Affordable Cybersecurity Solutions Within Google Ecosystem

Open-Source and Free Tools for Enhancing Security in Google’s Ecosystem

Curated List of Six Open-Source Tools for Google Environment Security

• OSSEC (Open Source Host-based Intrusion Detection System) OSSEC monitors log files from Google Workspace (e.g., Gmail, Drive, or Admin SDK logs) for suspicious activities like brute-force attempts, unusual login locations, or data exfiltration. It supports real-time alerts via email or Slack and integrates with Google Cloud Logging for centralized analysis.

  Use Case: Deploy OSSEC on a Linux server with access to Google Workspace audit logs to detect anomalies in user behavior, such as sudden bulk downloads or login attempts from high-risk countries.

• Fail2Ban Fail2Ban dynamically blocks IP addresses attempting repeated failed logins to Google accounts (e.g., via SMTP, IMAP, or OAuth). It parses authentication logs from Google Workspace or Android devices to mitigate credential-stuffing attacks.

  Configuration Note: Configure Fail2Ban to monitor /var/log/mail.log (for Workspace) or Android device logs (via ADB) for failed OAuth token requests.

• Wazuh Wazuh extends OSSEC with advanced threat detection, including file integrity monitoring (FIM) for Google Drive files and endpoint detection for Android devices. It correlates logs from Google’s Admin SDK with local device events to identify lateral movement or malware.

  Key Feature: Uses machine learning to detect deviations in Google Workspace API usage patterns, such as unexpected script executions in Google Apps Script.

• ClamAV ClamAV scans attachments in Gmail or files uploaded to Google Drive for malware. It integrates with Google Workspace via custom scripts that trigger scans on upload or forward suspicious files to a quarantine folder.

  Integration Tip: Use Google Apps Script to automate ClamAV scans on Drive uploads by invoking a local or cloud-based ClamAV instance via API calls.

• Suricata Suricata analyzes network traffic from Google Workspace (e.g., VPN or proxy logs) to detect phishing domains, C2 communication, or data leaks. It can be deployed alongside Google’s reCAPTCHA Enterprise to add an extra layer of traffic inspection.

  Example Rule: Custom rules to flag HTTP requests to known phishing domains (e.g., alert tcp any any -> any 80 (msg:"Phishing Attempt"; content:"login.google.com"; nocase; threshold:type threshold, track by_src, count 5, seconds 300;)).

• OpenInvestigate OpenInvestigate automates forensic investigations by parsing Google Workspace logs (e.g., Gmail headers, Drive metadata) to reconstruct attack timelines. It identifies compromised accounts by analyzing email forwarding rules or shared Drive permissions.

  Output: Generates timelines of suspicious activities, such as sudden permission changes to shared Google Drive folders or email aliases added to accounts.

Deployment of a Free Google Sheets-Based Threat Log Analyzer

Prerequisites:

Implementation Steps:

1. Set Up Audit Log Export Enable audit log export in the Google Admin Console under Reports > Audit > Export. Choose "Login Events" and "User Activity" logs, then select a destination bucket (e.g., Google Cloud Storage).
2. Create a Google Apps Script Trigger Use the following script to fetch logs daily and append them to the Sheet. Replace YOUR_SERVICE_ACCOUNT_EMAIL and YOUR_PRIVATE_KEY with credentials from the Admin SDK.

           function fetchAuditLogs() {
   
             const sheet = SpreadsheetApp.getActiveSpreadsheet().getSheetByName("Logins");
   
             const serviceAccount = "YOUR_SERVICE_ACCOUNT_EMAIL";
   
             const privateKey = "-----BEGIN PRIVATE KEY-----\nYOUR_PRIVATE_KEY\n-----END PRIVATE KEY-----";
   // Authenticate and fetch logs from the last 24 hours
   
             const jwtClient = OAuth2.createService("AuditLogs")
   
               .setAuthorizationType(OAuth2Service.AuthorizationType.JWT)
   
               .setServiceAccountId(serviceAccount)
   
               .setPrivateKey(privateKey)
   
               .setName("AuditLogsService")
   
               .setIssuer("YOUR_DOMAIN");
   const response = UrlFetchApp.fetch(
   
               "https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/login?maxResults=1000&userKey=all&key=AIzaSy...",
   
               {
   
                 headers: { Authorization: "Bearer " + jwtClient.getAccessToken() }
   
               }
   
             );
   
             const logs = JSON.parse(response.getContentText()).items;
   // Append logs to Sheet
   
             logs.forEach(log => {
   
               sheet.appendRow([
   
                 log.id.time,
   
                 log.events[0].parameters.loginTime,
   
                 log.events[0].parameters.ipAddress,
   
                 log.events[0].parameters.loginType,
   
                 log.events[0].parameters.loginStatus
   
               ]);
   
             });
   
           }
   
           

   Schedule this script to run daily via Triggers > Add Trigger.
3. Add Conditional Formatting for Anomalies Use Google Sheets’ conditional formatting to highlight:
   • Logins from high-risk countries (e.g., IP ranges from known threat actors).
   • Multiple failed login attempts within 5 minutes.
   • Logins outside of user’s typical time zone.
   Example rule for failed logins:

           =COUNTIFS(Logins!C:C, "FAILED", Logins!A:A, ">="&TODAY()-1) > 3
   
           

4. Automate Phishing Detection Extend the script to parse Gmail logs for phishing indicators (e.g., emails with malicious links or spoofed sender addresses). Use a regex pattern to match known phishing domains:

           function detectPhishing() {
   
             const phishingSheet = SpreadsheetApp.getActiveSpreadsheet().getSheetByName("Phishing Attempts");
   
             const emails = GmailApp.search("from:external after:1d", 0);
   emails.forEach(email => {
   
               const body = email.getBody();
   
               if (/https?:\/\/(?:[^\/\s]+\.)?google\.com\.[^\/\s]+|login\.google\.com/i.test(body)) {
   
                 phishingSheet.appendRow([email.getDate(), email.getFrom(), email.getSubject(), body]);
   
               }
   
             });
   
           }
   
           

Custom Google Chrome Extension to Block Malicious Sites Without Ads

Key Components: