Evidence formats

Google Workspace, Okta and AWS CloudTrail audit log analysis

Export the identity provider's and the cloud account's audit logs for the window you care about and drop them into a case. NEMUQU reads sign-ins, account, group and factor changes, OAuth grants and CloudTrail logging changes as structured events, and runs its cloud identity and account compromise packs over them. Each case gets a timeline, findings that cite the exact records behind them, a list of what the evidence cannot establish, and hunts compiled to Defender KQL, Sentinel KQL, Splunk SPL, Elastic ES|QL and Sigma for the tools you already run.

On this page

What you can upload

  • Google Workspace audit activities from the Admin SDK Reports API (login, user accounts, admin, token and drive), JSON or NDJSON
  • Okta System Log events from the API as JSON or NDJSON, or the Admin Console CSV download
  • AWS CloudTrail records: S3 delivery files after decompressing them, NDJSON, or aws cloudtrail lookup-events output

How to export it

Google Workspace

  1. Export the audit activities with the Admin SDK Reports API method activities.list, once for each application: login, user_accounts, admin, token and, on Business and Enterprise editions, drive. Set userKey to all, or to the user's address, and startTime and endTime as RFC 3339 times in UTC, for example 2026-10-01T00:00:00Z.
  2. Save each response as it is, as JSON. A response holds one page of activities; request the next page with its nextPageToken until there is none, and keep every page.
  3. The Admin console's audit and investigation pages also download CSV or Google Sheets files. They do not carry the same fields as the API, so send the API JSON instead.
  4. NEMUQU reads sign-ins, 2-Step Verification and Advanced Protection changes, user, role and group changes, Gmail forwarding and filter settings and OAuth grants as structured events, one per event in each activity. Google's own suspicious-login warnings are kept as its conclusions and never become findings on their own.

Access you need: The Reports API needs an administrator account authorized for the admin.reports.audit.readonly scope.

Okta

  1. From the System Log API (GET /api/v1/logs), request the window you need with since and until as ISO 8601 times, and save every page of the response as JSON. The API keeps about 90 days of events.
  2. Or, in the Admin Console, open Reports, then System Log, set the time range and filters, and download the results as CSV. Keep the column names as Okta writes them, for example actor.alternateId and outcome.result.
  3. Include sign-ins (user.session.start, user.authentication.*), factor changes (user.mfa.factor.*), group and privilege changes and OAuth grants (app.oauth2.*) for the accounts involved, not only failures.
  4. NEMUQU reads sign-ins by their recorded outcome and factor, group, privilege and OAuth grant events as changes only when Okta recorded SUCCESS. ThreatInsight detections and Okta's risk and behavior evaluations are kept as Okta's conclusions and never become findings on their own.

Access you need: Reading the System Log needs an Okta administrator role that can view reports, such as Read-only Administrator, or an API token or service app granted okta.logs.read.

AWS CloudTrail

  1. From a trail: copy the log files for the window you need from the trail's S3 bucket. They are delivered as .json.gz; decompress each one first, because a single compressed file is not extracted (a .tar.gz of several is). Each file holds a Records array.
  2. Without a trail: in the CloudTrail console open Event history in each Region involved, set the time range, clear the default Read-only filter if you need read events too, and choose Download events, then Download as JSON. Event history keeps 90 days of management events and does not include data events.
  3. Or run aws cloudtrail lookup-events with --start-time, --end-time and --region and save the output as JSON; each event's CloudTrailEvent field holds the full record.
  4. The CSV download leaves out the request and response details of each call, so send JSON.
  5. NEMUQU reads console sign-ins, IAM user, access key, password, policy, group and MFA device changes and trail logging changes, and keeps every other call as a record. A call AWS refused (an errorCode in the record) is never read as a change.

Access you need: AWS documents read access to CloudTrail (for example the AWSCloudTrail_ReadOnlyAccess managed policy) for Event history and lookup-events, and s3:GetObject on the trail's bucket for its log files.

What NEMUQU checks

  • CloudTrail logging stopped or a trail deleted; trail and event-selector changes are reported as observations
  • An AWS access key or console password created for an IAM user by a different principal, with later use of the new key cited when the evidence holds it
  • An authentication factor reset or removed in Okta, Google Workspace or IAM, followed by a sign-in for the same account within 12 hours
  • An OAuth grant in Google Workspace or Okta that gives an application full mail or Drive access, directory management or Okta management API scopes
  • Administrator roles granted: Okta Super or Organization Administrator, Google Workspace Super Admin, the AdministratorAccess policy on an IAM user
  • The account compromise checks, run over the same sign-ins and failures

Every finding cites the records behind it and states what it does not establish. Statistical signals are reported as rarity within your upload and never become findings. ATT&CK mappings describe what a behavior resembles, not proof that an adversary was present.

What it does not do

  • Okta ThreatInsight and risk evaluations and Google's suspicious-login warnings are kept as the providers' conclusions, labeled on the records, and never become findings
  • Gzip-compressed CloudTrail files (.json.gz) are not decompressed: decompress them first. The CloudTrail console's event history CSV and Google Admin console CSV downloads are read as plain tables, without these checks
  • Calls a stopped trail did not record are not in the evidence; another trail or region may have kept recording
  • Whether an application is approved is not in these logs; its name is chosen by whoever registered it
  • Calls refused by AWS and Okta changes that did not succeed are kept as records and never reported as changes

Try it

Browse the synthetic demo cases to see a finished investigation without an account. When you are ready, create an account and compare plans.

Other evidence formats