Google Workspace: Gmail

This section covers the following topics:

• Prerequisites

• Configure Google Workspace Account

• Add Gmail Data Store

• Add Gmail Scan

Prerequisites

Configure Google Workspace Account

Before you add Gmail targets, you must have:

• A Gmail administrator account for the target Gmail domain.

• A Gmail account. DDC only supports Gmail accounts. Personal Google accounts are not supported.

To configure your Google Workspace account for scanning:

1. Select a Project

2. Enable APIs

3. Create a Service Account

4. Set up Domain-Wide Delegation

5. Generate a New Key for the Service Account

Select a Project

1. Log on to the Google API Console.

2. From the projects list, select the project that you want to scan with DDC. If no project exists, create a new project.

Enable APIs

To scan a Gmail account, enable the APIs for it in your selected project.

To enable the APIs:

1. In the left pane, click Enabled APIs & services.

2. On the APIs & Services, click + ENABLE APIS AND SERVICES.

3. On the API Library page, search for the following APIs:

   Target Gmail	API Library
   All	Admin SDK API
   Google Mail	Gmail API

4. Click ENABLE for both the APIs.

Create a Service Account

Before adding Gmail as a target, you must create a Google service account for use with DDC. The service account must have the required permissions to allow DDC to authenticate and access (scan) the resources in your Gmail account.

1. Log on to the Google Cloud Console.

2. Select the desired project from the project list.

3. Click the hamburger icon (☰) to expand the navigation menu.

4. Go to IAM & Admin > Service Accounts.

5. Click +CREATE SERVICE ACCOUNT.

6. In the Service account details section, specify the following details:

   Field	Description
   Service account name	Enter a descriptive name for the service account, for example, ddc-sa.
   (Optional) Service account ID	Edit the default ID for the service account, or click the refresh button to generate a service account ID. For example, ddc-sa@project-id.iam.gserviceaccount.com. This will be required when configuring connection for the Gmail data store.
   (Optional) Description	Provide a description for the new service account.

7. Click CREATE AND CONTINUE.

8. In the Grant this service account access to project section, from the Select a role drop-down list, select Project > Owner.

9. Click CONTINUE and then Done. Your service account is created.

10. Navigate back the Service accounts page.

11. Click the newly created service account.

12. Click the DETAILS tab.

13. Note down the Unique ID (or OAuth 2 Client ID) for the service account (for example, 123456789012345678901). This is required when setting up domain-wide delegation.

Set up Domain-Wide Delegation

After creating a service account, you need to set up and enable domain-wide delegation to allow DDC to access your Gmail domain with the service account.

To delegate domain-wide authority to a service account:

1. Log on to Google Admin Console as a super administrator of the Gmail domain.

2. Click the hamburger icon (☰) to expand the navigation menu.

3. Go to Security > Access and data control > API controls.

4. Click MANAGE DOMAIN WIDE DELEGATION.

5. Click Add New. The Add a new customer ID dialog box is displayed.

6. In the Customer ID field, enter the service account's Client ID or Unique ID (for example, 123456789012345678901).

7. In the OAuth scopes (comma delimited) field, enter a comma-separated list of Google API scopes for every Gmail service that you want to scan with DDC.

   Google Service	Google API OAuth 2.0 Scope
   All (required)	https://www.googleapis.com/auth/admin.directory.user.readonly
   Google Mail	https://mail.google.com/

   For example, specify https://www.googleapis.com/auth/admin.directory.user.readonly, https://mail.google.com/.

8. Click AUTHORIZE.

Generate a New Key for the Service Account

Credentials for a service account are set to expire in the year 10000, making expiration unlikely. However, a contingency plan exists for regenerating a new key, if needed. If the key is not obtained or expires, it's acceptable to create a new key, although not an ideal practice.

1. Log on to the Google Cloud Platform (GCP) with your credentials.

2. Go to the DASHHBOARD.

3. Click the hamburger icon (☰) to expand the navigation menu.

4. Click IAM & Admin > Service Accounts.

5. Search for the project in which the required service account is available.

6. Click the overflow icon () and click Manage keys. The Keys page is displayed.

7. Click ADD KEY, then Create new key to generate a new key. The Create private key for "<Your service account>" dialog box is displayed.

