Admin Console

eventName	Description	Sample	Rule
any	Source-only rules that filter on applicationName 'admin' without specifying an eventName attribute here.	N	N
ADD_APPLICATION	An application was added to the Google Workspace domain.	N	Y
ADD_GROUP_MEMBER	A user was added to a group.	Y	Y
ADD_PRIVILEGE	A privilege was added to a role.	N	Y
ADD_TRUSTED_DOMAINS	A domain was added to the trusted domains list.	N	Y
ALLOW_STRONG_AUTHENTICATION	The administrator changed the MFA enforcement setting (allow/require strong authentication).	N	Y
ASSIGN_ROLE	An admin role was assigned to a user or service account.	Y	Y
AUTHORIZE_API_CLIENT_ACCESS	An API client was authorized domain-wide access via OAuth.	Y	Y
CHANGE_APPLICATION_SETTING	A setting for a Google Workspace application was modified.	Y	Y
CHANGE_GMAIL_SETTING	A Gmail routing or mail-flow setting was changed.	N	Y
CREATE_APPLICATION_SETTING	A new application setting was created.	N	Y
CREATE_DATA_TRANSFER_REQUEST	An admin initiated a data transfer (Drive file ownership reassignment) to another user.	N	Y
CREATE_GMAIL_SETTING	A new Gmail routing or mail-flow setting was created.	N	Y
CREATE_ROLE	A custom admin role was created.	N	Y
CUSTOMER_TAKEOUT_CREATED	An admin initiated a Takeout export job for organizational data.	N	Y
DELETE_ROLE	An admin role was permanently deleted.	N	Y
ENFORCE_STRONG_AUTHENTICATION	The MFA/2SV enforcement policy was changed for the domain or an organizational unit.	N	Y
GRANT_ADMIN_PRIVILEGE	Administrator privileges were granted to a user account.	N	Y
GRANT_DELEGATED_ADMIN_PRIVILEGES	Delegated administrator privileges were granted to a user.	N	Y
MOVE_USER_TO_ORG_UNIT	A user was moved to a different organizational unit.	N	Y
REMOVE_APPLICATION	An application was removed from the Google Workspace domain.	N	Y
REMOVE_APPLICATION_FROM_WHITELIST	An application was removed from the domain's marketplace allowlist.	N	Y
REMOVE_PRIVILEGE	A privilege was removed from a role.	N	Y
RENAME_ROLE	An admin role was renamed.	N	Y
SAML2_SERVICE_PROVIDER_CONFIG	A SAML 2.0 service provider configuration was added, modified, or removed.	N	Y
TOGGLE_OUTBOUND_RELAY	Outbound email relay routing was enabled or disabled.	N	Y
TURN_OFF_2_STEP_VERIFICATION	2-Step Verification was disabled for a user or the domain.	N	Y
UNSUSPEND_USER	A suspended user account was reactivated.	N	Y
UPDATE_ROLE	An existing admin role was modified (e.g. description or privileges changed).	N	Y
BLOCK_ALL_THIRD_PARTY_API_ACCESS	An admin blocked all third-party application access to Google Workspace APIs.	N	N
UNBLOCK_ALL_THIRD_PARTY_API_ACCESS	An admin unblocked third-party application access to Google Workspace APIs.	N	N
ADD_TO_TRUSTED_OAUTH2_APPS	An OAuth2 application was added to the trusted apps list.	N	N
ADD_TO_BLOCKED_OAUTH2_APPS	An OAuth2 application was blocked from accessing Google Workspace data.	N	N
REMOVE_FROM_BLOCKED_OAUTH2_APPS	An OAuth2 application was removed from the blocked apps list.	N	N
REMOVE_FROM_TRUSTED_OAUTH2_APPS	An OAuth2 application was removed from the trusted apps list.	N	N
CREATE_USER	A new user account was created in the Google Workspace domain.	Y	N
DELETE_USER	A user account was deleted from the Google Workspace domain.	Y	N
SUSPEND_USER	A user account was suspended by an administrator.	N	N
RENAME_USER	A user's primary email address was changed.	Y	N
CHANGE_PASSWORD	An administrator changed a user's password.	Y	N
REVOKE_ASP	An administrator revoked an application-specific password (ASP) for a user.	N	N
REVOKE_3LO_TOKEN	An administrator revoked an OAuth token for a user.	N	N
SESSION_CONTROL_SETTINGS_CHANGE	Web session duration or re-authentication settings were changed.	N	N
WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED	Settings controlling less-secure app access (LSA/basic auth) were changed.	N	N
CHANGE_SSO_SETTINGS	SAML/SSO settings for the domain were changed.	N	N
TOGGLE_SSO_ENABLED	SSO (SAML-based single sign-on) was enabled or disabled for the domain.	N	N
REVOKE_ADMIN_PRIVILEGE	Administrator privileges were revoked from a user account.	N	N
ALLOW_SERVICE_FOR_OAUTH2_ACCESS	A Google service was allowed for OAuth2 API access.	N	N
DISALLOW_SERVICE_FOR_OAUTH2_ACCESS	A Google service was disallowed for OAuth2 API access.	N	N
TOGGLE_CAA_ENABLEMENT	Context-Aware Access was enabled or disabled for the domain.	N	N
CHANGE_GROUP_SETTING	A setting for a Google Group was changed by an administrator.	Y	N
ADD_APPLICATION_TO_WHITELIST	An application was added to the domain's Google Workspace Marketplace allowlist.	N	N
CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION	The enrollment period for 2-Step Verification was changed.	N	N
CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS	The allowed methods for 2-Step Verification were changed.	N	N
APPLICATION_SETTINGS	Events of this type are returned with type=APPLICATION_SETTINGS .	N	N
DELETE_APPLICATION_SETTING	For {APPLICATION_NAME} , {SETTING_NAME} with value {OLD_VALUE} deleted	N	N
REORDER_GROUP_BASED_POLICIES_EVENT	For {APPLICATION_NAME} , group override priorities for {SETTING_NAME} changed to {GROUP_PRIORITIES} .	N	N
GPLUS_PREMIUM_FEATURES	Premium features for Google+ service for your organization changed to {NEW_VALUE}	N	N
CREATE_MANAGED_CONFIGURATION	Managed configuration with name {MANAGED_CONFIGURATION_NAME} is created for {DEVICE_TYPE} application {MOBILE_APP_PACKAGE_ID} .	N	N
DELETE_MANAGED_CONFIGURATION	Managed configuration with name {MANAGED_CONFIGURATION_NAME} is deleted for {DEVICE_TYPE} application {MOBILE_APP_PACKAGE_ID} .	N	N
UPDATE_MANAGED_CONFIGURATION	Managed configuration with name {MANAGED_CONFIGURATION_NAME} is updated for {DEVICE_TYPE} application {MOBILE_APP_PACKAGE_ID} .	N	N
FLASHLIGHT_EDU_NON_FEATURED_SERVICES_SELECTED	{FLASHLIGHT_EDU_NON_FEATURED_SERVICES_SELECTION} selection was made for Non-Featured Services.	N	N
UPDATE_SMART_FEATURES	Smart features and personalization setting has been updated to {NEW_VALUE}	N	N
CALENDAR_SETTINGS	Events of this type are returned with type=CALENDAR_SETTINGS .	N	N
CREATE_BUILDING	Building {NEW_VALUE} created	N	N
DELETE_BUILDING	Building {OLD_VALUE} deleted	N	N
UPDATE_BUILDING	Building {RESOURCE_IDENTIFIER} updated field {FIELD_NAME} from {OLD_VALUE} to {NEW_VALUE}	N	N
EWS_IN_NEW_CREDENTIALS_GENERATED	Short description for EWS IN credentials generation.	N	N
EWS_OUT_ENDPOINT_CONFIGURATION_RESET	Short description for clearing Calendar Interop Exchange endpoint configuration.	N	N
EWS_OUT_ENDPOINT_CONFIGURATION_CHANGED	Short description for changing Calendar Interop Exchange endpoint configuration.	N	N
CREATE_CALENDAR_RESOURCE	Calendar resource {NEW_VALUE} created	N	N
DELETE_CALENDAR_RESOURCE	Calendar resource {OLD_VALUE} deleted	N	N
CREATE_CALENDAR_RESOURCE_FEATURE	Calendar resource feature {NEW_VALUE} created	N	N
DELETE_CALENDAR_RESOURCE_FEATURE	Calendar resource feature {OLD_VALUE} deleted	N	N
UPDATE_CALENDAR_RESOURCE_FEATURE	Calendar resource feature {RESOURCE_IDENTIFIER} updated field {FIELD_NAME} from {OLD_VALUE} to {NEW_VALUE}	N	N
RENAME_CALENDAR_RESOURCE	Calendar resource {OLD_VALUE} renamed to {NEW_VALUE}	N	N
UPDATE_CALENDAR_RESOURCE	Calendar resource {RESOURCE_IDENTIFIER} updated field {FIELD_NAME} from {OLD_VALUE} to {NEW_VALUE}	N	N
CHANGE_CALENDAR_SETTING	{SETTING_NAME} for calendar service in your organization changed from {OLD_VALUE} to {NEW_VALUE}	N	Y
CANCEL_CALENDAR_EVENTS	Event cancellation request created for {USER_EMAIL}	N	N
RELEASE_CALENDAR_RESOURCES	Release resources request created for {USER_EMAIL}	N	N
CHAT_SETTINGS	Note that this page also contains events for Google Hangouts, as well as the previous Google Chat product. Events of this type are returned with type=CHAT_SETTINGS .	N	N
MEET_INTEROP_CREATE_GATEWAY	A Hangouts Meet interoperability gateway was created	N	N
MEET_INTEROP_DELETE_GATEWAY	A Hangouts Meet interoperability gateway was deleted	N	N
MEET_INTEROP_MODIFY_GATEWAY	A Hangouts Meet interoperability gateway was modified	N	N
CHANGE_CHAT_SETTING	{SETTING_NAME} for talk service for your organization changed from {OLD_VALUE} to {NEW_VALUE}	N	N
CHROME_OS_SETTINGS	Events of this type are returned with type=CHROME_OS_SETTINGS .	N	N
CHANGE_CHROME_OS_ANDROID_APPLICATION_SETTING	{SETTING_NAME} for Android app {APP_ID} for session type {CHROME_OS_SESSION_TYPE} changed from {OLD_VALUE} to {NEW_VALUE}	N	N
CHANGE_DEVICE_STATE	Event for 'Change device state'.	N	N
CHANGE_DEVICE_UPGRADE	Changed upgrade from {OLD_VALUE} to {NEW_VALUE} for device with serial number {DEVICE_SERIAL_NUMBER} .	N	N
CHANGE_CHROME_OS_APPLICATION_SETTING	{SETTING_NAME} for Chrome app {APP_ID} for session type {CHROME_OS_SESSION_TYPE} changed from {OLD_VALUE} to {NEW_VALUE}	N	N
SEND_CHROME_OS_DEVICE_COMMAND	Sent {NEW_VALUE} command to ChromeOS device {DEVICE_SERIAL_NUMBER}	N	N
CHANGE_CHROME_OS_DEVICE_ANNOTATION	ChromeOS device {DEVICE_SERIAL_NUMBER} had its properties updated	N	N
CHANGE_CHROME_OS_DEVICE_SETTING	{SETTING_NAME} for ChromeOS devices in {ORG_UNIT_NAME} organization unit changed from {OLD_VALUE} to {NEW_VALUE}	N	N
CHANGE_CHROME_OS_DEVICE_STATE	State of ChromeOS device {DEVICE_SERIAL_NUMBER} changed from {OLD_VALUE} to {NEW_VALUE}	N	N
CHANGE_CHROME_OS_PUBLIC_SESSION_SETTING	{SETTING_NAME} for ChromeOS managed guest session in {ORG_UNIT_NAME} organization unit changed from {OLD_VALUE} to {NEW_VALUE}	N	N
INSERT_CHROME_OS_PRINT_SERVER	Print server is added.	N	N
DELETE_CHROME_OS_PRINT_SERVER	Existing print server is deleted.	N	N
UPDATE_CHROME_OS_PRINT_SERVER	Existing print server is updated.	N	N
INSERT_CHROME_OS_PRINTER	Printer is added.	N	N
DELETE_CHROME_OS_PRINTER	Existing printer is deleted.	N	N
UPDATE_CHROME_OS_PRINTER	Existing printer is updated.	N	N
CHANGE_CHROME_OS_SETTING	{SETTING_NAME} for ChromeOS devices in your organization changed from {OLD_VALUE} to {NEW_VALUE}	N	N
CHANGE_CHROME_OS_USER_SETTING	{SETTING_NAME} for ChromeOS users in {ORG_UNIT_NAME} organization unit changed from {OLD_VALUE} to {NEW_VALUE}	N	N
CREATE_CHROME_OS_ENROLLMENT_TOKEN	Event for 'Create ChromeOS enrollment token'.	N	N
CHANGE_CHROME_OS_CUSTOM_CONFIGURATIONS_JSON_SETTING	Custom configurations JSON field in the {ORG_UNIT_NAME} organizational unit changed from {OLD_VALUE} to {NEW_VALUE}	N	N
DELETE_CHROME_OS_DEVICE	Event for 'Delete ChromeOS device'.	N	N
DELETE_DUPLICATE_CHROME_OS_DEVICE	Event for 'Delete duplicate ChromeOS device'.	N	N
CHANGE_CHROME_OS_ISOLATED_WEB_APPLICATION_SETTING	{SETTING_NAME} for Isolated Web app {APP_ID} for session type {CHROME_OS_SESSION_TYPE} changed from {OLD_VALUE} to {NEW_VALUE}	N	N
ISSUE_DEVICE_COMMAND	Event for 'Issue device command'.	N	N
MOVE_DEVICE_TO_ORG_UNIT_DETAILED	Event for 'Move device to Org Unit'.	N	N
PRE_PROVISION_CHROME_OS_DEVICE	Event for 'Pre-provision ChromeOS device'.	N	N
REMOVE_CHROME_OS_APPLICATION_SETTING	{APP_TYPE} app {APP_ID} for session type {CHROME_OS_SESSION_TYPE} removed	N	N
REMOVE_CHROME_OS_APPLICATION_SETTINGS	Settings for Chrome app {APP_ID} removed	N	N
REMOVE_CHROME_OS_WEB_ORIGIN_SETTINGS	Settings for web origin {WEB_ORIGIN} for session type {CHROME_OS_SESSION_TYPE} removed	N	N
REPAIR_CENTER_DEPROVISION	Event for 'Repair Center deprovision'.	N	N
REVOKE_CHROME_OS_ENROLLMENT_TOKEN	Event for 'Revoke ChromeOS enrollment token'.	N	N
UPDATE_DEVICE	Event for 'Update device'.	N	N
CHANGE_CHROME_OS_WEB_APPLICATION_SETTING	{SETTING_NAME} for Web app {APP_ID} for session type {CHROME_OS_SESSION_TYPE} changed from {OLD_VALUE} to {NEW_VALUE}	N	N
CHANGE_CHROME_OS_WEB_PERMISSION_SETTING	{SETTING_NAME} for {WEB_ORIGIN} for session type {CHROME_OS_SESSION_TYPE} changed from {OLD_VALUE} to {NEW_VALUE}	N	N
CONTACTS_SETTINGS	Events of this type are returned with type=CONTACTS_SETTINGS .	N	N
CHANGE_CONTACTS_SETTING	{SETTING_NAME} for contacts service changed from {OLD_VALUE} to {NEW_VALUE}	N	N
DOCS_SETTINGS	Events of this type are returned with type=DOCS_SETTINGS .	N	N
TRANSFER_DOCUMENT_OWNERSHIP	Owner of documents changed from {USER_EMAIL} to {NEW_VALUE}	N	N
DOCS_ORG_BRANDING_PROVISIONING	Organizational branding provisioning initiated for account {SERVICE_ACCOUNT_EMAIL} and shared drive {SHARED_DRIVE_NAME} with status {ORG_BRANDING_PROVISIONING_STATUS}	N	N
DOCS_ORG_BRANDING_UPLOAD	Organizational branding document upload attempted for document {DOCUMENT_ID} in editor {ORG_BRANDING_EDITOR_TYPE} with status {ORG_BRANDING_UPLOAD_STATUS}	N	N
DRIVE_DATA_RESTORE	Drive data restoration initiated for {USER_EMAIL}	N	N
CHANGE_DOCS_SETTING	{SETTING_NAME} for Drive changed from {OLD_VALUE} to {NEW_VALUE}	N	N
MOVE_SHARED_DRIVE_TO_ORG_UNIT	Shared drive {SHARED_DRIVE_ID} moved from {ORG_UNIT_NAME} to {NEW_VALUE}	N	N
DOMAIN_SETTINGS	Events of this type are returned with type=DOMAIN_SETTINGS .	N	N
CHANGE_ACCOUNT_AUTO_RENEWAL	Account automatic renewal changed to {NEW_VALUE} on {DOMAIN_NAME}	N	N
CHANGE_ADVERTISEMENT_OPTION	Advertisement option for your organization changed from {OLD_VALUE} to {NEW_VALUE}	N	N
CREATE_ALERT	Alert {ALERT_NAME} has been created	N	N
CHANGE_ALERT_CRITERIA	Alert criteria for {ALERT_NAME} has been changed	N	N
DELETE_ALERT	Alert {ALERT_NAME} has been deleted	N	N
ALERT_RECEIVERS_CHANGED	Alert receivers for {ALERT_NAME} changed from {OLD_VALUE} to {NEW_VALUE}	N	N
RENAME_ALERT	Alert {OLD_VALUE} has been renamed to {NEW_VALUE}	N	N
ALERT_STATUS_CHANGED	Alert status for {ALERT_NAME} changed from {OLD_VALUE} to {NEW_VALUE}	N	N
ADD_DOMAIN_ALIAS	An unverified {DOMAIN_ALIAS} created as an alias of {DOMAIN_NAME}	N	N
REMOVE_DOMAIN_ALIAS	{DOMAIN_ALIAS} deleted as an alias of {DOMAIN_NAME}	N	N
SKIP_DOMAIN_ALIAS_MX	Skipped MX record setup of alias {DOMAIN_ALIAS} of domain {DOMAIN_NAME}	N	N
VERIFY_DOMAIN_ALIAS_MX	Verified MX record of alias {DOMAIN_ALIAS} of domain {DOMAIN_NAME}	N	N
VERIFY_DOMAIN_ALIAS	{DOMAIN_ALIAS} verified as an alias of {DOMAIN_NAME} using {DOMAIN_VERIFICATION_METHOD}	N	N
TOGGLE_OAUTH_ACCESS_TO_ALL_APIS	OAuth access for all APIs changed to {NEW_VALUE} for your organization	N	N
TOGGLE_ALLOW_ADMIN_PASSWORD_RESET	Allow admin password reset setting changed to {NEW_VALUE}	N	N
ENABLE_API_ACCESS	API access for your organization changed from {OLD_VALUE} to {NEW_VALUE}	N	N
REMOVE_API_CLIENT_ACCESS	API client access to your organization from client {API_CLIENT_NAME} removed	N	N
CHROME_LICENSES_REDEEMED	Licenses redeemed event name.	N	N
TOGGLE_AUTO_ADD_NEW_SERVICE	Automatic addition for new services and pre-release features for your organization changed to {NEW_VALUE}	N	N
CHANGE_PRIMARY_DOMAIN	Primary domain name changed from {DOMAIN_NAME} to {NEW_VALUE}	N	N
CHANGE_WHITELIST_SETTING	{SETTING_NAME} changed from {OLD_VALUE} to {NEW_VALUE} for the domain	N	N
COMMUNICATION_PREFERENCES_SETTING_CHANGE	{SETTING_NAME} setting in Communication Preferences changed from {OLD_VALUE} to {NEW_VALUE} (Domain Name : {DOMAIN_NAME} )	N	N
CHANGE_CONFLICT_ACCOUNT_ACTION	Conflict account action for {DOMAIN_NAME} changed from {OLD_VALUE} to {NEW_VALUE}	N	N
CHANGE_CONFLICT_ACCOUNTS_MANAGEMENT_SETTINGS	Conflict accounts management setting changed to: {CONFLICT_ACCOUNTS_MANAGEMENT_SETTINGS} .	N	N
ENABLE_FEEDBACK_SOLICITATION	Can contact for feedback setting for your organization changed from {OLD_VALUE} to {NEW_VALUE}	N	N
TOGGLE_CONTACT_SHARING	Contact sharing changed to {NEW_VALUE}	N	N
CREATE_PLAY_FOR_WORK_TOKEN	MDM vendor enrollment token ( {PLAY_FOR_WORK_TOKEN_ID} ) created	N	N
TOGGLE_USE_CUSTOM_LOGO	Use custom logo changed to {NEW_VALUE}	N	N
CHANGE_CUSTOM_LOGO	New custom logo uploaded for your organization	N	N
CHANGE_DATA_LOCALIZATION_FOR_RUSSIA	Setting for Data Localization for Russian Federation changed from {OLD_VALUE} to {NEW_VALUE}	N	N
CHANGE_DATA_LOCALIZATION_SETTING	Setting for Data Localization changed from {OLD_VALUE} to {NEW_VALUE}	N	N
CHANGE_DATA_PROTECTION_OFFICER_CONTACT_INFO	Part of an audit log event for contact info update for Data Protection Officer. This is used as an indicator of what kind of event log this message is.	N	N
DELETE_PLAY_FOR_WORK_TOKEN	MDM vendor enrollment token ( {PLAY_FOR_WORK_TOKEN_ID} ) deleted	N	N
VIEW_DNS_LOGIN_DETAILS	DNS console login details for {DOMAIN_NAME} viewed	N	N
CHANGE_DOMAIN_DEFAULT_LOCALE	Default locale for your organization changed from {OLD_VALUE} to {NEW_VALUE}	N	N
CHANGE_DOMAIN_DEFAULT_TIMEZONE	Default time zone for your organization changed from {OLD_VALUE} to {NEW_VALUE}	N	N
CHANGE_DOMAIN_NAME	Change of domain name for {DOMAIN_NAME} to {NEW_VALUE} started	N	N
TOGGLE_ENABLE_PRE_RELEASE_FEATURES	Pre-release features for your organization was set to {NEW_VALUE}	N	N
CHANGE_DOMAIN_SUPPORT_MESSAGE	Support message for your organization changed from {OLD_VALUE} to {NEW_VALUE}	N	N
REMOVE_TRUSTED_DOMAINS	Domains {DOMAIN_NAME} removed from Trusted Domains list	N	Y
CHANGE_EDU_TYPE	Educational organization type changed from {OLD_VALUE} to {NEW_VALUE}	N	N
TOGGLE_ENABLE_OAUTH_CONSUMER_KEY	Enabling OAuth consumer key changed to {NEW_VALUE} for your organization	N	N
TOGGLE_SSL	SSL Enforcement changed to {NEW_VALUE} for {DOMAIN_NAME}	N	N
CHANGE_EU_REPRESENTATIVE_CONTACT_INFO	Part of an audit log event for contact info update for EU Representative. This is used as an indicator of what kind of event log this message is.	N	N
GENERATE_TRANSFER_TOKEN	Transfer token generated	N	N
CHANGE_LOGIN_BACKGROUND_COLOR	Login background color for your organization changed from {OLD_VALUE} to {NEW_VALUE}	N	N
CHANGE_LOGIN_BORDER_COLOR	Login border color for your organization changed from {OLD_VALUE} to {NEW_VALUE}	N	N
CHANGE_LOGIN_ACTIVITY_TRACE	Marketplace Login audit setting in {DOMAIN_NAME} changed from {OLD_VALUE} to {NEW_VALUE}	N	N
PLAY_FOR_WORK_ENROLL	Enrolled for {PLAY_FOR_WORK_MDM_VENDOR_NAME} mobile device management services using token ( {PLAY_FOR_WORK_TOKEN_ID} )	N	N
PLAY_FOR_WORK_UNENROLL	Unenrolled from {PLAY_FOR_WORK_MDM_VENDOR_NAME} mobile device management services	N	N
MX_RECORD_VERIFICATION_CLAIM	{USER_EMAIL} claimed to verify the MX record for {DOMAIN_NAME}	N	N
TOGGLE_NEW_APP_FEATURES	New app features for your organization changed to {NEW_VALUE}	N	N
TOGGLE_USE_NEXT_GEN_CONTROL_PANEL	The setting to enable the new Admin Console changed to {NEW_VALUE} for your organization	N	N
UPLOAD_OAUTH_CERTIFICATE	New OAuth certificate uploaded for your organization	N	N
REGENERATE_OAUTH_CONSUMER_SECRET	New OAuth consumer secret generated for your organization	N	N
TOGGLE_OPEN_ID_ENABLED	OpenId federated login for {DOMAIN_NAME} changed to {NEW_VALUE}	N	N
CHANGE_ORGANIZATION_NAME	Organization name changed from {OLD_VALUE} to {NEW_VALUE}	N	N
CHANGE_PASSWORD_MAX_LENGTH	Password maximum length for {DOMAIN_NAME} changed from {OLD_VALUE} to {NEW_VALUE}	N	N
CHANGE_PASSWORD_MIN_LENGTH	Password minimum length for {DOMAIN_NAME} changed from {OLD_VALUE} to {NEW_VALUE}	N	N
UPDATE_DOMAIN_PRIMARY_ADMIN_EMAIL	Primary admin for your organization changed from {OLD_VALUE} to {NEW_VALUE}	N	N
ENABLE_SERVICE_OR_FEATURE_NOTIFICATIONS	Receive email notification setting for your organization changed from {OLD_VALUE} to {NEW_VALUE}	N	N
CHANGE_RENEW_DOMAIN_REGISTRATION	Renew domain registration setting in {DOMAIN_NAME} changed from {OLD_VALUE} to {NEW_VALUE}	N	N
CHANGE_RESELLER_ACCESS	Reseller access changed from {OLD_VALUE} to {NEW_VALUE}	N	N
CHANGE_RESELLER_ACCESS_FOR_SKU	Reseller access for {SKU_NAME} changed from {OLD_VALUE} to {NEW_VALUE}	N	N
RULE_ACTIONS_CHANGED	Rule actions for {RULE_NAME} changed	N	N
CREATE_RULE	Rule {RULE_NAME} has been created	N	N
CHANGE_RULE_CRITERIA	Rule criteria for {RULE_NAME} has been changed	N	N
DELETE_RULE	Rule {RULE_NAME} has been deleted	N	N
RENAME_RULE	Rule {OLD_VALUE} has been renamed to {NEW_VALUE}	N	N
RULE_STATUS_CHANGED	Rule status for {RULE_NAME} changed from {OLD_VALUE} to {NEW_VALUE}	N	N
ADD_SECONDARY_DOMAIN	An unverified {SECONDARY_DOMAIN_NAME} created as a secondary domain of {DOMAIN_NAME}	N	N
REMOVE_SECONDARY_DOMAIN	{SECONDARY_DOMAIN_NAME} deleted as a secondary domain of {DOMAIN_NAME}	N	N
SKIP_SECONDARY_DOMAIN_MX	Skipped MX record setup of secondary domain {SECONDARY_DOMAIN_NAME} of domain {DOMAIN_NAME}	N	N
VERIFY_SECONDARY_DOMAIN_MX	Verified MX records of secondary domain {SECONDARY_DOMAIN_NAME} of domain {DOMAIN_NAME}	N	N
VERIFY_SECONDARY_DOMAIN	{SECONDARY_DOMAIN_NAME} verified as a secondary domain of {DOMAIN_NAME}	N	N
UPDATE_DOMAIN_SECONDARY_EMAIL	Secondary email for your organization changed from {OLD_VALUE} to {NEW_VALUE}	N	N
GENERATE_PIN	Customer support PIN generated	N	N
UPDATE_RULE	Update rule event name.	N	N
EMAIL_SETTINGS	Events of this type are returned with type=EMAIL_SETTINGS .	N	N
DROP_FROM_QUARANTINE	The title for the event release from quarantine. This title shows the message was dropped from quarantine.	N	N
EMAIL_LIFE_OF_A_MESSAGE	Email life of a message search is launched.	N	N
EMAIL_LOG_SEARCH	An email log search is performed for logs from {EMAIL_LOG_SEARCH_START_DATE} to {EMAIL_LOG_SEARCH_END_DATE} with a sender of [ {EMAIL_LOG_SEARCH_SENDER} ], a recipient of [ {EMAIL_LOG_SEARCH_RECIPIENT} ], and an email message id of [ {EMAIL_LOG_SEARCH_MSG_ID} ]	N	N
EMAIL_UNDELETE	Email restoration from {START_DATE} to {END_DATE} initiated for {USER_EMAIL}	N	N
CHANGE_EMAIL_SETTING	{SETTING_NAME} for email service in your organization changed from {OLD_VALUE} to {NEW_VALUE}	N	N
DELETE_GMAIL_SETTING	Gmail setting {SETTING_NAME} was deleted	N	Y
REJECT_FROM_QUARANTINE	The title for the event release from quarantine. This title shows the message was rejected from quarantine.	N	N
RELEASE_FROM_QUARANTINE	The title for the event release from quarantine. This title shows the message was released from quarantine.	N	N
GROUP_SETTINGS	Events of this type are returned with type=GROUP_SETTINGS .	N	N
WHITELISTED_GROUPS_UPDATED	Whitelisted groups updated event.	N	N
