Allow Code42 access to Google Drive
Who is this article for?
Instructor, no.
Incydr Professional, Enterprise, Gov F2, and Horizon, yes.
Incydr Basic, Advanced, and Gov F1, yes.
CrashPlan Cloud, no.
Retired product plans, no.
CrashPlan for Small Business, no.
Overview
To help protect you from data loss, you can use Code42 to monitor files moving to and from users' Google Drive.
When you add Google Drive as a data connection, you must authorize Code42 as a registered client API using your administrator account in Google Workspace (formerly G Suite). Once connected, we monitor your organization's Google Drive environment to capture when a user:
This article explains how to add Google Drive as a data connection. It also explains why Code42 needs this level of access to your Google environment.
Considerations
The following considerations apply to Google Drive. See also the considerations applicable to all cloud storage environments.
- Code42 can connect to your Google Drive environment only when supported by your Google product plan.
- To allow Code42 access to Google Drive, you must be a Google Workspace administrator with a Super Admin role. See Permissions your Google Workspace administrator needs below for more information.
- Sharing permissions that files inherit from a parent folder are detected as new events for those files. In Forensic Search, the actor for these events identifies the user who applied those sharing permissions to the parent folder.
- File events do not immediately appear when sharing with Google domains that are not configured with Code42.
- If the ;drive SDK is disabled in Google Drive, Code42 does not monitor file activity on the user's Google Drive account.
- Code42 does index the content of suspended users' Google Drives.
- Files owned by suspended users are still accessible by any users those files have been shared with. Code42 monitors files owned by suspended users files for any activity generated by these shared users.
Before you begin
In your Google Drive environment, verify that third-party apps have access to Drive files. If the Allow users to access Google Drive with the Drive SDK API option is Off, edit the option to turn it on. Code42 cannot monitor your Google Drive environment if this setting is disabled.
- If you connect Code42 to your Google Drive environment without this setting enabled, the connection enters an error state immediately following authorization.
- If you disable this setting it while the connection has a status of Indexing or Monitoring, Code42 stops monitoring the drives in your Google Drive environment until it is re-enabled.
Authorize Code42's connection to Google Drive
Step 1: Connect Code42 to Google Drive
- Sign in to the Code42 console.
- Add a cloud storage data connection:
- Select Administration > Integrations > Data Connections.
- Click Add data connection.
The Add data connection panel opens. - From Data connection, select Google Drive under Cloud storage.
Note the Client ID and OAuth scopes details that appear near the bottom of the panel. You enter this information into the Google Admin console later in this procedure. - Enter a display name. This display name must be unique.
- Authorize the Code42 app in Google:
- Go to your Google Admin console and log in using your Google Workspace administrator username and password.
- Go to Security > Access and data control > API controls.
- Click Manage domain wide delegation in the Domain wide delegation panel.
- On the Domain-wide delegation page, click Add new next to API clients.
- In the Add a new client ID dialog box:
- Copy the Client ID from the Code42 console and paste it in the Client ID field.
- Copy the OAuth scopes from the Code42 console and paste it in the in the OAuth scopes (comma-delimited) field.
- Click Authorize.
The Code42 cloud storage data connection is added to the API clients table.
Step 2: Add users
- Return to the Code42 console.
- In the Add data connection panel, select I've completed these steps under Complete these steps in Google Workspace and then click Continue.
The Add Users panel appears.
- Select one of the following options:
- All: Monitors all Google Drive users in your environment, including any drives owned by suspended users.
- Specific users: Monitors only the Google Drive users you designate.
- Click Upload .CSV file.
- Select a .csv file containing a list of only those Google Drive users you want to monitor. For details, see Upload a .csv file listing Google Drive users below.
- Specific groups: Monitors only the users in Google Drive groups you designate.
- Click Upload .CSV file.
- Select a .csv file containing a list of Google Drive groups whose users you want to monitor. For details, see Upload a .csv file listing Google Drive groups below.
Step 3: Verify the setup
- In the Add data connection dialog, click Continue.
The Verify panel appears.
- Enter the Google Workspace username that you used earlier to log in to the Google Admin console.
- Click Authorize.
Google Drive is added as a data connection, and Code42 begins the initial indexing process.
Next steps
Once you have added Google Drive as a data connection, learn more about:
- Common use cases for investigating incidents with Forensic Search
- How to use Forensic Search
- Adding trusted domains to easily identify when files are shared with users not on your list of approved domains.
