Collect Google Workspace logs

Supported in:

This document describes how to ingest your Google Workspace logs into Google Security Operations. Sending these logs to Google SecOps lets you to use its security analytics capabilities for enhanced threat detection, investigation, and response across your Google Workspace environment.

You can ingest various log types from Google Workspace, including activity events, alerts, user information, and more. There are two primary methods available to bring this data into Google SecOps:

  • Native Ingestion: This method provides a direct connection configured from the Google Workspace Admin console to Google SecOps. It is streamlined for specific log types but has particular Google Workspace license requirements.
  • Feed-based Ingestion: This method uses the Feed Management feature within Google SecOps to regularly fetch logs from the Google Workspace APIs. This approach supports a wider range of Google Workspace log types.

The following sections detail each method, including their capabilities, prerequisites, limitations, and step-by-step configuration instructions, to help you make an informed decision.

This document also provides details on the supported Google Workspace log types and how the log fields from these sources map to the Google SecOps Unified Data Model (UDM), enabling you to understand how the data is normalized and can be utilized within Google SecOps.

Choosing Your Ingestion Method

The best method for your organization to ingest Google Workspace logs into Google SecOps depends on factors such as the specific log types you need, your current Google Workspace license, and your sensitivity to data latency. The following table summarizes the supported methods and key considerations for each Google Workspace log type:

Log Type (Ingestion Label) Supported Ingestion Method(s) Key Considerations
WORKSPACE_ACTIVITY Native OR Feed Native: Near real-time ingestion. Requires a Google Workspace Enterprise license to access the Data Integrations feature within the Admin console Reporting section.
Feed: Compatible with all Google Workspace log types. Subject to potential data latency.
WORKSPACE_ALERTS Feed Subject to potential data latency.
WORKSPACE_CHROMEOS Feed Subject to potential data latency.
WORKSPACE_GROUPS Feed Subject to potential data latency.
WORKSPACE_MOBILE Feed Subject to potential data latency.
WORKSPACE_PRIVILEGES Feed Subject to potential data latency.
WORKSPACE_USERS Feed Subject to potential data latency.

Key Differences

License Requirements

  • Native Ingestion for Google Workspace Activity logs (WORKSPACE_ACTIVITY) requires a Google Workspace Enterprise edition. This is because it leverages the Data Integrations functionality, which is part of the Enterprise offering.
  • Feed-based Ingestion is generally available across more Google Workspace editions as it uses the Google Workspace Reports API.

Data Latency

  • Native Ingestion offers a direct stream and is designed to deliver logs with lower latency, making it suitable for near real-time monitoring of activity events.
  • Feed-based Ingestion fetches data periodically. While configuration options exist, there's an inherent delay compared to the native method. The actual latency can vary based on the API and the log type. For more details on what to expect from the source, see Google Workspace data retention and lag times. Google SecOps feed configurations also influence the fetch schedule.

Supported Log Types

  • Only the WORKSPACE_ACTIVITY log type supports Native Ingestion.
  • Feed-based Ingestion supports all the listed Google Workspace log types, offering broader coverage across different data sources within Google Workspace.

Recommendation

  • If you have a Google Workspace Enterprise license and require Google Workspace Activity logs (WORKSPACE_ACTIVITY) in near real-time, Native Ingestion is the preferred method for that specific log type.
  • For all other log types (WORKSPACE_ALERTS, WORKSPACE_CHROMEOS, etc.), or if you don't have an Enterprise license for Google Workspace Activity logs (WORKSPACE_ACTIVITY), you must use the Feed-based Ingestion method.
  • If using the Feed method for Google Workspace Activity logs (WORKSPACE_ACTIVITY), be aware of the potential for data delays.

The following sections provide detailed instructions for configuring both Native Ingestion (for WORKSPACE_ACTIVITY) and Feed-based Ingestion.

Method 1: Configure Native Ingestion for WORKSPACE_ACTIVITY

This method streams Google Workspace Activity logs (WORKSPACE_ACTIVITY) directly from the Google Workspace Admin console to Google SecOps, offering nearly real time data. Multiple Workspace organizations can be mapped to a single SecOps instance through our native ingestion method. This method fully supports environments with multiple Google Workspace organizations; you can configure ingestion to collect activity logs from all associated Google Workspace organizations.

Native ingestion for WORKSPACE_ACTIVITY supports logs from the following Google application types:

  • Access Transparency
  • Accounts
  • Google Admin console
  • Google Calendar
  • Google Chat
  • Google Chrome
  • Classroom
  • Google Cloud
  • Access Context Manager
  • Data Studio
  • Device
  • Google Drive
  • Gmail
  • Google Groups
  • Jamboard management
  • LDAP
  • Login
  • Google Meet
  • OAuth
  • Password Vault
  • Firewall Rules Logging
  • SAML
  • User accounts
  • Voice

Before you begin

Make sure you have the following prerequisites:

  • A Google SecOps instance
  • An enterprise version of Google Workspace

Obtain your Google SecOps instance ID and token

To obtain your Google SecOps instance ID and token, complete the following steps from your Google SecOps account:

  1. Open your Google SecOps instance.
  2. From the navigation bar, select Settings.
  3. Click Google Workspace.
  4. Enter your Google Workspace Customer ID.
  5. Click Generate Token.
  6. Copy the token and your Google SecOps instance ID (located on the same page).

To send your Google Workspace data to your Google SecOps instance, complete the following steps from the Google Workspace Admin console:

  1. Open the Google Workspace Admin console.
  2. Click Reporting.
  3. Click Data Integrations.
  4. Select Google SecOps export, and then click Connect to Google SecOps. This opens the Connect to Google SecOps page.
  5. Paste the token copied from your Google SecOps account into the indicated field. Click Connect. Export audit data to Google SecOps should now display On. Your Google Workspace account is now linked to your Google SecOps instance and will begin sending your Google Workspace data.
  6. Click Go to Google SecOps to open your Google SecOps instance and begin to monitor your Google Workspace data from Google SecOps. For more information, see the Data Ingestion and Health dashboard.

Disconnect Google Workspace from Google SecOps

To disconnect your Google Workspace account from your Google SecOps instance, complete the following steps:

  1. Open the Google Workspace Admin console.
  2. Click Data Integrations.
  3. In the Google SecOps export panel, click Disconnect from Google SecOps. Export audit data to Google SecOps should now display Off.

What's next

The next step is to enable the Cloud Threats category rules sets designed to help identify threats using Google Workspace data.

Method 2: Configure Feed-based Ingestion

This method uses Google SecOps Feed Management to periodically fetch logs from various Google Workspace APIs. As mentioned in the Choosing Your Ingestion Method section, this approach is necessary for all Google Workspace log types other than WORKSPACE_ACTIVITY, and it can also be used for WORKSPACE_ACTIVITY if you don't have an Enterprise license.

A typical deployment consists of Google Workspace and the Google Security Operations feed configured to send logs to Google Security Operations. Each customer deployment might differ and might be more complex.

The deployment contains the following components:

  • Google Workspace. The Google Workspace platform from which you collect logs.

  • Google Security Operations feed. The Google Security Operations feed that fetches logs from Google Workspace and writes logs to Google Security Operations.

  • Google Security Operations. Google Security Operations retains and analyzes the logs from Google Workspace.