CREATE_GROUP	Group {GROUP_EMAIL} created	N	N
DELETE_GROUP	Group {GROUP_EMAIL} deleted	N	N
CHANGE_GROUP_DESCRIPTION	Description for group {GROUP_EMAIL} changed	N	N
CHANGE_GROUP_EMAIL	Email of group {GROUP_EMAIL} changed to {NEW_VALUE}	N	N
GROUP_LIST_DOWNLOAD	Group list was downloaded as a CSV file	N	N
REMOVE_GROUP_MEMBER	User {USER_EMAIL} deleted from group {GROUP_EMAIL}	N	N
UPDATE_GROUP_MEMBER	Group Setting Change.	N	N
UPDATE_GROUP_MEMBER_DELIVERY_SETTINGS	Group Member Delivery Settings Change.	N	N
UPDATE_GROUP_MEMBER_DELIVERY_SETTINGS_CAN_EMAIL_OVERRIDE	Group Member Delivery Settings Email Override Change.	N	N
GROUP_MEMBER_BULK_UPLOAD	A total of {GROUP_MEMBER_BULK_UPLOAD_TOTAL_NUMBER} members selected for upload. {GROUP_MEMBER_BULK_UPLOAD_FAILED_NUMBER} out of {GROUP_MEMBER_BULK_UPLOAD_TOTAL_NUMBER} members failed to be uploaded	N	N
GROUP_MEMBERS_DOWNLOAD	Group member list was downloaded as a CSV file	N	N
CHANGE_GROUP_NAME	Name of group {GROUP_EMAIL} changed to {NEW_VALUE}	N	N
LICENSES_SETTINGS	Events of this type are returned with type=LICENSES_SETTINGS .	N	N
CHROME_APP_LICENSES_ENABLED	Licenses enabled or not for a specified group/org unit event name.	N	N
ORG_USERS_LICENSE_ASSIGNMENT	Licenses for {PRODUCT_NAME} product and {NEW_VALUE} sku were assigned to all unassigned users of {ORG_UNIT_NAME}	N	N
ORG_ALL_USERS_LICENSE_ASSIGNMENT	Licenses for {PRODUCT_NAME} product and {NEW_VALUE} sku were assigned to all users of {ORG_UNIT_NAME}	N	N
SUPPRESSED_LICENSE_ASSIGNMENT	A suppressed license for {PRODUCT_NAME} product and {NEW_VALUE} sku was assigned to the user {USER_EMAIL}	N	N
TEMPORARY_LICENSE_ASSIGNMENT	A temporary license for {PRODUCT_NAME} product and {NEW_VALUE} sku was assigned to the user {USER_EMAIL}	N	N
USER_LICENSE_ASSIGNMENT	A license for {PRODUCT_NAME} product and {NEW_VALUE} sku was assigned to the user {USER_EMAIL}	N	N
CHANGE_LICENSE_AUTO_ASSIGN	License Auto Assign option changed to {NEW_VALUE} for {PRODUCT_NAME} product and {SKU_NAME} sku	N	N
SUPPRESSED_TO_ASSIGNED_LICENSE_CONVERSION	Suppressed license of the user {USER_EMAIL} for {PRODUCT_NAME} product and {NEW_VALUE} sku was converted to Active	N	N
TEMPORARY_TO_ASSIGNED_LICENSE_CONVERSION	Temporary license of the user {USER_EMAIL} for {PRODUCT_NAME} product and {NEW_VALUE} sku was converted to Active	N	N
TEMPORARY_TO_SUPPRESSED_LICENSE_CONVERSION	Temporary license of the user {USER_EMAIL} for {PRODUCT_NAME} product and {NEW_VALUE} sku was expired and converted to Suppressed	N	N
FIRST_TEMPORARY_OR_SUPPRESSED_LICENSE_NOTIFICATION	Audit log event generated when first temporary or suppressed license email notification is sent to the customer.	N	N
RESELLER_FIRST_TEMPORARY_OR_SUPPRESSED_LICENSE_NOTIFICATION	Audit log event generated when first temporary or suppressed license email notification is sent to the reseller.	N	N
USER_LICENSE_REASSIGNMENT	A license for {PRODUCT_NAME} product and {OLD_VALUE} sku was reassigned for user {USER_EMAIL} to new sku {NEW_VALUE}	N	N
ORG_LICENSE_REVOKE	Licenses for {PRODUCT_NAME} product and {OLD_VALUE} sku were removed from assigned users of {ORG_UNIT_NAME}	N	N
SUPPRESSED_LICENSE_REVOKE	A suppressed license for {PRODUCT_NAME} product and {OLD_VALUE} sku was revoked from the user {USER_EMAIL}	N	N
TEMPORARY_LICENSE_REVOKE	A temporary license for {PRODUCT_NAME} product and {OLD_VALUE} sku was revoked from the user {USER_EMAIL}	N	N
USER_LICENSE_REVOKE	A license for {PRODUCT_NAME} product and {OLD_VALUE} sku was revoked from user {USER_EMAIL}	N	N
TEMPORARY_LICENSES_EXPIRED_NOTIFICATION	Audit log event generated when temporary licenses expired email notification is sent to the customer.	N	N
RESELLER_TEMPORARY_LICENSES_EXPIRED_NOTIFICATION	Audit log event generated when temporary licenses expired email notification is sent to the reseller.	N	N
UPDATE_DYNAMIC_LICENSE	Auto Licensing settings for {PRODUCT_NAME} product in {ORG_UNIT_NAME} organization changed from {OLD_VALUE} to {NEW_VALUE}	N	N
CHROME_APP_USER_LICENSE_ASSIGNED	Short description to indicate user license is assigned.	N	N
CHROME_APP_USER_LICENSE_REVOKED	Short description to indicate user license is revoked.	N	N
MOBILE_SETTINGS	Events of this type are returned with type=MOBILE_SETTINGS .	N	N
ACTION_CANCELLED	{ACTION_TYPE} with id {ACTION_ID} on device type {DEVICE_TYPE} and id {DEVICE_ID} was cancelled by user {USER_EMAIL}	N	N
ACTION_REQUESTED	{ACTION_TYPE} with id {ACTION_ID} on device type {DEVICE_TYPE} and id {DEVICE_ID} was requested by user {USER_EMAIL}	N	N
ADD_MOBILE_CERTIFICATE	Mobile certificate {MOBILE_CERTIFICATE_COMMON_NAME} added for mobile devices in your organization	N	N
APPLE_DEP_SYNC_TRIGGERED	Apple DEP sync triggered by {USER_EMAIL}	N	N
APPLE_DEP_TOKEN_SETUP_COMPLETE	Apple Device Enrollment tokens updated by {USER_EMAIL}	N	N
APPLE_VPP_TOKEN_OPERATION	Apple VPP token {TOKEN_OPERATION_NAME} was {TOKEN_OPERATION_STATUS}	N	N
COMPANY_DEVICES_BULK_CREATION	Details of {NUMBER_OF_COMPANY_OWNED_DEVICES} company owned device(s) were imported	N	N
COMPANY_OWNED_DEVICE_BLOCKED	Company owned device {COMPANY_DEVICE_ID} was blocked	N	N
COMPANY_DEVICE_DELETION	Company owned device {COMPANY_DEVICE_ID} was deleted	N	N
COMPANY_OWNED_DEVICE_UNBLOCKED	Company owned device {COMPANY_DEVICE_ID} was unblocked	N	N
COMPANY_OWNED_DEVICE_WIPED	Company owned device {COMPANY_DEVICE_ID} was wiped	N	N
CUSTOMER_USER_DEVICE_DELETION_EVENT	Customer user device {COMPANY_DEVICE_ID} was deleted	N	N
CHANGE_MOBILE_APPLICATION_PERMISSION_GRANT	Change in mobile application permission grant.	N	N
CHANGE_MOBILE_APPLICATION_PRIORITY_ORDER	Change in priority order of mobile application.	N	N
REMOVE_MOBILE_APPLICATION_FROM_WHITELIST	{DEVICE_TYPE} application {MOBILE_APP_PACKAGE_ID} is no longer whitelisted for {DISTRIBUTION_ENTITY_NAME} {DISTRIBUTION_ENTITY_TYPE}	N	N
CHANGE_MOBILE_APPLICATION_SETTINGS	Change in mobile application setting.	N	N
ADD_MOBILE_APPLICATION_TO_WHITELIST	Mobile application is added to whitelist.	N	Y
MOBILE_DEVICE_APPROVE	Mobile device for {USER_EMAIL} approved	N	N
MOBILE_DEVICE_BLOCK	Mobile device for {USER_EMAIL} blocked	N	N
MOBILE_DEVICE_DELETE	Mobile device for {USER_EMAIL} deleted	N	N
MOBILE_DEVICE_WIPE	Mobile device for {USER_EMAIL} wiped	N	N
CHANGE_MOBILE_SETTING	{SETTING_NAME} for mobile devices in your organization changed from {OLD_VALUE} to {NEW_VALUE}	N	N
CHANGE_ADMIN_RESTRICTIONS_PIN	Administrator restrictions PIN for mobile devices in your organization changed	N	N
CHANGE_MOBILE_WIRELESS_NETWORK	Mobile wireless network {MOBILE_WIRELESS_NETWORK_NAME} changed for mobile devices in your organization	N	N
ADD_MOBILE_WIRELESS_NETWORK	Mobile wireless network {MOBILE_WIRELESS_NETWORK_NAME} created for mobile devices in your organization	N	N
REMOVE_MOBILE_WIRELESS_NETWORK	Mobile wireless network {MOBILE_WIRELESS_NETWORK_NAME} deleted for mobile devices in your organization	N	N
CHANGE_MOBILE_WIRELESS_NETWORK_PASSWORD	Password changed for mobile wireless network {MOBILE_WIRELESS_NETWORK_NAME} in your organization	N	N
REMOVE_MOBILE_CERTIFICATE	Mobile certificate {MOBILE_CERTIFICATE_COMMON_NAME} removed for mobile devices in your organization	N	N
ENROLL_FOR_GOOGLE_DEVICE_MANAGEMENT	Google Device Management is a part of the Google Admin console.	N	N
USE_GOOGLE_MOBILE_MANAGEMENT	You have selected Google Mobile Management to manage all your mobile devices	N	N
USE_GOOGLE_MOBILE_MANAGEMENT_FOR_NON_IOS	You have selected Google Mobile Management to manage your Android and Active Sync devices	N	N
USE_GOOGLE_MOBILE_MANAGEMENT_FOR_IOS	You have selected Google Mobile Management to manage your iOS devices	N	N
MOBILE_ACCOUNT_WIPE	Mobile account for {USER_EMAIL} has been wiped	N	N
MOBILE_DEVICE_CANCEL_WIPE_THEN_APPROVE	Wipe on mobile device for {USER_EMAIL} was cancelled and the device was approved	N	N
MOBILE_DEVICE_CANCEL_WIPE_THEN_BLOCK	Wipe on mobile device for {USER_EMAIL} was cancelled and the device has been blocked	N	N
ORG_SETTINGS	Events of this type are returned with type=ORG_SETTINGS .	N	N
CHROME_LICENSES_ENABLED	Licenses enabled or not at an org unit event name.	N	N
CHROME_APPLICATION_LICENSE_RESERVATION_CREATED	License reservation at an org unit is created.	N	N
CHROME_APPLICATION_LICENSE_RESERVATION_DELETED	License reservation at an org unit is deleted.	N	N
CHROME_APPLICATION_LICENSE_RESERVATION_UPDATED	License reservation at an org unit is updated.	N	N
CREATE_DEVICE_ENROLLMENT_TOKEN	Event for 'Create enrollment token'.	N	N
ASSIGN_CUSTOM_LOGO	New custom logo assigned for org unit {ORG_UNIT_NAME}	N	N
UNASSIGN_CUSTOM_LOGO	Custom logo unassigned for org unit {ORG_UNIT_NAME}	N	N
CREATE_ENROLLMENT_TOKEN	A new enrollment token is generated for {ORG_UNIT_NAME}	N	N
REVOKE_ENROLLMENT_TOKEN	The enrollment token of {ORG_UNIT_NAME} has been revoked	N	N
CHROME_LICENSES_ALLOWED	Licenses allowed or not at an org unit event name.	N	N
CREATE_ORG_UNIT	Org Unit {ORG_UNIT_NAME} created	N	N
REMOVE_ORG_UNIT	Org Unit {ORG_UNIT_NAME} deleted	N	N
EDIT_ORG_UNIT_DESCRIPTION	Description of {ORG_UNIT_NAME} changed	N	N
MOVE_ORG_UNIT	{ORG_UNIT_NAME} moved to parent {NEW_VALUE}	N	N
EDIT_ORG_UNIT_NAME	Name of {ORG_UNIT_NAME} changed to {NEW_VALUE}	N	N
REVOKE_DEVICE_ENROLLMENT_TOKEN	Event for 'Revoke enrollment token'.	N	N
TOGGLE_SERVICE_ENABLED	Service {SERVICE_NAME} changed to {NEW_VALUE} for {ORG_UNIT_NAME} organizational unit in your organization	N	N
SECURITY_SETTINGS	Events of this type are returned with type=SECURITY_SETTINGS .	N	N
CHANGE_CAA_APP_ASSIGNMENTS	For {TARGET_ENTITY_TYPE} [ {TARGET_ENTITY_NAME} ]: Before: Access level [ {CAA_ACCESS_ASSIGNMENTS_OLD} ] applied to {CAA_ENFORCEMENT_ENDPOINTS_OLD} of [ {APPLICATION_NAME} ] in [ {MODE} ] mode. After: Access level [ {CAA_ACCESS_ASSIGNMENTS_NEW} ] applied to {CAA_ENFORCEMENT_ENDPOINTS_NEW} of [ {APPLICATION_NAME} ] in [ {MODE} ] mode.	N	N
UNDERAGE_BLOCK_ALL_THIRD_PARTY_API_ACCESS	All third party API access blocked for users under 18.	N	N
UNDERAGE_SIGN_IN_ONLY_THIRD_PARTY_API_ACCESS	Allow Google Sign-in only third party API access for users under 18.	N	N
SIGN_IN_ONLY_THIRD_PARTY_API_ACCESS	Allow Google Sign-in only third party API access	N	N
CHANGE_APP_ACCESS_SETTINGS_COLLECTION_ID	App Access Settings Collection for the org unit {ORG_UNIT_NAME} has changed from {OLD_VALUE} to {NEW_VALUE}	N	N
ADD_TO_LIMITED_OAUTH2_APPS	{OAUTH2_APP_NAME} added to Limited list for {ORG_UNIT_NAME}	N	N
ADD_TO_TRUSTED_BY_OAUTH_SCOPE_OAUTH2_APPS	{OAUTH2_APP_NAME} added to trusted by OAuth scope list for {ORG_UNIT_NAME}	N	N
ADD_TO_CAA_EXEMPT_OAUTH2_APPS	{OAUTH2_APP_NAME} allowlisted for exemption from API access blocks for {ORG_UNIT_NAME}	N	N
REMOVE_FROM_CAA_EXEMPT_OAUTH2_APPS	{OAUTH2_APP_NAME} removed from allowlist for exemption from API access blocks for {ORG_UNIT_NAME}	N	N
REMOVE_FROM_LIMITED_OAUTH2_APPS	{OAUTH2_APP_NAME} removed from Limited list for {ORG_UNIT_NAME}	N	N
REMOVE_FROM_TRUSTED_BY_OAUTH_SCOPE_OAUTH2_APPS	{OAUTH2_APP_NAME} removed from trusted by OAuth scope list for {ORG_UNIT_NAME}	N	N
MULTIPLE_ADD_TO_BLOCKED_OAUTH2_APPS	{OAUTH2_NUM_APPS} apps added to Blocked list for {ORG_UNIT_NAME}	N	N
MULTIPLE_ADD_TO_LIMITED_OAUTH2_APPS	{OAUTH2_NUM_APPS} apps added to Limited list for {ORG_UNIT_NAME}	N	N
MULTIPLE_ADD_TO_TRUSTED_BY_OAUTH_SCOPE_OAUTH2_APPS	{OAUTH2_NUM_APPS} apps added to Trusted by OAuth Scope list for {ORG_UNIT_NAME}	N	N
MULTIPLE_ADD_TO_TRUSTED_OAUTH2_APPS	{OAUTH2_NUM_APPS} apps added to Trusted list for {ORG_UNIT_NAME}	N	N
OAUTH_APPS_BULK_UPLOAD	{BULK_UPLOAD_SUCCESS_OAUTH_APPS_NUMBER} of {BULK_UPLOAD_TOTAL_OAUTH_APPS_NUMBER} rows successfully uploaded	N	N
OAUTH_APPS_BULK_UPLOAD_NOTIFICATION_SENT	Notification of bulk upload for apps list sent to {USER_EMAIL}	N	N
BLOCK_ON_DEVICE_ACCESS	Summary message to display in the audit log when device access for OAuth2 apps is blocked.	N	N
CHANGE_TWO_STEP_VERIFICATION_FREQUENCY	2-step verification frequency for {ORG_UNIT_NAME} changed from {OLD_VALUE} to {NEW_VALUE}	N	N
CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION	2-step verification grace period duration for {ORG_UNIT_NAME} changed from {OLD_VALUE} to {NEW_VALUE}	N	N
CHANGE_TWO_STEP_VERIFICATION_START_DATE	2-step verification start date has been changed from {OLD_VALUE} to {NEW_VALUE}	N	N
CHANGE_CAA_ERROR_MESSAGE	Error message has been changed to [ {NEW_VALUE} ]. (OrgUnit Name: {ORG_UNIT_NAME} )	N	N
TOGGLE_CAA_REMEDIATION_ENABLEMENT	Context Aware Access Remediation has been {NEW_VALUE} . (OrgUnit Name: {ORG_UNIT_NAME} )	N	N
EDU_OVER_18_APPROVAL_WORKFLOW_DISABLED	Disabled Edu over 18 users apps requests for {ORG_UNIT_NAME}	N	N
EDU_DELEGATED_USER_APPROVAL_WORKFLOW_DISABLED	Disabled over 18 users making delegated apps requests for {ORG_UNIT_NAME}	N	N
UNDERAGE_USER_APPROVAL_WORKFLOW_DISABLED	Disabled under 18 users apps requests for {ORG_UNIT_NAME}	N	N
USER_APPROVAL_WORKFLOW_DISABLED	Disabled users over 18 to make apps requests for {ORG_UNIT_NAME}	N	N
UNTRUST_DOMAIN_OWNED_OAUTH2_APPS	Domain Owned Apps removed from trusted list	N	N
TRUST_DOMAIN_OWNED_OAUTH2_APPS	Domain Owned Apps added to trusted list	N	N
ENABLE_NON_ADMIN_USER_PASSWORD_RECOVERY	Enable non-admin user password recovery setting in {ORG_UNIT_NAME} organization changed from {OLD_VALUE} to {NEW_VALUE}	N	N
EDU_OVER_18_APPROVAL_WORKFLOW_ENABLED	Enabled Edu over 18 users apps requests for {ORG_UNIT_NAME}	N	N
EDU_DELEGATED_USER_APPROVAL_WORKFLOW_ENABLED	Enabled over 18 users making delegated apps requests for {ORG_UNIT_NAME}	N	N
UNDERAGE_USER_APPROVAL_WORKFLOW_ENABLED	Enabled under 18 users apps requests for {ORG_UNIT_NAME}	N	N
USER_APPROVAL_WORKFLOW_ENABLED	Enabled users over 18 to make apps requests for {ORG_UNIT_NAME}	N	N
UPDATE_ERROR_MSG_FOR_RESTRICTED_OAUTH2_APPS	Summary message to display in the audit log for Oauth2 scope management settings.	N	N
CHANGE_SESSION_LENGTH	Session length has been changed from {OLD_VALUE} to {NEW_VALUE}	N	N
UNBLOCK_ON_DEVICE_ACCESS	Summary message to display in the audit log when device access for OAuth2 apps is unblocked.	N	N
DOWNLOAD_PENDING_APP_USER_REQUESTS	Downloaded list of users requesting access to {OAUTH2_APP_NAME}	N	N
SITES_SETTINGS	Events of this type are returned with type=SITES_SETTINGS .	N	N
ADD_WEB_ADDRESS	Event gets triggered when a web address is added via cpanel.	N	N
DELETE_WEB_ADDRESS	Event gets triggered when a web address is deleted via cpanel.	N	N
CHANGE_SITES_SETTING	{SETTING_NAME} for sites in your organization changed from {OLD_VALUE} to {NEW_VALUE}	N	N
CHANGE_SITES_WEB_ADDRESS_MAPPING_UPDATES	Sites web address mapping update.	N	N
VIEW_SITE_DETAILS	Admin viewed the site details of {SITE_NAME}	N	N
USER_SETTINGS	Events of this type are returned with type=USER_SETTINGS .	N	N
DELETE_2SV_SCRATCH_CODES	2-step verification scratch codes of the user {USER_EMAIL} deleted	N	N
GENERATE_2SV_SCRATCH_CODES	New 2-step verification scratch codes generated for the user {USER_EMAIL}	N	N
REVOKE_3LO_DEVICE_TOKENS	3-legged OAuth tokens issued by user {USER_EMAIL} for the device type {DEVICE_TYPE} and id {DEVICE_ID} were revoked	N	N
ACCEPT_USER_INVITATION	User invitation accepted for user: {USER_EMAIL}	N	N
ADD_RECOVERY_EMAIL	Recovery email added for {USER_EMAIL}	N	N
ADD_RECOVERY_PHONE	Recovery phone added for {USER_EMAIL}	N	N
TOGGLE_AUTOMATIC_CONTACT_SHARING	Automatic contact sharing for {USER_EMAIL} changed to {NEW_VALUE}	N	N
BULK_UPLOAD	{BULK_UPLOAD_TOTAL_USERS_NUMBER} users selected for upload to your organization. {BULK_UPLOAD_FAIL_USERS_NUMBER} out of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users were not uploaded.	N	N
BULK_UPLOAD_NOTIFICATION_SENT	Notification of bulk users upload sent to {USER_EMAIL}	N	N
CANCEL_USER_INVITE	Invite to {USER_EMAIL} cancelled	N	N
CHANGE_USER_CUSTOM_FIELD	{USER_CUSTOM_FIELD} changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}	N	N
CHANGE_USER_EXTERNAL_ID	External Ids changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}	N	N
CHANGE_USER_GENDER	Change here is a verb. The genders will be customizable, so this should be broader than male vs female.	N	N
CHANGE_USER_IM	IMs changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}	N	N
ENABLE_USER_IP_WHITELIST	IP whitelist changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}	N	N
CHANGE_USER_KEYWORD	Keywords are used on user profiles to help identify a user in searches. Example: find person with name 'Larry' and school 'Stanford'. 'Change' is a verb.	N	N
CHANGE_USER_LANGUAGE	Can be a predefined set of more common languages provided by Google or a custom language. 'Change' here is a verb.	N	N
CHANGE_USER_LOCATION	Location is different from address in the following ways: (1) Location can be fuzzy. Example: Near Seattle. (2) Hovercards and other short user summaries display location, not address. 'Change' is a verb.	N	N
CHANGE_USER_ORGANIZATION	Organizations changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}	N	N
CHANGE_USER_PHONE_NUMBER	Phone Numbers changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}	N	N
CHANGE_RECOVERY_EMAIL	Recovery email changed for {USER_EMAIL}	N	N
CHANGE_RECOVERY_PHONE	Recovery phone changed for {USER_EMAIL}	N	N
CHANGE_USER_RELATION	Relations changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}	N	N
CHANGE_USER_ADDRESS	Addresses changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}	N	N
CREATE_EMAIL_MONITOR	Created an email monitor for {USER_EMAIL} to {EMAIL_MONITOR_DEST_EMAIL} that will expire on {END_DATE_TIME}	N	N
DELETE_ACCOUNT_INFO_DUMP	Deleted account and login information dump for {USER_EMAIL} and request ID {REQUEST_ID}	N	N
DELETE_EMAIL_MONITOR	Deleted an email monitor for {USER_EMAIL} to {EMAIL_MONITOR_DEST_EMAIL}	N	N
DELETE_MAILBOX_DUMP	Deleted mailbox dump for {USER_EMAIL} and request ID {REQUEST_ID}	N	N
DELETE_PROFILE_PHOTO	Profile photo of {USER_EMAIL} has been deleted	N	N
ADD_DISPLAY_NAME	{USER_DISPLAY_NAME} added as a display name of {USER_EMAIL}	N	N
CHANGE_DISPLAY_NAME	Display name of {USER_EMAIL} changed from {OLD_VALUE} to {NEW_VALUE}	N	N
REMOVE_DISPLAY_NAME	{USER_DISPLAY_NAME} removed as a display name of {USER_EMAIL}	N	N
CHANGE_FIRST_NAME	First name of {USER_EMAIL} changed from {OLD_VALUE} to {NEW_VALUE}	N	N
GMAIL_RESET_USER	Gmail account of {USER_EMAIL} reset	N	N
CHANGE_LAST_NAME	Last name of {USER_EMAIL} changed from {OLD_VALUE} to {NEW_VALUE}	N	N
MAIL_ROUTING_DESTINATION_ADDED	User {USER_EMAIL} has received the following individual mail routing destination: {NEW_VALUE}	N	N
MAIL_ROUTING_DESTINATION_REMOVED	User {USER_EMAIL} has had the following individual mail routing destination removed: {OLD_VALUE}	N	N
ADD_NICKNAME	{USER_NICKNAME} created as a nickname of {USER_EMAIL}	N	N
REMOVE_NICKNAME	{USER_NICKNAME} deleted as a nickname of {USER_EMAIL}	N	N
PASSKEY_REVOKED	A passkey enrolled for user {USER_EMAIL} was revoked	N	N
CHANGE_PASSWORD_ON_NEXT_LOGIN	Password change requirement for {USER_EMAIL} on next login changed from {OLD_VALUE} to {NEW_VALUE}	N	N
DOWNLOAD_PENDING_INVITES_LIST	Pending Invites List was downloaded as a CSV file	N	N
UPDATE_PUBLIC_KEY_CERTIFICATE_STATUS	Public key certificate status updated to {PUBLIC_KEY_CERTIFICATE_STATUS} for email {USER_IMPACTED_EMAIL} of user {USER_EMAIL}	N	N
UPDATE_PUBLIC_KEY_CERTIFICATE	Public key certificate updated for {USER_DISPLAY_NAME} email {USER_EMAIL}	N	N
REMOVE_RECOVERY_EMAIL	Recovery email removed for {USER_EMAIL}	N	N
REMOVE_RECOVERY_PHONE	Recovery phone removed for {USER_EMAIL}	N	N
REQUEST_ACCOUNT_INFO	Requested account and login information for {USER_EMAIL}	N	N
REQUEST_MAILBOX_DUMP	Requested mailbox dump for {USER_EMAIL}	N	N
RESEND_USER_INVITE	Invite email to {USER_EMAIL} resent	N	N
RESET_SIGNIN_COOKIES	Cookies reset for {USER_EMAIL} and forced re-login	N	N
SECURITY_KEY_REGISTERED_FOR_USER	Security key registered for {USER_EMAIL}	N	N
REVOKE_SECURITY_KEY	A security key enrolled for user {USER_EMAIL} for 2-step verification was revoked	N	N
USER_INVITE	{USER_EMAIL} invited to join your organization	N	N
VIEW_TEMP_PASSWORD	Temporary password for user {USER_EMAIL} viewed by the admin	N	N
UNBLOCK_USER_SESSION	User {USER_EMAIL} unblocked by temporarily disabling login challenge	N	N
UNMANAGED_USERS_BULK_UPLOAD	A total of {BULK_UPLOAD_TOTAL_USERS_NUMBER} unmanaged users selected for upload. {BULK_UPLOAD_FAIL_USERS_NUMBER} out of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users failed to be uploaded.	N	N
DOWNLOAD_UNMANAGED_USERS_LIST	Unmanaged Users list was downloaded as a CSV file	N	N
UPDATE_PROFILE_PHOTO	Profile photo of {USER_EMAIL} has been updated	N	N
UNENROLL_USER_FROM_TITANIUM	User {USER_EMAIL} unenrolled from Advanced Protection	N	N
ARCHIVE_USER	{USER_EMAIL} archived	N	N
UPDATE_BIRTHDATE	The birth date for {USER_EMAIL} changed to {BIRTHDATE}	N	N
USER_CREATED_PASSKEY_REVOKE	A user created passkey enrolled for user {USER_EMAIL} was revoked	N	N
DOWNGRADE_USER_FROM_GPLUS	{USER_EMAIL} was downgraded from Google+	N	N
USER_ENROLLED_IN_TWO_STEP_VERIFICATION	{USER_EMAIL} enrolled in 2-step verification	N	N
DOWNLOAD_USERLIST_CSV	User list was downloaded as a CSV file	N	N
DOWNLOAD_USERLIST	User list was downloaded in {FORMAT}	N	N
USER_PUT_IN_TWO_STEP_VERIFICATION_GRACE_PERIOD	2-step verification grace period has been enabled on {USER_EMAIL} till {NEW_VALUE}	N	N
UNENROLL_USER_FROM_STRONG_AUTH	User {USER_EMAIL} unenrolled from Strong Auth	N	Y
UNARCHIVE_USER	{USER_EMAIL} unarchived	N	N
UNDELETE_USER	{USER_EMAIL} undeleted	N	N
UPGRADE_USER_TO_GPLUS	{USER_EMAIL} was upgraded to Google+	N	N
USERS_BULK_UPLOAD	A total of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users selected for upload. {BULK_UPLOAD_FAIL_USERS_NUMBER} out of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users failed to be uploaded.	N	N
USERS_BULK_UPLOAD_NOTIFICATION_SENT	Notification of bulk users upload sent to {USER_EMAIL}	N	N

