Google Drive Cloud Sensor

The Google Drive Cloud Sensor uses Google Workspace APIs to provide visibility into file activities within Google Drive. It enables Cyberhaven to capture and correlate user activity across browser and cloud surfaces, even when endpoint sensors are not present.

Before you begin, review prerequisites: Google Drive Prerequisites

Connect Cyberhaven to Google Drive

To connect your Google Workspace tenant, enable domain‑wide delegation for the Google Workspace domain you want to connect, then complete the steps in the Console.

1. In the Cyberhaven Console, click the cloud icon in the left navigation (bottom‑left).
2. Click the + (plus) symbol next to Google Drive to connect an instance.
3. In the pop‑up window, open the Connection Guide dropdown and follow the Pre‑connection steps to authorize Cyberhaven access to your Google Workspace domain (domain‑wide delegation).
4. Enter the admin email address used for domain‑wide delegation and continue.
5. After successful authorization, the connected instance appears in the Cloud Sensors list and begins monitoring file activity for that domain.

It can take up to one hour for events to appear in the Console after connection.

Connect Multiple Google Drive Instances

Cyberhaven supports configuring and managing multiple Google Drive instances concurrently for centralized visibility across multiple environments.

1. On the Cloud Sensors page, click the + (plus) symbol next to Google Drive to connect an additional instance.
2. In the pop‑up window, open the Connection Guide dropdown and follow the Pre‑connection steps to authorize Cyberhaven for the additional Google Workspace domain.
3. Enter the admin email address configured for domain‑wide delegation for the additional instance and complete the connection.

Repeat these steps for each additional Google Drive instance. Each instance appears separately in your Cyberhaven Console.

Coverage

The Google Drive Cloud Sensor provides visibility into: download, upload, share, open, create, move, rename, copy, and delete activities.

Event lineage is compatible with all Cyberhaven browser extension versions; upgrading to the latest extension is recommended.

Metadata collected

The sensor collects: cloud app, file name (displayed as Path in the UI), file ID, domain, actor (user), action (e.g., rename/download), and event timestamp. Cyberhaven correlates events across browser extension and cloud sensor using a combination of action, actor, file ID, and timestamp.

Troubleshooting

• Authorization issues: Ensure domain‑wide delegation was completed as described in the Connection Guide and that the admin email entered matches the delegated admin.
• No events appearing: It may take up to one hour for events to appear. Verify the sensor shows as Connected and that the required Google Admin APIs are enabled.

Disconnect

• To disconnect the Google Drive connector, click DISCONNECT in the connector details on the Cloud Sensors page.