Google Drive Connector

FortiDLP's Google Drive integration provides comprehensive visibility into cloud activity generated by FortiDLP users across all their devices, both managed and unmanaged.

For example, you can track when a user is granted permissions to share documents and then when they modify a document's sharing permissions to make it publicly available.

Once a connection is made to Google, FortiDLP users are mapped to events in the cloud, which are then reported in the Investigate module as Google Drive events.

As events are collected from the cloud drive, there is no requirement for the FortiDLP Agent to be installed on users' devices when you use this feature.

Google Drive event types

The following Google Drive event types are collected. For more information about them, refer to Google's documentation here.

• ADDED_TO_FOLDER
• COPIED
• CREATED
• DELETED
• DOWNLOADED
• DRIVE_EMAILED_AS_ATTACHMENT
• EDITED
• FORMS_RESPONSES_DOWNLOADED
• LABEL_APPLIED
• LABEL_APPLIED_ON_CREATION
• LABEL_FIELD_VALUE_CHANGED
• MOVED
• VIEWED
• PRINTED
• REMOVED_FROM_FOLDER
• RENAMED
• RESTORED
• UPLOADED
• DOCUMENT_CHANGED_OWNERS
• DRIVE_PUBLISH_STATUS_CHANGED
• EDITOR_SETTINGS_CHANGED
• LINK_SHARING_ACCESS_TYPE_CHANGED
• LINK_SHARING_VISIBILITY_CHANGED
• PUBLISHED_NEW_VERSION
• SHARED_DRIVE_MEMBERSHIP_CHANGED
• SHARED_DRIVE_SETTINGS_CHANGED
• USER_SHARING_PERMISSIONS_CHANGED

At times, duplicate events may be sent by Google and therefore reported in the event stream.

To set up this feature, see Enabling the Google Drive Connector or refer to the FortiDLP Google Drive Connector Quick Start Guide.