any: Admin Console (any event)

ApplicationName: admin

Description

Source-only rules that filter on applicationName 'admin' without specifying an eventName attribute here.

References #

Reports API: admin activity events

ADD_APPLICATION: Add Application

ApplicationName: admin

Description

An application was added to the Google Workspace domain.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Application Added to Google Workspace Domain source high: Detects when an administrator adds a Google Workspace Marketplace application to the domain. Adversaries with administrative access may register a malicious OAuth application to establish long-lived API access to mail, drive, and other Workspace data, maintaining persistence and enabling collection without relying on a single user password alone.T1098, T1098.001

YARA-L #

Google Workspace Application Added source high: Identifies when a Marketplace app is added in a Google Workspace organization. Installing certain apps may increase the organization's risk of data exfiltration/leakage and increase its attack surface.

Panther #

Google Workspace Apps Marketplace New Domain Application source medium: A Google Workspace User configured a new domain application from the Google Workspace Apps Marketplace.

References #

Admin Activity Events: ADD_APPLICATION

ADD_GROUP_MEMBER: Group Member Creation

ApplicationName: admin

Description

A user was added to a group.

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2022-08-02T07:23:13.421Z",
    "uniqueQualifier": "-6242204098544478741",
    "applicationName": "admin",
    "customerId": "C00mpaiwz"
  },
  "etag": "\"_ZVRqe-BUDYcYeOIPo-gm6Eh1QaGne4ACjHHI6qsr6A/9oyhwvio4MjL25Tdz-HrTS7DwCc\"",
  "actor": {
    "callerType": "USER",
    "email": "admin@cloud-response.com",
    "profileId": "111440584475724055600"
  },
  "ipAddress": "86.48.11.48",
  "events": [
    {
      "type": "GROUP_SETTINGS",
      "name": "ADD_GROUP_MEMBER",
      "parameters": [
        {
          "name": "USER_EMAIL",
          "value": "workspace@cloud-response.com"
        },
        {
          "name": "GROUP_EMAIL",
          "value": "sales@cloud-response.com"
        }
      ]
    }
  ]
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

External User Added to Google Workspace Group source medium: Detects an external Google Workspace user account being added to an existing group. Adversaries may add external user accounts as a means to intercept shared files or emails with that specific group.T1078, T1078.004, T1098

YARA-L #

Google Workspace External User Added To Group source medium: Identifies when an external user account is added to a group in Google Workspace. Security teams can monitor for unexpected user accounts being added to Google Workspace groups to prevent unauthorized access to data.T1078

References #

ADD_PRIVILEGE: Add Privilege

ApplicationName: admin

Description

A privilege was added to a role.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Google Workspace Role Modified source high: Detects when a custom admin role or its privileges are modified in Google Workspace. Adversaries may add or expand privileges on an existing role to elevate access for assigned users or groups without creating a new role or directly assigning a well-known admin role. Because privilege changes take effect for all principals assigned the role, modifying role permissions can silently expand access across multiple accounts.T1098↳ also matches UPDATE_ROLE: Update Role

References #

Admin Activity Events: role and privilege management

ADD_TRUSTED_DOMAINS: Domains added to Trusted Domains

ApplicationName: admin

Description

A domain was added to the trusted domains list.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Domain Added to Google Workspace Trusted Domains source high: Detects when an administrator adds a domain to the Google Workspace allowlisted (trusted) domains list. Adversaries with administrative access may onboard a domain they control to relax cross-organization sharing restrictions, enabling data collection and exfiltration through Drive, Chat, and other services that honor the tenant trust boundary.T1484, T1484.002, T1562, T1562.007

YARA-L #

Google Workspace New Trusted Domain Added source high: Identifies when a domain is added to the list of trusted domains in Google Workspace. An adversary may attempt to manipulate sharing settings for trusted domains to gain unauthorized access to sensitive files and folders within an organization.T1562

Panther #

GSuite Workspace Trusted Domain Allowlist Modified source medium suffix: A Workspace Admin Has Modified The Trusted Domains ListT1098↳ also matches REMOVE_TRUSTED_DOMAINS: Domains removed from Trusted Domains

References #

Admin Activity Events: ADD_TRUSTED_DOMAINS

ALLOW_STRONG_AUTHENTICATION: Allow 2-Step Verification

ApplicationName: admin

Description

The administrator changed the MFA enforcement setting (allow/require strong authentication).

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`google_workspace.admin.new_value (GWS)`	eq	`false`	2 rules	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Google Workspace MFA Disabled source medium: Detects when multi-factor authentication (MFA) is disabled.↳ also matches ENFORCE_STRONG_AUTHENTICATION: Enforce 2-Step Verification

Elastic #

Google Workspace MFA Enforcement Disabled For Organization source high: Detects when an administrator disables multi-factor authentication enforcement or removes the ability for users to enroll in 2-step verification across a Google Workspace organization or organizational unit. Adversaries with administrative access may weaken tenant-wide authentication requirements to enable password-only sign-ins, facilitate credential abuse at scale, and reduce friction for follow-on account takeover across the domain.T1531, T1556, T1556.006↳ also matches ENFORCE_STRONG_AUTHENTICATION: Enforce 2-Step Verification
Deprecated - MFA Disabled for Google Workspace Organization source high: Detects when multi-factor authentication (MFA) is disabled for a Google Workspace organization. An adversary may attempt to modify a password policy in order to weaken an organization’s security controls.T1556↳ also matches ENFORCE_STRONG_AUTHENTICATION: Enforce 2-Step Verification

YARA-L #

Google Workspace MFA Disabled source high: Identifies when multi-factor authentication (MFA) is disabled for a Google Workspace organization. Security teams can monitor for changes to MFA configuration that may weaken the organization's security posture.T1556↳ also matches ENFORCE_STRONG_AUTHENTICATION: Enforce 2-Step Verification

References #

Admin Activity Events: ALLOW_STRONG_AUTHENTICATION

ASSIGN_ROLE: Assign Role

ApplicationName: admin

Description

An admin role was assigned to a user or service account.

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2022-03-19T22:20:43.530Z",
    "uniqueQualifier": "-7508907472163717949",
    "applicationName": "admin",
    "customerId": "C00mpaiwz"
  },
  "etag": "\"_ZVRqe-BUDYcYeOIPo-gm6Eh1QaGne4ACjHHI6qsr6A/mBEzkDVa6667CpQAnS5-siNE7Q8\"",
  "actor": {
    "callerType": "USER",
    "email": "admin@cloud-response.com",
    "profileId": "111440584475724055600"
  },
  "ipAddress": "80.114.222.200",
  "events": [
    {
      "type": "DELEGATED_ADMIN_SETTINGS",
      "name": "ASSIGN_ROLE",
      "parameters": [
        {
          "name": "ROLE_NAME",
          "value": "_SEED_ADMIN_ROLE"
        },
        {
          "name": "USER_EMAIL",
          "value": "greg@cloud-response.com"
        }
      ]
    }
  ]
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`security_result.category_details (Chronicle)`	eq	`DELEGATED_ADMIN_SETTINGS`	1 rule	chronicle

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Google Workspace Admin Role Assigned to a User or Group source high: Assigning an administrative role to a user or group grants elevated privileges within Google Workspace, including access to the Google Admin console and the ability to manage domain resources and applications. Adversaries may assign administrator roles to an existing account or a newly created account/group to establish persistence, facilitate privilege escalation, and enable follow-on actions across the tenant. In particular, users with Super Admin privileges can bypass single sign-on (SSO) if it is enabled in Google Workspace.T1098, T1098.003

YARA-L #

Google Workspace Admin Role Assignment source high: Identifies when an administrator role is assigned to a user account in Google Workspace. Security teams can monitor for the malicious or accidental assignment of administrator privileges to prevent unauthorized access to data.T1098

References #

AUTHORIZE_API_CLIENT_ACCESS: API Client Access Authorize

ApplicationName: admin

Description

An API client was authorized domain-wide access via OAuth.

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2022-07-19T07:27:14.787Z",
    "uniqueQualifier": "-3655413010083625269",
    "applicationName": "admin",
    "customerId": "C00mpaiwz"
  },
  "etag": "\"_ZVRqe-BUDYcYeOIPo-gm6Eh1QaGne4ACjHHI6qsr6A/d2q8JXudtHXN9ju8y1422NasFeM\"",
  "actor": {
    "email": "admin@cloud-response.com",
    "profileId": "111440584475724055600"
  },
  "events": [
    {
      "type": "DOMAIN_SETTINGS",
      "name": "AUTHORIZE_API_CLIENT_ACCESS",
      "parameters": [
        {
          "name": "DOMAIN_NAME",
          "value": ""
        },
        {
          "name": "API_CLIENT_NAME",
          "value": "106850843410684334493"
        },
        {
          "name": "API_SCOPES",
          "value": "https://www.googleapis.com/auth/admin.reports.audit.readonly"
        }
      ]
    }
  ]
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Google Workspace Granted Domain API Access source medium: Detects when an API access service account is granted domain authority.T1098

Elastic #

Google Workspace API Access Granted via Domain-Wide Delegation source high: Detects when a super administrator authorizes domain-wide delegation (DWD) API client access for a Google Cloud service account or OAuth client. DWD lets an application impersonate users and access Workspace APIs across the tenant. Adversaries with admin access may register or authorize a malicious client with broad scopes to maintain API-based persistence and access mail, drive, and directory data without relying on a single user's password alone.T1098

Kusto #

GWorkspace - API Access Granted source medium: Triggers when API Access has been granted to a new client.T1550

References #

CHANGE_APPLICATION_SETTING: Application Setting Change

ApplicationName: admin

Description

A setting for a Google Workspace application was modified.

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2022-07-19T06:43:02.250Z",
    "uniqueQualifier": "-6822745075951815011",
    "applicationName": "admin",
    "customerId": "C00mpaiwz"
  },
  "etag": "\"_ZVRqe-BUDYcYeOIPo-gm6Eh1QaGne4ACjHHI6qsr6A/1UHNER-nXmxzm1FTJ6hrJsN1r5w\"",
  "actor": {
    "callerType": "USER",
    "email": "admin@cloud-response.com",
    "profileId": "111440584475724055600"
  },
  "ipAddress": "80.114.222.200",
  "events": [
    {
      "type": "APPLICATION_SETTINGS",
      "name": "CHANGE_APPLICATION_SETTING",
      "parameters": [
        {
          "name": "APPLICATION_NAME",
          "value": "Google Cloud Platform Sharing Options"
        },
        {
          "name": "ORG_UNIT_NAME",
          "value": "cloud-response.com"
        },
        {
          "name": "SETTING_NAME",
          "value": "Data Sharing Settings between GCP and Google Workspace \"Sharing Options\""
        },
        {
          "name": "OLD_VALUE",
          "value": "DISABLED"
        },
        {
          "name": "NEW_VALUE",
          "value": "ENABLED"
        }
      ]
    }
  ]
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`google_workspace.admin.application.name (GWS)`	eq	`google workspace marketplace`	2 rules	elastic
`parameters.APPLICATION_NAME` (panther rule field)	eq	`gmail`	2 rules	panther
`parameters.NEW_VALUE` (panther rule field)	eq	`true`	2 rules	panther
`security_result.category_details (Chronicle)`	eq	`APPLICATION_SETTINGS`	2 rules	chronicle
`type` (panther rule field)	eq	`APPLICATION_SETTINGS`	2 rules	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Google Workspace Application Access Level Modified source medium: Detects when an access level is changed for a Google workspace application. An access level is part of BeyondCorp Enterprise which is Google Workspace's way of enforcing Zero Trust model. An adversary would be able to remove access levels to gain easier access to Google workspace resources.T1098, T1098.003

Elastic #

Google Workspace Gmail Routing or Forwarding Rule Created or Modified source high: Detects when a Gmail routing, mail-forwarding, or custom mail-host setting is created or modified in Google Workspace. Adversaries with administrative access can add Routing rules (also deliver to / change envelope recipient), recipient address map forwarding, or mail hosts and outbound gateways to copy or redirect sensitive email for collection.T1114, T1114.003↳ also matches CHANGE_GMAIL_SETTING: Gmail Setting Change, CREATE_APPLICATION_SETTING: Application Setting Creation, CREATE_GMAIL_SETTING: Gmail Setting Creation
Application Removed from Blocklist in Google Workspace source medium: Google Workspace administrators may be aware of malicious applications within the Google marketplace and block these applications for user security purposes. An adversary, with administrative privileges, may remove this application from the explicit block list to allow distribution of the application amongst users. This may also indicate the unauthorized use of an application that had been previously blocked before by a user with admin privileges.T1484, T1562, T1562.001
Google Workspace Bitlocker Setting Disabled source medium: Google Workspace administrators whom manage Windows devices and have Windows device management enabled may also enable BitLocker drive encryption to mitigate unauthorized data access on lost or stolen computers. Adversaries with valid account access may disable BitLocker to access sensitive data on an endpoint added to Google Workspace device management.T1484, T1562, T1562.001

Show 2 more (5 total) on the rules page

YARA-L #

Google Workspace Marketplace Allowlist Configuration source low: Identifies when the Google Workspace Marketplace allowlist is configured to allow users to install and run any apps from the Marketplace. Allowing users to install and run any apps may increase the organization's risk of data exfiltration/leakage and increase its attack surface.T1562
Google Workspace Password Policy Changed source low: Identifies when Google Workspace password policy is changed. Security teams can monitor for changes to password policy configuration that may weaken the organization's security posture.T1098↳ also matches CREATE_APPLICATION_SETTING: Application Setting Creation

Panther #

GSuite Workspace Gmail Pre-Delivery Message Scanning Disabled source medium: A Workspace Admin Has Disabled Pre-Delivery Scanning For Gmail.T1566
GSuite Workspace Gmail Security Sandbox Disabled source medium: A Workspace Admin Has Disabled The Security SandboxT1566
GSuite Workspace Strong Password Enforcement Has Been Disabled source high: A Workspace Admin Has Disabled The Enforcement Of Strong PasswordsT1110

Show 1 more (4 total) on the rules page

References #

CHANGE_GMAIL_SETTING: Gmail Setting Change

ApplicationName: admin

Description

A Gmail routing or mail-flow setting was changed.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Google Workspace Gmail Routing or Forwarding Rule Created or Modified source high: Detects when a Gmail routing, mail-forwarding, or custom mail-host setting is created or modified in Google Workspace. Adversaries with administrative access can add Routing rules (also deliver to / change envelope recipient), recipient address map forwarding, or mail hosts and outbound gateways to copy or redirect sensitive email for collection.T1114, T1114.003↳ also matches CHANGE_APPLICATION_SETTING: Application Setting Change, CREATE_APPLICATION_SETTING: Application Setting Creation, CREATE_GMAIL_SETTING: Gmail Setting Creation

Panther #

GSuite Workspace Gmail Default Routing Rule Modified source high suffix: A Workspace Admin Has Modified A Default Routing Rule In GmailT1098↳ also matches CREATE_GMAIL_SETTING: Gmail Setting Creation, DELETE_GMAIL_SETTING: Gmail Setting Deletion

References #

Admin Activity Events: Gmail/email settings

CREATE_APPLICATION_SETTING: Application Setting Creation

ApplicationName: admin

Description

A new application setting was created.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`security_result.category_details (Chronicle)`	eq	`APPLICATION_SETTINGS`	1 rule	chronicle

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Google Workspace Gmail Routing or Forwarding Rule Created or Modified source high: Detects when a Gmail routing, mail-forwarding, or custom mail-host setting is created or modified in Google Workspace. Adversaries with administrative access can add Routing rules (also deliver to / change envelope recipient), recipient address map forwarding, or mail hosts and outbound gateways to copy or redirect sensitive email for collection.T1114, T1114.003↳ also matches CHANGE_APPLICATION_SETTING: Application Setting Change, CHANGE_GMAIL_SETTING: Gmail Setting Change, CREATE_GMAIL_SETTING: Gmail Setting Creation
Google Workspace Password Policy Modified source medium: Detects when a Google Workspace administrator modifies organization password policy settings. Adversaries with administrative access may weaken password requirements, such as disabling strong password enforcement, allowing password reuse, or reducing minimum length, to increase the success of password spraying and credential stuffing against tenant accounts and to sustain access after initial compromise.T1098, T1484↳ also matches CHANGE_APPLICATION_SETTING: Application Setting Change

YARA-L #

Google Workspace Password Policy Changed source low: Identifies when Google Workspace password policy is changed. Security teams can monitor for changes to password policy configuration that may weaken the organization's security posture.T1098↳ also matches CHANGE_APPLICATION_SETTING: Application Setting Change

Panther #

Google Workspace Advanced Protection Program source medium: Your organization's Google Workspace Advanced Protection Program settings were modified.

