Stolen passwords and account takeover
Someone signs in with a stolen or guessed password.
- Sign-ins from two places too far apart to travel between, and bursts of wrong passwords.
Google Workspace
Live
Ojava reads your Google Workspace audit logs and warns you about stolen passwords, mail forwarding, risky apps and new administrators.
What it catches
Attacks on the second sign-in step
The attacker has the password and tries to get past MFA or 2-step verification.
- Repeated failed 2-step verification codes.
Mail forwarding and invoice fraud
A hijacked mailbox quietly sends copies of your mail outside: the classic first step of invoice fraud.
- Forwarding to an address outside your domain.
Risky app access
Someone gives an unknown app access to mail or files, often after a phishing link.
- Apps granted access to Gmail, Drive or admin data.
New administrator rights
An account suddenly gets admin rights, so an attacker can take over the whole company account.
- Admin roles given to a user.
Mass downloads and data theft
Many files leave in a short time.
- 50 or more Drive downloads within an hour, where Google logs Drive activity.
Linked attacks
Related warning signs become one incident, so you see the whole story instead of separate alerts.
- For example a sign-in from abroad followed by forwarding to an outside address.
What you need
- Any Google Workspace business edition (from Business Starter)From Business Starter up. Sign-ins, admin changes, mail forwarding and app access work on every edition.
- Drive downloads, where Google logs themGoogle logs most Drive activity only for files owned by users on editions that support Drive audit. If you see Drive events under Reporting → Audit and investigation → Drive log events in your Admin console, Ojava sees them too.
- 2-step verification switched onNeeded for the alert on repeated failed 2-step verification codes.
- A super adminSigns in once to give Ojava read-only access to the audit reports.
How you connect it
- In Ojava: Settings → Integrations → Connect Google Workspace.
- Sign in as a super admin of your Workspace.
- Google lists the access Ojava asks for: your name and email address, "View audit reports for your Google Workspace domain" and "See info about users on your domain". Click Continue.
- Ojava starts reading right away; the first events appear within minutes.
Google’s "unverified app" notice
Google checks every app that asks to read Workspace audit reports. Until Google has finished checking Ojava, it may show a notice that it hasn’t verified this app. The access Ojava asks for stays the same: read-only, no emails, no files.
- On the notice "Google hasn’t verified this app", click Advanced.
- Click the link at the bottom: Go to … (unsafe).
- Check the access listed (your name and email, and "View audit reports for your Google Workspace domain") and click Continue.
Your Workspace can also block apps it does not know. A super admin can allow Ojava first: Admin console → Security → Access and data control → API controls → Manage App Access → Configure new app → search for Ojava → Trusted. Google does not say that this hides the notice, so you may still see it once.
What Ojava reads
Google’s audit reports: sign-ins (time, IP address, success or failure, 2-step verification), admin changes such as new admin roles, user-account events such as mail forwarding to an outside address, apps granted access to your data, and Drive activity records (file name and action, never the content). Permissions: two read-only data permissions, admin.reports.audit.readonly (the audit reports) and admin.directory.user.readonly (the list of users: address, name, active, suspended or archived, read once a day to count the active accounts for your plan limit and check that every account is monitored), plus Google’s standard sign-in permissions (openid, email, profile), which only tell Ojava which administrator approved.
What Ojava never reads
The content of emails, attachments, Drive files, chats or calendars. Ojava cannot change anything in your Google Workspace. When you disconnect, Ojava deletes its access and asks Google to revoke it.
What Ojava sees and never sees, per permission
| Permission (read-only) | What Ojava sees | What Ojava never sees or does |
|---|---|---|
admin.reports.audit.readonly | Google’s audit reports for your Workspace: sign-ins (time, IP address, success or failure, 2-step verification), admin changes, account events such as mail forwarding, apps granted access, Drive activity and sharing (action, how many files, outside address; file names only inside a mass-sharing alert, at most 20). | The content of emails, Drive files, chats or calendars; it cannot change any setting, user or file. |
admin.directory.user.readonly | The list of your Workspace users (address, name, active, suspended or archived), read once a day to count the active accounts for your plan limit and to check that every account is monitored. | It cannot create, change or delete users; no groups, passwords or user content. |
openid, profile, email | Who approved the connection (name and email of the super administrator). | Nothing else. |
How quickly alerts arrive
Ojava reads Google Workspace every 5 minutes. Google decides when its logs are available: sign-ins, admin and Drive events usually within a few minutes, user-account events (such as forwarding) within tens of minutes, app-access events within a few hours.
The other sources
Windows PCs
Early access: we set it up with youRansomware, malware, password-stealing tools and protection switched off, on each Windows PC. Works with or without Microsoft 365 or Google Workspace.
How it worksMicrosoft 365
LiveStolen passwords, failed MFA, mail forwarding, risky app access, new admins and mass downloads. Every business plan; faster with Entra ID P1.
How it works