Google Workspace Attack Surface

This document provides a step-by-step guide to build a Google Workspace threat detection lab with Elastic, including GCP/GW configuration (Admin SDK, OAuth consent, service accounts with domain-wide delegation), deploying Elastic Cloud and Fleet, installing the Google Workspace integration, validating log ingestion, and enabling prebuilt detection rules. It also demonstrates crafting a custom detection rule to identify suspicious Gmail routing/forwarding changes, mapping to MITRE ATT&CK techniques, and offers practical queries and workflows to operationalize detections; it does not report on a specific incident.