[google_workspace] Add Gemini AI audit log datastream #19410

Description

Google Workspace Gemini is Google's AI assistant, integrated across Gmail, Docs, Drive, Meet, Sheets, and Slides. It's widely deployed in enterprise Workspace environments and represents a growing AI-governance and compliance surface — users interact with Gemini directly within the tools they use for sensitive work every day.

Gemini usage is auditable via the Google Admin SDK Reports API, but Elastic currently has no support for this data. Security teams with Workspace already connected have a blind spot: they can see file access, logins, and admin changes, but not the AI activity happening alongside that same data.

This is a net new datastream following the same pattern as all other Workspace datastreams in the integration.

What this data does (and doesn't) give you

Setting expectations up front, because it shapes the realistic use cases:

What the Reports API exposes — usage metadata:

• Who used Gemini (actor, IP), in which Workspace app, and when
• The category of action (e.g. summarize_document, generate_text) and the UI entry point
• Engagement type and volume

What it does not expose:

• Prompt or response content
• The specific file/email/document operated on (no document ID or filename)
• Any data classification or sensitivity signal

The practical consequence: this datastream is about visibility and behavioral anomaly detection — who is using AI, where, and how much — not content-level inspection of what was shared with the AI. Correlation with sensitive-data access is temporal (same user/app around the same time as a Drive or Gmail event), not a field-level join.

Scope & data boundaries

This datastream collects Gemini usage metadata from the Admin SDK Reports API (gemini_in_workspace_apps). It deliberately does not attempt to capture AI content, because of where that data lives:

• Prompt/response content (in-app Gemini): Available only via Google Vault, which is an eDiscovery tool — on-demand, batch XML export with no streaming/event feed. There is no SIEM-style streaming path for Vault content from any vendor, so it is out of scope for this datastream. (Note: the integration's existing "Vault" datastream is the Vault audit log — admin actions like searches and holds — not retained conversation content.)
• The specific file/data operated on: Not present in the Gemini event. Inferred by temporal correlation with the existing Drive datastream (file IDs, titles, access events), already collected by this integration.
• Sensitivity signal: Provided by the existing Rules (DLP) datastream, already collected — correlate DLP rule matches with Gemini activity for the same user/time window.
• Gemini API (Vertex AI) content: A separate product with full request/response logging to BigQuery, already addressed by the standalone Elastic GCP Vertex AI integration — not this integration.

Net: the correlation story (AI usage ↔ file access ↔ DLP matches) works today using Drive + Rules + this new Gemini stream - no additional collection required.

Why this matters

• AI governance & visibility: As Gemini adoption grows, security teams need an audit trail of who is using it, in which apps, and whether usage aligns with policy. Elastic ingests these events and makes them searchable, dashboardable, and alertable alongside the rest of the Workspace estate.
• Behavioral baselining: Bringing AI usage into the same data model as the rest of Workspace activity lets teams baseline normal usage and flag deviations (off-hours, volume spikes, first-time use by sensitive accounts).
• Compliance & audit: Regulated industries need a durable, queryable record of AI tool usage to support GDPR, HIPAA, and internal acceptable-use requirements.
• Admin oversight: Changes to Gemini feature availability and org-unit policies are configuration changes that should be monitored like any other. (Note: admin config-change events likely originate from a separate Admin SDK event source rather than the usage event below — to be confirmed during development.)

What needs to be built

New datastream: google_workspace.gemini

• Collect Gemini audit events via the Admin SDK Reports API (gemini_in_workspace_apps application)
• Cover user interactions across all Gemini-enabled Workspace apps, plus admin configuration events (source to be confirmed)
• Dashboards: usage by user, org unit, and app; admin change timeline
• Detection rules: see below

Sample event

⚠️ Illustrative sample. The structure and field names follow the Admin SDK Reports API documentation for the gemini_in_workspace_apps application; the values are representative. Google does not publish a populated example response, so a real captured event should be added during development from a Gemini-enabled tenant.

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2026-06-01T14:23:11.000Z",
    "uniqueQualifier": "-1234567890123456789",
    "applicationName": "gemini_in_workspace_apps",
    "customerId": "C03az79cb"
  },
  "actor": {
    "email": "analyst@example.com",
    "profileId": "104328974627593847562"
  },
  "ipAddress": "203.0.113.42",
  "events": [
    {
      "type": "ai_usage_event",
      "name": "feature_utilization",
      "parameters": [
        { "name": "app_name", "value": "docs" },
        { "name": "action", "value": "summarize_document" },
        { "name": "feature_source", "value": "side_panel" },
        { "name": "event_category", "value": "active_summarize" }
      ]
    }
  ]
}

Key fields

Access requirements

Google Workspace Enterprise Standard or Plus with the Gemini Enterprise add-on. Development requires a Workspace Enterprise tenant with Gemini enabled.

References

• Admin SDK Reports API
• Gemini in Workspace apps audit events
• Google Vault now supports the Gemini app
• Elastic GCP Vertex AI integration
• Google Workspace Gemini enterprise security