References #

Admin Activity Events: CREATE_APPLICATION_SETTING

CREATE_DATA_TRANSFER_REQUEST: Data transfer request created

ApplicationName: admin

Description

An admin initiated a data transfer (Drive file ownership reassignment) to another user.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`security_result.category_details (Chronicle)`	eq	`USER_SETTINGS`	1 rule	chronicle

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Google Workspace Drive Data Transfer or Takeout Export Initiated source medium: Detects when Google Workspace administrators initiate bulk movement or export of user Drive data. This includes admin data transfer requests that reassign a user's Drive files to another account, and Customer Takeout export jobs that package organizational data for download or off-platform transfer. Adversaries with administrative access may abuse these mechanisms to stage or exfiltrate sensitive files.T1074, T1074.002, T1537↳ also matches CUSTOMER_TAKEOUT_CREATED: Customer Takeout Created

YARA-L #

Google Workspace Ownership Transferred On Google Drive source high: Identifies when a Google Workspace user transfers the ownership of a file.T1074

References #

Admin Activity Events: CREATE_DATA_TRANSFER_REQUEST

CREATE_GMAIL_SETTING: Gmail Setting Creation

ApplicationName: admin

Description

A new Gmail routing or mail-flow setting was created.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Google Workspace Gmail Routing or Forwarding Rule Created or Modified source high: Detects when a Gmail routing, mail-forwarding, or custom mail-host setting is created or modified in Google Workspace. Adversaries with administrative access can add Routing rules (also deliver to / change envelope recipient), recipient address map forwarding, or mail hosts and outbound gateways to copy or redirect sensitive email for collection.T1114, T1114.003↳ also matches CHANGE_APPLICATION_SETTING: Application Setting Change, CHANGE_GMAIL_SETTING: Gmail Setting Change, CREATE_APPLICATION_SETTING: Application Setting Creation

Panther #

GSuite Workspace Gmail Default Routing Rule Modified source high suffix: A Workspace Admin Has Modified A Default Routing Rule In GmailT1098↳ also matches CHANGE_GMAIL_SETTING: Gmail Setting Change, DELETE_GMAIL_SETTING: Gmail Setting Deletion

References #

Admin Activity Events: Gmail/email settings

CREATE_ROLE: Create Role

ApplicationName: admin

Description

A custom admin role was created.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`security_result.category_details (Chronicle)`	eq	`DELEGATED_ADMIN_SETTINGS`	1 rule	chronicle

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Google Workspace Custom Admin Role Created source medium: Detects when a custom administrative role is created in Google Workspace. Unlike prebuilt admin roles, custom roles allow granular selection of privileges across Google services and can be assigned to users or groups. Adversaries may create a custom admin role to craft elevated permissions tailored to their objectives, then assign that role to a compromised or attacker-controlled account to establish persistence and enable follow-on actions such as modifying security controls, granting OAuth access, or changing mail routing.T1098, T1098.003

YARA-L #

Google Workspace Custom Admin Role Created source high: Identifies when a custom administrator role is created in Google Workspace. Security teams can monitor for malicious or accidental configuration of administrator privileges to prevent unauthorized access to data.T1098

Panther #

Google Workspace Admin Custom Role source medium: A Google Workspace administrator created a new custom administrator role.

References #

Admin Activity Events: role management

CUSTOMER_TAKEOUT_CREATED: Customer Takeout Created

ApplicationName: admin

Description

An admin initiated a Takeout export job for organizational data.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Google Workspace Drive Data Transfer or Takeout Export Initiated source medium: Detects when Google Workspace administrators initiate bulk movement or export of user Drive data. This includes admin data transfer requests that reassign a user's Drive files to another account, and Customer Takeout export jobs that package organizational data for download or off-platform transfer. Adversaries with administrative access may abuse these mechanisms to stage or exfiltrate sensitive files.T1074, T1074.002, T1537↳ also matches CREATE_DATA_TRANSFER_REQUEST: Data transfer request created

Panther #

GSuite Workspace Data Export Has Been Created source medium prefix: A Workspace Admin Has Created a Data Export

References #

Admin Activity Events: CUSTOMER_TAKEOUT_CREATED

DELETE_ROLE: Delete Role

ApplicationName: admin

Description

An admin role was permanently deleted.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Google Workspace Role Modified or Deleted source medium: Detects when an a role is modified or deleted in Google Workspace.↳ also matches RENAME_ROLE: Rename Role, UPDATE_ROLE: Update Role

Elastic #

Google Workspace Admin Role Deletion source medium: Detects when a custom administrative role is deleted in Google Workspace. Adversaries may delete a custom admin role to disrupt delegated administration, remove security team access, or hinder incident response. Deleting a role removes the privileges it granted from all assigned users and groups, which can cause operational impact or blind spots during an active investigation.T1484, T1531

References #

Admin Activity Events: role management

ENFORCE_STRONG_AUTHENTICATION: Enforce 2-Step Verification

ApplicationName: admin

Description

The MFA/2SV enforcement policy was changed for the domain or an organizational unit.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`google_workspace.admin.new_value (GWS)`	eq	`false`	2 rules	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Google Workspace MFA Disabled source medium: Detects when multi-factor authentication (MFA) is disabled.↳ also matches ALLOW_STRONG_AUTHENTICATION: Allow 2-Step Verification

Elastic #

Google Workspace MFA Enforcement Disabled For Organization source high: Detects when an administrator disables multi-factor authentication enforcement or removes the ability for users to enroll in 2-step verification across a Google Workspace organization or organizational unit. Adversaries with administrative access may weaken tenant-wide authentication requirements to enable password-only sign-ins, facilitate credential abuse at scale, and reduce friction for follow-on account takeover across the domain.T1531, T1556, T1556.006↳ also matches ALLOW_STRONG_AUTHENTICATION: Allow 2-Step Verification
Deprecated - MFA Disabled for Google Workspace Organization source high: Detects when multi-factor authentication (MFA) is disabled for a Google Workspace organization. An adversary may attempt to modify a password policy in order to weaken an organization’s security controls.T1556↳ also matches ALLOW_STRONG_AUTHENTICATION: Allow 2-Step Verification

YARA-L #

Google Workspace MFA Disabled source high: Identifies when multi-factor authentication (MFA) is disabled for a Google Workspace organization. Security teams can monitor for changes to MFA configuration that may weaken the organization's security posture.T1556↳ also matches ALLOW_STRONG_AUTHENTICATION: Allow 2-Step Verification

References #

Admin Activity Events: ENFORCE_STRONG_AUTHENTICATION

GRANT_ADMIN_PRIVILEGE: Admin Privileges Grant

ApplicationName: admin

Description

Administrator privileges were granted to a user account.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Google Workspace User Granted Admin Privileges source medium: Detects when an Google Workspace user is granted admin privileges.T1098↳ also matches GRANT_DELEGATED_ADMIN_PRIVILEGES: Delegated Admin Privileges Grant

Kusto #

GWorkspace - Admin permissions granted source high: Triggers on admin permissions granted.T1098

References #

Admin Activity Events: GRANT_ADMIN_PRIVILEGE

GRANT_DELEGATED_ADMIN_PRIVILEGES: Delegated Admin Privileges Grant

ApplicationName: admin

Description

Delegated administrator privileges were granted to a user.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Google Workspace User Granted Admin Privileges source medium: Detects when an Google Workspace user is granted admin privileges.T1098↳ also matches GRANT_ADMIN_PRIVILEGE: Admin Privileges Grant

References #

Admin Activity Events: GRANT_DELEGATED_ADMIN_PRIVILEGES

MOVE_USER_TO_ORG_UNIT: User OrgUnit Change

ApplicationName: admin

Description

A user was moved to a different organizational unit.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`google_workspace.event.type (GWS)`	eq	`user_settings`	1 rule	elastic
`security_result.category_details (Chronicle)`	eq	`USER_SETTINGS`	1 rule	chronicle

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Google Workspace User Organizational Unit Changed source low: Users in Google Workspace are typically assigned a specific organizational unit that grants them permissions to certain services and roles that are inherited from this organizational unit. Adversaries may compromise a valid account and change which organizational account the user belongs to which then could allow them to inherit permissions to applications and resources inaccessible prior to.T1098, T1098.003

YARA-L #

Google Workspace User Ou Changed source high: Identifies when a Google Workspace user account is moved between Organizational Units.T1098

References #

Admin Activity Events: MOVE_USER_TO_ORG_UNIT

REMOVE_APPLICATION: Remove Application

ApplicationName: admin

Description

An application was removed from the Google Workspace domain.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Google Workspace Application Removed source medium: Detects when an an application is removed from Google Workspace.↳ also matches REMOVE_APPLICATION_FROM_WHITELIST: Remove Application from Whitelist

References #

Admin Activity Events: REMOVE_APPLICATION

REMOVE_APPLICATION_FROM_WHITELIST: Remove Application from Whitelist

ApplicationName: admin

Description

An application was removed from the domain's marketplace allowlist.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Google Workspace Application Removed source medium: Detects when an an application is removed from Google Workspace.↳ also matches REMOVE_APPLICATION: Remove Application

References #

Admin Activity Events: REMOVE_APPLICATION_FROM_WHITELIST

REMOVE_PRIVILEGE: Remove Privilege

ApplicationName: admin

Description

A privilege was removed from a role.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Google Workspace Role Privilege Deleted source medium: Detects when an a role privilege is deleted in Google Workspace.

References #

Admin Activity Events: role and privilege management

RENAME_ROLE: Rename Role

ApplicationName: admin

Description

An admin role was renamed.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Google Workspace Role Modified or Deleted source medium: Detects when an a role is modified or deleted in Google Workspace.↳ also matches DELETE_ROLE: Delete Role, UPDATE_ROLE: Update Role

References #

Admin Activity Events: role management

SAML2_SERVICE_PROVIDER_CONFIG: SAML2 Service Provider Config

ApplicationName: admin

Description

A SAML 2.0 service provider configuration was added, modified, or removed.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

YARA-L #

Google Workspace SAML IDP Configuration Change source high: Identifies SAML provider configuration changes in Google Workspace. Security teams can monitor for changes to SAML provider configuration that may weaken the organization's security posture.T1078

References #

Admin Activity Events: SAML2_SERVICE_PROVIDER_CONFIG

TOGGLE_OUTBOUND_RELAY: Outbound Relay Change

ApplicationName: admin

Description

Outbound email relay routing was enabled or disabled.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

GWorkspace - An Outbound Relay has been added to a G Suite Domain source medium: Detects outbound relays may be added to collect email.T1114

References #

Admin Activity Events: TOGGLE_OUTBOUND_RELAY

TURN_OFF_2_STEP_VERIFICATION: Turn off 2-step verification

ApplicationName: admin

Description

2-Step Verification was disabled for a user or the domain.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

GWorkspace - Two-step authentification disabled for a user source medium: Triggers on two-step authentification disabled for a user.T1111

References #

Admin Activity Events: 2SV settings

UNSUSPEND_USER: User Unsuspension

ApplicationName: admin

Description

A suspended user account was reactivated.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`google_workspace.event.type (GWS)`	eq	`user_settings`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Google Workspace Suspended User Account Renewed source high: Detects when a previously suspended user's account is renewed in Google Workspace. An adversary may renew a suspended user account to maintain access to the Google Workspace organization with a valid account.T1078, T1078.004, T1098

YARA-L #

Google Workspace User Unsuspended source medium: Identifies when a user account is unsuspended in Google Workspace.T1078

References #

Admin Activity Events: UNSUSPEND_USER

UPDATE_ROLE: Update Role

ApplicationName: admin

Description

An existing admin role was modified (e.g. description or privileges changed).

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Google Workspace Role Modified or Deleted source medium: Detects when an a role is modified or deleted in Google Workspace.↳ also matches DELETE_ROLE: Delete Role, RENAME_ROLE: Rename Role

Elastic #

Google Workspace Role Modified source high: Detects when a custom admin role or its privileges are modified in Google Workspace. Adversaries may add or expand privileges on an existing role to elevate access for assigned users or groups without creating a new role or directly assigning a well-known admin role. Because privilege changes take effect for all principals assigned the role, modifying role permissions can silently expand access across multiple accounts.T1098↳ also matches ADD_PRIVILEGE: Add Privilege

References #

Admin Activity Events: role management

BLOCK_ALL_THIRD_PARTY_API_ACCESS: All third party API access blocked

ApplicationName: admin

Description

An admin blocked all third-party application access to Google Workspace APIs.

References #

Admin Activity Events: BLOCK_ALL_THIRD_PARTY_API_ACCESS

UNBLOCK_ALL_THIRD_PARTY_API_ACCESS: All third party API access unblocked

ApplicationName: admin

Description

An admin unblocked third-party application access to Google Workspace APIs.

References #

Admin Activity Events: UNBLOCK_ALL_THIRD_PARTY_API_ACCESS

ADD_TO_TRUSTED_OAUTH2_APPS: App trusted

ApplicationName: admin

Description

An OAuth2 application was added to the trusted apps list.

References #

Admin Activity Events: ADD_TO_TRUSTED_OAUTH2_APPS

ADD_TO_BLOCKED_OAUTH2_APPS: App added to Blocked list

ApplicationName: admin

Description

An OAuth2 application was blocked from accessing Google Workspace data.

References #

Admin Activity Events: ADD_TO_BLOCKED_OAUTH2_APPS

REMOVE_FROM_BLOCKED_OAUTH2_APPS: App removed from Blocked list

ApplicationName: admin

Description

An OAuth2 application was removed from the blocked apps list.

References #

Admin Activity Events: REMOVE_FROM_BLOCKED_OAUTH2_APPS

REMOVE_FROM_TRUSTED_OAUTH2_APPS: App no longer trusted

ApplicationName: admin

Description

An OAuth2 application was removed from the trusted apps list.

References #

Admin Activity Events: OAuth2 app management

CREATE_USER: User Creation

ApplicationName: admin

Description

A new user account was created in the Google Workspace domain.

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2022-07-19T10:30:16.448Z",
    "uniqueQualifier": "-6485662965628883717",
    "applicationName": "admin",
    "customerId": "C00mpaiwz"
  },
  "etag": "\"_ZVRqe-BUDYcYeOIPo-gm6Eh1QaGne4ACjHHI6qsr6A/xgZr-1-dUUwmP7cz8G9pXT-7nL8\"",
  "actor": {
    "callerType": "USER",
    "email": "admin@cloud-response.com",
    "profileId": "111440584475724055600"
  },
  "ipAddress": "80.114.222.200",
  "events": [
    {
      "type": "USER_SETTINGS",
      "name": "CREATE_USER",
      "parameters": [
        {
          "name": "USER_EMAIL",
          "value": "suspicious@cloud-response.com"
        }
      ]
    }
  ]
}

References #

DELETE_USER: User Deletion

ApplicationName: admin

Description

A user account was deleted from the Google Workspace domain.

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2022-08-11T09:11:04.542Z",
    "uniqueQualifier": "-8365490708529497756",
    "applicationName": "admin",
    "customerId": "C00mpaiwz"
  },
  "etag": "\"_ZVRqe-BUDYcYeOIPo-gm6Eh1QaGne4ACjHHI6qsr6A/PargyQuH7NlMI8Ov8vSZAlDrUEU\"",
  "actor": {
    "callerType": "USER",
    "email": "admin@cloud-response.com",
    "profileId": "111440584475724055600"
  },
  "ipAddress": "145.128.241.109",
  "events": [
    {
      "type": "USER_SETTINGS",
      "name": "DELETE_USER",
      "parameters": [
        {
          "name": "USER_EMAIL",
          "value": "workspace@cloud-response.com"
        }
      ]
    }
  ]
}

References #

SUSPEND_USER: User Suspension

ApplicationName: admin

Description

A user account was suspended by an administrator.

References #

Admin Activity Events: SUSPEND_USER

RENAME_USER: User Rename

ApplicationName: admin

Description

A user's primary email address was changed.

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2022-07-21T13:37:47.057Z",
    "uniqueQualifier": "-6570038635980180654",
    "applicationName": "admin",
    "customerId": "C00mpaiwz"
  },
  "etag": "\"_ZVRqe-BUDYcYeOIPo-gm6Eh1QaGne4ACjHHI6qsr6A/v88-DyEM0pnIGTdGBaEFFudjFic\"",
  "actor": {
    "callerType": "USER",
    "email": "admin@cloud-response.com",
    "profileId": "111440584475724055600"
  },
  "ipAddress": "80.114.222.200",
  "events": [
    {
      "type": "USER_SETTINGS",
      "name": "RENAME_USER",
      "parameters": [
        {
          "name": "USER_EMAIL",
          "value": "suspicious@cloud-response.com"
        },
        {
          "name": "NEW_VALUE",
          "value": "workspace@cloud-response.com"
        }
      ]
    },
    {
      "type": "USER_SETTINGS",
      "name": "CHANGE_FIRST_NAME",
      "parameters": [
        {
          "name": "USER_EMAIL",
          "value": "suspicious@cloud-response.com"
        },
        {
          "name": "OLD_VALUE",
          "value": "Suspicious"
        },
        {
          "name": "NEW_VALUE",
          "value": "Workspace"
        }
      ]
    },
    {
      "type": "USER_SETTINGS",
      "name": "CHANGE_LAST_NAME",
      "parameters": [
        {
          "name": "USER_EMAIL",
          "value": "suspicious@cloud-response.com"
        },
        {
          "name": "OLD_VALUE",
          "value": "account"
        },
        {
          "name": "NEW_VALUE",
          "value": "Admin"
        }
      ]
    }
  ]
}

References #

CHANGE_PASSWORD: Password Change

ApplicationName: admin

Description

An administrator changed a user's password.

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2022-07-21T13:38:00.608Z",
    "uniqueQualifier": "-8471045246260126614",
    "applicationName": "admin",
    "customerId": "C00mpaiwz"
  },
  "etag": "\"_ZVRqe-BUDYcYeOIPo-gm6Eh1QaGne4ACjHHI6qsr6A/41AqQRL7AL27pZdLqUiiksMUcEQ\"",
  "actor": {
    "callerType": "USER",
    "email": "admin@cloud-response.com",
    "profileId": "111440584475724055600"
  },
  "ipAddress": "80.114.222.200",
  "events": [
    {
      "type": "USER_SETTINGS",
      "name": "CHANGE_PASSWORD",
      "parameters": [
        {
          "name": "USER_EMAIL",
          "value": "workspace@cloud-response.com"
        }
      ]
    }
  ]
}

References #

REVOKE_ASP: Application Specific Password Revoke

ApplicationName: admin

Description

An administrator revoked an application-specific password (ASP) for a user.

References #

Admin Activity Events: REVOKE_ASP

REVOKE_3LO_TOKEN: 3-legged OAuth Token Revoke

ApplicationName: admin

Description

An administrator revoked an OAuth token for a user.

References #

Admin Activity Events: REVOKE_3LO_TOKEN

SESSION_CONTROL_SETTINGS_CHANGE: Session Control Settings Change

ApplicationName: admin

Description

Web session duration or re-authentication settings were changed.

References #

Admin Activity Events: SESSION_CONTROL_SETTINGS_CHANGE

CHANGE_SSO_SETTINGS: SSO Setting Change

ApplicationName: admin

Description

SAML/SSO settings for the domain were changed.

References #

Admin Activity Events: CHANGE_SSO_SETTINGS

TOGGLE_SSO_ENABLED: Enable SSO Change

ApplicationName: admin

Description

SSO (SAML-based single sign-on) was enabled or disabled for the domain.

References #

Admin Activity Events: TOGGLE_SSO_ENABLED

REVOKE_ADMIN_PRIVILEGE: Admin Privileges Revoke

ApplicationName: admin

Description

Administrator privileges were revoked from a user account.

References #

Admin Activity Events: REVOKE_ADMIN_PRIVILEGE

ALLOW_SERVICE_FOR_OAUTH2_ACCESS: API Access Allowed

ApplicationName: admin

Description

A Google service was allowed for OAuth2 API access.

References #

Admin Activity Events: ALLOW_SERVICE_FOR_OAUTH2_ACCESS

DISALLOW_SERVICE_FOR_OAUTH2_ACCESS: API Access Blocked

ApplicationName: admin

Description

A Google service was disallowed for OAuth2 API access.

References #

Admin Activity Events: DISALLOW_SERVICE_FOR_OAUTH2_ACCESS

TOGGLE_CAA_ENABLEMENT: Context Aware Access Enablement

ApplicationName: admin

Description

Context-Aware Access was enabled or disabled for the domain.

References #

Admin Activity Events: TOGGLE_CAA_ENABLEMENT

CHANGE_GROUP_SETTING: Group Setting Change

ApplicationName: admin

Description

A setting for a Google Group was changed by an administrator.

Example Audit Activity #

{
  "kind": "admin#reports#activity",
  "id": {
    "time": "2022-08-02T07:23:13.089Z",
    "uniqueQualifier": "-8719895655046965875",
    "applicationName": "admin",
    "customerId": "C00mpaiwz"
  },
  "etag": "\"_ZVRqe-BUDYcYeOIPo-gm6Eh1QaGne4ACjHHI6qsr6A/u50Xc4yaXja3OryKbjY0C8gwceE\"",
  "actor": {
    "callerType": "USER",
    "email": "admin@cloud-response.com",
    "profileId": "111440584475724055600"
  },
  "ipAddress": "86.48.11.48",
  "events": [
    {
      "type": "GROUP_SETTINGS",
      "name": "CHANGE_GROUP_SETTING",
      "parameters": [
        {
          "name": "SETTING_NAME",
          "value": "WHO_CAN_POST_MESSAGE"
        },
        {
          "name": "GROUP_EMAIL",
          "value": "sales@cloud-response.com"
        },
        {
          "name": "OLD_VALUE",
          "value": "ANYONE_CAN_POST"
        },
        {
          "name": "NEW_VALUE",
          "value": "ALL_MEMBERS_CAN_POST"
        }
      ]
    },
    {
      "type": "GROUP_SETTINGS",
      "name": "CHANGE_GROUP_SETTING",
      "parameters": [
        {
          "name": "SETTING_NAME",
          "value": "IS_ARCHIVED"
        },
        {
          "name": "GROUP_EMAIL",
          "value": "sales@cloud-response.com"
        },
        {
          "name": "OLD_VALUE",
          "value": "false"
        },
        {
          "name": "NEW_VALUE",
          "value": "true"
        }
      ]
    }
  ]
}

References #

ADD_APPLICATION_TO_WHITELIST: Add Application to Whitelist

ApplicationName: admin

Description

An application was added to the domain's Google Workspace Marketplace allowlist.