An ingestion label identifies the parser which normalizes raw log data to structured UDM format. The information in this document applies to Google Workspace parsers with the following ingestion labels:

  • WORKSPACE_ACTIVITY
  • WORKSPACE_ALERTS
  • WORKSPACE_CHROMEOS
  • WORKSPACE_GROUPS
  • WORKSPACE_MOBILE
  • WORKSPACE_PRIVILEGES
  • WORKSPACE_USERS

Before you begin

Ensure that you have the following prerequisites:

  • Google Workspace Business Standard or Business Plus edition; the Google Workspace parser supports both of these editions. For more information, see Set up Google Workspace.

  • Google Workspace Administrator account. For more information, see Set up a Google Workspace administrator account.

  • Enable the following APIs in your Google Cloud project:

  • To authenticate Google Workspace APIs, create a service account in your Google Cloud project and take a note of the unique numeric ID and email address of the service account. For more information about creating a service account, see Creating and managing service accounts.

  • Create a user that impersonates the service account, and then grant privileges to the user:

    1. Sign in to Google Admin console.
    2. Select Directory > Users and then click Add new user.
    3. Enter the user details.
    4. Click Add new user.
    5. Click the newly created user link, and then Admin roles and privileges.
    6. Click Expand less.
    7. Click Create custom role.
    8. Click the Create new role and give this role a name.
    9. Grant the following privileges to the role:
      • Privileges > Reports
      • Privileges > Services > Alert Center > Full Access > View access
      • Privileges > Services > Mobile Device Management > Manage Devices and Settings
      • Privileges > Services > Chrome Management > Settings
      • Admin API > Privileges > Users > Read
      • Admin API > Privileges > Groups > Read
    10. Click Continue, and then Create role.
    11. Click Assign users.
    12. Select the user to assign the role.
    13. Click Assign role.

  • The created user has the Super Admin role. For more information, see How to assign a Super Admin role.

  • Create access credentials. For more information about creating access credentials, see Create a service account key.

  • Set up domain-wide delegation for the service account to access data with the following scopes:

    • https://www.googleapis.com/auth/admin.reports.audit.readonly
    • https://www.googleapis.com/auth/apps.alerts
    • https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly
    • https://www.googleapis.com/auth/admin.directory.group.readonly
    • https://www.googleapis.com/auth/admin.directory.device.mobile.readonly
    • https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly
    • https://www.googleapis.com/auth/admin.directory.user.readonly

  • To locate the Google Workspace customer ID, in the Google Admin console, select Account > Account Settings > Profile.

  • All systems in the deployment architecture are configured in the UTC time zone.

  • Verify the log types that the Google Security Operations parser supports. For information about supported Google Workspace logs, see Supported Google Workspace log types.

Set up feeds

There are two different entry points to set up feeds in the Google SecOps platform:

  • SIEM Settings > Feeds > Add New Feed
  • Content Hub > Content Packs > Get Started

How to set up the Workspace Activity feed

To configure this log type, follow these steps:

  1. Click the Google Workspace pack.
  2. Locate the Workspace Activities log type.

  3. Specify values for the following fields:

    • Source Type: Third Party API
    • OAuth JWT endpoint: contains the OAuth JSON Web Token. Specify the token_uri value from the service account JSON key.
    • JWT claims issuer: client ID. Specify the client_email value from the service account JSON key. For example, InsertServiceAccount@project.iam.gserviceaccount.com
    • JWT claims subject: email address of the user that you created in the Google Workspace Admin console.
    • JWT claims audience: token_uri value from the service account JSON key.
    • RSA private key: key in PEM format. The PEM key is available in the service account key file. When you enter the private key, include the BEGIN PRIVATE KEY header and the END PRIVATE KEY footer in the text box.
    • Customer ID: for all log types, except the Alerts log type, the customer ID field requires a leading 'C' character. If the customer ID field does not contain a leading 'C' character, then prepend what the value with a 'C' character.
    • Applications: required only when you create a feed for Workspace Activities.

    Advanced options

    • Feed Name: A prepopulated value that identifies the feed.
    • Asset Namespace: Namespace associated with the feed.
    • Ingestion Labels: Labels applied to all events from this feed.

  4. Click Create feed

For more information about configuring multiple feeds for different log types within this product family, see Configure feeds by product.

For more information about Google Security Operations feeds, see Google Security Operations feeds documentation. For information about requirements for each feed type, see Feed configuration by type.

Supported Google Workspace log types

The following sections list the log types that the Google Workspace parser supports:

WORKSPACE_ACTIVITY

Refer to the Workspace Activity applications and event names.

For more information about the Google Workspace applications that Google Security Operations supports, see Google Workspace applications.

WORKSPACE_ALERTS

The following is the list of supported alert types:

  • Customer takeout initiated
  • Malware reclassification
  • Misconfigured whitelist
  • Phishing reclassification
  • Suspicious message reported
  • User reported phishing
  • User reported spam spike
  • Leaked password
  • Suspicious login
  • Suspicious login (less secure app)
  • Suspicious programmatic login
  • User suspended
  • User suspended (spam)
  • User suspended (spam through relay)
  • User suspended (suspicious activity)
  • Google Operations
  • Configuration problem
  • Government attack warning
  • Device compromised
  • Suspicious activity
  • AppMaker Default Cloud SQL setup
  • Activity Rule
  • Data Loss Prevention
  • Apps outage
  • Primary admin changed
  • SSO profile added
  • SSO profile updated
  • SSO profile deleted
  • Super admin password reset
  • APNS certificate is expiring soon
  • APNS certificate has expired

WORKSPACE_CHROMEOS

For information about the supported ChromeOS log schema, see ChromeOS devices.

WORKSPACE_GROUPS

For information about the supported groups log schema, see group.

WORKSPACE_MOBILE

For information about the supported mobile log schema, see mobile.

WORKSPACE_PRIVILEGES

For information about the supported privileges log schema, see privilege.

WORKSPACE_USERS

For information about the supported users log schema, see users.

Supported Google Workspace log formats

The Google Workspace parser supports logs in JSON format.

Supported Google Workspace sample logs

  • Supported WORKSPACE_ACTIVITY sample logs

    • JSON
    {
  "kind": "admin#reports#activity",
  "id": {
    "time": "2021-10-03T12:42:42.020Z",
    "uniqueQualifier": "1654049432447411495",
    "applicationName": "data_studio",
    "customerId": "dummycustomerid"
  },
  "etag": "\\"JCPRxFaiNR1s5TJ6ecIH8OpGdY4efiOYXbIB65itOzY/Zk_h3ikUIFND0y87A64RQpJm58s\\"",
  "actor": {
    "callerType": "USER",
    "email": "dummy.user@xyz.com",
    "profileId": "106217923299022556308"
  },
  "ipAddress": "198.51.100.0",
  "events": [
    {
      "type": "ACCESS",
      "name": "CREATE",
      "parameters": [
        {
          "name": "ASSET_ID",
          "value": "52605549-b378-4a08-8a34-a23c8412a952"
        },
        {
          "name": "ASSET_NAME",
          "value": "Flashpoint - Sheet1"
        },
        {
          "name": "ASSET_TYPE",
          "value": "DATA_SOURCE"
        },
        {
          "name": "OWNER_EMAIL",
          "value": "dummy.user@xyz.com"
        },
        {
          "name": "VISIBILITY",
          "value": "PRIVATE"
        },
        {
          "name": "CONNECTOR_TYPE",
          "value": "Google Sheets"
        },
        {
          "name": "EMBEDDED_IN_REPORT_ID",
          "value": "d4dec8a5-9d81-4c58-8a6d-5e53ee4d10b3"
        }
      ]
    }
  ]
}