8. Select P12 as the Key type and click CREATE.

The key will be automatically downloaded to your system. Save the created P12 private key file to a secure location on your computer. This will be required when configuring connection for the Gmail data store.

Add Gmail Data Store

To add the Gmail data store:

1. Log on to the CipherTrust Manager GUI.

2. Open the Data Discovery & Classification application.

3. Click Data Stores > Data Stores > Add Data Store. The Add Data Store wizard is displayed.

4. Complete the following steps:

   1. Select Type & Category

   2. General Info

   3. Configure Connection

   4. Add Access Control & Tags

Select Type & Category

1. Under Select Data Store Category, select Cloud.

2. From Select Cloud Type, select G-Mail.

3. Click Next.

General Info

1. Specify the following details:

   • Data Store Name: Name for the data store.

   • Description (Optional): Description for the data store.

   • Location Name: Location of the data store.

   • Add Location: Click Add Location to add new locations to the Location Name dropdown list. Refer to Adding Locations for detailed steps.

   • Sensitivity Level (Optional): Sensitivity level for the data store. Refer to Sensitivity Levels for details.

   • Enable Data Store: Whether to enable the newly added data store. Select the check box to enable the data store.

2. Click Next.

Configure Connection

1. Specify the credentials of the Google domain.

   Field	Description
   Google Domain	Google domain that you want to scan. For example, if your Gmail administrator email address is admin@example.com, your Google domain is example.com.
   User	Email address of the Gmail administrator account. For example, admin@example.com.
   Service Account ID	Your service account ID or email address. For example, enterprise-recon-sa@project-id.iam.gserviceaccount.com. Refer to Create a Service Account to get the service account ID.
   Private Key	Private key (*.p12) associated with the service account. Refer to Generate a New Key for the Service Account for the key details.

2. In the Select Number of Agents field, set the minimum and maximum number of agents for the data store. Refer to Agents for more information.

   

   Warning

   • As there is no limit on the number of minimum and maximum agents that you can set, you should exercise caution so that you do not impact the system performance by using too many resources for a single scan.
   • You will not be able to add a datastore if the minimum number of agents cannot be assigned.
   • A scan will fail if the assigned agent is unavailable after adding the datastore.
   • The minimum number of agents must be less than or equal to the maximum number of agents.

3. (Optional) In the Add Label field, enter a label. You can also remove an existing label.

4. Click Next.

Add Access Control & Tags

1. (Optional) Grant the All groups (default) access for reports. Alternatively, select a group.

2. Click Save.

The data store is added to the Data stores page. If the Ready to Scan column shows Ready, then data store is properly configured.

For more information on Access control and Tags, expand the section below.

Add Gmail Scan

To add a scan for Gmail:

1. Open the Data Discovery & Classification application.

2. Click Scans > Add Scan. The Add Scan wizard is displayed.

3. Complete the following steps:

   1. General Info

   2. Select Data Stores

   3. Add Targets

   4. Select Profiles

   5. Add Filters

   6. Schedule Run

   Refer to Scans for the description of screens of the Add Scan wizard.

General Info

1. Specify a Name for the scan.

2. (optional) Add a Description for the scan.

3. Expand Advanced Configuration and specify advanced configurations such Scan Priority, Memory Usage Limit, and Amount of Data Object Volume. Refer to Advanced Configuration for details.

4. Click Next.

Select Data Stores

1. Under Data Store Name, select the desired data store that is Ready for scanning. You can select multiple data stores, if required.

2. Click Next.

Add Targets

1. To add a scan target, do one of the following:

   • Under the Add Target field, specify the correct target path and click Apply.

     If no specific target is added, the entire data store will be scanned.

     The following table lists target paths and syntax to specify them with examples.

     Target Path to Scan	Syntax
     Complete data store	<Empty_Path>
     User account	<User_Name>
     Folder in user account	<user_name/folder_name>

     

     Note

     • Target paths are not case-sensitive.

     • To scan the mailbox user_name@example.com, enter user_name. To scan a specific folder in the mailbox, specify user_name/<folder>. For example:

       • To scan the Inbox folder, enter user_name/inbox.

       • To scan the Sent Mail folder, enter user_name/sent.

   • Navigate and add target paths.

     1. Click Browse to navigate target paths from the root level.

        Alternatively, provide an initial path in the Add Target Path field and click Browse to navigate targets from that point onward.

