google-workspace-security-report

Build concise weekly Google Workspace security reports from exported Admin Reports and customer usage evidence, including shadow AI OAuth activity, Gemini Workspace usage, Drive external exposure, login risk, admin configuration changes, and configuration snapshot metrics. Use when Codex needs to consolidate Google Workspace audit logs into Markdown, CSV, and JSON weekly reporting artifacts for MDR or executive review.

Jump to install

Repository: transilienceai/transilience-mdr-rainer
Last source activity: August 9, 2026 at 21:15
Detected SKILL.md language: English
Stars: 2
Forks: 0

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/transilienceai/transilience-mdr-rainer --skill google-workspace-security-report

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

6 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

aws-remediation-leverage

Rank AWS remediations by how many attack chains each one severs, so a team gets maximum blast-radius reduction per fix. Use when you have an aws_attack_chains/v1 file from the chain enumerator and need to turn it into a prioritized "biggest bang for the buck" remediation plan - which single control fix breaks the most kill chains and techniques, a severity-weighted leverage ranking, the crown jewels and accounts each fix protects, and a greedy do-in-this-order roadmap (marginal set-cover) showing how few fixes cover most of the attack surface, and a compounding matrix (which misconfiguration enables the next) so fixing the source control cuts a chain early. Final decision-support stage of the AWS red-team attack-chain suite.

2026-08-09

aws-attack-chain-enumerator

Traverse a merged aws_attack_model/v1 attack graph and emit aws_attack_chains/v1 - ranked kill chains from an entry (internet or a single stolen credential) to crown jewels, the atomic technique catalog of attack primitives actually present, and root causes rolled up by control. Use when turning a merged AWS attack model into scored attacker kill chains, an ATT&CK-mapped technique catalog, prioritized root causes, or the input a red-team report packager renders.

2026-08-09

aws-attack-graph-builder

Merge one or more aws_attack_model/v1 envelopes from the AWS attack-surface / identity-trust / crown-jewel / active-threat collectors into a single, de-duplicated attack graph ready for chain enumeration. Use when combining multiple collector outputs into one model, reconciling nodes and edges across accounts, validating that every edge references a real node, or producing the merged attack_model.json that aws-attack-chain-enumerator traverses.

2026-08-09

View all from this repository

name

google-workspace-security-report

description

Google Workspace Security Weekly Report

Use this skill to convert exported Google Workspace evidence into a weekly security report.

Workflow

Confirm the evidence directory contains exported Google Workspace *.ndjson files and optional customerUsageReports-YYYY-MM-DD.json.
Run scripts/build_weekly_google_workspace_report.py --input-dir <evidence> --output-dir <report-dir> --internal-domain <domain> --week-label <label>.
Review generated CSVs for Drive, login, admin, OAuth, Gemini, and configuration evidence.
Edit the Markdown executive narrative only after validating the source CSV/JSON counts.
Keep customer raw evidence and final customer reports out of public repositories.

Report Sections

The script generates a Markdown report with:

Executive summary.
Shadow AI and OAuth risk.
Gemini Workspace usage.
Drive external exposure.
Login and authentication risk.
Admin and configuration changes.
Configuration snapshot from customer usage reports.
Evidence files generated.

Use references/finding-rules.md for signal definitions. Use references/report-template.md when manually extending the generated report.

google-workspace-security-report

Source facts

Install options

Review the source files

More from this repository

More from this repository

Google Workspace Security Weekly Report

Workflow

Report Sections

Google Workspace Security Weekly Report

Workflow

Report Sections