  • Supported WORKSPACE_ALERTS sample logs

    • JSON
    {
  "customerId": "dummycustomerid",
  "alertId": "8d647731-d2f8-4328-b48f-f753f42462bb",
  "createTime": "2021-10-03T07:45:09.500919Z",
  "startTime": "2021-10-03T05:47:59.592561Z",
  "endTime": "2022-10-03T07:29:26.205542Z",
  "type": "Phishing reclassification",
  "source": "Gmail phishing",
  "data": {
    "@type": "type.googleapis.com/google.apps.alertcenter.type.MailPhishing",
    "domainId": {
      "customerPrimaryDomain": "dummy.com"
    },
    "maliciousEntity": {
      "fromHeader": "dummy_noreply@xyz.com"
    },
    "messages": [
      {
        "messageId": "dummy_message_id",
        "md5HashMessageBody": "ecfb410a04167c7dc5e046f755446a88",
        "md5HashSubject": "1fbdd83c4f8d76482a1670b05c6ec5d9",
        "attachmentsSha256Hash": [
          "dba5166ad9db9ba648c1032ebbd34dcd0d085b50023b839ef5c68ca1db93a563",
          "c412fbec3dfff3b080b2ac918acc4d78b4c43bfa14a1aa5b8a8c684a2a0a7591"
        ],
        "recipient": "abc@xyz.com",
        "date": "2022-10-03T05:47:59.592561Z"
      }
    ],
    "systemActionType": "REMOVED_FROM_INBOX"
  },
  "metadata": {
    "customerId": "dummycustomerid",
    "alertId": "8d647731-d2f8-4328-b48f-f753f42462bb",
    "status": "NOT_STARTED",
    "updateTime": "2022-10-03T07:45:09.500919Z",
    "severity": "MEDIUM",
    "etag": "5o4FwC15S_k="
  },
  "updateTime": "2022-10-03T07:45:09.500919Z",
  "etag": "5o4FwC15S_k="
}

  • Supported WORKSPACE_CHROMEOS sample logs

    • JSON
    {
  "kind": "admin#directory#chromeosdevice",
  "etag": "\\"occ7bTD-Q2yefKPIae3LMOtCT9xQVZYBzlAbHU5b86Q/1sxLKg0cwMsajkfUCDMjixGR8f4\\"",
  "deviceId": "deviceId",
  "serialNumber": "8B17G066JL",
  "status": "DEPROVISIONED",
  "lastSync": "2020-02-18T00:26:57.326Z",
  "annotatedUser": "",
  "model": "Google Pixelbook",
  "osVersion": "79.0.3945.123",
  "platformVersion": "12607.82.0 (Official Build) stable-channel eve",
  "firmwareVersion": "Google_Eve.9584.195.0",
  "macAddress": "b4692118c676",
  "bootMode": "Verified",
  "lastEnrollmentTime": "2020-02-17T05:28:08.264Z",
  "orgUnitPath": "/Kiosks",
  "recentUsers": [
    {
      "type": "USER_TYPE_MANAGED",
      "email": "user@dummy.com"
    }
  ],
  "ethernetMacAddress": "ethernetMacAddress",
  "activeTimeRanges": [
    {
      "date": "2020-02-03",
      "activeTime": 18760877
    },
    {
      "date": "2020-02-04",
      "activeTime": 21540238
    },
    {
      "date": "2020-02-05",
      "activeTime": 19920286
    },
    {
      "date": "2020-02-06",
      "activeTime": 16530212
    },
    {
      "date": "2020-02-07",
      "activeTime": 18012134
    },
    {
      "date": "2020-02-10",
      "activeTime": 9930058
    },
    {
      "date": "2020-02-11",
      "activeTime": 270002
    },
    {
      "date": "2020-02-12",
      "activeTime": 270003
    },
    {
      "date": "2020-02-14",
      "activeTime": 540005
    },
    {
      "date": "2020-02-17",
      "activeTime": 330006
    },
    {
      "date": "2020-02-18",
      "activeTime": 120002
    }
  ],
  "tpmVersionInfo": {
    "family": "322e3000",
    "specLevel": "74",
    "manufacturer": "43524f53",
    "tpmModel": "1",
    "firmwareVersion": "aa1dd980d1631ea",
    "vendorSpecific": "784347206654504D"
  },
  "systemRamTotal": "16695300096",
  "diskVolumeReports": [
    {
      "volumeInfo": [
        {
          "volumeId": "/home/chronos/u-1c8d83ca2fe7d986667dc2669affb8260fd4e605/MyFiles",
          "storageTotal": "494383112192",
          "storageFree": "466741694464"
        },
        {
          "volumeId": "/media/archive",
          "storageTotal": "8347648000",
          "storageFree": "8347648000"
        },
        {
          "volumeId": "/usr/share/oem",
          "storageTotal": "12042240",
          "storageFree": "11681792"
        },
        {
          "volumeId": "/media/removable",
          "storageTotal": "8347648000",
          "storageFree": "8347648000"
        }
      ]
    }
  ],
  "lastKnownNetwork": [
    {
      "ipAddress": "198.51.100.0",
      "wanIpAddress": "198.51.100.1"
    }
  ],
  "autoUpdateExpiration": "1719730800000"
}

  • Supported WORKSPACE_GROUPS sample logs

    • JSON
    {
  "kind": "admin#directory#group",
  "id": "01mrcu093wh92ak",
  "etag": "\\"JCPRxFaiNR1s5TJ6ecIH8OpGdY4efiOYXbIB65itOzY/h8Qlm2adIy9p4D4KAM9kAGcpAWw\\"",
  "email": "test.user@domain.com",
  "name": "RH",
  "directMembersCount": "1",
  "description": "",
  "adminCreated": true,
  "nonEditableAliases": [
    "test@nimble.io.test-google-a.com"
  ]
}

  • Supported WORKSPACE_MOBILE sample logs

    • JSON
    {
  "kind": "admin#reports#activity",
  "id": {
    "time": "2021-10-03T12:42:42.020Z",
    "uniqueQualifier": "1654049432447411495",
    "applicationName": "data_studio",
    "customerId": "C02umwv6u"
  },
  "etag": "\\"JCPRxFaiNR1s5TJ6ecIH8OpGdY4efiOYXbIB65itOzY/Zk_h3ikUIFND0y87A64RQpJm58s\\"",
  "actor": {
    "callerType": "USER",
    "email": "dummy.user@xyz.com",
    "profileId": "106217923299022556308"
  },
  "ipAddress": "198.51.100.0",
  "events": [
    {
      "type": "ACCESS",
      "name": "CREATE",
      "parameters": [
        {
          "name": "ASSET_ID",
          "value": "52605549-b378-4a08-8a34-a23c8412a952"
        },
        {
          "name": "ASSET_NAME",
          "value": "Flashpoint - Sheet1"
        },
        {
          "name": "ASSET_TYPE",
          "value": "DATA_SOURCE"
        },
        {
          "name": "OWNER_EMAIL",
          "value": "dummy.user@xyz.com"
        },
        {
          "name": "VISIBILITY",
          "value": "PRIVATE"
        },
        {
          "name": "CONNECTOR_TYPE",
          "value": "Google Sheets"
        },
        {
          "name": "EMBEDDED_IN_REPORT_ID",
          "value": "d4dec8a5-9d81-4c58-8a6d-5e53ee4d10b3"
        }
      ]
    }
  ]
}

