We did a phishing engagement on a client both payload and credential phishing. The first was using shortened file sharing links (including Google Drive) of our payloads and the second was a duplicate site of one of their payroll cloud applications.
What recommendations can we provide them so that they can allow their logs to go through their ELK (for custom rules detection) and how to prevent shared links and shortened links. I am aware of such third-party solutions for Outlook which passes emails into a proxy and rewrites the URL so that it goes through a "trusted scanner".
The problem is that I do not see Gmail audit logs and a proper DLP solution (web proxy) solution apart from these: