[google_workspace] Add calendar event type as a new data stream

packages/google_workspace/_dev/build/docs/README.md

@@ -28,6 +28,7 @@ It is compatible with a subset of applications under the [Google Reports API v1]
 | [GCP](https://developers.google.com/admin-sdk/reports/v1/appendix/activity/gcp) | The GCP activity report returns information about various types of Google Cloud Platform activity events. |
 | [Chrome](https://developers.google.com/admin-sdk/reports/v1/appendix/activity/chrome) | The Chrome activity reports return information about Chrome browser and Chrome OS events. |
 | [Data Studio](https://developers.google.com/admin-sdk/reports/v1/appendix/activity/data-studio) | Track and audit user interactions and changes made to Looker Studio assets. |
+| [Calendar](https://developers.google.com/admin-sdk/reports/v1/appendix/activity/calendar) | The Calendar activity report returns information about how your account's users manage and modify their Google Calendar events. |
 
 ## Requirements
 
@@ -44,7 +45,7 @@ This integration will make use of the following *oauth2 scope*:
 
 Once you have downloaded your service account credentials as a JSON file, you are ready to set up your integration.
 
-Click the Advanced option of Google Workspace Audit Reports. The default value of "API Host" is `https://www.googleapis.com`. The API Host will be used for collecting `access_transparency`, `admin`, `chrome`, `context_aware_access`, `data_studio`, `device`, `drive`, `gcp`, `groups`, `group_enterprise`, `login`, `rules`, `saml`, `token` and `user accounts` logs.
+Click the Advanced option of Google Workspace Audit Reports. The default value of "API Host" is `https://www.googleapis.com`. The API Host will be used for collecting `access_transparency`, `admin`, `calendar`, `chrome`, `context_aware_access`, `data_studio`, `device`, `drive`, `gcp`, `groups`, `group_enterprise`, `login`, `rules`, `saml`, `token` and `user accounts` logs.
 
 >  NOTE: The `Delegated Account` value in the configuration, is expected to be the email of the administrator account, and not the email of the ServiceAccount.
 
@@ -274,3 +275,11 @@ This is the `data_studio` dataset.
 {{event "data_studio"}}
 
 {{fields "data_studio"}}
+
+### Calendar
+
+This is the `calendar` dataset.
+
+{{event "calendar"}}
+
+{{fields "calendar"}}

packages/google_workspace/_dev/deploy/docker/config.yml

@@ -407,6 +407,39 @@ rules:
           "events":[{"type":"ACCESS","name":"DELETE_DISTRIBUTION_CONTENT","parameters":[{"name":"ASSET_ID","value":"abc-123"},{"name":"ASSET_NAME","value":"[Sample]ReportName"},{"name":"OWNER_EMAIL","value":"[email protected]"},{"name":"ASSET_TYPE","value":"REPORT"},
           {"name":"VISIBILITY","value":"PEOPLE_WITHIN_DOMAIN_WITH_LINK"},{"name":"PARENT_WORKSPACE_ID","value":""},{"name":"CONNECTOR_TYPE","value":""},{"name":"DISTRIBUTION_CONTENT_NAME","value":"[Sample]ReportName"},
           {"name":"DISTRIBUTION_CONTENT_OWNER_EMAIL","value":"[email protected]"},{"name":"DISTRIBUTION_CONTENT_ID","value":"abc-123"},{"name":"DISTRIBUTION_CONTENT_TYPE","value":"SCHEDULE"}]}]}]}
+  - path: /admin/reports/v1/activity/users/all/applications/calendar
+    methods: ['GET']
+    query_params:
+      maxResults: 1
+      pageToken: page-2
+    request_headers:
+      Authorization:
+        - "Bearer 1/fFAGRNJru1FTz70BzhT3Zg"
+    responses:
+      - status_code: 200
+        headers:
+          Content-Type:
+            - "application/json"
+        body: |-
+          {"kind":"admin#reports#activities","items":[{"kind":"admin#reports#activity","id":{"time":"2025-04-01T07:10:14.651Z","uniqueQualifier":"1","applicationName":"calendar","customerId":"1"},"etag":"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A","actor":{"email":"[email protected]","profileId":"1"},
+          "ownerDomain":"elastic.com","ipAddress":"67.43.156.13","events":[{"type":"event_change","name":"transfer_event_requested","parameters":[{"name":"event_id","value":"abc123"},{"name":"organizer_calendar_id","value":"[email protected]"},{"name":"calendar_id","value":"[email protected]"},
+          {"name":"event_title","value":"TestEvent"},{"name":"recurring","value":"no"},{"name":"client_side_encrypted","value":"no"},{"name":"grantee_email","value":"[email protected]"},{"name":"api_kind","value":"web"},{"name":"user_agent","value":"Mozilla/5.0"}]}]}]}
+  - path: /admin/reports/v1/activity/users/all/applications/calendar
+    methods: ['GET']
+    query_params:
+      maxResults: 1
+    request_headers:
+      Authorization:
+        - "Bearer 1/fFAGRNJru1FTz70BzhT3Zg"
+    responses:
+      - status_code: 200
+        headers:
+          Content-Type:
+            - "application/json"
+        body: |-
+          {"kind":"admin#reports#activities","nextPageToken":"page-2","items":[{"kind":"admin#reports#activity","id":{"time":"2025-04-01T07:13:46.662Z","uniqueQualifier":"1","applicationName":"calendar","customerId":"1"},"etag":"abcdefgh/cBsNSJx2A9Lg8kiQCGLddmq827A","actor":{"email":"[email protected]","profileId":"1"},
+          "ownerDomain":"elastic.com","ipAddress":"67.43.156.13","events":[{"type":"event_change","name":"delete_event","parameters":[{"name":"event_id","value":"abc123"},{"name":"organizer_calendar_id","value":"[email protected]"},{"name":"calendar_id","value":"[email protected]"},{"name":"event_title","value":"TestEvent"},
+          {"name":"recurring","value":"no"},{"name":"client_side_encrypted","value":"no"},{"name":"start_time","intValue":"63879175800"},{"name":"end_time","intValue":"63879177600"},{"name":"api_kind","value":"web"},{"name":"user_agent","value":"Mozilla/5.0"}]}]}]}
   - path: /admin/reports/v1/activity/users/all/applications/drive
     methods: [GET]
     query_params:

packages/google_workspace/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "2.36.0"
+  changes:
+    - description: Add support for Calendar event type.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/13461
 - version: "2.35.0"
   changes:
     - description: Add support for Data Studio event type.