  • Supported WORKSPACE_PRIVILEGES sample logs

    • JSON
    {
  "userId": "115789998599383404219",
  "roleAssignments": [
    {
      "roleAssignmentId": "13801188331880513",
      "roleId": "13801188331880500",
      "assignedTo": "115789998599383404219",
      "scopeType": "CUSTOMER",
      "roleDetails": {
        "roleId": "13801188331880500",
        "roleName": "testadmin",
        "roleDescription": "",
        "rolePrivileges": [
          {
            "privilegeName": "USERS_DELETE_PRIVILEGE_GROUP",
            "serviceId": "serviceId",
            "details": null
          },
          {
            "privilegeName": "USERS_SUSPEND",
            "serviceId": "00haapch16h1ysv",
            "details": null
          },
          {
            "privilegeName": "USERS_UPDATE",
            "serviceId": "00haapch16h1ysv",
            "details": null
          },
          {
            "privilegeName": "USERS_ALL",
            "serviceId": "00haapch16h1ysv",
            "details": {
              "kind": "admin#directory#privilege",
              "etag": "\\"JCPRxFaiNR1s5TJ6ecIH8OpGdY4efiOYXbIB65itOzY/wBCzWwKeC3waKUCE3yZ20yDyw-4\\"",
              "serviceId": "00haapch16h1ysv",
              "serviceName": "admin_apis",
              "privilegeName": "USERS_ALL",
              "isOuScopable": true,
              "childPrivileges": [
                {
                  "kind": "admin#directory#privilege",
                  "etag": "\\"JCPRxFaiNR1s5TJ6ecIH8OpGdY4efiOYXbIB65itOzY/_EwUpbUxOWRchDOLthCHXSIXfU8\\"",
                  "serviceId": "00haapch16h1ysv",
                  "serviceName": "admin_apis",
                  "privilegeName": "USERS_CREATE_PRIVILEGE_GROUP",
                  "isOuScopable": true
                },
                {
                  "kind": "admin#directory#privilege",
                  "etag": "\\"JCPRxFaiNR1s5TJ6ecIH8OpGdY4efiOYXbIB65itOzY/Gfb1BNFCQYMpoXP5kDFYaAxlRLA\\"",
                  "serviceId": "00haapch16h1ysv",
                  "serviceName": "admin_apis",
                  "privilegeName": "USERS_RETRIEVE_PRIVILEGE_GROUP",
                  "isOuScopable": true
                },
                {
                  "kind": "admin#directory#privilege",
                  "etag": "\\"JCPRxFaiNR1s5TJ6ecIH8OpGdY4efiOYXbIB65itOzY/OWKYOG2T8wp2XN5aN_rph-bSK6U\\"",
                  "serviceId": "00haapch16h1ysv",
                  "serviceName": "admin_apis",
                  "privilegeName": "USERS_UPDATE",
                  "isOuScopable": true,
                  "childPrivileges": [
                    {
                      "kind": "admin#directory#privilege",
                      "etag": "\\"JCPRxFaiNR1s5TJ6ecIH8OpGdY4efiOYXbIB65itOzY/2ftvr43QDvhauQrbWTRZqCQTcCQ\\"",
                      "serviceId": "00haapch16h1ysv",
                      "serviceName": "admin_apis",
                      "privilegeName": "USERS_ALIAS",
                      "isOuScopable": true
                    },
                    {
                      "kind": "admin#directory#privilege",
                      "etag": "\\"JCPRxFaiNR1s5TJ6ecIH8OpGdY4efiOYXbIB65itOzY/zPWWFJF3OJ4WitnItfmCG0D7lyA\\"",
                      "serviceId": "00haapch16h1ysv",
                      "serviceName": "admin_apis",
                      "privilegeName": "USERS_MOVE",
                      "isOuScopable": true
                    },
                    {
                      "kind": "admin#directory#privilege",
                      "etag": "\\"JCPRxFaiNR1s5TJ6ecIH8OpGdY4efiOYXbIB65itOzY/GZlngzILW5ViYA8VleovaIvbkbE\\"",
                      "serviceId": "00haapch16h1ysv",
                      "serviceName": "admin_apis",
                      "privilegeName": "USERS_RESET_PASSWORD",
                      "isOuScopable": true
                    },
                    {
                      "kind": "admin#directory#privilege",
                      "etag": "\\"JCPRxFaiNR1s5TJ6ecIH8OpGdY4efiOYXbIB65itOzY/LMEMNnXTsYvl3S-g6HYBXgU25-Q\\"",
                      "serviceId": "00haapch16h1ysv",
                      "serviceName": "admin_apis",
                      "privilegeName": "USERS_FORCE_PASSWORD_CHANGE",
                      "isOuScopable": true
                    },
                    {
                      "kind": "admin#directory#privilege",
                      "etag": "\\"JCPRxFaiNR1s5TJ6ecIH8OpGdY4efiOYXbIB65itOzY/rL_F59Vg8sWQOcsHHWJ8Wwm0yhc\\"",
                      "serviceId": "00haapch16h1ysv",
                      "serviceName": "admin_apis",
                      "privilegeName": "USERS_ADD_NICKNAME",
                      "isOuScopable": true
                    },
                    {
                      "kind": "admin#directory#privilege",
                      "etag": "\\"JCPRxFaiNR1s5TJ6ecIH8OpGdY4efiOYXbIB65itOzY/C1v3E2d3y7R8I52p_YoJbxD1328\\"",
                      "serviceId": "00haapch16h1ysv",
                      "serviceName": "admin_apis",
                      "privilegeName": "USERS_SUSPEND",
                      "isOuScopable": true
                    }
                  ]
                },
                {
                  "kind": "admin#directory#privilege",
                  "etag": "\\"JCPRxFaiNR1s5TJ6ecIH8OpGdY4efiOYXbIB65itOzY/MUKzUOa37XWIpUoKXfKRt55cYHQ\\"",
                  "serviceId": "00haapch16h1ysv",
                  "serviceName": "admin_apis",
                  "privilegeName": "USERS_UPDATE_CUSTOM_ATTRIBUTES_USER_PRIVILEGE_GROUP",
                  "isOuScopable": true
                },
                {
                  "kind": "admin#directory#privilege",
                  "etag": "\\"JCPRxFaiNR1s5TJ6ecIH8OpGdY4efiOYXbIB65itOzY/VrPNeHSLlnDFNuekbj7FihGGXds\\"",
                  "serviceId": "00haapch16h1ysv",
                  "serviceName": "admin_apis",
                  "privilegeName": "USERS_DELETE_PRIVILEGE_GROUP",
                  "isOuScopable": true
                }
              ]
            }
          },
          {
            "privilegeName": "USERS_ALIAS",
            "serviceId": "00haapch16h1ysv",
            "details": null
          },
          {
            "privilegeName": "USERS_MOVE",
            "serviceId": "00haapch16h1ysv",
            "details": null
          },
          {
            "privilegeName": "USERS_FORCE_PASSWORD_CHANGE",
            "serviceId": "00haapch16h1ysv",
            "details": null
          },
          {
            "privilegeName": "USERS_CREATE_PRIVILEGE_GROUP",
            "serviceId": "00haapch16h1ysv",
            "details": null
          },
          {
            "privilegeName": "USERS_RESET_PASSWORD",
            "serviceId": "00haapch16h1ysv",
            "details": null
          },
          {
            "privilegeName": "USERS_RETRIEVE_PRIVILEGE_GROUP",
            "serviceId": "00haapch16h1ysv",
            "details": null
          },
          {
            "privilegeName": "USERS_UPDATE_CUSTOM_ATTRIBUTES_USER_PRIVILEGE_GROUP",
            "serviceId": "00haapch16h1ysv",
            "details": null
          },
          {
            "privilegeName": "USERS_ADD_NICKNAME",
            "serviceId": "00haapch16h1ysv",
            "details": null
          },
          {
            "privilegeName": "ORGANIZATION_UNITS_RETRIEVE",
            "serviceId": "00haapch16h1ysv",
            "details": null
          }
        ],
        "isSystemRole": false
      }
    }
  ]
}

