LoFP / application being removed may be performed by a system administrator.

Techniques

Sample rules

Google Workspace Application Removed

• source: sigma
• technicques:

Description

Detects when an an application is removed from Google Workspace.

Detection logic

condition: selection
selection:
  eventName:
  - REMOVE_APPLICATION
  - REMOVE_APPLICATION_FROM_WHITELIST
  eventService: admin.googleapis.com