Spotting data exfiltration via Google Drive

[SriniKrish]

Hello,

I am investigating a data exfiltration from a google drive and have already deployed Harmony to scan the contents of the drive.

The scan came clean  and did not return any flags. Probably that is the case as well.

I was trying to run custom queries for google drive and chose template " Show all Drive changes", but query returns no results. Any suggestions  here on the query or anything else I can do to get insights on possible exfiltration ?

Thanks,

Srini

[PhoneBoy]

How were you informed of Data Exfiltration exactly?
In any case, the TAC may be necessary to assist with this: https://help.checkpoint.com