  • Supported WORKSPACE_USERS sample logs

    • JSON
    {
  "kind": "admin#directory#user",
  "id": "102585217528814888330",
  "etag": "\\"JCPRxFaiNR1s5TJ6ecIH8OpGdY4efiOYXbIB65itOzY/Fvq8oDDWIwwaXS2j2yA3Stqn6mg\\"",
  "primaryEmail": "dummy@domain.io",
  "name": {
    "givenName": "dummyName",
    "familyName": "dummyFamilyName",
    "fullName": "dummy Shah"
  },
  "isAdmin": true,
  "isDelegatedAdmin": false,
  "lastLoginTime": "2022-08-13T02:04:12.000Z",
  "creationTime": "2017-05-19T01:44:55.000Z",
  "agreedToTerms": true,
  "suspended": false,
  "archived": false,
  "changePasswordAtNextLogin": false,
  "ipWhitelisted": false,
  "emails": [
    {
      "address": "dummy@domain.oi",
      "primary": true
    },
    {
      "address": "dummy@domain.oi.tast-goggle-a.com"
    }
  ],
  "languages": [
    {
      "languageCode": "en",
      "preference": "preferred"
    }
  ],
  "nonEditableAliases": [
    "dummy@domain.oi.tast-goggle-a.com"
  ],
  "customerId": "C03puekhd",
  "orgUnitPath": "/",
  "isMailboxSetup": true,
  "isEnrolledIn2Sv": false,
  "isEnforcedIn2Sv": false,
  "includeInGlobalAddressList": true,
  "recoveryEmail": "test@xyz.com",
  "recoveryPhone": "+919879995533"
}

Field mapping reference

The following sections explain how the Google Security Operations parser maps Google Workspace log fields to Google Security Operations Unified Data Model (UDM) fields. The field mappings of this parser remain the same for feed-based ingestion and native ingestion.

Field mapping reference: WORKSPACE_ACTIVITY log types to UDM event type

The following table lists the WORKSPACE_ACTIVITY event names and their corresponding UDM event types.

