Details
Content
Dependencies
Version History

Google Drive allows users to store files on their servers, synchronize files across devices, and share files. This integration helps you to create a new drive, query past activity and view change logs performed by the users, as well as list drives and files, and manage their permissions.

Google Drive

This pack includes XSIAM content.

To configure the ingestion of data from Google Workspace, see the information here.

Pay attention: Timestamp parsing is available for UTC (+0000) timezone of the following formats:
- %Y-%m-%dT%H:%M:%SZ - UTC (+0000) format.
- %Y-%m-%dT%H:%M:E3SZ - UTC (+0000) format with 3 digits of fractional precision.

Google Drive

This pack includes XSIAM content.

To configure the ingestion of data from Google Workspace, see the information here.

Pay attention: Timestamp parsing is available for UTC (+0000) timezone of the following formats:
- %Y-%m-%dT%H:%M:%SZ - UTC (+0000) format.
- %Y-%m-%dT%H:%M:E3SZ - UTC (+0000) format with 3 digits of fractional precision.

Classifiers

Name	Description
Google Drive - Classifier	Classifies Google Drive Incidents.
Google Drive - Incoming Mapper	Maps incoming Google Drive incident fields.

Incident Fields

Name	Description
Google Drive Activity Removed Permissions	The set of permissions removed by this change.
Google Drive Activity Assignment Subtype	The sub-type of this event.
Google Drive Activity Delete Type	The type of delete action taken.
Google Drive Activity Assigned Person Name	The user to whom the comment was assigned.
Google Drive Activity Added Parents	The added parent object(s).
Google Drive Activity Identified As
Google Drive Activity Copied Item Is File	A Drive item which is a file.
Google Drive Activity Restore Type	The type of restore action taken.
Google Drive Activity Mentioned Users	Users who are mentioned in this comment.
Google Drive Activity Created New	Indicates the object was newly created (e.g. as a blank document), not derived from a Drive object or external object.
Google Drive Activity Copied Folder Type	The type of a Drive folder.
Google Drive Activity Added Permissions	The set of permissions added by this change.
Google Drive Activity Assigned Current User	True if this is the user making the request.
Google Drive Activity Restriction Changes	The set of changes made to restrictions.
Google Drive Activity Post Subtype	The sub-type of this event.
Google Drive Activity New Title	The new title of the drive object.
Google Drive Activity Copied Item Name	The target Drive item. The format is "items/ITEM_ID".
Google Drive Activity Reference Type	The reference type corresponding to this event.
Google Drive Activity Targets
Google Drive Activity Copied Item Title	The title of the Drive item.
Google Drive Activity Removed Parents	The removed parent object(s).
Google Drive Activity Copied Shared Drive Name	The resource name of the shared drive.
Google Drive Activity Copied Shared Drive Title	The title of the shared drive.
Google Drive Activity Suggestion Subtype	The sub-type of this event.
Google Drive Activity Assigned Deleted User	A user whose account has since been deleted.
Google Drive Activity Uploaded	Indicates the object originated externally and was uploaded to Drive.
Google Drive Activity Assigned Unknown User	A user about whom nothing is currently known.
Google Drive Activity Old Title	The previous title of the drive object.
Google Drive Activity DLP Change Type	The type of Data Leak Prevention (DLP) change.

Incident Types

Name	Description
Google Drive Activity

Integrations

Name	Description
Google Drive	Google Drive allows users to store files on their servers, synchronize files across devices, and share files. This integration helps you to create a new drive, query past activity, and view change logs performed by the users.

Layouts

Name	Description
Google Drive Activity	Google Drive Activity Layout

Classifiers

Name	Description
Google Drive - Classifier	Classifies Google Drive Incidents.
Google Drive - Incoming Mapper	Maps incoming Google Drive incident fields.

Incident Fields

Name	Description
Google Drive Activity Removed Permissions	The set of permissions removed by this change.
Google Drive Activity Restriction Changes	The set of changes made to restrictions.
Google Drive Activity Assigned Unknown User	A user about whom nothing is currently known.
Google Drive Activity Copied Folder Type	The type of a Drive folder.
Google Drive Activity Uploaded	Indicates the object originated externally and was uploaded to Drive.
Google Drive Activity Identified As
Google Drive Activity Assigned Deleted User	A user whose account has since been deleted.
Google Drive Activity Copied Shared Drive Name	The resource name of the shared drive.
Google Drive Activity Assigned Current User	True if this is the user making the request.
Google Drive Activity Assignment Subtype	The sub-type of this event.
Google Drive Activity Added Parents	The added parent object(s).
Google Drive Activity DLP Change Type	The type of Data Leak Prevention (DLP) change.
Google Drive Activity Copied Item Title	The title of the Drive item.
Google Drive Activity Created New	Indicates the object was newly created (e.g. as a blank document), not derived from a Drive object or external object.
Google Drive Activity Removed Parents	The removed parent object(s).
Google Drive Activity Copied Item Name	The target Drive item. The format is "items/ITEM_ID".
Google Drive Activity Targets
Google Drive Activity Old Title	The previous title of the drive object.
Google Drive Activity New Title	The new title of the drive object.
Google Drive Activity Copied Item Is File	A Drive item which is a file.
Google Drive Activity Delete Type	The type of delete action taken.
Google Drive Activity Assigned Person Name	The user to whom the comment was assigned.
Google Drive Activity Restore Type	The type of restore action taken.
Google Drive Activity Suggestion Subtype	The sub-type of this event.
Google Drive Activity Added Permissions	The set of permissions added by this change.
Google Drive Activity Reference Type	The reference type corresponding to this event.
Google Drive Activity Copied Shared Drive Title	The title of the shared drive.
Google Drive Activity Mentioned Users	Users who are mentioned in this comment.
Google Drive Activity Post Subtype	The sub-type of this event.

