Google Workspace - Log Insights to Your Threat Hunt

This article explains how to hunt for data exfiltration in Google Workspace (mainly Google Drive) by describing log limitations (missing user-agent, absent path fields, anonymous access), how to restructure and interpret event chains and parameters, the impact of third-party applications on IP and activity attribution, sharing/visibility behaviors that enable exfiltration, reconstructing file paths from logs, and a case study where a mass download was investigated and determined benign; it concludes with practical takeaways and recommendations for improving forensic readiness.