Upload a .csv file
In Step 2, if you select Specific users or Specific groups and click Upload .CSV file, you must upload a .csv file that lists Google Drive users or groups you want to monitor.
General considerations for uploading a .csv file:
- The .csv file is limited to 1,000 entries.
- Uploading a new .csv replaces the existing list of people or groups being monitored.
- Shared drives are monitored if at least one member is an in-scope user.
Upload a .csv file listing Google Drive users
To get a list of Google Drive users, see Google Workspace Admin Help. Create a .csv file from this list that contains only the users you want to monitor. Code42 reads usernames from column headers labeled Email Address [Required], Email Address, or Emailsin the .csv file. If these columns contain any entries that aren't email addresses, the upload produces an error.
Click to download an example of users identified by email address.
Upload a .csv file listing Google Drive groups
To create a Google Drive group, see the Google Workspace Learning Center. After your Google Drive groups are set up, create a .csv file that contains only the groups you want to monitor. In this file, use column headers to identify either the name or the email addresses of those groups.
- Code42 reads the names of groups from the column header labeledGroup Name or Groups. Specify the names of the groups exactly as they appear in the Google Admin console.
- Code42 reads a list of email addresses associated with a group from the column header labeled Email or Email Address. In the .csv file, specify the email address associated with each group.
Click to download an example of groups identified by email address.
If the .csv file does not contain at least one of these column headers, the upload produces an error.
Code42 looks for users associated with Google Drive groups as follows:
- When a group's name or email address is provided, Code42 attempts to look up users associated with that group name or group email address.
- If the group includes another group name or email address (a "nested" group), Code42 looks up users associated with that nested group as well.
- If the group name or email address cannot be found, Code42 proceeds to the next entry in the .csv file. Code42 looks for that group or email address again every 24 hours.
As users are added and removed from the monitored groups, Code42 detects these changes within 24 hours and adjusts monitoring of user drives accordingly.
Users that are removed from monitored groups have their event history preserved so that it remains searchable in Forensic Search. When an unmonitored user in your Code42 organization shares a file with a monitored user, the events associated with that file are not captured because the unmonitored user is the owner of the file.
Required permissions
Permissions your Google Workspace administrator needs
For more information, see Data connection is not sending security data below.
Permissions the Code42 service account needs
As a service account, Code42 uses delegated domain-wide authority to collect file events from Google Drive. A file event is any activity observed for a file, such as creating, modifying, sharing, renaming, moving, or deleting a file. To see this file activity, Code42 requires access to your Google Drive environment.
In the configuration steps above, Code42 provides the following scopes for you to enter in your Google Admin console:
https://www.googleapis.com/auth/drive.readonly https://www.googleapis.com/auth/admin.directory.user.readonly https://www.googleapis.com/auth/admin.directory.group.readonly https://www.googleapis.com/auth/admin.directory.customer.readonly https://www.googleapis.com/auth/admin.reports.audit.readonly https://www.googleapis.com/auth/admin.reports.usage.readonly
Configuring these scopes in the Google Admin console gives the Code42 API client delegated domain-wide authority to your Google Drive environment, and follows Google's recommendation for allowing service accounts to read content from user drives. Because of this authority, audit logs of your Google Workspace environment may show the Code42 Cloud Service account impersonating the owner of each user drive in order to read its contents.
Troubleshooting
Issues occurring during authorization
Email domain already exists
Data connection is already registered or the email address is not valid
Other issues
Data connection is not sending security data
Slowed performance
Maximum user drive number exceeded
Reconfigure scoping for user and group monitoring
File events aren't appearing for a shared drive
Code42 monitors a shared drive only when at least one of its members is an in-scope user. If file events aren't appearing for a shared drive as expected, examine the list of people or groups who have been assigned to that drive. Then, use one of these methods to adjust that user list as needed:
- In Code42, reconfigure scoping in Code42 to add one or more members of that drive as users that are in scope for monitoring.
- In Google Drive, add a user that is in scope for monitoring as a member of that shared drive.
Usernames are missing from "Shared with users" lists
Code42 automatically filters the list of users a file is shared with in Google Drive to exclude any username that is not an email address. Such usernames are typically associated with service or integration accounts with sharing permissions in your Google environment instead of end users, and generally aren't useful for investigating file events.
While these usernames may appear in Google Drive, Code42 only displays user names that are email addresses in "Shared with users" lists in Forensic Search or alert notifications.