Incident Types

Name	Description
Google Drive Activity

Integrations

Name	Description
Google Drive	Google Drive allows users to store files on their servers, synchronize files across devices, and share files. This integration helps you to create a new drive, query past activity, and view change logs performed by the users.

Modeling Rules

Name	Description
Google Drive Modeling Rule

Parsing Rules

Name	Description
GoogleDrive Parsing Rule

Required Content Packs (2)

Pack Name	Pack By
Base	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

Optional Content Packs (6)

Pack Name	Pack By
Common Types	By: Cortex XSOAR
Google SecOps	By: Google
NIST	By: Cortex XSOAR
Phishing	By: Cortex XSOAR
RiskIQ Digital Footprint	By: RiskIQ
SANS	By: Cortex XSOAR

All level dependencies (3)

Pack Name	Pack By
Base	By: Cortex XSOAR
Aggregated Scripts	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

1.5.0 - 9981621 (June 9, 2026)

Integrations

Google Drive

Updated the google-drive-file-delete command to support moving a file to Trash via the new soft_delete argument.
Updated the google-drive-file-permission-create command to support ownership transfer via the new transfer_ownership and move_to_new_owners_root arguments when promoting a user to file owner.
Updated the google-drive-file-permission-delete command with the new ignore_not_found argument, which allows already removed permissions to be treated as a success.
Updated the google-drive-file-permissions-list command to indicate whether each permission is inherited and from where it is inherited.

Related pull requests:
- 44555
- 44476

Download

1.4.0 - 8888333 (May 10, 2026)

Integrations

Google Drive

Added support for google-drive-file-move command that moves a file from one folder to another by modifying its parent folder references. used for quarantine workflows.
Added support for google-drive-file-create command that creates a new metadataonly file or folder without uploading content. use for creating quarantine folders or tombstone placeholder files.
Updated the Docker image to: demisto/googleapi-python3:1.0.0.8516410.

Related pull requests:
- 44220
- 43776

Download

1.3.21 - 8515806 (April 27, 2026)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 43940

Download

1.3.20 - 8479105 (April 26, 2026)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 43941

Download

1.3.19 - 7827247 (March 22, 2026)

Documentation and metadata improvements.

Related pull requests:
- 43566

Download

1.3.18 - 5689147 (November 2, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 41690

Download

1.3.17 - 5636304 (October 29, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 41629

Download

1.3.16 - R5469292 (October 20, 2025)

Integrations

Google Drive

Improved error message from the vendor.

Related pull requests:
- 39991

Download

1.5.0 - 9981621 (June 9, 2026)

Integrations

Google Drive

Updated the google-drive-file-delete command to support moving a file to Trash via the new soft_delete argument.
Updated the google-drive-file-permission-create command to support ownership transfer via the new transfer_ownership and move_to_new_owners_root arguments when promoting a user to file owner.
Updated the google-drive-file-permission-delete command with the new ignore_not_found argument, which allows already removed permissions to be treated as a success.
Updated the google-drive-file-permissions-list command to indicate whether each permission is inherited and from where it is inherited.

Related pull requests:
- 44555
- 44476

Download

1.4.0 - 8888333 (May 10, 2026)

Integrations

Google Drive

Added support for google-drive-file-move command that moves a file from one folder to another by modifying its parent folder references. used for quarantine workflows.
Added support for google-drive-file-create command that creates a new metadataonly file or folder without uploading content. use for creating quarantine folders or tombstone placeholder files.
Updated the Docker image to: demisto/googleapi-python3:1.0.0.8516410.

Related pull requests:
- 44220
- 43776

Download

1.3.21 - 8542515 (April 28, 2026)

Modeling Rules

Google Drive Modeling Rule

Documentation and metadata improvements.

Related pull requests:
- 43940

Download

1.3.20 - 8479105 (April 26, 2026)

Parsing Rules

GoogleDrive Parsing Rule

Documentation and metadata improvements.

Related pull requests:
- 43941

Download

1.3.19 - 7827247 (March 22, 2026)

Documentation and metadata improvements.

Related pull requests:
- 43566

Download

1.3.18 - 5689147 (November 2, 2025)

Modeling Rules

Google Drive Modeling Rule

Implemented structure changes for backend compatibility.

Related pull requests:
- 41690

Download

1.3.17 - 5636304 (October 29, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 41629

Download

1.3.16 - R5469292 (October 20, 2025)

Integrations

Google Drive

Improved error message from the vendor.

Related pull requests:
- 39991

Download

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Cortex
Created	August 14, 2020
Last Release	June 9, 2026

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

By downloading or using Marketplace content, you agree to the applicable Terms of Use and End User License Agreement. Third-party content is provided by its publisher, and Palo Alto Networks does not warrant, endorse, support, or assume responsibility for content not expressly identified as owned by Palo Alto Networks.