format. | | `39` | `.max_lag_time_in_minutes" property must be between 0 and 72` | This error is raised when optional value `max_lag_time_in_minutes` is defined in the config file but is not in the range [0-72]. | Edit the value of `max_lag_time_in_minutes` in the configuration file so it is between `0` and `72` | | `ServiceConfigurationError` | `31` | ` mandatory property is missing or empty` | This error is raised when the required property `input_config_key_path` is not found in the `config` file. | Add `input_config_key_path` to `config `file, for example: `gsuit_alerts:` | | `32` | ` property must be a dictionary` | This error is raised when `service_config_key_path` is defined in the `config`file but the format is not `dict`. | Edit the value of `service_config_key_path` in `config `file, so it is of valid `dict` format. | | `33` | `.start_time property must be a string` | This error is raised when `start_time` is defined in the `config`file but the format is not `str`. | Edit the value of `start_time` in `config `file, so it is of valid `str` format. | | `34` | `.start_time property value should fulfil the regex: ` | This error is raised when `start_time` is defined in the `config`file but It does not comply with the following regex: `\d{4}-(?:0\d|1[0-2])-(?:[0-2]\d|3[0-1])T(?:2[0-3]|[01]\d):[0-5]\d:[0-5]\d\.\d{1,3}Z`. | Edit the value of `start_time` in `config `file, so that it complies with the regex: `\d{4}-(?:0\d|1[0-2])-(?:[0-2]\d|3[0-1])T(?:2[0-3]|[01]\d):[0-5]\d:[0-5]\d\.\d{1,3}Z`. | | `35` | `.tag property must be a string` | This error is raised when `tag` is defined in the `config`file but the format is not `str`. | Edit the value of `tag` in `config `file, so it is of valid `str` format. | ### Lookups This collector does not create lookups. To convert data from the collector to a lookup, [create a lookup from a query](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95204060). ## API Endpoints | **Endpoint** | **Service** | **Table** | | --- | --- | --- | | `admin.googleapis.com/admin/reports/v1/activity/users/all/applications/access_transparency` | `access_transparency` | `cloud.gsuite.reports.access_transparency` | | `admin.googleapis.com/admin/reports/v1/activity/users/all/applications/admin` | `admin` | `cloud.gsuite.reports.admin` | | `admin.googleapis.com/admin/reports/v1/activity/users/all/applications/calendar` | `calendar` | `cloud.gsuite.reports.calendar` | | `admin.googleapis.com/admin/reports/v1/activity/users/all/applications/chat` | `chat` | `cloud.gsuite.reports.chat` | | `admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive` | `drive` | `cloud.gsuite.reports.drive` | | `admin.googleapis.com/admin/reports/v1/activity/users/all/applications/gcp` | `gcp` | `cloud.gsuite.reports.gcp` | | `admin.googleapis.com/admin/reports/v1/activity/users/all/applications/groups` | `groups` | `cloud.gsuite.reports.groups` | | `admin.googleapis.com/admin/reports/v1/activity/users/all/applications/gplus` | `gplus` | `cloud.gsuite.reports.gplus` | | `admin.googleapis.com/admin/reports/v1/activity/users/all/applications/groups_enterprise` | `groups_enterprise` | `cloud.gsuite.reports.cloud.gsuite.reports.groups_enterprise` | | `admin.googleapis.com/admin/reports/v1/activity/users/all/applications/jamboard` | `jamboard` | `cloud.gsuite.reports.jamboard` | | `admin.googleapis.com/admin/reports/v1/activity/users/all/applications/meet` | `meet` | `cloud.gsuite.reports.meet` | | `admin.googleapis.com/admin/reports/v1/activity/users/all/applications/login` | `login` | `cloud.gsuite.reports.login` | | `admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile` | `mobile` | `cloud.gsuite.reports.mobile` | | `admin.googleapis.com/admin/reports/v1/activity/users/all/applications/saml` | `saml` | `cloud.gsuite.reports.saml` | | `admin.googleapis.com/admin/reports/v1/activity/users/all/applications/token` | `token` | `cloud.gsuite.reports.token` | | `admin.googleapis.com/admin/reports/v1/activity/users/all/applications/rules` | `rules` | `cloud.gsuite.reports.rules` | | `admin.googleapis.com/admin/reports/v1/activity/users/all/applications/user_accounts` | `user_accounts` | `cloud.gsuite.reports.user_account` | | `admin.googleapis.com/admin/reports/v1/activity/users/all/applications/data_studio` | `data_studio` | `cloud.gsuite.reports.data_studio` | ## Devo collector features | **Feature** | **Details** | | --- | --- | | Allow parallel downloading (`multipod`) | - `Not allowed` | | Running environments | - `Collector server` | | Populated Devo events | - `Table` | | Flattening preprocessing | - `Yes` | ## Release Notes - v1.14.0 (2023-03-28) - Added services for Gmail, Context Aware Access, and Gemini - v1.13.0 (2025-08-07) - Added Vault service - v1.12.0 (2025-07-29) - IMPROVEMENT - Added a new service with application_name: `chrome` - The DCSDK Docker base image has been updated from "1.4.1" to "1.5.1" - The DevoCollectorSDK Python package (devo-collector-sdk) has been updated from "1.15.0" to "1.16.3" - BUG FIX - Fixed the bug related to 'start_time' in the persistence - v1.11.0 (2025-05-05) - IMPROVEMENT - Updated DCSDK Docker base image from "1.3.0" to "1.4.1" and DevoCollectorSDK Python package from "1.12.4" to "1.15.0". - v1.11.0 (2025-05-05) - IMPROVEMENT - Updated DCSDK Docker base image from "1.3.0" to "1.4.1" and DevoCollectorSDK Python package from "1.12.4" to "1.15.0". - v1.11.0 (2025-05-05) - IMPROVEMENT - Updated DCSDK Docker base image from "1.3.0" to "1.4.1" and DevoCollectorSDK Python package from "1.12.4" to "1.15.0". - v1.11.0 (2025-05-05) - IMPROVEMENT - Updated DCSDK Docker base image from "1.3.0" to "1.4.1" and DevoCollectorSDK Python package from "1.12.4" to "1.15.0". - v1.10.0 (2024-09-16) - BUG FIX - Updated DCSDK from 1.10.2 to 1.12.4 and upgraded Base Docker Image to 1.3.0. v1.9.0 - (2024-01-19) - IMPROVEMENT - Upgraded DCSDK from 1.9.0 to 1.10.2, improved logging, and added ability to validate collector setup. - v1.8.0 (2023-08-09) - IMPROVEMENT - Upgraded DCSDK from 1.1.4 to 1.9.0, added new template functionality, and improved resilience. - v1.7.0 (2022-11-08) - IMPROVEMENT - Updated max lag time for Google reports to minutes for more flexible data recovery. - v1.6.0 (2022-10-10) - IMPROVEMENT - Added custom time delay based on Workspace Reports maximum delay for each data source. - v1.5.0 (2022-09-08) - IMPROVEMENT - Split Google Workspace Collector into Google Workspace Alerts and Google Workspace Reports collectors. - v1.4.2 (2023-08-12) - BUG FIX - Fixed bug preventing Syslog output from being enabled. - v1.4.1 (2022-08-12) - IMPROVEMENT - Enhanced memory management with compression and improved resilience. - v1.2.0 (2022-04-29) - FEATURE - Added feature to restart persistence when config start_time is updated, improved performance with batch delivery.