Google Workspace
Google Workspace
Hal reads Google Workspace activity through the Reports API and the Alert Center, over a read-only service-account authorization you grant in your Admin Console. He never writes to the workspace.
What’s collected:
- Login and account activity, including login type and source IP
- Admin console actions and changes
- Drive and other application audit events
- Google’s own security alerts from the Alert Center, with their severity
Polled every few minutes, retained 365 days.
Connect it: the Hal-assisted, script, and manual methods all set up the same read-only delegation.