Detection rules › By event

GoogleWorkspace-mobile

Event	Rules
DEVICE_REGISTER_UNREGISTER_EVENT	2
DEVICE_COMPROMISED_EVENT	1
FAILED_PASSWORD_ATTEMPTS_EVENT	1
SUSPICIOUS_ACTIVITY_EVENT	1

DEVICE_REGISTER_UNREGISTER_EVENT

2 detection rules reference this event. View event page.

Elastic (2)

Google Workspace Device Registration Burst for Single User severity medium T1078, T1078.004, T1098, T1098.005, T1557
Google Workspace User Sign-in from Atypical Device Type severity medium T1078, T1078.004, T1098, T1098.005

DEVICE_COMPROMISED_EVENT

1 detection rules reference this event. View event page.

Panther (1)

GSuite User Device Compromised severity medium

FAILED_PASSWORD_ATTEMPTS_EVENT

1 detection rules reference this event. View event page.

Panther (1)

GSuite User Device Unlock Failures severity medium T1110

SUSPICIOUS_ACTIVITY_EVENT

1 detection rules reference this event. View event page.

Panther (1)

GSuite Device Suspicious Activity severity low