CloudLock GeoFence Manual

What Is CloudLock GeoFence?

CloudLock GeoFence is a CloudLock Labs project, giving administrators the ability to track where their users accessing data from, what locations users are logging in from, and any changes made by admins in their domain.

What is CloudLock Labs?

CloudLock Labs is a forum for an innovative, adventurous, and essentially customer-driven set of cloud security offerings, made available at low or no-cost, with the specific intention of gathering feedback and helping to shape the future of both the CloudLock security suite and the security industry as a whole.

Getting Started

In order to install CloudLock GeoFence, please ensure that the following are true:

  • You (the user of CloudLock GeoFence) must be Google Apps SuperAdmin for your domain
  • The Reports administrator privilege has been enabled; by default, a SuperAdmin will have this role; for delegated admins, create a custom administrator role.
  • In order to track document activity, you must first enable the Docs audit log.
Installing CloudLock GeoFence
  1. Navigate to the Google Apps Marketplace. Either search for CloudLock GeoFence, and/or click on the “GeoFence” listing in the marketplace apps listing (or use this link):
  2. CloudLock GeoFence’s Marketplace Listing will open. Click Install App.
  3. Read and agree to the Terms of Service.
  4. Launch GeoFence from your list of installed applications
  5. CloudLock GeoFence main page will load.
Using CloudLock GeoFence
Accessing CloudLock GeoFence

Once installed, navigate to:

Interface Overview

The primary interface elements are the Incident Map and the Incident Grid. Both have markers — graphical markers in the Incident Map, and textual rows in the Incident Grid. Every marker maps to an event; note that the graphical markers are reliant upon the Google APIs and may not be entirely precise, although it does reflect an API-level best effort.

If you hover over a marker, you can see additional information like username, doc_id etc. The grid will automatically scroll down to the event this marker points to.

You can click on a marker to leave the info box open.

Viewing Events

CloudLock GeoFence reports on the following types of activity within a Google Apps domain:

  • User login activity – Includes successful, unsuccessful, and suspicious login events (CloudLock does not track this information itself, data on logins is sourced from Google directly).
  • Documents activity – Includes view and edit activities, on Document types only. Note that the underlying APIs support only documents, not spreadsheets/ presentations/other data types
  • Administrative activity – Includes all events that an admin can perform in Control Panel and events that apps can perform in behalf of administrators, such as the addition/removal of users from Groups.
Modifying Range of Data Displayed

By default, the app shows all events (admin, login, and document activity) for the last week, limited to the 100 most recent records. The displayed date filter can be modified via the dropdown calendar beneath the map image.

Grid Filtering

A variety of filters are available:

  • Filter by Activity Type: All, Login, Documents and Admin
  • Filter by Date: Last week is the default
  • Filter by Location: Click “Location” in the grid header row
  • Filter by IP: Click “IP Address” in the grid header row
  • Filter by User: Click “User” in the grid header row
Viewing Event Details

You can see event details by hovering over a marker on the map. Note that the grid automatically scrolls down to the appropriate row, and vice-versa in that clicking on a grid marker will highlight the map marker.

Viewing a Document Using Document ID

Every document activity in the grid has a link to the document, referenced by the unique document id. To view a document, click (or right click the link and select “Open in New Tab”); note that you must have view permissions in order to see the document itself.

Exporting Data

Data can be exported in two formats: CSV and JSON, both accessible by using Export button in the top right corner of the grid.

Q: Why don’t I see anything?

A: A few common reasons why this may be occurring:
1. Try to extend date range to the last month
2. Try to reset all filters (click on cloudlock logo)

Q: I see Docs Audit is disabled for this domain, but I did enable it!

A: It’s a bug. This message appears, when no documents are returned from the API. If you applied any filters, reset them (or go back in the browser). Or you can extend date range (top right corner)

Experience a Live Demo

See the CloudLock CASB & cloud cybersecurity solution in action from one of our cloud security experts

Browser Not Supported

Your browser version is outdated.

We would recommend you upgrade to a recent version to ensure that you have a good experience on the CloudLock site. Outdated browsers also increase your security risk. So please update your browser and come back later!

Click on the icon below to download the latest version of your browser