References #

Admin Activity Events: ADD_APPLICATION_TO_WHITELIST

CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION: Change 2-Step Verification Enrollment Period Duration

ApplicationName: admin

Description

The enrollment period for 2-Step Verification was changed.

References #

Admin Activity Events: 2SV settings

CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS: Change Allowed 2-step Verification Methods

ApplicationName: admin

Description

The allowed methods for 2-Step Verification were changed.

References #

Admin Activity Events: 2SV settings

APPLICATION_SETTINGS: Application Settings

ApplicationName: admin

Description

Events of this type are returned with type=APPLICATION_SETTINGS .

References #

Reports API admin activity events: APPLICATION_SETTINGS

DELETE_APPLICATION_SETTING: Application Setting Deletion

ApplicationName: admin

Description

For {APPLICATION_NAME} , {SETTING_NAME} with value {OLD_VALUE} deleted

References #

Reports API admin activity events: DELETE_APPLICATION_SETTING

REORDER_GROUP_BASED_POLICIES_EVENT: Application Setting Group Priorities Change

ApplicationName: admin

Description

For {APPLICATION_NAME} , group override priorities for {SETTING_NAME} changed to {GROUP_PRIORITIES} .

References #

Reports API admin activity events: REORDER_GROUP_BASED_POLICIES_EVENT

GPLUS_PREMIUM_FEATURES: Google+ Premium Features

ApplicationName: admin

Description

Premium features for Google+ service for your organization changed to {NEW_VALUE}

References #

Reports API admin activity events: GPLUS_PREMIUM_FEATURES

CREATE_MANAGED_CONFIGURATION: Managed configuration is created

ApplicationName: admin

Description

Managed configuration with name {MANAGED_CONFIGURATION_NAME} is created for {DEVICE_TYPE} application {MOBILE_APP_PACKAGE_ID} .

References #

Reports API admin activity events: CREATE_MANAGED_CONFIGURATION

DELETE_MANAGED_CONFIGURATION: Managed configuration is deleted

ApplicationName: admin

Description

Managed configuration with name {MANAGED_CONFIGURATION_NAME} is deleted for {DEVICE_TYPE} application {MOBILE_APP_PACKAGE_ID} .

References #

Reports API admin activity events: DELETE_MANAGED_CONFIGURATION

UPDATE_MANAGED_CONFIGURATION: Managed configuration is updated

ApplicationName: admin

Description

Managed configuration with name {MANAGED_CONFIGURATION_NAME} is updated for {DEVICE_TYPE} application {MOBILE_APP_PACKAGE_ID} .

References #

Reports API admin activity events: UPDATE_MANAGED_CONFIGURATION

FLASHLIGHT_EDU_NON_FEATURED_SERVICES_SELECTED: Non-Featured Services Selected

ApplicationName: admin

Description

{FLASHLIGHT_EDU_NON_FEATURED_SERVICES_SELECTION} selection was made for Non-Featured Services.

References #

Reports API admin activity events: FLASHLIGHT_EDU_NON_FEATURED_SERVICES_SELECTED

UPDATE_SMART_FEATURES: Update Smart features and personalization

ApplicationName: admin

Description

Smart features and personalization setting has been updated to {NEW_VALUE}

References #

Reports API admin activity events: UPDATE_SMART_FEATURES

CALENDAR_SETTINGS: Calendar Settings

ApplicationName: admin

Description

Events of this type are returned with type=CALENDAR_SETTINGS .

References #

Reports API admin activity events: CALENDAR_SETTINGS

CREATE_BUILDING: Building Creation

ApplicationName: admin

Description

Building {NEW_VALUE} created

References #

Reports API admin activity events: CREATE_BUILDING

DELETE_BUILDING: Building Deletion

ApplicationName: admin

Description

Building {OLD_VALUE} deleted

References #

Reports API admin activity events: DELETE_BUILDING

UPDATE_BUILDING: Building Update

ApplicationName: admin

Description

Building {RESOURCE_IDENTIFIER} updated field {FIELD_NAME} from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: UPDATE_BUILDING

EWS_IN_NEW_CREDENTIALS_GENERATED: Calendar Interop credentials generated

ApplicationName: admin

Description

Short description for EWS IN credentials generation.

References #

Reports API admin activity events: EWS_IN_NEW_CREDENTIALS_GENERATED

EWS_OUT_ENDPOINT_CONFIGURATION_RESET: Calendar Interop Exchange endpoint configuration cleared

ApplicationName: admin

Description

Short description for clearing Calendar Interop Exchange endpoint configuration.

References #

Reports API admin activity events: EWS_OUT_ENDPOINT_CONFIGURATION_RESET

EWS_OUT_ENDPOINT_CONFIGURATION_CHANGED: Calendar Interop Exchange endpoint configuration updated

ApplicationName: admin

Description

Short description for changing Calendar Interop Exchange endpoint configuration.

References #

Reports API admin activity events: EWS_OUT_ENDPOINT_CONFIGURATION_CHANGED

CREATE_CALENDAR_RESOURCE: Calendar Resource Creation

ApplicationName: admin

Description

Calendar resource {NEW_VALUE} created

References #

Reports API admin activity events: CREATE_CALENDAR_RESOURCE

DELETE_CALENDAR_RESOURCE: Calendar Resource Deletion

ApplicationName: admin

Description

Calendar resource {OLD_VALUE} deleted

References #

Reports API admin activity events: DELETE_CALENDAR_RESOURCE

CREATE_CALENDAR_RESOURCE_FEATURE: Calendar Resource Feature Creation

ApplicationName: admin

Description

Calendar resource feature {NEW_VALUE} created

References #

Reports API admin activity events: CREATE_CALENDAR_RESOURCE_FEATURE

DELETE_CALENDAR_RESOURCE_FEATURE: Calendar Resource Feature Deletion

ApplicationName: admin

Description

Calendar resource feature {OLD_VALUE} deleted

References #

Reports API admin activity events: DELETE_CALENDAR_RESOURCE_FEATURE

UPDATE_CALENDAR_RESOURCE_FEATURE: Calendar Resource Feature Update

ApplicationName: admin

Description

Calendar resource feature {RESOURCE_IDENTIFIER} updated field {FIELD_NAME} from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: UPDATE_CALENDAR_RESOURCE_FEATURE

RENAME_CALENDAR_RESOURCE: Calendar Resource Rename

ApplicationName: admin

Description

Calendar resource {OLD_VALUE} renamed to {NEW_VALUE}

References #

Reports API admin activity events: RENAME_CALENDAR_RESOURCE

UPDATE_CALENDAR_RESOURCE: Calendar Resource Update

ApplicationName: admin

Description

Calendar resource {RESOURCE_IDENTIFIER} updated field {FIELD_NAME} from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: UPDATE_CALENDAR_RESOURCE

CHANGE_CALENDAR_SETTING: Calendar Setting Change

ApplicationName: admin

Description

{SETTING_NAME} for calendar service in your organization changed from {OLD_VALUE} to {NEW_VALUE}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

GSuite Workspace Calendar External Sharing Setting Change source medium: A Workspace Admin Changed The Sharing Settings for Primary CalendarsT1087

References #

Reports API admin activity events: CHANGE_CALENDAR_SETTING

CANCEL_CALENDAR_EVENTS: Event cancellation request created

ApplicationName: admin

Description

Event cancellation request created for {USER_EMAIL}

References #

Reports API admin activity events: CANCEL_CALENDAR_EVENTS

RELEASE_CALENDAR_RESOURCES: Release resources request created

ApplicationName: admin

Description

Release resources request created for {USER_EMAIL}

References #

Reports API admin activity events: RELEASE_CALENDAR_RESOURCES

CHAT_SETTINGS: Talk Settings

ApplicationName: admin

Description

Note that this page also contains events for Google Hangouts, as well as the previous Google Chat product. Events of this type are returned with type=CHAT_SETTINGS .

References #

Reports API admin activity events: CHAT_SETTINGS

MEET_INTEROP_CREATE_GATEWAY: A Google Meet interoperability gateway was created.

ApplicationName: admin

Description

A Hangouts Meet interoperability gateway was created

References #

Reports API admin activity events: MEET_INTEROP_CREATE_GATEWAY

MEET_INTEROP_DELETE_GATEWAY: A Google Meet interoperability gateway was deleted.

ApplicationName: admin

Description

A Hangouts Meet interoperability gateway was deleted

References #

Reports API admin activity events: MEET_INTEROP_DELETE_GATEWAY

MEET_INTEROP_MODIFY_GATEWAY: A Google Meet interoperability gateway was modified.

ApplicationName: admin

Description

A Hangouts Meet interoperability gateway was modified

References #

Reports API admin activity events: MEET_INTEROP_MODIFY_GATEWAY

CHANGE_CHAT_SETTING: Hangouts Setting Change

ApplicationName: admin

Description

{SETTING_NAME} for talk service for your organization changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_CHAT_SETTING

CHROME_OS_SETTINGS: ChromeOS Settings

ApplicationName: admin

Description

Events of this type are returned with type=CHROME_OS_SETTINGS .

References #

Reports API admin activity events: CHROME_OS_SETTINGS

CHANGE_CHROME_OS_ANDROID_APPLICATION_SETTING: Android Application Setting Change

ApplicationName: admin

Description

{SETTING_NAME} for Android app {APP_ID} for session type {CHROME_OS_SESSION_TYPE} changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_CHROME_OS_ANDROID_APPLICATION_SETTING

CHANGE_DEVICE_STATE: Change device state

ApplicationName: admin

Description

Event for 'Change device state'.

References #

Reports API admin activity events: CHANGE_DEVICE_STATE

CHANGE_DEVICE_UPGRADE: Change Device Upgrade

ApplicationName: admin

Description

Changed upgrade from {OLD_VALUE} to {NEW_VALUE} for device with serial number {DEVICE_SERIAL_NUMBER} .

References #

Reports API admin activity events: CHANGE_DEVICE_UPGRADE

CHANGE_CHROME_OS_APPLICATION_SETTING: Chrome Application Setting Change

ApplicationName: admin

Description

{SETTING_NAME} for Chrome app {APP_ID} for session type {CHROME_OS_SESSION_TYPE} changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_CHROME_OS_APPLICATION_SETTING

SEND_CHROME_OS_DEVICE_COMMAND: ChromeOS Device Command

ApplicationName: admin

Description

Sent {NEW_VALUE} command to ChromeOS device {DEVICE_SERIAL_NUMBER}

References #

Reports API admin activity events: SEND_CHROME_OS_DEVICE_COMMAND

CHANGE_CHROME_OS_DEVICE_ANNOTATION: ChromeOS Device Property Change

ApplicationName: admin

Description

ChromeOS device {DEVICE_SERIAL_NUMBER} had its properties updated

References #

Reports API admin activity events: CHANGE_CHROME_OS_DEVICE_ANNOTATION

CHANGE_CHROME_OS_DEVICE_SETTING: ChromeOS Device Setting Change

ApplicationName: admin

Description

{SETTING_NAME} for ChromeOS devices in {ORG_UNIT_NAME} organization unit changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_CHROME_OS_DEVICE_SETTING

CHANGE_CHROME_OS_DEVICE_STATE: ChromeOS Device State Change

ApplicationName: admin

Description

State of ChromeOS device {DEVICE_SERIAL_NUMBER} changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_CHROME_OS_DEVICE_STATE

CHANGE_CHROME_OS_PUBLIC_SESSION_SETTING: ChromeOS managed guest session setting change

ApplicationName: admin

Description

{SETTING_NAME} for ChromeOS managed guest session in {ORG_UNIT_NAME} organization unit changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_CHROME_OS_PUBLIC_SESSION_SETTING

INSERT_CHROME_OS_PRINT_SERVER: ChromeOS Print Server Added

ApplicationName: admin

Description

Print server is added.

References #

Reports API admin activity events: INSERT_CHROME_OS_PRINT_SERVER

DELETE_CHROME_OS_PRINT_SERVER: ChromeOS Print Server Deleted

ApplicationName: admin

Description

Existing print server is deleted.

References #

Reports API admin activity events: DELETE_CHROME_OS_PRINT_SERVER

UPDATE_CHROME_OS_PRINT_SERVER: ChromeOS Print Server Updated

ApplicationName: admin

Description

Existing print server is updated.

References #

Reports API admin activity events: UPDATE_CHROME_OS_PRINT_SERVER

INSERT_CHROME_OS_PRINTER: ChromeOS Printer Added

ApplicationName: admin

Description

Printer is added.

References #

Reports API admin activity events: INSERT_CHROME_OS_PRINTER

DELETE_CHROME_OS_PRINTER: ChromeOS Printer Deleted

ApplicationName: admin

Description

Existing printer is deleted.

References #

Reports API admin activity events: DELETE_CHROME_OS_PRINTER

UPDATE_CHROME_OS_PRINTER: ChromeOS Printer Updated

ApplicationName: admin

Description

Existing printer is updated.

References #

Reports API admin activity events: UPDATE_CHROME_OS_PRINTER

CHANGE_CHROME_OS_SETTING: ChromeOS Setting Change

ApplicationName: admin

Description

{SETTING_NAME} for ChromeOS devices in your organization changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_CHROME_OS_SETTING

CHANGE_CHROME_OS_USER_SETTING: ChromeOS User Setting Change

ApplicationName: admin

Description

{SETTING_NAME} for ChromeOS users in {ORG_UNIT_NAME} organization unit changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_CHROME_OS_USER_SETTING

CREATE_CHROME_OS_ENROLLMENT_TOKEN: Create ChromeOS enrollment token

ApplicationName: admin

Description

Event for 'Create ChromeOS enrollment token'.

References #

Reports API admin activity events: CREATE_CHROME_OS_ENROLLMENT_TOKEN

CHANGE_CHROME_OS_CUSTOM_CONFIGURATIONS_JSON_SETTING: Custom Configurations JSON Setting Change

ApplicationName: admin

Description

Custom configurations JSON field in the {ORG_UNIT_NAME} organizational unit changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_CHROME_OS_CUSTOM_CONFIGURATIONS_JSON_SETTING

DELETE_CHROME_OS_DEVICE: Delete ChromeOS device

ApplicationName: admin

Description

Event for 'Delete ChromeOS device'.

References #

Reports API admin activity events: DELETE_CHROME_OS_DEVICE

DELETE_DUPLICATE_CHROME_OS_DEVICE: Delete duplicate ChromeOS device

ApplicationName: admin

Description

Event for 'Delete duplicate ChromeOS device'.

References #

Reports API admin activity events: DELETE_DUPLICATE_CHROME_OS_DEVICE

CHANGE_CHROME_OS_ISOLATED_WEB_APPLICATION_SETTING: Isolated Web Application Setting Change

ApplicationName: admin

Description

{SETTING_NAME} for Isolated Web app {APP_ID} for session type {CHROME_OS_SESSION_TYPE} changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_CHROME_OS_ISOLATED_WEB_APPLICATION_SETTING

ISSUE_DEVICE_COMMAND: Issue device command

ApplicationName: admin

Description

Event for 'Issue device command'.

References #

Reports API admin activity events: ISSUE_DEVICE_COMMAND

MOVE_DEVICE_TO_ORG_UNIT_DETAILED: Move device to Organizational unit

ApplicationName: admin

Description

Event for 'Move device to Org Unit'.

References #

Reports API admin activity events: MOVE_DEVICE_TO_ORG_UNIT_DETAILED

PRE_PROVISION_CHROME_OS_DEVICE: Pre-provision ChromeOS device

ApplicationName: admin

Description

Event for 'Pre-provision ChromeOS device'.

References #

Reports API admin activity events: PRE_PROVISION_CHROME_OS_DEVICE

REMOVE_CHROME_OS_APPLICATION_SETTING: Remove Application Setting

ApplicationName: admin

Description

{APP_TYPE} app {APP_ID} for session type {CHROME_OS_SESSION_TYPE} removed

References #

Reports API admin activity events: REMOVE_CHROME_OS_APPLICATION_SETTING

REMOVE_CHROME_OS_APPLICATION_SETTINGS: Remove Chrome Application Settings

ApplicationName: admin

Description

Settings for Chrome app {APP_ID} removed

References #

Reports API admin activity events: REMOVE_CHROME_OS_APPLICATION_SETTINGS

REMOVE_CHROME_OS_WEB_ORIGIN_SETTINGS: Remove Web Origin Settings

ApplicationName: admin

Description

Settings for web origin {WEB_ORIGIN} for session type {CHROME_OS_SESSION_TYPE} removed

References #

Reports API admin activity events: REMOVE_CHROME_OS_WEB_ORIGIN_SETTINGS

REPAIR_CENTER_DEPROVISION: Repair Center deprovision

ApplicationName: admin

Description

Event for 'Repair Center deprovision'.

References #

Reports API admin activity events: REPAIR_CENTER_DEPROVISION

REVOKE_CHROME_OS_ENROLLMENT_TOKEN: Revoke ChromeOS enrollment token

ApplicationName: admin

Description

Event for 'Revoke ChromeOS enrollment token'.

References #

Reports API admin activity events: REVOKE_CHROME_OS_ENROLLMENT_TOKEN

UPDATE_DEVICE: Update device

ApplicationName: admin

Description

Event for 'Update device'.

References #

Reports API admin activity events: UPDATE_DEVICE

CHANGE_CHROME_OS_WEB_APPLICATION_SETTING: Web Application Setting Change

ApplicationName: admin

Description

{SETTING_NAME} for Web app {APP_ID} for session type {CHROME_OS_SESSION_TYPE} changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_CHROME_OS_WEB_APPLICATION_SETTING

CHANGE_CHROME_OS_WEB_PERMISSION_SETTING: Web Permission Setting Change

ApplicationName: admin

Description

{SETTING_NAME} for {WEB_ORIGIN} for session type {CHROME_OS_SESSION_TYPE} changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_CHROME_OS_WEB_PERMISSION_SETTING

CONTACTS_SETTINGS: Contacts Settings

ApplicationName: admin

Description

Events of this type are returned with type=CONTACTS_SETTINGS .

References #

Reports API admin activity events: CONTACTS_SETTINGS

CHANGE_CONTACTS_SETTING: Contacts Setting Change

ApplicationName: admin

Description

{SETTING_NAME} for contacts service changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_CONTACTS_SETTING

DOCS_SETTINGS: Drive Settings

ApplicationName: admin

Description

Events of this type are returned with type=DOCS_SETTINGS .

References #

Reports API admin activity events: DOCS_SETTINGS

TRANSFER_DOCUMENT_OWNERSHIP: Document Ownership Change

ApplicationName: admin

Description

Owner of documents changed from {USER_EMAIL} to {NEW_VALUE}

References #

Reports API admin activity events: TRANSFER_DOCUMENT_OWNERSHIP

DOCS_ORG_BRANDING_PROVISIONING: Drive and Docs org branding provisioning initiated

ApplicationName: admin

Description

Organizational branding provisioning initiated for account {SERVICE_ACCOUNT_EMAIL} and shared drive {SHARED_DRIVE_NAME} with status {ORG_BRANDING_PROVISIONING_STATUS}

References #

Reports API admin activity events: DOCS_ORG_BRANDING_PROVISIONING

DOCS_ORG_BRANDING_UPLOAD: Drive and Docs org branding upload attempt

ApplicationName: admin

Description

Organizational branding document upload attempted for document {DOCUMENT_ID} in editor {ORG_BRANDING_EDITOR_TYPE} with status {ORG_BRANDING_UPLOAD_STATUS}

References #

Reports API admin activity events: DOCS_ORG_BRANDING_UPLOAD

DRIVE_DATA_RESTORE: Drive Data Restore

ApplicationName: admin

Description

Drive data restoration initiated for {USER_EMAIL}

References #

Reports API admin activity events: DRIVE_DATA_RESTORE

CHANGE_DOCS_SETTING: Drive Setting Change

ApplicationName: admin

Description

{SETTING_NAME} for Drive changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_DOCS_SETTING

MOVE_SHARED_DRIVE_TO_ORG_UNIT: Shared Drive Moved

ApplicationName: admin

Description

Shared drive {SHARED_DRIVE_ID} moved from {ORG_UNIT_NAME} to {NEW_VALUE}

References #

Reports API admin activity events: MOVE_SHARED_DRIVE_TO_ORG_UNIT

DOMAIN_SETTINGS: Domain Settings

ApplicationName: admin

Description

Events of this type are returned with type=DOMAIN_SETTINGS .

References #

Reports API admin activity events: DOMAIN_SETTINGS

CHANGE_ACCOUNT_AUTO_RENEWAL: Account Automatic Renewal Change

ApplicationName: admin

Description

Account automatic renewal changed to {NEW_VALUE} on {DOMAIN_NAME}

References #

Reports API admin activity events: CHANGE_ACCOUNT_AUTO_RENEWAL

CHANGE_ADVERTISEMENT_OPTION: Advertisement Option Change

ApplicationName: admin

Description

Advertisement option for your organization changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_ADVERTISEMENT_OPTION

CREATE_ALERT: Alert Creation

ApplicationName: admin

Description

Alert {ALERT_NAME} has been created

References #

Reports API admin activity events: CREATE_ALERT

CHANGE_ALERT_CRITERIA: Alert Criteria Change

ApplicationName: admin

Description

Alert criteria for {ALERT_NAME} has been changed

References #

Reports API admin activity events: CHANGE_ALERT_CRITERIA

DELETE_ALERT: Alert Deletion

ApplicationName: admin

Description

Alert {ALERT_NAME} has been deleted

References #

Reports API admin activity events: DELETE_ALERT

ALERT_RECEIVERS_CHANGED: Alert Receivers Change

ApplicationName: admin

Description

Alert receivers for {ALERT_NAME} changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: ALERT_RECEIVERS_CHANGED

RENAME_ALERT: Alert Rename

ApplicationName: admin

Description

Alert {OLD_VALUE} has been renamed to {NEW_VALUE}

References #

Reports API admin activity events: RENAME_ALERT

ALERT_STATUS_CHANGED: Alert Status Change

ApplicationName: admin

Description

Alert status for {ALERT_NAME} changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: ALERT_STATUS_CHANGED

ADD_DOMAIN_ALIAS: Alias Creation

ApplicationName: admin

Description

An unverified {DOMAIN_ALIAS} created as an alias of {DOMAIN_NAME}

References #

Reports API admin activity events: ADD_DOMAIN_ALIAS

REMOVE_DOMAIN_ALIAS: Alias Deletion

ApplicationName: admin

Description

{DOMAIN_ALIAS} deleted as an alias of {DOMAIN_NAME}

References #

Reports API admin activity events: REMOVE_DOMAIN_ALIAS

SKIP_DOMAIN_ALIAS_MX: Alias MX Record Setup Skipped

ApplicationName: admin

Description

Skipped MX record setup of alias {DOMAIN_ALIAS} of domain {DOMAIN_NAME}

References #

Reports API admin activity events: SKIP_DOMAIN_ALIAS_MX

VERIFY_DOMAIN_ALIAS_MX: Alias MX Record Verification

ApplicationName: admin

Description

Verified MX record of alias {DOMAIN_ALIAS} of domain {DOMAIN_NAME}

References #

Reports API admin activity events: VERIFY_DOMAIN_ALIAS_MX

VERIFY_DOMAIN_ALIAS: Alias Verification

ApplicationName: admin

Description

{DOMAIN_ALIAS} verified as an alias of {DOMAIN_NAME} using {DOMAIN_VERIFICATION_METHOD}

References #

Reports API admin activity events: VERIFY_DOMAIN_ALIAS

TOGGLE_OAUTH_ACCESS_TO_ALL_APIS: All API OAuth Access Change

ApplicationName: admin

Description

OAuth access for all APIs changed to {NEW_VALUE} for your organization

References #

Reports API admin activity events: TOGGLE_OAUTH_ACCESS_TO_ALL_APIS

TOGGLE_ALLOW_ADMIN_PASSWORD_RESET: Allow Admin Password Reset

ApplicationName: admin

Description

Allow admin password reset setting changed to {NEW_VALUE}

References #

Reports API admin activity events: TOGGLE_ALLOW_ADMIN_PASSWORD_RESET

ENABLE_API_ACCESS: API Access Change

ApplicationName: admin

Description

API access for your organization changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: ENABLE_API_ACCESS

REMOVE_API_CLIENT_ACCESS: API Client Access Remove

ApplicationName: admin

Description

API client access to your organization from client {API_CLIENT_NAME} removed

References #

Reports API admin activity events: REMOVE_API_CLIENT_ACCESS

CHROME_LICENSES_REDEEMED: App Licenses Redeemed

ApplicationName: admin

Description

Licenses redeemed event name.