Application Name Event Type Event Name UDM Event Type
access_transparency GSUITE_RESOURCE ACCESS USER_RESOURCE_ACCESS
admin APPLICATION_SETTINGS CHANGE_APPLICATION_SETTING SETTING_MODIFICATION
admin APPLICATION_SETTINGS CREATE_APPLICATION_SETTING SETTING_CREATION
admin APPLICATION_SETTINGS DELETE_APPLICATION_SETTING SETTING_MODIFICATION
admin APPLICATION_SETTINGS REORDER_GROUP_BASED_POLICIES_EVENT SETTING_MODIFICATION
admin APPLICATION_SETTINGS GPLUS_PREMIUM_FEATURES SETTING_MODIFICATION
admin APPLICATION_SETTINGS CREATE_MANAGED_CONFIGURATION SETTING_CREATION
admin APPLICATION_SETTINGS DELETE_MANAGED_CONFIGURATION SETTING_DELETION
admin APPLICATION_SETTINGS UPDATE_MANAGED_CONFIGURATION SETTING_MODIFICATION
admin APPLICATION_SETTINGS FLASHLIGHT_EDU_NON_FEATURED_SERVICES_SELECTED SETTING_MODIFICATION
admin APPLICATION_SETTINGS UPDATE_SMART_FEATURES SETTING_MODIFICATION
admin CALENDAR_SETTINGS CREATE_BUILDING RESOURCE_CREATION
admin CALENDAR_SETTINGS DELETE_BUILDING RESOURCE_DELETION
admin CALENDAR_SETTINGS UPDATE_BUILDING RESOURCE_WRITTEN
admin CALENDAR_SETTINGS EWS_IN_NEW_CREDENTIALS_GENERATED USER_UNCATEGORIZED
admin CALENDAR_SETTINGS EWS_OUT_ENDPOINT_CONFIGURATION_RESET GENERIC_EVENT
admin CALENDAR_SETTINGS EWS_OUT_ENDPOINT_CONFIGURATION_CHANGED SETTING_MODIFICATION
admin CALENDAR_SETTINGS CREATE_CALENDAR_RESOURCE RESOURCE_CREATION
admin CALENDAR_SETTINGS DELETE_CALENDAR_RESOURCE RESOURCE_DELETION
admin CALENDAR_SETTINGS CREATE_CALENDAR_RESOURCE_FEATURE RESOURCE_CREATION
admin CALENDAR_SETTINGS DELETE_CALENDAR_RESOURCE_FEATURE RESOURCE_DELETION
admin CALENDAR_SETTINGS UPDATE_CALENDAR_RESOURCE_FEATURE RESOURCE_WRITTEN
admin CALENDAR_SETTINGS RENAME_CALENDAR_RESOURCE RESOURCE_WRITTEN
admin CALENDAR_SETTINGS UPDATE_CALENDAR_RESOURCE RESOURCE_WRITTEN
admin CALENDAR_SETTINGS CHANGE_CALENDAR_SETTING SETTING_MODIFICATION
admin CALENDAR_SETTINGS CANCEL_CALENDAR_EVENTS GENERIC_EVENT
admin CALENDAR_SETTINGS RELEASE_CALENDAR_RESOURCES GENERIC_EVENT
admin CHAT_SETTINGS MEET_INTEROP_CREATE_GATEWAY RESOURCE_CREATION
admin CHAT_SETTINGS MEET_INTEROP_DELETE_GATEWAY RESOURCE_DELETION
admin CHAT_SETTINGS MEET_INTEROP_MODIFY_GATEWAY RESOURCE_WRITTEN
admin CHAT_SETTINGS CHANGE_CHAT_SETTING SETTING_MODIFICATION
admin CHROME_OS_SETTINGS CHANGE_CHROME_OS_ANDROID_APPLICATION_SETTING SETTING_MODIFICATION
admin CHROME_OS_SETTINGS CHANGE_DEVICE_STATE STATUS_UPDATE
admin CHROME_OS_SETTINGS CHANGE_DEVICE_UPGRADE DEVICE_CONFIG_UPDATE
admin CHROME_OS_SETTINGS CHANGE_CHROME_OS_APPLICATION_SETTING SETTING_MODIFICATION
admin CHROME_OS_SETTINGS SEND_CHROME_OS_DEVICE_COMMAND GENERIC_EVENT
admin CHROME_OS_SETTINGS CHANGE_CHROME_OS_DEVICE_ANNOTATION SETTING_MODIFICATION
admin CHROME_OS_SETTINGS CHANGE_CHROME_OS_DEVICE_SETTING SETTING_MODIFICATION
admin CHROME_OS_SETTINGS CHANGE_CHROME_OS_DEVICE_STATE DEVICE_CONFIG_UPDATE
admin CHROME_OS_SETTINGS CHANGE_CHROME_OS_PUBLIC_SESSION_SETTING SETTING_MODIFICATION
admin CHROME_OS_SETTINGS INSERT_CHROME_OS_PRINT_SERVER RESOURCE_CREATION
admin CHROME_OS_SETTINGS DELETE_CHROME_OS_PRINT_SERVER RESOURCE_DELETION
admin CHROME_OS_SETTINGS UPDATE_CHROME_OS_PRINT_SERVER RESOURCE_WRITTEN
admin CHROME_OS_SETTINGS INSERT_CHROME_OS_PRINTER RESOURCE_CREATION
admin CHROME_OS_SETTINGS DELETE_CHROME_OS_PRINTER RESOURCE_DELETION
admin CHROME_OS_SETTINGS UPDATE_CHROME_OS_PRINTER RESOURCE_WRITTEN
admin CHROME_OS_SETTINGS CHANGE_CHROME_OS_SETTING SETTING_MODIFICATION
admin CHROME_OS_SETTINGS CHANGE_CHROME_OS_USER_SETTING SETTING_MODIFICATION
admin CHROME_OS_SETTINGS CREATE_CHROME_OS_ENROLLMENT_TOKEN GENERIC_EVENT
admin CHROME_OS_SETTINGS CHANGE_CHROME_OS_CUSTOM_CONFIGURATIONS_JSON_SETTING SETTING_MODIFICATION
admin CHROME_OS_SETTINGS DELETE_CHROME_OS_DEVICE DEVICE_CONFIG_UPDATE
admin CHROME_OS_SETTINGS DELETE_DUPLICATE_CHROME_OS_DEVICE DEVICE_CONFIG_UPDATE
admin CHROME_OS_SETTINGS CHANGE_CHROME_OS_ISOLATED_WEB_APPLICATION_SETTING SETTING_MODIFICATION
admin CHROME_OS_SETTINGS ISSUE_DEVICE_COMMAND GENERIC_EVENT
admin CHROME_OS_SETTINGS MOVE_DEVICE_TO_ORG_UNIT_DETAILED DEVICE_CONFIG_UPDATE
admin CHROME_OS_SETTINGS PRE_PROVISION_CHROME_OS_DEVICE DEVICE_CONFIG_UPDATE
admin CHROME_OS_SETTINGS REMOVE_CHROME_OS_APPLICATION_SETTING SETTING_DELETION
admin CHROME_OS_SETTINGS REMOVE_CHROME_OS_APPLICATION_SETTINGS SETTING_DELETION
admin CHROME_OS_SETTINGS REMOVE_CHROME_OS_WEB_ORIGIN_SETTINGS SETTING_DELETION
admin CHROME_OS_SETTINGS REPAIR_CENTER_DEPROVISION DEVICE_CONFIG_UPDATE
admin CHROME_OS_SETTINGS REVOKE_CHROME_OS_ENROLLMENT_TOKEN GENERIC_EVENT
admin CHROME_OS_SETTINGS UPDATE_DEVICE DEVICE_CONFIG_UPDATE
admin CHROME_OS_SETTINGS CHANGE_CHROME_OS_WEB_APPLICATION_SETTING SETTING_MODIFICATION
admin CHROME_OS_SETTINGS CHANGE_CHROME_OS_WEB_PERMISSION_SETTING SETTING_MODIFICATION
admin CONTACTS_SETTINGS CHANGE_CONTACTS_SETTING SETTING_MODIFICATION
