Developed by CISA, ScubaGoggles is an assessment tool that verifies a Google Workspace (GWS) organization's configuration conforms to the policies described in the Secure Cloud Business Applications ( SCuBA ) Secure Configuration Baseline documents .
For the Microsoft 365 (M365) rendition of this tool, see ScubaGear .
We use a three-step process:
Export . In this step, we primarily use the Google Admin SDK API to export and serialize all the relevant logs and settings into json. ScubaGoggles also uses various other Google APIs to grab organization metadata, user privileges etc.
Verify . Compare the exported settings from the step with the configuration prescribed in the baselines. We do this using OPA Rego , a declarative query language for defining policy.
Report . Package the results as HTML and JSON.
Download and Install Python Module
Download the OPA Executable
Authentication Methods
Using a Service Account
Configuration UI — web-based form for building config files
Comparing Two Runs — report how each policy's result changed between two runs
Not Authorized to Access This Resource
macOS: Certificate Verification Error
WinError 10013 Permission Error
Unable to view HTML report due to environment limitations
ScubaGoggles lists failures for the SPF, DKIM, and DMARC policies (GWS.GMAIL.2 through GWS.GMAIL.4) even though you have published the applicable DNS records
ScubaConnect - ScubaConnect is cloud-native infrastructure, developed by CISA, that automates the execution of assessment tools ScubaGear and ScubaGoggles.
Unless otherwise noted, this project is distributed under the Creative Commons Zero license. With developer approval, contributions may be submitted with an alternate compatible license. If accepted, those contributions will be listed herein with the appropriate license.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