References #

Reports API admin activity events: CHROME_LICENSES_REDEEMED

TOGGLE_AUTO_ADD_NEW_SERVICE: Automatic Addition Update

ApplicationName: admin

Description

Automatic addition for new services and pre-release features for your organization changed to {NEW_VALUE}

References #

Reports API admin activity events: TOGGLE_AUTO_ADD_NEW_SERVICE

CHANGE_PRIMARY_DOMAIN: Change Primary Domain Name

ApplicationName: admin

Description

Primary domain name changed from {DOMAIN_NAME} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_PRIMARY_DOMAIN

CHANGE_WHITELIST_SETTING: Change Whitelist Setting

ApplicationName: admin

Description

{SETTING_NAME} changed from {OLD_VALUE} to {NEW_VALUE} for the domain

References #

Reports API admin activity events: CHANGE_WHITELIST_SETTING

COMMUNICATION_PREFERENCES_SETTING_CHANGE: Communication Preferences Setting Change

ApplicationName: admin

Description

{SETTING_NAME} setting in Communication Preferences changed from {OLD_VALUE} to {NEW_VALUE} (Domain Name : {DOMAIN_NAME} )

References #

Reports API admin activity events: COMMUNICATION_PREFERENCES_SETTING_CHANGE

CHANGE_CONFLICT_ACCOUNT_ACTION: Conflict Account Action Change

ApplicationName: admin

Description

Conflict account action for {DOMAIN_NAME} changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_CONFLICT_ACCOUNT_ACTION

CHANGE_CONFLICT_ACCOUNTS_MANAGEMENT_SETTINGS: Conflict accounts management settings change

ApplicationName: admin

Description

Conflict accounts management setting changed to: {CONFLICT_ACCOUNTS_MANAGEMENT_SETTINGS} .

References #

Reports API admin activity events: CHANGE_CONFLICT_ACCOUNTS_MANAGEMENT_SETTINGS

ENABLE_FEEDBACK_SOLICITATION: Contact for Feedback Setting Change

ApplicationName: admin

Description

Can contact for feedback setting for your organization changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: ENABLE_FEEDBACK_SOLICITATION

CREATE_PLAY_FOR_WORK_TOKEN: Create MDM vendor enrollment token

ApplicationName: admin

Description

MDM vendor enrollment token ( {PLAY_FOR_WORK_TOKEN_ID} ) created

References #

Reports API admin activity events: CREATE_PLAY_FOR_WORK_TOKEN

TOGGLE_USE_CUSTOM_LOGO: Custom Logo Change

ApplicationName: admin

Description

Use custom logo changed to {NEW_VALUE}

References #

Reports API admin activity events: TOGGLE_USE_CUSTOM_LOGO

CHANGE_CUSTOM_LOGO: Custom Logo Upload

ApplicationName: admin

Description

New custom logo uploaded for your organization

References #

Reports API admin activity events: CHANGE_CUSTOM_LOGO

CHANGE_DATA_LOCALIZATION_FOR_RUSSIA: Data Localization For Russian Federation Change

ApplicationName: admin

Description

Setting for Data Localization for Russian Federation changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_DATA_LOCALIZATION_FOR_RUSSIA

CHANGE_DATA_LOCALIZATION_SETTING: Data Localization Setting Change

ApplicationName: admin

Description

Setting for Data Localization changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_DATA_LOCALIZATION_SETTING

CHANGE_DATA_PROTECTION_OFFICER_CONTACT_INFO: Data Protection Officer Contact Information Change

ApplicationName: admin

Description

Part of an audit log event for contact info update for Data Protection Officer. This is used as an indicator of what kind of event log this message is.

References #

Reports API admin activity events: CHANGE_DATA_PROTECTION_OFFICER_CONTACT_INFO

DELETE_PLAY_FOR_WORK_TOKEN: Delete MDM vendor enrollment token

ApplicationName: admin

Description

MDM vendor enrollment token ( {PLAY_FOR_WORK_TOKEN_ID} ) deleted

References #

Reports API admin activity events: DELETE_PLAY_FOR_WORK_TOKEN

CHANGE_DOMAIN_DEFAULT_LOCALE: Domain Default Locale Change

ApplicationName: admin

Description

Default locale for your organization changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_DOMAIN_DEFAULT_LOCALE

CHANGE_DOMAIN_DEFAULT_TIMEZONE: Domain Default Timezone Change

ApplicationName: admin

Description

Default time zone for your organization changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_DOMAIN_DEFAULT_TIMEZONE

CHANGE_DOMAIN_NAME: Domain Name Change

ApplicationName: admin

Description

Change of domain name for {DOMAIN_NAME} to {NEW_VALUE} started

References #

Reports API admin activity events: CHANGE_DOMAIN_NAME

TOGGLE_ENABLE_PRE_RELEASE_FEATURES: Domain Pre-release Setting Change

ApplicationName: admin

Description

Pre-release features for your organization was set to {NEW_VALUE}

References #

Reports API admin activity events: TOGGLE_ENABLE_PRE_RELEASE_FEATURES

CHANGE_DOMAIN_SUPPORT_MESSAGE: Domain Support Message Change

ApplicationName: admin

Description

Support message for your organization changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_DOMAIN_SUPPORT_MESSAGE

REMOVE_TRUSTED_DOMAINS: Domains removed from Trusted Domains

ApplicationName: admin

Description

Domains {DOMAIN_NAME} removed from Trusted Domains list

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

GSuite Workspace Trusted Domain Allowlist Modified source medium suffix: A Workspace Admin Has Modified The Trusted Domains ListT1098↳ also matches ADD_TRUSTED_DOMAINS: Domains added to Trusted Domains

References #

Reports API admin activity events: REMOVE_TRUSTED_DOMAINS

CHANGE_EDU_TYPE: Education Organization Type Change

ApplicationName: admin

Description

Educational organization type changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_EDU_TYPE

TOGGLE_ENABLE_OAUTH_CONSUMER_KEY: Enable OAuth Consumer Key

ApplicationName: admin

Description

Enabling OAuth consumer key changed to {NEW_VALUE} for your organization

References #

Reports API admin activity events: TOGGLE_ENABLE_OAUTH_CONSUMER_KEY

TOGGLE_SSL: Enforce SSL Change

ApplicationName: admin

Description

SSL Enforcement changed to {NEW_VALUE} for {DOMAIN_NAME}

References #

Reports API admin activity events: TOGGLE_SSL

CHANGE_EU_REPRESENTATIVE_CONTACT_INFO: EU Representative Contact Information Change

ApplicationName: admin

Description

Part of an audit log event for contact info update for EU Representative. This is used as an indicator of what kind of event log this message is.

References #

Reports API admin activity events: CHANGE_EU_REPRESENTATIVE_CONTACT_INFO

GENERATE_TRANSFER_TOKEN: Generate Transfer Token

ApplicationName: admin

Description

Transfer token generated

References #

Reports API admin activity events: GENERATE_TRANSFER_TOKEN

PLAY_FOR_WORK_ENROLL: MDM vendor enrollment

ApplicationName: admin

Description

Enrolled for {PLAY_FOR_WORK_MDM_VENDOR_NAME} mobile device management services using token ( {PLAY_FOR_WORK_TOKEN_ID} )

References #

Reports API admin activity events: PLAY_FOR_WORK_ENROLL

PLAY_FOR_WORK_UNENROLL: MDM vendor unenrollment

ApplicationName: admin

Description

Unenrolled from {PLAY_FOR_WORK_MDM_VENDOR_NAME} mobile device management services

References #

Reports API admin activity events: PLAY_FOR_WORK_UNENROLL

MX_RECORD_VERIFICATION_CLAIM: MX Record Verification Claim

ApplicationName: admin

Description

{USER_EMAIL} claimed to verify the MX record for {DOMAIN_NAME}

References #

Reports API admin activity events: MX_RECORD_VERIFICATION_CLAIM

TOGGLE_NEW_APP_FEATURES: New App Features Update

ApplicationName: admin

Description

New app features for your organization changed to {NEW_VALUE}

References #

Reports API admin activity events: TOGGLE_NEW_APP_FEATURES

TOGGLE_USE_NEXT_GEN_CONTROL_PANEL: Next Generation CPanel Setting Change

ApplicationName: admin

Description

The setting to enable the new Admin Console changed to {NEW_VALUE} for your organization

References #

Reports API admin activity events: TOGGLE_USE_NEXT_GEN_CONTROL_PANEL

UPLOAD_OAUTH_CERTIFICATE: OAuth Certificate Upload

ApplicationName: admin

Description

New OAuth certificate uploaded for your organization

References #

Reports API admin activity events: UPLOAD_OAUTH_CERTIFICATE

REGENERATE_OAUTH_CONSUMER_SECRET: OAuth Consumer Secret Regenerate

ApplicationName: admin

Description

New OAuth consumer secret generated for your organization

References #

Reports API admin activity events: REGENERATE_OAUTH_CONSUMER_SECRET

TOGGLE_OPEN_ID_ENABLED: OpenId Change

ApplicationName: admin

Description

OpenId federated login for {DOMAIN_NAME} changed to {NEW_VALUE}

References #

Reports API admin activity events: TOGGLE_OPEN_ID_ENABLED

CHANGE_ORGANIZATION_NAME: Organization Name Change

ApplicationName: admin

Description

Organization name changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_ORGANIZATION_NAME

CHANGE_PASSWORD_MAX_LENGTH: Password Maximum Length Change

ApplicationName: admin

Description

Password maximum length for {DOMAIN_NAME} changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_PASSWORD_MAX_LENGTH

CHANGE_PASSWORD_MIN_LENGTH: Password Minimum Length Change

ApplicationName: admin

Description

Password minimum length for {DOMAIN_NAME} changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_PASSWORD_MIN_LENGTH

UPDATE_DOMAIN_PRIMARY_ADMIN_EMAIL: Primary Admin Change

ApplicationName: admin

Description

Primary admin for your organization changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: UPDATE_DOMAIN_PRIMARY_ADMIN_EMAIL

ENABLE_SERVICE_OR_FEATURE_NOTIFICATIONS: Receive Email Notification Setting Change

ApplicationName: admin

Description

Receive email notification setting for your organization changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: ENABLE_SERVICE_OR_FEATURE_NOTIFICATIONS

CHANGE_RENEW_DOMAIN_REGISTRATION: Renew Domain Registration Setting Change

ApplicationName: admin

Description

Renew domain registration setting in {DOMAIN_NAME} changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_RENEW_DOMAIN_REGISTRATION

CHANGE_RESELLER_ACCESS: Reseller Access Change

ApplicationName: admin

Description

Reseller access changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_RESELLER_ACCESS

CHANGE_RESELLER_ACCESS_FOR_SKU: Reseller Access Change for SKU

ApplicationName: admin

Description

Reseller access for {SKU_NAME} changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_RESELLER_ACCESS_FOR_SKU

RULE_ACTIONS_CHANGED: Rule Actions Change

ApplicationName: admin

Description

Rule actions for {RULE_NAME} changed

References #

Reports API admin activity events: RULE_ACTIONS_CHANGED

CREATE_RULE: Rule Creation

ApplicationName: admin

Description

Rule {RULE_NAME} has been created

References #

Reports API admin activity events: CREATE_RULE

CHANGE_RULE_CRITERIA: Rule Criteria Change

ApplicationName: admin

Description

Rule criteria for {RULE_NAME} has been changed

References #

Reports API admin activity events: CHANGE_RULE_CRITERIA

DELETE_RULE: Rule Deletion

ApplicationName: admin

Description

Rule {RULE_NAME} has been deleted

References #

Reports API admin activity events: DELETE_RULE

RENAME_RULE: Rule Rename

ApplicationName: admin

Description

Rule {OLD_VALUE} has been renamed to {NEW_VALUE}

References #

Reports API admin activity events: RENAME_RULE

RULE_STATUS_CHANGED: Rule Status Change

ApplicationName: admin

Description

Rule status for {RULE_NAME} changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: RULE_STATUS_CHANGED

ADD_SECONDARY_DOMAIN: Secondary Domain Creation

ApplicationName: admin

Description

An unverified {SECONDARY_DOMAIN_NAME} created as a secondary domain of {DOMAIN_NAME}

References #

Reports API admin activity events: ADD_SECONDARY_DOMAIN

REMOVE_SECONDARY_DOMAIN: Secondary Domain Deletion

ApplicationName: admin

Description

{SECONDARY_DOMAIN_NAME} deleted as a secondary domain of {DOMAIN_NAME}

References #

Reports API admin activity events: REMOVE_SECONDARY_DOMAIN

SKIP_SECONDARY_DOMAIN_MX: Secondary Domain MX Record Setup Skipped

ApplicationName: admin

Description

Skipped MX record setup of secondary domain {SECONDARY_DOMAIN_NAME} of domain {DOMAIN_NAME}

References #

Reports API admin activity events: SKIP_SECONDARY_DOMAIN_MX

VERIFY_SECONDARY_DOMAIN_MX: Secondary Domain MX Verification

ApplicationName: admin

Description

Verified MX records of secondary domain {SECONDARY_DOMAIN_NAME} of domain {DOMAIN_NAME}

References #

Reports API admin activity events: VERIFY_SECONDARY_DOMAIN_MX

VERIFY_SECONDARY_DOMAIN: Secondary Domain Verification

ApplicationName: admin

Description

{SECONDARY_DOMAIN_NAME} verified as a secondary domain of {DOMAIN_NAME}

References #

Reports API admin activity events: VERIFY_SECONDARY_DOMAIN

UPDATE_DOMAIN_SECONDARY_EMAIL: Secondary Email Change

ApplicationName: admin

Description

Secondary email for your organization changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: UPDATE_DOMAIN_SECONDARY_EMAIL

GENERATE_PIN: Support PIN Generation

ApplicationName: admin

Description

Customer support PIN generated

References #

Reports API admin activity events: GENERATE_PIN

UPDATE_RULE: Update rule

ApplicationName: admin

Description

Update rule event name.

References #

Reports API admin activity events: UPDATE_RULE

EMAIL_SETTINGS: Email Settings

ApplicationName: admin

Description

Events of this type are returned with type=EMAIL_SETTINGS .

References #

Reports API admin activity events: EMAIL_SETTINGS

DROP_FROM_QUARANTINE: Drop from Quarantine

ApplicationName: admin

Description

The title for the event release from quarantine. This title shows the message was dropped from quarantine.

References #

Reports API admin activity events: DROP_FROM_QUARANTINE

EMAIL_LIFE_OF_A_MESSAGE: Email life of a message search

ApplicationName: admin

Description

Email life of a message search is launched.

References #

Reports API admin activity events: EMAIL_LIFE_OF_A_MESSAGE

EMAIL_LOG_SEARCH: Email Log Search

ApplicationName: admin

Description

An email log search is performed for logs from {EMAIL_LOG_SEARCH_START_DATE} to {EMAIL_LOG_SEARCH_END_DATE} with a sender of [ {EMAIL_LOG_SEARCH_SENDER} ], a recipient of [ {EMAIL_LOG_SEARCH_RECIPIENT} ], and an email message id of [ {EMAIL_LOG_SEARCH_MSG_ID} ]

References #

Reports API admin activity events: EMAIL_LOG_SEARCH

EMAIL_UNDELETE: Email Restore

ApplicationName: admin

Description

Email restoration from {START_DATE} to {END_DATE} initiated for {USER_EMAIL}

References #

Reports API admin activity events: EMAIL_UNDELETE

CHANGE_EMAIL_SETTING: Email Setting Change

ApplicationName: admin

Description

{SETTING_NAME} for email service in your organization changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_EMAIL_SETTING

DELETE_GMAIL_SETTING: Gmail Setting Deletion

ApplicationName: admin

Description

Gmail setting {SETTING_NAME} was deleted

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

GSuite Workspace Gmail Default Routing Rule Modified source high suffix: A Workspace Admin Has Modified A Default Routing Rule In GmailT1098↳ also matches CHANGE_GMAIL_SETTING: Gmail Setting Change, CREATE_GMAIL_SETTING: Gmail Setting Creation

References #

Reports API admin activity events: DELETE_GMAIL_SETTING

REJECT_FROM_QUARANTINE: Reject from Quarantine

ApplicationName: admin

Description

The title for the event release from quarantine. This title shows the message was rejected from quarantine.

References #

Reports API admin activity events: REJECT_FROM_QUARANTINE

RELEASE_FROM_QUARANTINE: Release from Quarantine

ApplicationName: admin

Description

The title for the event release from quarantine. This title shows the message was released from quarantine.

References #

Reports API admin activity events: RELEASE_FROM_QUARANTINE

GROUP_SETTINGS: Group Settings

ApplicationName: admin

Description

Events of this type are returned with type=GROUP_SETTINGS .

References #

Reports API admin activity events: GROUP_SETTINGS

WHITELISTED_GROUPS_UPDATED: Filtering groups updated

ApplicationName: admin

Description

Whitelisted groups updated event.

References #

Reports API admin activity events: WHITELISTED_GROUPS_UPDATED

CREATE_GROUP: Group Creation

ApplicationName: admin

Description

Group {GROUP_EMAIL} created

References #

Reports API admin activity events: CREATE_GROUP

DELETE_GROUP: Group Deletion

ApplicationName: admin

Description

Group {GROUP_EMAIL} deleted

References #

Reports API admin activity events: DELETE_GROUP

CHANGE_GROUP_DESCRIPTION: Group Description Change

ApplicationName: admin

Description

Description for group {GROUP_EMAIL} changed

References #

Reports API admin activity events: CHANGE_GROUP_DESCRIPTION

CHANGE_GROUP_EMAIL: Group Email Change

ApplicationName: admin

Description

Email of group {GROUP_EMAIL} changed to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_GROUP_EMAIL

GROUP_LIST_DOWNLOAD: Group List Download

ApplicationName: admin

Description

Group list was downloaded as a CSV file

References #

Reports API admin activity events: GROUP_LIST_DOWNLOAD

REMOVE_GROUP_MEMBER: Group Member Deletion

ApplicationName: admin

Description

User {USER_EMAIL} deleted from group {GROUP_EMAIL}

References #

Reports API admin activity events: REMOVE_GROUP_MEMBER

UPDATE_GROUP_MEMBER: Group Member Update

ApplicationName: admin

Description

Group Setting Change.

References #

Reports API admin activity events: UPDATE_GROUP_MEMBER

UPDATE_GROUP_MEMBER_DELIVERY_SETTINGS: Group Member Update

ApplicationName: admin

Description

Group Member Delivery Settings Change.

References #

Reports API admin activity events: UPDATE_GROUP_MEMBER_DELIVERY_SETTINGS

UPDATE_GROUP_MEMBER_DELIVERY_SETTINGS_CAN_EMAIL_OVERRIDE: Group Member Update

ApplicationName: admin

Description

Group Member Delivery Settings Email Override Change.

References #

Reports API admin activity events: UPDATE_GROUP_MEMBER_DELIVERY_SETTINGS_CAN_EMAIL_OVERRIDE

GROUP_MEMBER_BULK_UPLOAD: Group Members Bulk Upload

ApplicationName: admin

Description

A total of {GROUP_MEMBER_BULK_UPLOAD_TOTAL_NUMBER} members selected for upload. {GROUP_MEMBER_BULK_UPLOAD_FAILED_NUMBER} out of {GROUP_MEMBER_BULK_UPLOAD_TOTAL_NUMBER} members failed to be uploaded

References #

Reports API admin activity events: GROUP_MEMBER_BULK_UPLOAD

GROUP_MEMBERS_DOWNLOAD: Group Members Download

ApplicationName: admin

Description

Group member list was downloaded as a CSV file

References #

Reports API admin activity events: GROUP_MEMBERS_DOWNLOAD

CHANGE_GROUP_NAME: Group Name Change

ApplicationName: admin

Description

Name of group {GROUP_EMAIL} changed to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_GROUP_NAME

LICENSES_SETTINGS: Licenses Settings

ApplicationName: admin

Description

Events of this type are returned with type=LICENSES_SETTINGS .

References #

Reports API admin activity events: LICENSES_SETTINGS

CHROME_APP_LICENSES_ENABLED: App License Policy Setting Changed

ApplicationName: admin

Description

Licenses enabled or not for a specified group/org unit event name.

References #

Reports API admin activity events: CHROME_APP_LICENSES_ENABLED

ORG_USERS_LICENSE_ASSIGNMENT: Assign Licenses to All Unassigned Users

ApplicationName: admin

Description

Licenses for {PRODUCT_NAME} product and {NEW_VALUE} sku were assigned to all unassigned users of {ORG_UNIT_NAME}

References #

Reports API admin activity events: ORG_USERS_LICENSE_ASSIGNMENT

ORG_ALL_USERS_LICENSE_ASSIGNMENT: Assign Licenses to All Users

ApplicationName: admin

Description

Licenses for {PRODUCT_NAME} product and {NEW_VALUE} sku were assigned to all users of {ORG_UNIT_NAME}

References #

Reports API admin activity events: ORG_ALL_USERS_LICENSE_ASSIGNMENT

SUPPRESSED_LICENSE_ASSIGNMENT: Assign Suppressed License

ApplicationName: admin

Description

A suppressed license for {PRODUCT_NAME} product and {NEW_VALUE} sku was assigned to the user {USER_EMAIL}

References #

Reports API admin activity events: SUPPRESSED_LICENSE_ASSIGNMENT

TEMPORARY_LICENSE_ASSIGNMENT: Assign Temporary License

ApplicationName: admin

Description

A temporary license for {PRODUCT_NAME} product and {NEW_VALUE} sku was assigned to the user {USER_EMAIL}

References #

Reports API admin activity events: TEMPORARY_LICENSE_ASSIGNMENT

USER_LICENSE_ASSIGNMENT: Assign User License

ApplicationName: admin

Description

A license for {PRODUCT_NAME} product and {NEW_VALUE} sku was assigned to the user {USER_EMAIL}

References #

Reports API admin activity events: USER_LICENSE_ASSIGNMENT

CHANGE_LICENSE_AUTO_ASSIGN: Auto Assign Licenses

ApplicationName: admin

Description

License Auto Assign option changed to {NEW_VALUE} for {PRODUCT_NAME} product and {SKU_NAME} sku

References #

Reports API admin activity events: CHANGE_LICENSE_AUTO_ASSIGN

SUPPRESSED_TO_ASSIGNED_LICENSE_CONVERSION: Convert user's Suppressed License to Active

ApplicationName: admin

Description

Suppressed license of the user {USER_EMAIL} for {PRODUCT_NAME} product and {NEW_VALUE} sku was converted to Active

References #

Reports API admin activity events: SUPPRESSED_TO_ASSIGNED_LICENSE_CONVERSION

TEMPORARY_TO_ASSIGNED_LICENSE_CONVERSION: Convert user's Temporary License to Active

ApplicationName: admin

Description

Temporary license of the user {USER_EMAIL} for {PRODUCT_NAME} product and {NEW_VALUE} sku was converted to Active

References #

Reports API admin activity events: TEMPORARY_TO_ASSIGNED_LICENSE_CONVERSION

TEMPORARY_TO_SUPPRESSED_LICENSE_CONVERSION: Convert user's Temporary License to Suppressed

ApplicationName: admin

Description

Temporary license of the user {USER_EMAIL} for {PRODUCT_NAME} product and {NEW_VALUE} sku was expired and converted to Suppressed

References #

Reports API admin activity events: TEMPORARY_TO_SUPPRESSED_LICENSE_CONVERSION

FIRST_TEMPORARY_OR_SUPPRESSED_LICENSE_NOTIFICATION: First Temporary or Suppressed License Email Sent

ApplicationName: admin

Description

Audit log event generated when first temporary or suppressed license email notification is sent to the customer.

