Workspace_Activity Download: Who done it?

[Leif_Tishendorf]

I'm looking at events in Chronicle with

metadata.log_type = "WORKSPACE_ACTIVITY"
metadata.product_name = "drive"
metadata.product_event_type = "download"

But I'm not seeing any field that would indicate who or where the files are downloaded.  I'm wondering if I'm not understanding something in the log events correctly, or if there is somewhere I'm not looking to correlate files downloaded with who or where they are downloaded?

Any pointers would be much appreciated.

[stein1 · Accepted solution]

In the raw log from Workspace, the actor.email is the person who downloaded the file.  This actually gets translated to 2 places in the UDM - principal.user.email_addresses and security_result.about.email.  

In the raw log from Workspace, the ipAddress field has the IP that downloaded the file.  This is translated in the UDM to principal.ip, and then subsequently enriched in other principal.ip_geo_artifact fields.

Not all Workspace Drive activity "download" events will contain an ipAddress or actor.email.  Files that are shared publicly can be anonymously downloaded, in which case you will not get either field in the raw log from Workspace.  Files that are shared with other Google users outside of your Workspace domain, you may see the actor.email in the raw log from Workspace (if the Drive file is shared directly with that Google user and not just "anyone with the link").  For Drive download events by users outside of your Workspace domain (like @gmail.com), you will not get the ipAddress field.