Got contracted by a client to work with their Google Workspace account and automate security features.
For reference:
https://developers.google.com/admin-sdk/alertcenter/reference/alert-types
https://developers.google.com/admin-sdk/alertcenter/reference/rest/v1beta1/MailPhishing
https://developers.google.com/admin-sdk/alertcenter/reference/rest/v1beta1/GmailMessageInfo
https://developers.google.com/gmail/api/reference/rest/v1/users.messages
https://developers.google.com/gmail/api/reference/rest/v1/users.messages.attachments
Why are there "Suspicious message reported" and "User reported Phishing" categories but there is no "User reported spam"? Is "Suspicious" actually "Spam"? Or Phishing? It is not explained in documentation. The user interface in Gmail only has two button to report emails. Spam and Phishing. What do you mean by "Suspicious message"?
Why is there no way to download attachments or entire mail headers + body with the alert center API? How are we expected to analyze suspicious emails?
If we have to use the Gmail API, why is the messageId that comes within the alert message list different from the ID used in the Gmail api to retrieve messages? How are we supposed to get the entire message? I couldnt find an API that translates one into the another.
Regarding hashes that come inside "attachmentsSha256Hash[]": It is not specified to what each belongs to. Is the first one always related to the body? Or to what MIME part? Sometimes there is only 1 value, some others 2 and some others 3 or more.
Why when the client gets email from domains that are not under their control the "isInternal" value is set to true? This should be set to false.
I can expect this kind of errors and confusion from a small startup or SaaS with a low price tag but not from a company with such trajectory and that tries to compete with O365. This is unacceptable.
Setting up an alert center API. Not something I am super familiar with but used the documentation I found from Google.
Steps taken
-
Created project
-
Added alert Center API
-
created service account and generated a key
-
Set 0Auth up. ( Internal )did not list a scope. attempted to list the scope manually with the following URL found in documentation https://www.googleapis.com/auth/apps.alerts But it says this is invalid.
-
Added to Google workspace. Security -> API Controls -> Manage third Part app access -> add app -> full access
I now use the JSON key from the service account to link the api with third party software for logging but authentication to the service account fails.
If anyone sees any big holes in this please let me know. Feel like I am close but obviously missing something. Here is the documentation I used. https://developers.google.com/admin-sdk/alertcenter/guides/prerequisites