References #

Reports API admin activity events: FIRST_TEMPORARY_OR_SUPPRESSED_LICENSE_NOTIFICATION

RESELLER_FIRST_TEMPORARY_OR_SUPPRESSED_LICENSE_NOTIFICATION: First Temporary or Suppressed License Email Sent for a User

ApplicationName: admin

Description

Audit log event generated when first temporary or suppressed license email notification is sent to the reseller.

References #

Reports API admin activity events: RESELLER_FIRST_TEMPORARY_OR_SUPPRESSED_LICENSE_NOTIFICATION

USER_LICENSE_REASSIGNMENT: Reassign User License

ApplicationName: admin

Description

A license for {PRODUCT_NAME} product and {OLD_VALUE} sku was reassigned for user {USER_EMAIL} to new sku {NEW_VALUE}

References #

Reports API admin activity events: USER_LICENSE_REASSIGNMENT

ORG_LICENSE_REVOKE: Revoke Licenses to All Users

ApplicationName: admin

Description

Licenses for {PRODUCT_NAME} product and {OLD_VALUE} sku were removed from assigned users of {ORG_UNIT_NAME}

References #

Reports API admin activity events: ORG_LICENSE_REVOKE

SUPPRESSED_LICENSE_REVOKE: Revoke Suppressed License

ApplicationName: admin

Description

A suppressed license for {PRODUCT_NAME} product and {OLD_VALUE} sku was revoked from the user {USER_EMAIL}

References #

Reports API admin activity events: SUPPRESSED_LICENSE_REVOKE

TEMPORARY_LICENSE_REVOKE: Revoke Temporary License

ApplicationName: admin

Description

A temporary license for {PRODUCT_NAME} product and {OLD_VALUE} sku was revoked from the user {USER_EMAIL}

References #

Reports API admin activity events: TEMPORARY_LICENSE_REVOKE

USER_LICENSE_REVOKE: Revoke User License

ApplicationName: admin

Description

A license for {PRODUCT_NAME} product and {OLD_VALUE} sku was revoked from user {USER_EMAIL}

References #

Reports API admin activity events: USER_LICENSE_REVOKE

TEMPORARY_LICENSES_EXPIRED_NOTIFICATION: Temporary Licenses Expiration Email Notification Sent

ApplicationName: admin

Description

Audit log event generated when temporary licenses expired email notification is sent to the customer.

References #

Reports API admin activity events: TEMPORARY_LICENSES_EXPIRED_NOTIFICATION

RESELLER_TEMPORARY_LICENSES_EXPIRED_NOTIFICATION: Temporary Licenses Expiration Email Notification Sent for a User

ApplicationName: admin

Description

Audit log event generated when temporary licenses expired email notification is sent to the reseller.

References #

Reports API admin activity events: RESELLER_TEMPORARY_LICENSES_EXPIRED_NOTIFICATION

UPDATE_DYNAMIC_LICENSE: Update Auto Licensing

ApplicationName: admin

Description

Auto Licensing settings for {PRODUCT_NAME} product in {ORG_UNIT_NAME} organization changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: UPDATE_DYNAMIC_LICENSE

CHROME_APP_USER_LICENSE_ASSIGNED: User license is assigned

ApplicationName: admin

Description

Short description to indicate user license is assigned.

References #

Reports API admin activity events: CHROME_APP_USER_LICENSE_ASSIGNED

CHROME_APP_USER_LICENSE_REVOKED: User license is revoked

ApplicationName: admin

Description

Short description to indicate user license is revoked.

References #

Reports API admin activity events: CHROME_APP_USER_LICENSE_REVOKED

MOBILE_SETTINGS: Mobile Settings

ApplicationName: admin

Description

Events of this type are returned with type=MOBILE_SETTINGS .

References #

Reports API admin activity events: MOBILE_SETTINGS

ACTION_CANCELLED: Action Cancelled On Device

ApplicationName: admin

Description

{ACTION_TYPE} with id {ACTION_ID} on device type {DEVICE_TYPE} and id {DEVICE_ID} was cancelled by user {USER_EMAIL}

References #

Reports API admin activity events: ACTION_CANCELLED

ACTION_REQUESTED: Action Requested On Device

ApplicationName: admin

Description

{ACTION_TYPE} with id {ACTION_ID} on device type {DEVICE_TYPE} and id {DEVICE_ID} was requested by user {USER_EMAIL}

References #

Reports API admin activity events: ACTION_REQUESTED

ADD_MOBILE_CERTIFICATE: Add Mobile certificate

ApplicationName: admin

Description

Mobile certificate {MOBILE_CERTIFICATE_COMMON_NAME} added for mobile devices in your organization

References #

Reports API admin activity events: ADD_MOBILE_CERTIFICATE

APPLE_DEP_SYNC_TRIGGERED: Apple DEP sync triggered by admin

ApplicationName: admin

Description

Apple DEP sync triggered by {USER_EMAIL}

References #

Reports API admin activity events: APPLE_DEP_SYNC_TRIGGERED

APPLE_DEP_TOKEN_SETUP_COMPLETE: Apple DEP token setup complete for customer

ApplicationName: admin

Description

Apple Device Enrollment tokens updated by {USER_EMAIL}

References #

Reports API admin activity events: APPLE_DEP_TOKEN_SETUP_COMPLETE

APPLE_VPP_TOKEN_OPERATION: Apple VPP token operation

ApplicationName: admin

Description

Apple VPP token {TOKEN_OPERATION_NAME} was {TOKEN_OPERATION_STATUS}

References #

Reports API admin activity events: APPLE_VPP_TOKEN_OPERATION

COMPANY_DEVICES_BULK_CREATION: Bulk import of company owned devices

ApplicationName: admin

Description

Details of {NUMBER_OF_COMPANY_OWNED_DEVICES} company owned device(s) were imported

References #

Reports API admin activity events: COMPANY_DEVICES_BULK_CREATION

COMPANY_OWNED_DEVICE_BLOCKED: Company owned device blocked

ApplicationName: admin

Description

Company owned device {COMPANY_DEVICE_ID} was blocked

References #

Reports API admin activity events: COMPANY_OWNED_DEVICE_BLOCKED

COMPANY_DEVICE_DELETION: Company owned device deleted

ApplicationName: admin

Description

Company owned device {COMPANY_DEVICE_ID} was deleted

References #

Reports API admin activity events: COMPANY_DEVICE_DELETION

COMPANY_OWNED_DEVICE_UNBLOCKED: Company owned device unblocked

ApplicationName: admin

Description

Company owned device {COMPANY_DEVICE_ID} was unblocked

References #

Reports API admin activity events: COMPANY_OWNED_DEVICE_UNBLOCKED

COMPANY_OWNED_DEVICE_WIPED: Company owned device wiped

ApplicationName: admin

Description

Company owned device {COMPANY_DEVICE_ID} was wiped

References #

Reports API admin activity events: COMPANY_OWNED_DEVICE_WIPED

CUSTOMER_USER_DEVICE_DELETION_EVENT: Customer user device deleted

ApplicationName: admin

Description

Customer user device {COMPANY_DEVICE_ID} was deleted

References #

Reports API admin activity events: CUSTOMER_USER_DEVICE_DELETION_EVENT

CHANGE_MOBILE_APPLICATION_PERMISSION_GRANT: Mobile application permission grant change

ApplicationName: admin

Description

Change in mobile application permission grant.

References #

Reports API admin activity events: CHANGE_MOBILE_APPLICATION_PERMISSION_GRANT

CHANGE_MOBILE_APPLICATION_PRIORITY_ORDER: Mobile application priority order change

ApplicationName: admin

Description

Change in priority order of mobile application.

References #

Reports API admin activity events: CHANGE_MOBILE_APPLICATION_PRIORITY_ORDER

REMOVE_MOBILE_APPLICATION_FROM_WHITELIST: Mobile application removed from whitelist

ApplicationName: admin

Description

{DEVICE_TYPE} application {MOBILE_APP_PACKAGE_ID} is no longer whitelisted for {DISTRIBUTION_ENTITY_NAME} {DISTRIBUTION_ENTITY_TYPE}

References #

Reports API admin activity events: REMOVE_MOBILE_APPLICATION_FROM_WHITELIST

CHANGE_MOBILE_APPLICATION_SETTINGS: Mobile application setting change

ApplicationName: admin

Description

Change in mobile application setting.

References #

Reports API admin activity events: CHANGE_MOBILE_APPLICATION_SETTINGS

ADD_MOBILE_APPLICATION_TO_WHITELIST: Mobile application whitelisted

ApplicationName: admin

Description

Mobile application is added to whitelist.

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

Google Workspace Apps New Mobile App Installed source medium: A new mobile application was added to your organization's mobile apps whitelist in Google Workspace Apps.

References #

Reports API admin activity events: ADD_MOBILE_APPLICATION_TO_WHITELIST

MOBILE_DEVICE_APPROVE: Mobile Device Approve

ApplicationName: admin

Description

Mobile device for {USER_EMAIL} approved

References #

Reports API admin activity events: MOBILE_DEVICE_APPROVE

MOBILE_DEVICE_BLOCK: Mobile Device Block

ApplicationName: admin

Description

Mobile device for {USER_EMAIL} blocked

References #

Reports API admin activity events: MOBILE_DEVICE_BLOCK

MOBILE_DEVICE_DELETE: Mobile Device Deletion

ApplicationName: admin

Description

Mobile device for {USER_EMAIL} deleted

References #

Reports API admin activity events: MOBILE_DEVICE_DELETE

MOBILE_DEVICE_WIPE: Mobile Device Wipe

ApplicationName: admin

Description

Mobile device for {USER_EMAIL} wiped

References #

Reports API admin activity events: MOBILE_DEVICE_WIPE

CHANGE_MOBILE_SETTING: Mobile Setting Change

ApplicationName: admin

Description

{SETTING_NAME} for mobile devices in your organization changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_MOBILE_SETTING

CHANGE_ADMIN_RESTRICTIONS_PIN: Mobile Setting Change: Administrator Restrictions Pin

ApplicationName: admin

Description

Administrator restrictions PIN for mobile devices in your organization changed

References #

Reports API admin activity events: CHANGE_ADMIN_RESTRICTIONS_PIN

CHANGE_MOBILE_WIRELESS_NETWORK: Mobile Wireless Network Change

ApplicationName: admin

Description

Mobile wireless network {MOBILE_WIRELESS_NETWORK_NAME} changed for mobile devices in your organization

References #

Reports API admin activity events: CHANGE_MOBILE_WIRELESS_NETWORK

ADD_MOBILE_WIRELESS_NETWORK: Mobile Wireless Network Creation

ApplicationName: admin

Description

Mobile wireless network {MOBILE_WIRELESS_NETWORK_NAME} created for mobile devices in your organization

References #

Reports API admin activity events: ADD_MOBILE_WIRELESS_NETWORK

REMOVE_MOBILE_WIRELESS_NETWORK: Mobile Wireless Network Deletion

ApplicationName: admin

Description

Mobile wireless network {MOBILE_WIRELESS_NETWORK_NAME} deleted for mobile devices in your organization

References #

Reports API admin activity events: REMOVE_MOBILE_WIRELESS_NETWORK

CHANGE_MOBILE_WIRELESS_NETWORK_PASSWORD: Mobile Wireless Network Password Change

ApplicationName: admin

Description

Password changed for mobile wireless network {MOBILE_WIRELESS_NETWORK_NAME} in your organization

References #

Reports API admin activity events: CHANGE_MOBILE_WIRELESS_NETWORK_PASSWORD

REMOVE_MOBILE_CERTIFICATE: Remove Mobile certificate

ApplicationName: admin

Description

Mobile certificate {MOBILE_CERTIFICATE_COMMON_NAME} removed for mobile devices in your organization

References #

Reports API admin activity events: REMOVE_MOBILE_CERTIFICATE

ENROLL_FOR_GOOGLE_DEVICE_MANAGEMENT: Use Google Device Management

ApplicationName: admin

Description

Google Device Management is a part of the Google Admin console.

References #

Reports API admin activity events: ENROLL_FOR_GOOGLE_DEVICE_MANAGEMENT

USE_GOOGLE_MOBILE_MANAGEMENT: Use Google Mobile Management

ApplicationName: admin

Description

You have selected Google Mobile Management to manage all your mobile devices

References #

Reports API admin activity events: USE_GOOGLE_MOBILE_MANAGEMENT

USE_GOOGLE_MOBILE_MANAGEMENT_FOR_NON_IOS: Use Google Mobile Management for Android and Active Sync devices

ApplicationName: admin

Description

You have selected Google Mobile Management to manage your Android and Active Sync devices

References #

Reports API admin activity events: USE_GOOGLE_MOBILE_MANAGEMENT_FOR_NON_IOS

USE_GOOGLE_MOBILE_MANAGEMENT_FOR_IOS: Use Google Mobile Management for iOS devices

ApplicationName: admin

Description

You have selected Google Mobile Management to manage your iOS devices

References #

Reports API admin activity events: USE_GOOGLE_MOBILE_MANAGEMENT_FOR_IOS

MOBILE_ACCOUNT_WIPE: Wipe Mobile Account

ApplicationName: admin

Description

Mobile account for {USER_EMAIL} has been wiped

References #

Reports API admin activity events: MOBILE_ACCOUNT_WIPE

MOBILE_DEVICE_CANCEL_WIPE_THEN_APPROVE: Wipe On Mobile Cancel And Approve Device

ApplicationName: admin

Description

Wipe on mobile device for {USER_EMAIL} was cancelled and the device was approved

References #

Reports API admin activity events: MOBILE_DEVICE_CANCEL_WIPE_THEN_APPROVE

MOBILE_DEVICE_CANCEL_WIPE_THEN_BLOCK: Wipe On Mobile Cancel And Block Device

ApplicationName: admin

Description

Wipe on mobile device for {USER_EMAIL} was cancelled and the device has been blocked

References #

Reports API admin activity events: MOBILE_DEVICE_CANCEL_WIPE_THEN_BLOCK

ORG_SETTINGS: Organization Settings

ApplicationName: admin

Description

Events of this type are returned with type=ORG_SETTINGS .

References #

Reports API admin activity events: ORG_SETTINGS

CHROME_LICENSES_ENABLED: App License Policy Changed

ApplicationName: admin

Description

Licenses enabled or not at an org unit event name.

References #

Reports API admin activity events: CHROME_LICENSES_ENABLED

CHROME_APPLICATION_LICENSE_RESERVATION_CREATED: App License Reservation Created

ApplicationName: admin

Description

License reservation at an org unit is created.

References #

Reports API admin activity events: CHROME_APPLICATION_LICENSE_RESERVATION_CREATED

CHROME_APPLICATION_LICENSE_RESERVATION_DELETED: App License Reservation Deleted

ApplicationName: admin

Description

License reservation at an org unit is deleted.

References #

Reports API admin activity events: CHROME_APPLICATION_LICENSE_RESERVATION_DELETED

CHROME_APPLICATION_LICENSE_RESERVATION_UPDATED: App License Reservation Updated

ApplicationName: admin

Description

License reservation at an org unit is updated.

References #

Reports API admin activity events: CHROME_APPLICATION_LICENSE_RESERVATION_UPDATED

CREATE_DEVICE_ENROLLMENT_TOKEN: Create enrollment token

ApplicationName: admin

Description

Event for 'Create enrollment token'.

References #

Reports API admin activity events: CREATE_DEVICE_ENROLLMENT_TOKEN

ASSIGN_CUSTOM_LOGO: Custom Logo Assign

ApplicationName: admin

Description

New custom logo assigned for org unit {ORG_UNIT_NAME}

References #

Reports API admin activity events: ASSIGN_CUSTOM_LOGO

UNASSIGN_CUSTOM_LOGO: Custom Logo Unassign

ApplicationName: admin

Description

Custom logo unassigned for org unit {ORG_UNIT_NAME}

References #

Reports API admin activity events: UNASSIGN_CUSTOM_LOGO

CREATE_ENROLLMENT_TOKEN: Enrollment Token Creation

ApplicationName: admin

Description

A new enrollment token is generated for {ORG_UNIT_NAME}

References #

Reports API admin activity events: CREATE_ENROLLMENT_TOKEN

REVOKE_ENROLLMENT_TOKEN: Enrollment Token Revocation

ApplicationName: admin

Description

The enrollment token of {ORG_UNIT_NAME} has been revoked

References #

Reports API admin activity events: REVOKE_ENROLLMENT_TOKEN

CHROME_LICENSES_ALLOWED: Licenses allowed or not at an org unit

ApplicationName: admin

Description

Licenses allowed or not at an org unit event name.

References #

Reports API admin activity events: CHROME_LICENSES_ALLOWED

CREATE_ORG_UNIT: OrgUnit Creation

ApplicationName: admin

Description

Org Unit {ORG_UNIT_NAME} created

References #

Reports API admin activity events: CREATE_ORG_UNIT

REMOVE_ORG_UNIT: OrgUnit Deletion

ApplicationName: admin

Description

Org Unit {ORG_UNIT_NAME} deleted

References #

Reports API admin activity events: REMOVE_ORG_UNIT

EDIT_ORG_UNIT_DESCRIPTION: OrgUnit Description Change

ApplicationName: admin

Description

Description of {ORG_UNIT_NAME} changed

References #

Reports API admin activity events: EDIT_ORG_UNIT_DESCRIPTION

MOVE_ORG_UNIT: OrgUnit Move

ApplicationName: admin

Description

{ORG_UNIT_NAME} moved to parent {NEW_VALUE}

References #

Reports API admin activity events: MOVE_ORG_UNIT

EDIT_ORG_UNIT_NAME: OrgUnit Name Change

ApplicationName: admin

Description

Name of {ORG_UNIT_NAME} changed to {NEW_VALUE}

References #

Reports API admin activity events: EDIT_ORG_UNIT_NAME

REVOKE_DEVICE_ENROLLMENT_TOKEN: Revoke enrollment token

ApplicationName: admin

Description

Event for 'Revoke enrollment token'.

References #

Reports API admin activity events: REVOKE_DEVICE_ENROLLMENT_TOKEN

TOGGLE_SERVICE_ENABLED: Service Change

ApplicationName: admin

Description

Service {SERVICE_NAME} changed to {NEW_VALUE} for {ORG_UNIT_NAME} organizational unit in your organization

References #

Reports API admin activity events: TOGGLE_SERVICE_ENABLED

SECURITY_SETTINGS: Security Settings

ApplicationName: admin

Description

Events of this type are returned with type=SECURITY_SETTINGS .

References #

Reports API admin activity events: SECURITY_SETTINGS

CHANGE_CAA_APP_ASSIGNMENTS: (Context-aware access) Access level assignment changed for an app

ApplicationName: admin

Description

For {TARGET_ENTITY_TYPE} [ {TARGET_ENTITY_NAME} ]: Before: Access level [ {CAA_ACCESS_ASSIGNMENTS_OLD} ] applied to {CAA_ENFORCEMENT_ENDPOINTS_OLD} of [ {APPLICATION_NAME} ] in [ {MODE} ] mode. After: Access level [ {CAA_ACCESS_ASSIGNMENTS_NEW} ] applied to {CAA_ENFORCEMENT_ENDPOINTS_NEW} of [ {APPLICATION_NAME} ] in [ {MODE} ] mode.

References #

Reports API admin activity events: CHANGE_CAA_APP_ASSIGNMENTS

UNDERAGE_BLOCK_ALL_THIRD_PARTY_API_ACCESS: All access to unconfigured third-party apps blocked for users under 18

ApplicationName: admin

Description

All third party API access blocked for users under 18.

References #

Reports API admin activity events: UNDERAGE_BLOCK_ALL_THIRD_PARTY_API_ACCESS

UNDERAGE_SIGN_IN_ONLY_THIRD_PARTY_API_ACCESS: Allow Google Sign-in only access to unconfigured third-party apps for users under 18

ApplicationName: admin

CHANGE_APP_ACCESS_SETTINGS_COLLECTION_ID: app access settings collection id change.

ApplicationName: admin

Description

App Access Settings Collection for the org unit {ORG_UNIT_NAME} has changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_APP_ACCESS_SETTINGS_COLLECTION_ID

ADD_TO_LIMITED_OAUTH2_APPS: App added to Limited list

ApplicationName: admin

Description

{OAUTH2_APP_NAME} added to Limited list for {ORG_UNIT_NAME}

References #

Reports API admin activity events: ADD_TO_LIMITED_OAUTH2_APPS

ADD_TO_TRUSTED_BY_OAUTH_SCOPE_OAUTH2_APPS: App added to Trusted by OAuth Scope list

ApplicationName: admin

Description

{OAUTH2_APP_NAME} added to trusted by OAuth scope list for {ORG_UNIT_NAME}

References #

Reports API admin activity events: ADD_TO_TRUSTED_BY_OAUTH_SCOPE_OAUTH2_APPS

ADD_TO_CAA_EXEMPT_OAUTH2_APPS: App allowlisted for exemption from API access blocks

ApplicationName: admin

Description

{OAUTH2_APP_NAME} allowlisted for exemption from API access blocks for {ORG_UNIT_NAME}

References #

Reports API admin activity events: ADD_TO_CAA_EXEMPT_OAUTH2_APPS

REMOVE_FROM_CAA_EXEMPT_OAUTH2_APPS: App no longer allowlisted for exemption from API access blocks

ApplicationName: admin

Description

{OAUTH2_APP_NAME} removed from allowlist for exemption from API access blocks for {ORG_UNIT_NAME}

References #

Reports API admin activity events: REMOVE_FROM_CAA_EXEMPT_OAUTH2_APPS

REMOVE_FROM_LIMITED_OAUTH2_APPS: App removed from Limited list

ApplicationName: admin

Description

{OAUTH2_APP_NAME} removed from Limited list for {ORG_UNIT_NAME}

References #

Reports API admin activity events: REMOVE_FROM_LIMITED_OAUTH2_APPS

REMOVE_FROM_TRUSTED_BY_OAUTH_SCOPE_OAUTH2_APPS: App removed from Trusted by OAuth Scope list

ApplicationName: admin

Description

{OAUTH2_APP_NAME} removed from trusted by OAuth scope list for {ORG_UNIT_NAME}

References #

Reports API admin activity events: REMOVE_FROM_TRUSTED_BY_OAUTH_SCOPE_OAUTH2_APPS

MULTIPLE_ADD_TO_BLOCKED_OAUTH2_APPS: Apps added to Blocked list

ApplicationName: admin

Description

{OAUTH2_NUM_APPS} apps added to Blocked list for {ORG_UNIT_NAME}

References #

Reports API admin activity events: MULTIPLE_ADD_TO_BLOCKED_OAUTH2_APPS

MULTIPLE_ADD_TO_LIMITED_OAUTH2_APPS: Apps added to Limited list

ApplicationName: admin

Description

{OAUTH2_NUM_APPS} apps added to Limited list for {ORG_UNIT_NAME}

References #

Reports API admin activity events: MULTIPLE_ADD_TO_LIMITED_OAUTH2_APPS

MULTIPLE_ADD_TO_TRUSTED_BY_OAUTH_SCOPE_OAUTH2_APPS: Apps added to Trusted by OAuth Scope list

ApplicationName: admin

Description

{OAUTH2_NUM_APPS} apps added to Trusted by OAuth Scope list for {ORG_UNIT_NAME}

References #

Reports API admin activity events: MULTIPLE_ADD_TO_TRUSTED_BY_OAUTH_SCOPE_OAUTH2_APPS

MULTIPLE_ADD_TO_TRUSTED_OAUTH2_APPS: Apps added to Trusted list

ApplicationName: admin

Description

{OAUTH2_NUM_APPS} apps added to Trusted list for {ORG_UNIT_NAME}

References #

Reports API admin activity events: MULTIPLE_ADD_TO_TRUSTED_OAUTH2_APPS

OAUTH_APPS_BULK_UPLOAD: Apps lists bulk upload

ApplicationName: admin

Description

{BULK_UPLOAD_SUCCESS_OAUTH_APPS_NUMBER} of {BULK_UPLOAD_TOTAL_OAUTH_APPS_NUMBER} rows successfully uploaded

References #

Reports API admin activity events: OAUTH_APPS_BULK_UPLOAD

OAUTH_APPS_BULK_UPLOAD_NOTIFICATION_SENT: Apps lists bulk upload notification

ApplicationName: admin

Description

Notification of bulk upload for apps list sent to {USER_EMAIL}

References #

Reports API admin activity events: OAUTH_APPS_BULK_UPLOAD_NOTIFICATION_SENT

BLOCK_ON_DEVICE_ACCESS: Block On Device Access

ApplicationName: admin

Description

Summary message to display in the audit log when device access for OAuth2 apps is blocked.

