[New hunt] All file activity by user and action in Google Workspace

[brokensound77]

Description

Explore all file activity by user and event action

Target Huntset

google_workspace

Target hunt Type

ES|QL

Query

from logs-google_workspace*
| where file.name == "*" or file.name is not null and event.action
| stats files=count(*) by file.name, user.email, event.action
| sort files asc

Related issues or PRs

#4121

References

No response

Redacted Example Data

No response

[botelastic[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.