How can I check which Google Workspace application types I’m receiving in Panther?

QUESTION

When trying to find information from our Google admin logs in Panther, I only see records of the admin#reports#activity type. I would like to see the Google Login activity and Google Drive activity. How can I check which Google Workspace application types I’m receiving?

ANSWER

To do this, run the following SQL query to retrieve a list of application types:

SELECT id:applicationName, max(p_event_time)
FROM panther_logs.public.gsuite_activityevent
WHERE p_occurs_since(12w)
GROUP BY id:applicationLog