If you want INSIGHT v4 documentation, see here ->
INSIGHT v4 documentation
Ctrlk
Contact UsVisit GuardWare
linkedinyoutube
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Cloud Monitoring

Cloud Monitoring monitors user activities within your organisation's Microsoft 365 and Google Workspace environments. These data are then analysed within GuardWare INSIGHT to provide dashboards, alerts, and reports on cloud usage and potential security incidents.

It monitors key cloud events such as:

  • Files accessed or downloaded from sensitive libraries

  • Access and download actions by anonymous, invited, or external users

  • Files accessed via shared links

  • Creation of anonymous links and external file access activities

  • Cloud storage file access, download, and link creation activities

  • Outgoing emails

Set up Integrations

Microsoft 365 and Google Workspace must each be connected to the Management Console before Cloud Monitoring can be set up for that service. Only once a service is connected can its monitoring be enabled or disabled.

Connect Microsoft 365

Requires an Azure Global Administrator account.

  1. Navigate to ORGANISATION > Integrations or from within Cloud Monitoring by clicking Configure Integrations.

  2. Click Connect Microsoft 365. You'll be redirected to Microsoft's sign-in page.

  3. Select your Global Administrator account or click Use another account if it is not listed.

  4. Enter your Global Administrator email address and password. Click Next and sign in.

  5. If your account is protected by multi-factor authentication (MFA), you'll need to approve the sign-in request. This might involve:

    1. Approving a notification in the Microsoft Authenticator app.

    2. Entering the code from your authenticator app.

    3. Responding to a text message or phone call, depending on your MFA settings.

  6. After authenticating, you'll see a permissions consent screen listing what DISCOVER is requesting access to. Select Consent on behalf of your organisation and click Accept.

  7. You'll be redirected back to the GuardWare Management Console, saying that the configuration was completed successfully.

Connect Google Workspace

Requires a Google Workspace administrator account, a security group with monitored users, and Google Service Account JSON credentials.

  1. Navigate to ORGANISATION > Google Workspace or INSIGHT > Cloud Monitoring and click Add Google Workspace.

  2. In Admin Email, enter the Google Workspace admin email address that is used to create the JSON Key.

  3. Enter the Security Group.

  4. Enable Gmail Monitoring and Google Drive Monitoring.

  5. Upload the Google Service Account JSON credentials you generated while setting up the Google Cloud Service Account.

  6. Click Submit.

Configure Cloud Monitoring

Cloud Monitoring Settings controls monitoring for Microsoft 365 and Google Workspace services. Enable or disable monitoring per service, manage which users' activities are monitored and sync cloud data here.

Configure Exchange Monitoring

Use this option to enable or disable monitoring of Microsoft Exchange activities.

  1. Navigate to INSIGHT > Cloud Monitoring.

  2. Toggle Exchange Monitoring to enable or disable Exchange monitoring.

  3. Click Save to apply the configuration.

Add Users to Security Group

The Security Group identifies the Microsoft 365 security group used for Exchange monitoring and is displayed when Exchange Monitoring is enabled.

  1. Click Assign Users.

  2. Select the users to be included in the monitoring group.

  3. Click Save to assign the selected users, or click Assign All Users to assign all the listed users.

Configure SharePoint Monitoring

Use this option to enable or disable monitoring of SharePoint activities.

  1. Navigate to INSIGHT > Cloud Monitoring.

  2. Toggle SharePoint Monitoring to enable or disable SharePoint monitoring.

  3. Click Save to apply the configuration.

Configure Gmail Monitoring

Use this option to enable or disable monitoring of Gmail activities.

  1. Navigate to INSIGHT > Cloud Monitoring.

  2. Toggle Gmail Monitoring to enable or disable Gmail monitoring.

  3. Click Save to apply the configuration.

Assign Users to Security Group

Use this option to assign the users whose Gmail activities are monitored.

  1. Click Assign Users.

  2. Select the users to be included in the monitoring group.

  3. Click Save to assign the selected users, or click Assign All Users to assign all the listed users.

Configure Google Drive Monitoring

Use this option to enable or disable monitoring of Google Drive activities.

  1. Navigate to INSIGHT > Cloud Monitoring.

  2. Toggle Google Drive Monitoring to enable or disable Google Drive monitoring.

  3. Click Save to apply the configuration.

Sync Cloud Monitoring

Manually refresh configuration and user information rather than waiting for the next scheduled sync.

  1. Navigate to INSIGHT > Cloud Monitoring.

  2. Click the Sync button to synchronise the latest configuration and user information from Microsoft 365.

The Last Synced field displays the date and time of the most recent successful synchronisation.

Assign Data Type

Control which sensitive data types Cloud Monitoring monitors.

  1. Click + Assign Data Type.

  2. Select the data types to monitor.

  3. Filter data types by category, including PCI, PII, SPI, and PHI, if required.

  4. Click Save to apply the changes.

PreviousOrganisation Settings
NextRisk Definitions

Last updated