Gighub Issue Fix #14387 - Google Workspace Reports

[v-hectorsu_microsoft (Hector-Suarez)]

Required Items

Change(s):

• Added a DCR transformKql post-processor to the Google Workspace Reports data connector.
• The transform reconstructs scope_name and product_bucket for Google Workspace Token audit authorize events from the complete scope array.
• Updated the Google Workspace Reports solution package and release notes for version 3.0.6.

Reason for Change(s):

• The server-side /ASI/GoogleWorkspace/OneDetectionPerRow transform processed scope_data.multiMessageValue entries sequentially and wrote each entry to the same scope_name and product_bucket fields.
• This caused a last-entry-wins overwrite, leaving only the final scope and its associated product bucket in the ingested event.
• The new DCR transform preserves all scopes and derives all applicable distinct product buckets from the complete scope array.
• Resolves: Google Workspace CCF Connector Drops Product Buckets from OAuth Authorize Events #14387

Version Updated:

• Yes. Google Workspace Reports solution updated to version 3.0.6.
• No Detection or Analytic Rule templates were modified.

Testing Completed:

• Yes.
• Built the updated solution package and deployed the generated ARM template to a Microsoft Sentinel test environment.
• Connected the Google Workspace Activities Codeless Connector Framework connector and confirmed that ingestion continued successfully.
• Verified historical events before the fix exhibited the reported last-entry-wins behavior.
• Verified newly ingested authorize events after deployment contained the complete scope_name array.
• Verified product_bucket contained all distinct product categories derived from the complete scope array.
• Confirmed that multiple scopes mapping to the same product category correctly produce one distinct product bucket.
• Validation screenshots are attached to the linked issue/work item.
• The transform applies only to applicable authorize events; unrelated Google Workspace events remain unchanged.

Checked that the validations are passing and have addressed any issues that are present:

• Yes.
• The solution package was generated successfully and the resulting ARM template was deployed successfully.
• Repository PR validation checks will also be monitored, and any reported issues will be addressed before merge.

Validation screenshots:

1. Connector connected after deployment: It shows the connector is connected, receiving logs, and has the deployed connector resources.

2. Before the fix: It shows historical authorize events where scope_name and product_bucket retained only the last value.

3. After the fix: It shows the post-deployment validation results, including ScopeCount, BucketCount, and ProductBuckets.

[v-hectorsu_microsoft (Hector-Suarez)]

@microsoft-github-policy-service agree company="Microsoft"