Administering Keen
Google Workspace
Chapter 21 of 30
Google Workspace
Google Workspace collection reads admin report streams through a delegated service account, so sign-ins, sharing and administrative changes can stand as evidence.
| Setting | Purpose |
|---|---|
KEEN_GOOGLE_WORKSPACE_ENABLED | Turns the adapter on. |
GOOGLE_WORKSPACE_IMPERSONATE | The delegated administrator identity. |
GOOGLE_WORKSPACE_SA_KEYFILE, GOOGLE_WORKSPACE_SA_JSON or GOOGLE_WORKSPACE_SA_JSON_B64 | The service-account material. A keyfile path must exist inside the running container. |
Grant the required upstream scopes and delegation deliberately, and keep private-key material out of collection definitions and browser-visible settings. Add named report streams under streams with the application, user key and system to query. The retained payload is under google_workspace; the upstream report application and event type determine its content.
Inspect and map evidence
Inspect a collected event and use Create mapping from this event. Structured selectors expose the payload that this source actually returns; a useful starting path is google_workspace. Action and outcome filters use Keen's normalised event values. Preview matching and non-matching examples.
For file-managed deployments, collection inputs live in config/google_workspace.yml. See the common collection workflow for UI configuration and override behaviour.