Google Workspace CCF Connector Drops Product Buckets from OAuth Authorize Events

[rabbanee-elsayed-cko]

Describe the bug
When ingesting Google Workspace Token audit events (application=token), the connector appears to flatten the nested scope_data structure and retains only the final product_bucket value pair.

As a result, OAuth authorization events that contain multiple scopes and associated product buckets lose information during ingestion.

For example, a Google Workspace OAuth authorization event may contain:

GMAIL
DRIVE
APPS_SCRIPT_RUNTIME
IDENTITY
OTHER

However, the ingested Sentinel event only contains:

"product_bucket": ["IDENTITY","OTHER"]

which corresponds to the final scope entry (userinfo.email).

This causes loss of context during security investigations because the relationship between OAuth scopes and Google products is no longer preserved.

To Reproduce
Steps to reproduce the behavior:

1. Deploy the Google Workspace CCP connector.
2. Enable ingestion of Token audit events (applications/token).
3. Authorize a third-party application that requests multiple scopes such as:
   - gmail.send
   - drive.file
   - documents
   - script.external_request
   - userinfo.email
4. Review the event in Google Workspace Admin Audit Logs.
   5.Review the corresponding event in GoogleWorkspaceReports.

Expected behavior

The connector should preserve all product bucket information returned by the Google Reports API.

Example source data:

{
"scope_name": "https://www.googleapis.com/auth/gmail.send",
"product_bucket": ["GMAIL"]
}
{
"scope_name": "https://www.googleapis.com/auth/script.external_request",
"product_bucket": ["APPS_SCRIPT_RUNTIME"]
}
{
"scope_name": "https://www.googleapis.com/auth/documents",
"product_bucket": ["DRIVE"]
}

Expected Sentinel representation:

Preserve the full scope_data structure, or
Expose all product buckets in a flattened array

Example:

"product_bucket": [
"GMAIL",
"DRIVE",
"APPS_SCRIPT_RUNTIME",
"IDENTITY",
"OTHER"
]

Actual behavior

The ingested event only contains:

"product_bucket": [
"IDENTITY",
"OTHER"
]

while all other product buckets are lost.

The Scope field correctly contains all scopes, indicating the source API returned the complete data.

Example:

"Scope": [
"https://www.googleapis.com/auth/documents",
"https://www.googleapis.com/auth/drive.file",
"https://www.googleapis.com/auth/gmail.send",
"https://www.googleapis.com/auth/script.external_request",
"https://www.googleapis.com/auth/spreadsheets",
"https://www.googleapis.com/auth/userinfo.email"
]

but only the final product bucket is retained.

Additional context

The issue appears related to the connector transformation:

"transformName": "/ASI/GoogleWorkspace/OneDetectionPerRow"

The raw Google Reports API response contains a nested:

events[].parameters[].multiMessageValue[]

structure under scope_data.

A custom ingestion pipeline consuming the same Google Reports API endpoint preserves all product buckets correctly, suggesting the issue occurs during the CCP transformation rather than at the Google API source.

[rabbanee-elsayed-cko]

logs from API

{"application": "token", "category": "reports", "event_time": "2026-05-29T04:57:14.757Z", "ingest_time": "2026-05-29T05:00:40.727435+00:00", "event_id": "3875568837644930026", "actor": {"email": "xxx.xxxx@xxxx.com", "profileId": "xxxxx4223", "callerType": null, "application_name": null, "oauth_client_id": null, "impersonation": null}, "actor_is_collaborator_account": null, "ip": "176.151.200.15", "dataSource": {"vendor": "Google", "name": "Google Workspace", "category": "security"}, "vendor": "Google", "product": "workspace", "raw_event": {"kind": "admin#reports#activity", "id": {"time": "2026-05-29T04:57:14.757Z", "uniqueQualifier": "3875568837644930026", "applicationName": "token", "customerId": "C038203ky"}, "etag": ""nBC2b3mkrLe3yaUGeBYjOu7ZBjYauyQWhITxhigiQwU/YlIg-a7fACK2WfTbP5lHxhbaauw"", "actor": {"email": "xxxx.xxx@xxxxx.com", "profileId": "xxxx4223"}, "ipAddress": "176.151.200.15", "networkInfo": {"ipAsn": [5410], "regionCode": "FR", "subdivisionCode": "FR-IDF"},

"events": [{"type": "auth",
"name": "authorize",
"parameters":
[{"name": "client_id", "value": "xxx247a.apps.googleusercontent.com"}, {"name": "app_name", "value": "Mail merge"}, {"name": "client_type", "value": "WEB"}, {"name": "scope_data", "multiMessageValue": [{"parameter": [{"name": "scope_name", "value": "https://www.googleapis.com/auth/documents"}, {"name": "product_bucket", "multiValue": ["DRIVE"]}]}, {"parameter": [{"name": "scope_name", "value": "https://www.googleapis.com/auth/drive.file"}, {"name": "product_bucket", "multiValue": ["DRIVE"]}]}, {"parameter": [{"name": "scope_name", "value": "https://www.googleapis.com/auth/gmail.send"}, {"name": "product_bucket", "multiValue": ["GMAIL"]}]}, {"parameter": [{"name": "scope_name", "value": "https://www.googleapis.com/auth/script.external_request"}, {"name": "product_bucket", "multiValue": ["APPS_SCRIPT_RUNTIME"]}]}, {"parameter": [{"name": "scope_name", "value": "https://www.googleapis.com/auth/spreadsheets"}, {"name": "product_bucket", "multiValue": ["DRIVE"]}]}, {"parameter": [{"name": "scope_name", "value": "https://www.googleapis.com/auth/userinfo.email"}, {"name": "product_bucket", "multiValue": ["IDENTITY", "OTHER"]}]}]}, {"name": "scope", "multiValue": ["https://www.googleapis.com/auth/documents", "https://www.googleapis.com/auth/drive.file", "https://www.googleapis.com/auth/gmail.send", "https://www.googleapis.com/auth/script.external_request", "https://www.googleapis.com/auth/spreadsheets", "https://www.googleapis.com/auth/userinfo.email"]}]}]},