[New hunt] All files accessed by user in Google Workspace

[brokensound77]

Description

Explore all files accessed via view or download by a user, within google workspace.

Target Huntset

google_workspace

Target hunt Type

ES|QL

Query

from logs-google_workspace*
| where file.name == "*" or file.name is not null and event.action in ("view", "download")
| stats files=count(*) by file.name, user.email
| sort files asc

Could potentially scope further to drive if needed

Related issues or PRs

No response

References

No response

Redacted Example Data

No response

[botelastic[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.