A third-party application's access to the Google Workspace domain's resources was revoked
Synopsis
Activation Period
14 Days
Training Period
30 Days
Test Period
N/A (single event)
Deduplication Period
5 Days
Required Data
Google Workspace Audit Logs
Detection Modules
Identity Threat Module, SaaS Threat Detection
Detector Tags
Google Workspace
ATT&CK Tactic
Impact (TA0040)
ATT&CK Technique
Account Access Removal (T1531)
Severity
Informational
Description
An identity removed a third-party application's access to Google Workspace domain's resources.
Attacker's Goals
An attacker might remove an application to impair the environment.
Investigative actions
Check the Google Workspace Application settings to determine which actions were triggered.
Investigate the source of the request and the user associated with it.
Review the access control policies to determine if the removal of the application is allowed.
Was this helpful?