admin DELEGATED_ADMIN_SETTINGS ASSIGN_ROLE USER_CHANGE_PERMISSIONS
admin DELEGATED_ADMIN_SETTINGS CREATE_ROLE USER_RESOURCE_CREATION
admin DELEGATED_ADMIN_SETTINGS DELETE_ROLE RESOURCE_DELETION
admin DELEGATED_ADMIN_SETTINGS ADD_PRIVILEGE USER_RESOURCE_UPDATE_CONTENT
admin DELEGATED_ADMIN_SETTINGS REMOVE_PRIVILEGE USER_RESOURCE_DELETION
admin DELEGATED_ADMIN_SETTINGS RENAME_ROLE RESOURCE_WRITTEN
admin DELEGATED_ADMIN_SETTINGS UPDATE_ROLE RESOURCE_WRITTEN
admin DELEGATED_ADMIN_SETTINGS UNASSIGN_ROLE USER_CHANGE_PERMISSIONS
admin DOCS_SETTINGS TRANSFER_DOCUMENT_OWNERSHIP USER_RESOURCE_UPDATE_PERMISSIONS
admin DOCS_SETTINGS DOCS_ORG_BRANDING_PROVISIONING STATUS_UPDATE
admin DOCS_SETTINGS DOCS_ORG_BRANDING_UPLOAD RESOURCE_WRITTEN
admin DOCS_SETTINGS DRIVE_DATA_RESTORE RESOURCE_CREATION
admin DOCS_SETTINGS CHANGE_DOCS_SETTING SETTING_MODIFICATION
admin DOCS_SETTINGS MOVE_SHARED_DRIVE_TO_ORG_UNIT USER_RESOURCE_UPDATE_PERMISSIONS
admin DOMAIN_SETTINGS CHANGE_ACCOUNT_AUTO_RENEWAL SETTING_MODIFICATION
admin DOMAIN_SETTINGS ADD_APPLICATION USER_RESOURCE_CREATION
admin DOMAIN_SETTINGS ADD_APPLICATION_TO_WHITELIST RESOURCE_PERMISSIONS_CHANGE
admin DOMAIN_SETTINGS CHANGE_ADVERTISEMENT_OPTION SETTING_MODIFICATION
admin DOMAIN_SETTINGS CREATE_ALERT SETTING_CREATION
admin DOMAIN_SETTINGS CHANGE_ALERT_CRITERIA USER_RESOURCE_UPDATE_CONTENT
admin DOMAIN_SETTINGS DELETE_ALERT USER_RESOURCE_DELETION
admin DOMAIN_SETTINGS ALERT_RECEIVERS_CHANGED USER_RESOURCE_UPDATE_PERMISSIONS
admin DOMAIN_SETTINGS RENAME_ALERT USER_RESOURCE_UPDATE_CONTENT
admin DOMAIN_SETTINGS ALERT_STATUS_CHANGED SETTING_MODIFICATION
admin DOMAIN_SETTINGS ADD_DOMAIN_ALIAS STATUS_UPDATE
admin DOMAIN_SETTINGS REMOVE_DOMAIN_ALIAS STATUS_UPDATE
admin DOMAIN_SETTINGS SKIP_DOMAIN_ALIAS_MX STATUS_UPDATE
admin DOMAIN_SETTINGS VERIFY_DOMAIN_ALIAS_MX STATUS_UPDATE
admin DOMAIN_SETTINGS VERIFY_DOMAIN_ALIAS STATUS_UPDATE
admin DOMAIN_SETTINGS TOGGLE_OAUTH_ACCESS_TO_ALL_APIS SETTING_MODIFICATION
admin DOMAIN_SETTINGS TOGGLE_ALLOW_ADMIN_PASSWORD_RESET SETTING_MODIFICATION
admin DOMAIN_SETTINGS ENABLE_API_ACCESS SETTING_MODIFICATION
admin DOMAIN_SETTINGS AUTHORIZE_API_CLIENT_ACCESS SETTING_CREATION
admin DOMAIN_SETTINGS REMOVE_API_CLIENT_ACCESS SETTING_DELETION
admin DOMAIN_SETTINGS CHROME_LICENSES_REDEEMED SETTING_MODIFICATION
admin DOMAIN_SETTINGS TOGGLE_AUTO_ADD_NEW_SERVICE SETTING_MODIFICATION
admin DOMAIN_SETTINGS CHANGE_PRIMARY_DOMAIN SETTING_MODIFICATION
admin DOMAIN_SETTINGS CHANGE_WHITELIST_SETTING SETTING_MODIFICATION
admin DOMAIN_SETTINGS COMMUNICATION_PREFERENCES_SETTING_CHANGE SETTING_MODIFICATION
admin DOMAIN_SETTINGS CHANGE_CONFLICT_ACCOUNT_ACTION SETTING_MODIFICATION
admin DOMAIN_SETTINGS CHANGE_CONFLICT_ACCOUNTS_MANAGEMENT_SETTINGS SETTING_MODIFICATION
admin DOMAIN_SETTINGS ENABLE_FEEDBACK_SOLICITATION SETTING_MODIFICATION
admin DOMAIN_SETTINGS TOGGLE_CONTACT_SHARING SETTING_MODIFICATION
admin DOMAIN_SETTINGS CREATE_PLAY_FOR_WORK_TOKEN USER_RESOURCE_CREATION
admin DOMAIN_SETTINGS TOGGLE_USE_CUSTOM_LOGO SETTING_MODIFICATION
admin DOMAIN_SETTINGS CHANGE_CUSTOM_LOGO STATUS_UPDATE
admin DOMAIN_SETTINGS CHANGE_DATA_LOCALIZATION_FOR_RUSSIA SETTING_MODIFICATION
admin DOMAIN_SETTINGS CHANGE_DATA_LOCALIZATION_SETTING SETTING_MODIFICATION
admin DOMAIN_SETTINGS CHANGE_DATA_PROTECTION_OFFICER_CONTACT_INFO USER_UNCATEGORIZED
admin DOMAIN_SETTINGS DELETE_PLAY_FOR_WORK_TOKEN USER_RESOURCE_DELETION
admin DOMAIN_SETTINGS VIEW_DNS_LOGIN_DETAILS RESOURCE_READ
admin DOMAIN_SETTINGS CHANGE_DOMAIN_DEFAULT_LOCALE SETTING_MODIFICATION
admin DOMAIN_SETTINGS CHANGE_DOMAIN_DEFAULT_TIMEZONE SETTING_MODIFICATION
admin DOMAIN_SETTINGS CHANGE_DOMAIN_NAME SETTING_MODIFICATION
admin DOMAIN_SETTINGS TOGGLE_ENABLE_PRE_RELEASE_FEATURES SETTING_MODIFICATION
admin DOMAIN_SETTINGS CHANGE_DOMAIN_SUPPORT_MESSAGE SETTING_MODIFICATION
admin DOMAIN_SETTINGS ADD_TRUSTED_DOMAINS SETTING_CREATION
admin DOMAIN_SETTINGS REMOVE_TRUSTED_DOMAINS USER_RESOURCE_DELETION
admin DOMAIN_SETTINGS CHANGE_EDU_TYPE SETTING_MODIFICATION
admin DOMAIN_SETTINGS TOGGLE_ENABLE_OAUTH_CONSUMER_KEY SETTING_MODIFICATION
admin DOMAIN_SETTINGS TOGGLE_SSO_ENABLED SETTING_MODIFICATION
admin DOMAIN_SETTINGS TOGGLE_SSL SETTING_MODIFICATION
admin DOMAIN_SETTINGS CHANGE_EU_REPRESENTATIVE_CONTACT_INFO USER_UNCATEGORIZED
admin DOMAIN_SETTINGS GENERATE_TRANSFER_TOKEN USER_RESOURCE_CREATION
admin DOMAIN_SETTINGS CHANGE_LOGIN_BACKGROUND_COLOR SETTING_MODIFICATION
admin DOMAIN_SETTINGS CHANGE_LOGIN_BORDER_COLOR SETTING_MODIFICATION
admin DOMAIN_SETTINGS CHANGE_LOGIN_ACTIVITY_TRACE SETTING_MODIFICATION
admin DOMAIN_SETTINGS PLAY_FOR_WORK_ENROLL SETTING_MODIFICATION
admin DOMAIN_SETTINGS PLAY_FOR_WORK_UNENROLL SETTING_MODIFICATION
admin DOMAIN_SETTINGS MX_RECORD_VERIFICATION_CLAIM GENERIC_EVENT
admin DOMAIN_SETTINGS TOGGLE_NEW_APP_FEATURES SETTING_MODIFICATION
