ALFA stands for Automated Audit Log Forensic Analysis for Google Workspace. You can use this tool to acquire all Google Workspace audit logs and to perform automated forensic analysis on the audit logs using statistics and the MITRE ATT&CK Cloud Framework
License: MIT License
Hi and thank you for your contribution!
I've noticed there are no logs collected for the Gmail app in the 'config.yml'.
It will be great if you can add it to ALFA!
When trying out: A.aoi(export='activities.json')
---------------------------------------------------------------------------
TypeError Traceback (most recent call last)
Input In [6], in <cell line: 1>()
----> 1 A.aoi(export='activities.json')
File ~/cloud/ALFA/alfa/main/alfa.py:169, in Alfa.aoi(self, export, nd)
167 f.write(row.to_json()+'\n')
168 else:
--> 169 aoi.to_json(export, orient='records')
170 print('saved to', export)
171 return aoi
File ~/.pyenv/versions/3.10.8/envs/ALFA/lib/python3.10/site-packages/pandas/core/generic.py:2558, in NDFrame.to_json(self, path_or_buf, orient, date_format, double_precision, force_ascii, date_unit, default_handler, lines, compression, index, indent, storage_options)
2555 config.is_nonnegative_int(indent)
2556 indent = indent or 0
-> 2558 return json.to_json(
2559 path_or_buf=path_or_buf,
2560 obj=self,
2561 orient=orient,
2562 date_format=date_format,
2563 double_precision=double_precision,
2564 force_ascii=force_ascii,
2565 date_unit=date_unit,
2566 default_handler=default_handler,
2567 lines=lines,
2568 compression=compression,
2569 index=index,
2570 indent=indent,
2571 storage_options=storage_options,
2572 )
File ~/.pyenv/versions/3.10.8/envs/ALFA/lib/python3.10/site-packages/pandas/io/json/_json.py:123, in to_json(path_or_buf, obj, orient, date_format, double_precision, force_ascii, date_unit, default_handler, lines, compression, index, indent, storage_options)
110 else:
111 raise NotImplementedError("'obj' should be a Series or a DataFrame")
113 s = writer(
114 obj,
115 orient=orient,
116 date_format=date_format,
117 double_precision=double_precision,
118 ensure_ascii=force_ascii,
119 date_unit=date_unit,
120 default_handler=default_handler,
121 index=index,
122 indent=indent,
--> 123 ).write()
125 if lines:
126 s = convert_to_line_delimits(s)
File ~/.pyenv/versions/3.10.8/envs/ALFA/lib/python3.10/site-packages/pandas/io/json/_json.py:175, in Writer.write(self)
173 def write(self):
174 iso_dates = self.date_format == "iso"
--> 175 return dumps(
176 self.obj_to_write,
177 orient=self.orient,
178 double_precision=self.double_precision,
179 ensure_ascii=self.ensure_ascii,
180 date_unit=self.date_unit,
181 iso_dates=iso_dates,
182 default_handler=self.default_handler,
183 indent=self.indent,
184 )
TypeError: 'float' object cannot be interpreted as an integer
I was testing the tool and was wondering if there is a full list of options for the alfa acquire -l command
Also with the logs being saved in JSON, do you have any recommendations on getting it into CSV format? Or could this be an output option?
Hi,
The installation was a breeze on the Google CLoud shell instance. After adding the credential (JSON) file, I need to Oauth it via the generated (using alfa acquire) link that features the Please visit this URL to authorize this application text: https://accounts*. After visiting the URL, I get page not found, as http://localhost:8089/ is not reachable. Any suggestions on how to install it in Cloud Shell environment/?
Note. I tried to set HTTP://localhost as a redirect on the GVP, but it seems the app is hardcoded.
Thank you!
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
Django
The Web framework for perfectionists with deadlines.
Laravel
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft
Open source projects and samples from Microsoft.
Google
Google ❤️ Open Source for everyone.
Alibaba
Alibaba Open Source for everyone
D3
Data-Driven Documents codes.
Tencent
China tencent open source team.