References #

Reports API admin activity events: BLOCK_ON_DEVICE_ACCESS

CHANGE_TWO_STEP_VERIFICATION_FREQUENCY: Change 2-Step Verification Frequency

ApplicationName: admin

Description

2-step verification frequency for {ORG_UNIT_NAME} changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_TWO_STEP_VERIFICATION_FREQUENCY

CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION: Change 2-Step Verification Grace Period Duration

ApplicationName: admin

Description

2-step verification grace period duration for {ORG_UNIT_NAME} changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION

CHANGE_TWO_STEP_VERIFICATION_START_DATE: Change 2-Step Verification Start Date

ApplicationName: admin

Description

2-step verification start date has been changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_TWO_STEP_VERIFICATION_START_DATE

CHANGE_CAA_ERROR_MESSAGE: Context Aware Access Error Message Change

ApplicationName: admin

Description

Error message has been changed to [ {NEW_VALUE} ]. (OrgUnit Name: {ORG_UNIT_NAME} )

References #

Reports API admin activity events: CHANGE_CAA_ERROR_MESSAGE

TOGGLE_CAA_REMEDIATION_ENABLEMENT: Context Aware Access Remediation Enablement

ApplicationName: admin

Description

Context Aware Access Remediation has been {NEW_VALUE} . (OrgUnit Name: {ORG_UNIT_NAME} )

References #

Reports API admin activity events: TOGGLE_CAA_REMEDIATION_ENABLEMENT

EDU_OVER_18_APPROVAL_WORKFLOW_DISABLED: Disabled Edu over 18 users apps requests

ApplicationName: admin

Description

Disabled Edu over 18 users apps requests for {ORG_UNIT_NAME}

References #

Reports API admin activity events: EDU_OVER_18_APPROVAL_WORKFLOW_DISABLED

EDU_DELEGATED_USER_APPROVAL_WORKFLOW_DISABLED: Disabled over 18 users making delegated apps requests

ApplicationName: admin

Description

Disabled over 18 users making delegated apps requests for {ORG_UNIT_NAME}

References #

Reports API admin activity events: EDU_DELEGATED_USER_APPROVAL_WORKFLOW_DISABLED

UNDERAGE_USER_APPROVAL_WORKFLOW_DISABLED: Disabled under 18 users apps requests

ApplicationName: admin

Description

Disabled under 18 users apps requests for {ORG_UNIT_NAME}

References #

Reports API admin activity events: UNDERAGE_USER_APPROVAL_WORKFLOW_DISABLED

USER_APPROVAL_WORKFLOW_DISABLED: Disabled users over 18 to make apps requests

ApplicationName: admin

Description

Disabled users over 18 to make apps requests for {ORG_UNIT_NAME}

References #

Reports API admin activity events: USER_APPROVAL_WORKFLOW_DISABLED

UNTRUST_DOMAIN_OWNED_OAUTH2_APPS: Domain Owned Apps not trusted

ApplicationName: admin

Description

Domain Owned Apps removed from trusted list

References #

Reports API admin activity events: UNTRUST_DOMAIN_OWNED_OAUTH2_APPS

TRUST_DOMAIN_OWNED_OAUTH2_APPS: Domain Owned Apps trusted

ApplicationName: admin

Description

Domain Owned Apps added to trusted list

References #

Reports API admin activity events: TRUST_DOMAIN_OWNED_OAUTH2_APPS

ENABLE_NON_ADMIN_USER_PASSWORD_RECOVERY: Enable Non-Admin User Password Recovery

ApplicationName: admin

Description

Enable non-admin user password recovery setting in {ORG_UNIT_NAME} organization changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: ENABLE_NON_ADMIN_USER_PASSWORD_RECOVERY

EDU_OVER_18_APPROVAL_WORKFLOW_ENABLED: Enabled Edu over 18 users apps requests

ApplicationName: admin

Description

Enabled Edu over 18 users apps requests for {ORG_UNIT_NAME}

References #

Reports API admin activity events: EDU_OVER_18_APPROVAL_WORKFLOW_ENABLED

EDU_DELEGATED_USER_APPROVAL_WORKFLOW_ENABLED: Enabled over 18 users making delegated apps requests

ApplicationName: admin

Description

Enabled over 18 users making delegated apps requests for {ORG_UNIT_NAME}

References #

Reports API admin activity events: EDU_DELEGATED_USER_APPROVAL_WORKFLOW_ENABLED

UNDERAGE_USER_APPROVAL_WORKFLOW_ENABLED: Enabled under 18 users apps requests

ApplicationName: admin

Description

Enabled under 18 users apps requests for {ORG_UNIT_NAME}

References #

Reports API admin activity events: UNDERAGE_USER_APPROVAL_WORKFLOW_ENABLED

USER_APPROVAL_WORKFLOW_ENABLED: Enabled users over 18 to make apps requests

ApplicationName: admin

Description

Enabled users over 18 to make apps requests for {ORG_UNIT_NAME}

References #

Reports API admin activity events: USER_APPROVAL_WORKFLOW_ENABLED

UPDATE_ERROR_MSG_FOR_RESTRICTED_OAUTH2_APPS: Error message for restricted OAuth2 apps updated

ApplicationName: admin

Description

Summary message to display in the audit log for Oauth2 scope management settings.

References #

Reports API admin activity events: UPDATE_ERROR_MSG_FOR_RESTRICTED_OAUTH2_APPS

CHANGE_SESSION_LENGTH: Session length changed

ApplicationName: admin

Description

Session length has been changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_SESSION_LENGTH

UNBLOCK_ON_DEVICE_ACCESS: Unblock on Device Access

ApplicationName: admin

Description

Summary message to display in the audit log when device access for OAuth2 apps is unblocked.

References #

Reports API admin activity events: UNBLOCK_ON_DEVICE_ACCESS

DOWNLOAD_PENDING_APP_USER_REQUESTS: Users requesting access list download

ApplicationName: admin

Description

Downloaded list of users requesting access to {OAUTH2_APP_NAME}

References #

Reports API admin activity events: DOWNLOAD_PENDING_APP_USER_REQUESTS

SITES_SETTINGS: Sites Settings

ApplicationName: admin

Description

Events of this type are returned with type=SITES_SETTINGS .

References #

Reports API admin activity events: SITES_SETTINGS

ADD_WEB_ADDRESS: Add Web Address

ApplicationName: admin

Description

Event gets triggered when a web address is added via cpanel.

References #

Reports API admin activity events: ADD_WEB_ADDRESS

DELETE_WEB_ADDRESS: Delete Web Address

ApplicationName: admin

Description

Event gets triggered when a web address is deleted via cpanel.

References #

Reports API admin activity events: DELETE_WEB_ADDRESS

CHANGE_SITES_SETTING: Sites Setting Change

ApplicationName: admin

Description

{SETTING_NAME} for sites in your organization changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_SITES_SETTING

CHANGE_SITES_WEB_ADDRESS_MAPPING_UPDATES: Sites web address mapping change

ApplicationName: admin

Description

Sites web address mapping update.

References #

Reports API admin activity events: CHANGE_SITES_WEB_ADDRESS_MAPPING_UPDATES

VIEW_SITE_DETAILS: Viewed Google Site details

ApplicationName: admin

Description

Admin viewed the site details of {SITE_NAME}

References #

Reports API admin activity events: VIEW_SITE_DETAILS

USER_SETTINGS: User Settings

ApplicationName: admin

Description

Events of this type are returned with type=USER_SETTINGS .

References #

Reports API admin activity events: USER_SETTINGS

DELETE_2SV_SCRATCH_CODES: 2-step Verification Scratch Codes Deletion

ApplicationName: admin

Description

2-step verification scratch codes of the user {USER_EMAIL} deleted

References #

Reports API admin activity events: DELETE_2SV_SCRATCH_CODES

GENERATE_2SV_SCRATCH_CODES: 2-step Verification Scratch Codes Generate

ApplicationName: admin

Description

New 2-step verification scratch codes generated for the user {USER_EMAIL}

References #

Reports API admin activity events: GENERATE_2SV_SCRATCH_CODES

REVOKE_3LO_DEVICE_TOKENS: 3-legged OAuth Device Tokens Revoke

ApplicationName: admin

Description

3-legged OAuth tokens issued by user {USER_EMAIL} for the device type {DEVICE_TYPE} and id {DEVICE_ID} were revoked

References #

Reports API admin activity events: REVOKE_3LO_DEVICE_TOKENS

ACCEPT_USER_INVITATION: Accept User Invite

ApplicationName: admin

Description

User invitation accepted for user: {USER_EMAIL}

References #

Reports API admin activity events: ACCEPT_USER_INVITATION

ADD_RECOVERY_EMAIL: Add Recovery Email

ApplicationName: admin

Description

Recovery email added for {USER_EMAIL}

References #

Reports API admin activity events: ADD_RECOVERY_EMAIL

ADD_RECOVERY_PHONE: Add Recovery Phone

ApplicationName: admin

Description

Recovery phone added for {USER_EMAIL}

References #

Reports API admin activity events: ADD_RECOVERY_PHONE

BULK_UPLOAD: Bulk Upload

ApplicationName: admin

Description

{BULK_UPLOAD_TOTAL_USERS_NUMBER} users selected for upload to your organization. {BULK_UPLOAD_FAIL_USERS_NUMBER} out of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users were not uploaded.

References #

Reports API admin activity events: BULK_UPLOAD

BULK_UPLOAD_NOTIFICATION_SENT: Bulk Upload Notification

ApplicationName: admin

Description

Notification of bulk users upload sent to {USER_EMAIL}

References #

Reports API admin activity events: BULK_UPLOAD_NOTIFICATION_SENT

CANCEL_USER_INVITE: Cancel User Invite

ApplicationName: admin

Description

Invite to {USER_EMAIL} cancelled

References #

Reports API admin activity events: CANCEL_USER_INVITE

CHANGE_USER_CUSTOM_FIELD: Change Custom Attribute

ApplicationName: admin

Description

{USER_CUSTOM_FIELD} changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_USER_CUSTOM_FIELD

CHANGE_USER_EXTERNAL_ID: Change External Id

ApplicationName: admin

Description

External Ids changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_USER_EXTERNAL_ID

CHANGE_USER_GENDER: Change Gender

ApplicationName: admin

Description

Change here is a verb. The genders will be customizable, so this should be broader than male vs female.

References #

Reports API admin activity events: CHANGE_USER_GENDER

CHANGE_USER_IM: Change IM

ApplicationName: admin

Description

IMs changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_USER_IM

ENABLE_USER_IP_WHITELIST: Change IP Whitelist

ApplicationName: admin

Description

IP whitelist changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: ENABLE_USER_IP_WHITELIST

CHANGE_USER_KEYWORD: Change Keyword

ApplicationName: admin

Description

Keywords are used on user profiles to help identify a user in searches. Example: find person with name 'Larry' and school 'Stanford'. 'Change' is a verb.

References #

Reports API admin activity events: CHANGE_USER_KEYWORD

CHANGE_USER_LANGUAGE: Change Language

ApplicationName: admin

Description

Can be a predefined set of more common languages provided by Google or a custom language. 'Change' here is a verb.

References #

Reports API admin activity events: CHANGE_USER_LANGUAGE

CHANGE_USER_LOCATION: Change Location

ApplicationName: admin

Description

Location is different from address in the following ways: (1) Location can be fuzzy. Example: Near Seattle. (2) Hovercards and other short user summaries display location, not address. 'Change' is a verb.

References #

Reports API admin activity events: CHANGE_USER_LOCATION

CHANGE_USER_ORGANIZATION: Change Organization

ApplicationName: admin

Description

Organizations changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_USER_ORGANIZATION

CHANGE_USER_PHONE_NUMBER: Change Phone Numbers

ApplicationName: admin

Description

Phone Numbers changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_USER_PHONE_NUMBER

CHANGE_RECOVERY_EMAIL: Change Recovery Email

ApplicationName: admin

Description

Recovery email changed for {USER_EMAIL}

References #

Reports API admin activity events: CHANGE_RECOVERY_EMAIL

CHANGE_RECOVERY_PHONE: Change Recovery Phone

ApplicationName: admin

Description

Recovery phone changed for {USER_EMAIL}

References #

Reports API admin activity events: CHANGE_RECOVERY_PHONE

CHANGE_USER_RELATION: Change Relation

ApplicationName: admin

Description

Relations changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_USER_RELATION

CHANGE_USER_ADDRESS: Change User Address

ApplicationName: admin

Description

Addresses changed for {USER_EMAIL} from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_USER_ADDRESS

CREATE_EMAIL_MONITOR: Create an email monitor

ApplicationName: admin

Description

Created an email monitor for {USER_EMAIL} to {EMAIL_MONITOR_DEST_EMAIL} that will expire on {END_DATE_TIME}

References #

Reports API admin activity events: CREATE_EMAIL_MONITOR

DELETE_ACCOUNT_INFO_DUMP: Delete account information dump

ApplicationName: admin

Description

Deleted account and login information dump for {USER_EMAIL} and request ID {REQUEST_ID}

References #

Reports API admin activity events: DELETE_ACCOUNT_INFO_DUMP

DELETE_EMAIL_MONITOR: Delete an email monitor

ApplicationName: admin

Description

Deleted an email monitor for {USER_EMAIL} to {EMAIL_MONITOR_DEST_EMAIL}

References #

Reports API admin activity events: DELETE_EMAIL_MONITOR

DELETE_MAILBOX_DUMP: Delete mailbox dump

ApplicationName: admin

Description

Deleted mailbox dump for {USER_EMAIL} and request ID {REQUEST_ID}

References #

Reports API admin activity events: DELETE_MAILBOX_DUMP

DELETE_PROFILE_PHOTO: Delete Profile Photo

ApplicationName: admin

Description

Profile photo of {USER_EMAIL} has been deleted

References #

Reports API admin activity events: DELETE_PROFILE_PHOTO

ADD_DISPLAY_NAME: Display Name Added

ApplicationName: admin

Description

{USER_DISPLAY_NAME} added as a display name of {USER_EMAIL}

References #

Reports API admin activity events: ADD_DISPLAY_NAME

CHANGE_DISPLAY_NAME: Display Name Change

ApplicationName: admin

Description

Display name of {USER_EMAIL} changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_DISPLAY_NAME

REMOVE_DISPLAY_NAME: Display Name Removed

ApplicationName: admin

Description

{USER_DISPLAY_NAME} removed as a display name of {USER_EMAIL}

References #

Reports API admin activity events: REMOVE_DISPLAY_NAME

CHANGE_FIRST_NAME: First Name Change

ApplicationName: admin

Description

First name of {USER_EMAIL} changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_FIRST_NAME

GMAIL_RESET_USER: Gmail Account Reset

ApplicationName: admin

Description

Gmail account of {USER_EMAIL} reset

References #

Reports API admin activity events: GMAIL_RESET_USER

CHANGE_LAST_NAME: Last Name Change

ApplicationName: admin

Description

Last name of {USER_EMAIL} changed from {OLD_VALUE} to {NEW_VALUE}

References #

Reports API admin activity events: CHANGE_LAST_NAME

MAIL_ROUTING_DESTINATION_ADDED: Mail Routing Destination Creation

ApplicationName: admin

Description

User {USER_EMAIL} has received the following individual mail routing destination: {NEW_VALUE}

References #

Reports API admin activity events: MAIL_ROUTING_DESTINATION_ADDED

MAIL_ROUTING_DESTINATION_REMOVED: Mail Routing Destination Deletion

ApplicationName: admin

Description

User {USER_EMAIL} has had the following individual mail routing destination removed: {OLD_VALUE}

References #

Reports API admin activity events: MAIL_ROUTING_DESTINATION_REMOVED

ADD_NICKNAME: Nickname Creation

ApplicationName: admin

Description

{USER_NICKNAME} created as a nickname of {USER_EMAIL}

References #

Reports API admin activity events: ADD_NICKNAME

REMOVE_NICKNAME: Nickname Deletion

ApplicationName: admin

Description

{USER_NICKNAME} deleted as a nickname of {USER_EMAIL}

References #

Reports API admin activity events: REMOVE_NICKNAME

PASSKEY_REVOKED: Passkey revoked

ApplicationName: admin

Description

A passkey enrolled for user {USER_EMAIL} was revoked

References #

Reports API admin activity events: PASSKEY_REVOKED

DOWNLOAD_PENDING_INVITES_LIST: Pending Invites List Download

ApplicationName: admin

Description

Pending Invites List was downloaded as a CSV file

References #

Reports API admin activity events: DOWNLOAD_PENDING_INVITES_LIST

UPDATE_PUBLIC_KEY_CERTIFICATE_STATUS: Public Key Certificate Status Updated

ApplicationName: admin

Description

Public key certificate status updated to {PUBLIC_KEY_CERTIFICATE_STATUS} for email {USER_IMPACTED_EMAIL} of user {USER_EMAIL}

References #

Reports API admin activity events: UPDATE_PUBLIC_KEY_CERTIFICATE_STATUS

UPDATE_PUBLIC_KEY_CERTIFICATE: Public Key Certificate Updated

ApplicationName: admin

Description

Public key certificate updated for {USER_DISPLAY_NAME} email {USER_EMAIL}

References #

Reports API admin activity events: UPDATE_PUBLIC_KEY_CERTIFICATE

REMOVE_RECOVERY_EMAIL: Remove Recovery Email

ApplicationName: admin

Description

Recovery email removed for {USER_EMAIL}

References #

Reports API admin activity events: REMOVE_RECOVERY_EMAIL

REMOVE_RECOVERY_PHONE: Remove Recovery Phone

ApplicationName: admin

Description

Recovery phone removed for {USER_EMAIL}

References #

Reports API admin activity events: REMOVE_RECOVERY_PHONE

REQUEST_ACCOUNT_INFO: Request account information

ApplicationName: admin

Description

Requested account and login information for {USER_EMAIL}

References #

Reports API admin activity events: REQUEST_ACCOUNT_INFO

REQUEST_MAILBOX_DUMP: Request mailbox dump

ApplicationName: admin

Description

Requested mailbox dump for {USER_EMAIL}

References #

Reports API admin activity events: REQUEST_MAILBOX_DUMP

RESEND_USER_INVITE: Resend User Invite

ApplicationName: admin

Description

Invite email to {USER_EMAIL} resent

References #

Reports API admin activity events: RESEND_USER_INVITE

SECURITY_KEY_REGISTERED_FOR_USER: Security Key Registered For User

ApplicationName: admin

Description

Security key registered for {USER_EMAIL}

References #

Reports API admin activity events: SECURITY_KEY_REGISTERED_FOR_USER

REVOKE_SECURITY_KEY: Security Key Revoke

ApplicationName: admin

Description

A security key enrolled for user {USER_EMAIL} for 2-step verification was revoked

References #

Reports API admin activity events: REVOKE_SECURITY_KEY

USER_INVITE: Send User Invite

ApplicationName: admin

Description

{USER_EMAIL} invited to join your organization

References #

Reports API admin activity events: USER_INVITE

VIEW_TEMP_PASSWORD: Temporary Password Viewed

ApplicationName: admin

Description

Temporary password for user {USER_EMAIL} viewed by the admin

References #

Reports API admin activity events: VIEW_TEMP_PASSWORD

UNBLOCK_USER_SESSION: Unblock User Session

ApplicationName: admin

Description

User {USER_EMAIL} unblocked by temporarily disabling login challenge

References #

Reports API admin activity events: UNBLOCK_USER_SESSION

UNMANAGED_USERS_BULK_UPLOAD: Unmanaged Users Bulk Upload

ApplicationName: admin

Description

A total of {BULK_UPLOAD_TOTAL_USERS_NUMBER} unmanaged users selected for upload. {BULK_UPLOAD_FAIL_USERS_NUMBER} out of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users failed to be uploaded.

References #

Reports API admin activity events: UNMANAGED_USERS_BULK_UPLOAD

DOWNLOAD_UNMANAGED_USERS_LIST: Unmanaged Users List Download

ApplicationName: admin

Description

Unmanaged Users list was downloaded as a CSV file

References #

Reports API admin activity events: DOWNLOAD_UNMANAGED_USERS_LIST

UPDATE_PROFILE_PHOTO: Update Profile Photo

ApplicationName: admin

Description

Profile photo of {USER_EMAIL} has been updated

References #

Reports API admin activity events: UPDATE_PROFILE_PHOTO

UNENROLL_USER_FROM_TITANIUM: User Advanced Protection Unenroll

ApplicationName: admin

Description

User {USER_EMAIL} unenrolled from Advanced Protection

References #

Reports API admin activity events: UNENROLL_USER_FROM_TITANIUM

ARCHIVE_USER: User Archival

ApplicationName: admin

Description

{USER_EMAIL} archived

References #

Reports API admin activity events: ARCHIVE_USER

UPDATE_BIRTHDATE: User BirthDate Change

ApplicationName: admin

Description

The birth date for {USER_EMAIL} changed to {BIRTHDATE}

References #

Reports API admin activity events: UPDATE_BIRTHDATE

USER_CREATED_PASSKEY_REVOKE: User created passkey revoked

ApplicationName: admin

Description

A user created passkey enrolled for user {USER_EMAIL} was revoked

References #

Reports API admin activity events: USER_CREATED_PASSKEY_REVOKE

DOWNGRADE_USER_FROM_GPLUS: User Downgrade From Google+

ApplicationName: admin

Description

{USER_EMAIL} was downgraded from Google+

References #

Reports API admin activity events: DOWNGRADE_USER_FROM_GPLUS

USER_ENROLLED_IN_TWO_STEP_VERIFICATION: User Enrolled In 2-Step Verification

ApplicationName: admin

Description

{USER_EMAIL} enrolled in 2-step verification

References #

Reports API admin activity events: USER_ENROLLED_IN_TWO_STEP_VERIFICATION

DOWNLOAD_USERLIST_CSV: User List Download

ApplicationName: admin

Description

User list was downloaded as a CSV file

References #

Reports API admin activity events: DOWNLOAD_USERLIST_CSV

DOWNLOAD_USERLIST: User List Download

ApplicationName: admin

Description

User list was downloaded in {FORMAT}

References #

Reports API admin activity events: DOWNLOAD_USERLIST

USER_PUT_IN_TWO_STEP_VERIFICATION_GRACE_PERIOD: User Put In 2-Step Verification Grace Period

ApplicationName: admin

Description

2-step verification grace period has been enabled on {USER_EMAIL} till {NEW_VALUE}

References #

Reports API admin activity events: USER_PUT_IN_TWO_STEP_VERIFICATION_GRACE_PERIOD

UNENROLL_USER_FROM_STRONG_AUTH: User Strong Auth Unenroll

ApplicationName: admin

Description

User {USER_EMAIL} unenrolled from Strong Auth

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk #

GCP Multi-Factor Authentication Disabled source: The following analytic detects an attempt to disable multi-factor authentication (MFA) for a Google Cloud Platform (GCP) user. It leverages Google Workspace Admin log events, specifically the UNENROLL_USER_FROM_STRONG_AUTH command. This…T1556, T1556.006, T1586, T1586.003

References #

Reports API admin activity events: UNENROLL_USER_FROM_STRONG_AUTH

UNARCHIVE_USER: User Unarchival

ApplicationName: admin

Description

{USER_EMAIL} unarchived

References #

Reports API admin activity events: UNARCHIVE_USER

UNDELETE_USER: User Undeletion

ApplicationName: admin

Description

{USER_EMAIL} undeleted

References #

Reports API admin activity events: UNDELETE_USER

UPGRADE_USER_TO_GPLUS: User Upgrade To Google+

ApplicationName: admin

Description

{USER_EMAIL} was upgraded to Google+

References #

Reports API admin activity events: UPGRADE_USER_TO_GPLUS

USERS_BULK_UPLOAD: Users Bulk Upload

ApplicationName: admin

Description

A total of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users selected for upload. {BULK_UPLOAD_FAIL_USERS_NUMBER} out of {BULK_UPLOAD_TOTAL_USERS_NUMBER} users failed to be uploaded.

References #

Reports API admin activity events: USERS_BULK_UPLOAD

USERS_BULK_UPLOAD_NOTIFICATION_SENT: Users Bulk Upload Notification

ApplicationName: admin

Description

Notification of bulk users upload sent to {USER_EMAIL}

References #

Reports API admin activity events: USERS_BULK_UPLOAD_NOTIFICATION_SENT