Google Workspace Integration Discovered Resources

Ingested Resources & Properties

Users (user)

Property	Description
name	Email address of the user (used as the primary identifier)
email_address	Email address of the user
label	Display name of the user (from Google Workspace profile)
google_workspace_raw_user_object	Complete raw user object from Google Workspace Admin SDK Directory API, containing all available user properties and metadata

Note: The google_workspace_raw_user_object property contains the full user object returned by the Google Workspace Admin SDK, including fields such as:

• User profile information (name, emails, organizations, etc.)

• User status and lifecycle

• User credentials and authentication settings

• Custom attributes

• And other Google Workspace-specific metadata

User Groups (user_group)

Property	Description
name	Display name of the group
subtype	Always "google_workspace" for groups observed from Google Workspace
native_id	Google Workspace group ID
created_at	Timestamp when the group was created in Google Workspace
members	List of user and group members that belong to this group. Each member entry is a dictionary with a uri key pointing to the member resource.
google_workspace_raw_group_object	Complete raw group object from Google Workspace Admin SDK Directory API, containing all available group properties and metadata

Note: The google_workspace_raw_group_object property contains the full group object returned by the Google Workspace Admin SDK, including:

• Group profile information

• Group email and description

• Group settings and policies

• And other Google Workspace-specific metadata

Relationships

Membership Relationships

The Google Workspace integration creates membership relationships between groups and their members (users or nested groups).

Group → Members

Groups have a members property that contains a list of member dictionaries. Each dictionary has:

• uri: The URI of the member (user or group)

EQL Examples:

# Find all groups that have a specific user as a member
has member(uri="[email protected]")

# Find all members of a specific group
type = "user_group" and is member of(name='some group')

User → Groups

Users can be queried to find which groups they belong to using the membership relationship in reverse.

EQL Examples:

# Find all groups that contain a specific user
has member(uri="[email protected]")

Resource URIs

User URI Format

Users are identified using the following URI format:

user_account.<EMAIL_ADDRESS>

Examples:

• [email protected]

• [email protected]

User Group URI Format

Groups are identified using the following URI format:

user_group.<GOOGLE_WORKSPACE_GROUP_ID>

Examples:

• user_group.01abc123def456

• user_group.02xyz789ghi012

Nested Groups

Google Workspace supports nested groups (groups that are members of other groups). Euno observes these relationships:

• When a group is a member of another group, it appears in the parent group's members list

• The nested group itself is also observed as a separate user_group resource

• You can traverse group hierarchies by following the members relationships

Example: If Group A contains Group B, and Group B contains User X:

• Group A's members will include Group B's URI

• Group B's members will include User X's URI

• You can query for all users in Group A (including nested members) by traversing the relationships