Google Workspace Admin Audit
| methodName | Description | Log type | Sample | Rule |
|---|---|---|---|---|
| google. | Creates an inbound SSO profile in the organization's Google Workspace or Cloud Identity settings. | activity | N | Y |
| google. | Updates an inbound SSO profile in the organization's Google Workspace or Cloud Identity settings. | activity | N | Y |
google.admin.AdminService.inboundSsoProfileCreated: Inbound SSO profile created
#Description
Creates an inbound SSO profile in the organization's Google Workspace or Cloud Identity settings.
Detection Fields #
Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.
| Name | Rules | Vendors |
|---|---|---|
protoPayload.methodName | 1 detection rule | Panther |
Detection Rules #
Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →Panther #
google.admin.AdminService.inboundSsoProfileUpdated: Inbound SSO profile updated
#Description
Updates an inbound SSO profile in the organization's Google Workspace or Cloud Identity settings.
Detection Fields #
Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.
| Name | Rules | Vendors |
|---|---|---|
protoPayload.methodName | 1 detection rule | Panther |
Detection Rules #
Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →Panther #
any: admin.googleapis.com (any method)
#Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.
Description
Catch-all entry for admin.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.