Release notes for the Splunk Add-on for Google Workspace

Version 2.2.0 of the Splunk Add-on for Google Workspace was released on June 1, 2022.

About this release

Version 2.2.0 of the Splunk Add-on for Google Workspace is compatible with the following software, CIM versions, and platforms:

Splunk platform versions	8.0.x, 8.1.x, 8.2.x
CIM	4.20
Platforms	Platform independent
Vendor Products	Google Workspace Enterprise Plus

New features

Version 2.2.0 of the Splunk Add-on for Google Workspace contains the following new features.

• Added the following new sourcetypes and CIM mapping support to event names:

sourcetype: gws:reports:calendar

• event names:
  • change_calendar_acls
  • create_calendar
  • delete_calendar
  • create_event
  • delete_event
  • add_event_guest
  • change_event
  • restore_event

sourcetype: gws:reports:context_aware_access

• event names:
  • ACCESS_DENY_EVENT

• Updated existing sourcetypes and added CIM mapping support to event names:

sourcetype: gws:reports:groups_enterprise

• event names:
  • invite_member

sourcetype: gws:reports:admin

• event names:
  • CREATE_CALENDAR_RESOURCE
  • UPDATE_CALENDAR_RESOURCE
  • CHANGE_FIRST_NAME
  • CHANGE_LAST_NAME
  • CHANGE_USER_LOCATION
  • RESET_SIGNIN_COOKIES
  • DELETE_GMAIL_SETTING
  • DELETE_ROLE
  • REMOVE_PRIVILEGE
  • RENAME_ROLE
  • UNASSIGN_ROLE
  • DISALLOW_SERVICE_FOR_OAUTH2_ACCESS
  • ORG_LICENSE_REVOKE
  • USER_LICENSE_ASSIGNMENT

Token expiration Fix
When an activity report is running for more than 1 hour, the add-on reported a 401 status code while trying to make another request to the Google Workspace API. One of the potential scenarios that could lead to this issue - an input that was enabled, then stopped for a while and then reenabled. This caused the activity report input to gather all the data for that period of time (from when the input stopped until reenabling). The amount of data the add-on was trying to pull was too large for the 1 hour (API token expiration time) given to collect all that data.

Proxy improvements
This release brings in an improvement regarding the proxy support.

Fixed issues

Version 2.2.0 of the Splunk Add-on for Google Workspace fixes the following issues:

Date filed	Issue number	Description
2022-05-16	ADDON-50955	The issue occurs on Splunk Add-On for Google Workspace. The logs are missing intermittent and the Customer could see "HTTPError: 401 Client Error: Unauthorized for url "

Known issues

Version 2.2.0 of the Splunk Add-on for Google Workspace contains the following known issues. If no issues appear below, no issues have yet been reported:

Third-party software attributions

Version 2.2.0 of the Splunk Add-on for Google Workspace incorporates the following third-party software or libraries:

File:Splunk Add-on for Google Workspace third-party software credits.pdf