Overview

Alert Center provides a comprehensive view of essential security-related notifications, alerts, and actions across all of Google Workspace. Integrate the Google Workspace Alert Center with Datadog to:

• View and parse your alert logs using Datadog’s Logs product.
• Set monitors on events from your Google Workspace domain.
• Leverage the Datadog Security Platform to monitor and detect threats across your Google Workspace domain.

Setup

Installation

The Datadog Google Workspace Alert Center integration uses service accounts to create an API connection between Google and Datadog. Below are instructions for creating a service account and providing Datadog with service account credentials to begin making API calls on your behalf.

Note: Ensure that you have enabled the Google Workspace Alert Center API.

1. Follow the service account creation and authorization instructions. You need super-admin access in order to complete these steps. Note the location where you save the private key JSON file as part of that process. Delegate domain-wide authority to the service account as described, granting the https://www.googleapis.com/auth/apps.alerts scope in the process.
2. From the Service account details page in your GCP console, click the Create Google Workspace Marketplace-Compatible OAuth Client button at the bottom of the Advanced settings section.
3. Navigate to the Datadog Google Workspace Alert Center Integration tile.
4. On the Configuration tab, select Upload Private Key File to integrate this project with Datadog. Select the private key JSON file you saved in the first step.
5. Enter the Subject Email, which is the email address for a user or robot account with Alert Center access. Do not use the email address associated with the service account itself. The integration impersonates this user when making API calls.

If you want to monitor multiple projects, you can repeat the process above to use multiple service accounts.

Configuration

Custom tags can also be specified per project. These tags are added to every log event for that project in Datadog.

Results

Wait at least five minutes to see logs coming in under the source google.workspace.alert.center. You may have to wait longer if your environment generates Alert Center alerts infrequently.

Data Collected

Metrics

This Google Workspace Alert Center does not include metrics data.

Events

For the full list of log events, see the Google Workspace Alert Center documentation.

Service Checks

The Google Workspace Alert Center integration does not include any service checks.

Troubleshooting

Need help? Contact Datadog support.

Further reading

Additional helpful documentation, links, and articles:

Monitor Google Workspace with DatadogBLOG