     2. In the left pane, navigate and select the desired target path.

     3. Click Add Path to add the target path to the right pane. Similarly, add other target paths.

     4. Click Add.

     

     Tip

     Either navigate the target paths from the root level (without specifying any path in the Add Target Path field) or make sure you provide the correct path to navigate further locations within it.

2. Click Next.

Select Profiles

1. Under Classification Profile Name, select the desired classification profiles to search for in the data store. You can select multiple data stores, if required. Refer to Classification Profiles for details on classification profiles.

2. Click Next.

Add Filters

This step is optional.

1. Select the desired filter from the Select Filter drop-down list.

   To filter the locations to scan a Gmail data store, consider the following syntax.

   

   Note

   Exclude locations by prefix, suffix, and expression filters support wildcard characters. See Using Wildcard Characters to learn how wildcards work.

   • Exclude locations by prefix

     Excludes search locations and nested locations with paths that begin with a given string. Can be used to exclude entire directory trees. Specify <string>.

     Filter Item	Syntax	Example
     User/Account	<UserName>	datastorecicduser
     Folder	<UserName>/<FolderName>	datastorecicduser/inbox Wildcard usage *inbox — Applies all paths ending with 'inbox' as prefix Note Labels are not supported. To filter labels, label ID is required.
     File	<UserName>/<FolderName>/<FileName>	datastorecicduser/inbox/mydata filter test data/Mon, 23 Aug 2021 10:54:40 +0530/50-contacts.csv datastorecicduser/inbox/test filter test data datastorecicduser/Label_4800715244570918733/test filter test data/ Wildcard usage datastorecicduser/inbox/mydata filter test data/*/50-contacts.csv — Applies all paths starting with 'datastorecicduser/inbox/mydata filter test data/' and ending with '/50-contacts.csv' as prefix. datastorecicduser/*/mydata filter test data — Applies all paths starting with 'datastorecicduser/' and ending '/mydata filter test data' as prefix

   • Exclude locations by suffix

     Excludes search locations and nested locations with paths that end with a given string. Specify <string>.

     Filter Item	Syntax	Example
     User/Account	<UserName>*	datastorecicduser* — Applies all paths starting with 'datastoreicduser' as suffix.
     Folder	<FolderName>*	inbox* — Applies all paths starting with 'inbox' as suffix.
     File	<FileName>	50-contacts.csv Wildcard usage datastorecicduser/inbox/mydata filter test data/*/50-contacts.csv — Applies all paths starting with 'datastorecicduser/inbox/mydata filter test data/' and ending with '/50-contacts.csv' as suffix. 50-contacts.csv* — Applies all paths starting with '50-contacts.csv' as suffix.

   • Exclude locations by expression

     This filter is majorly used with wildcard characters.

     Excludes search locations and nested locations that matches the given expression. Specify <string>.

     For example, to exclude locations that contain 'blob' in their path, use expression *blob*.

     Filter Item	Syntax	Example
     User/Account	<UserName>*	datastorecicduser*
     Folder	*<FolderName>*	*folder*
     File	<UserName>/<FolderName>/<Subject>/<Date>/<FileName> or <UserName>/<FolderName>/<Subject>/*/<FileName>	datastorecicduser/inbox/mydata filter test data/Mon, 23 Aug 2021 10:54:40 +0530/50-contacts.csv datastorecicduser/inbox/mydata filter test data/*/50-contacts.csv

   • Include locations modified recently

     Includes search locations modified within N number of days from the current date, where the value of N ranges from 1 to 99 days. After selecting this filter, specify Days from current date.

   • Include locations within modification date

     Includes search locations modified within a given range of dates. After selecting this filter, specify Start and End dates.

   • Exclude locations greater than file size

     This filter is not supported in this release.

2. Click Apply.

3. Repeat the above steps to apply multiple filters. Click Remove to remove any applied filter.

4. Click Next.

Schedule Run

1. Specify the scan run frequency. The two options are:

   • Manual: This is the default option. Select this option run the scan manually. Select the Run Now check box to start the scan run after you save the changes.

   • Scheduled: Select this option to configure the scan to run automatically at the specified time.

   Refer to Schedule Scan for more details on scheduling scan runs.

2. Click Save.

Note

API request default quota for Gmail is 15,000 per minute. If this limit is exceeded, API request will fail and scan run may encounter different issues.