admin DOMAIN_SETTINGS TOGGLE_USE_NEXT_GEN_CONTROL_PANEL SETTING_MODIFICATION
admin DOMAIN_SETTINGS UPLOAD_OAUTH_CERTIFICATE GENERIC_EVENT
admin DOMAIN_SETTINGS REGENERATE_OAUTH_CONSUMER_SECRET GENERIC_EVENT
admin DOMAIN_SETTINGS TOGGLE_OPEN_ID_ENABLED SETTING_MODIFICATION
admin DOMAIN_SETTINGS CHANGE_ORGANIZATION_NAME SETTING_MODIFICATION
admin DOMAIN_SETTINGS TOGGLE_OUTBOUND_RELAY SETTING_MODIFICATION
admin DOMAIN_SETTINGS CHANGE_PASSWORD_MAX_LENGTH SETTING_MODIFICATION
admin DOMAIN_SETTINGS CHANGE_PASSWORD_MIN_LENGTH SETTING_MODIFICATION
admin DOMAIN_SETTINGS UPDATE_DOMAIN_PRIMARY_ADMIN_EMAIL SETTING_MODIFICATION
admin DOMAIN_SETTINGS ENABLE_SERVICE_OR_FEATURE_NOTIFICATIONS SETTING_MODIFICATION
admin DOMAIN_SETTINGS REMOVE_APPLICATION USER_RESOURCE_DELETION
admin DOMAIN_SETTINGS REMOVE_APPLICATION_FROM_WHITELIST RESOURCE_PERMISSIONS_CHANGE
admin DOMAIN_SETTINGS CHANGE_RENEW_DOMAIN_REGISTRATION SETTING_MODIFICATION
admin DOMAIN_SETTINGS CHANGE_RESELLER_ACCESS SETTING_MODIFICATION
admin DOMAIN_SETTINGS CHANGE_RESELLER_ACCESS_FOR_SKU SETTING_MODIFICATION
admin DOMAIN_SETTINGS RULE_ACTIONS_CHANGED USER_RESOURCE_UPDATE_CONTENT
admin DOMAIN_SETTINGS CREATE_RULE USER_RESOURCE_CREATION
admin DOMAIN_SETTINGS CHANGE_RULE_CRITERIA USER_RESOURCE_UPDATE_CONTENT
admin DOMAIN_SETTINGS DELETE_RULE USER_RESOURCE_DELETION
admin DOMAIN_SETTINGS RENAME_RULE USER_RESOURCE_UPDATE_CONTENT
admin DOMAIN_SETTINGS RULE_STATUS_CHANGED SETTING_MODIFICATION
admin DOMAIN_SETTINGS ADD_SECONDARY_DOMAIN STATUS_UPDATE
admin DOMAIN_SETTINGS REMOVE_SECONDARY_DOMAIN STATUS_UPDATE
admin DOMAIN_SETTINGS SKIP_SECONDARY_DOMAIN_MX STATUS_UPDATE
admin DOMAIN_SETTINGS VERIFY_SECONDARY_DOMAIN_MX STATUS_UPDATE
admin DOMAIN_SETTINGS VERIFY_SECONDARY_DOMAIN STATUS_UPDATE
admin DOMAIN_SETTINGS UPDATE_DOMAIN_SECONDARY_EMAIL SETTING_MODIFICATION
admin DOMAIN_SETTINGS CHANGE_SSO_SETTINGS SETTING_MODIFICATION
admin DOMAIN_SETTINGS GENERATE_PIN GENERIC_EVENT
admin DOMAIN_SETTINGS UPDATE_RULE USER_RESOURCE_UPDATE_CONTENT
admin EMAIL_SETTINGS DROP_FROM_QUARANTINE EMAIL_UNCATEGORIZED
admin EMAIL_SETTINGS EMAIL_LIFE_OF_A_MESSAGE EMAIL_UNCATEGORIZED
admin EMAIL_SETTINGS EMAIL_LOG_SEARCH EMAIL_UNCATEGORIZED
admin EMAIL_SETTINGS EMAIL_UNDELETE EMAIL_UNCATEGORIZED
admin EMAIL_SETTINGS CHANGE_EMAIL_SETTING SETTING_MODIFICATION
admin EMAIL_SETTINGS CHANGE_GMAIL_SETTING SETTING_MODIFICATION
admin EMAIL_SETTINGS CREATE_GMAIL_SETTING SETTING_CREATION
admin EMAIL_SETTINGS DELETE_GMAIL_SETTING SETTING_DELETION
admin EMAIL_SETTINGS REJECT_FROM_QUARANTINE EMAIL_UNCATEGORIZED
admin EMAIL_SETTINGS RELEASE_FROM_QUARANTINE EMAIL_UNCATEGORIZED
admin GROUP_SETTINGS WHITELISTED_GROUPS_UPDATED GROUP_MODIFICATION
admin GROUP_SETTINGS CREATE_GROUP GROUP_CREATION
admin GROUP_SETTINGS DELETE_GROUP GROUP_DELETION
admin GROUP_SETTINGS CHANGE_GROUP_DESCRIPTION GROUP_MODIFICATION
admin GROUP_SETTINGS CHANGE_GROUP_EMAIL GROUP_MODIFICATION
admin GROUP_SETTINGS GROUP_LIST_DOWNLOAD GENERIC_EVENT
admin GROUP_SETTINGS ADD_GROUP_MEMBER GROUP_MODIFICATION
admin GROUP_SETTINGS REMOVE_GROUP_MEMBER GROUP_MODIFICATION
admin GROUP_SETTINGS UPDATE_GROUP_MEMBER GROUP_MODIFICATION
admin GROUP_SETTINGS UPDATE_GROUP_MEMBER_DELIVERY_SETTINGS GROUP_MODIFICATION
admin GROUP_SETTINGS UPDATE_GROUP_MEMBER_DELIVERY_SETTINGS_CAN_EMAIL_OVERRIDE GROUP_MODIFICATION
admin GROUP_SETTINGS GROUP_MEMBER_BULK_UPLOAD USER_UNCATEGORIZED
admin GROUP_SETTINGS GROUP_MEMBERS_DOWNLOAD USER_UNCATEGORIZED
admin GROUP_SETTINGS CHANGE_GROUP_NAME GROUP_MODIFICATION
admin GROUP_SETTINGS CHANGE_GROUP_SETTING GROUP_MODIFICATION
admin LICENSES_SETTINGS CHROME_APP_LICENSES_ENABLED SETTING_MODIFICATION
admin LICENSES_SETTINGS ORG_USERS_LICENSE_ASSIGNMENT SETTING_MODIFICATION
admin LICENSES_SETTINGS ORG_ALL_USERS_LICENSE_ASSIGNMENT SETTING_MODIFICATION
admin LICENSES_SETTINGS SUPPRESSED_LICENSE_ASSIGNMENT USER_CHANGE_PERMISSIONS
admin LICENSES_SETTINGS TEMPORARY_LICENSE_ASSIGNMENT USER_CHANGE_PERMISSIONS
admin LICENSES_SETTINGS USER_LICENSE_ASSIGNMENT USER_CHANGE_PERMISSIONS
admin LICENSES_SETTINGS CHANGE_LICENSE_AUTO_ASSIGN SETTING_MODIFICATION
admin LICENSES_SETTINGS SUPPRESSED_TO_ASSIGNED_LICENSE_CONVERSION USER_CHANGE_PERMISSIONS
admin LICENSES_SETTINGS TEMPORARY_TO_ASSIGNED_LICENSE_CONVERSION USER_CHANGE_PERMISSIONS
admin LICENSES_SETTINGS TEMPORARY_TO_SUPPRESSED_LICENSE_CONVERSION USER_CHANGE_PERMISSIONS
admin LICENSES_SETTINGS FIRST_TEMPORARY_OR_SUPPRESSED_LICENSE_NOTIFICATION STATUS_UPDATE
admin LICENSES_SETTINGS RESELLER_FIRST_TEMPORARY_OR_SUPPRESSED_LICENSE_NOTIFICATION STATUS_UPDATE
admin LICENSES_SETTINGS USER_LICENSE_REASSIGNMENT USER_CHANGE_PERMISSIONS
admin LICENSES_SETTINGS ORG_LICENSE_REVOKE SETTING_MODIFICATION
admin LICENSES_SETTINGS SUPPRESSED_LICENSE_REVOKE USER_CHANGE_PERMISSIONS
admin LICENSES_SETTINGS TEMPORARY_LICENSE_REVOKE USER_CHANGE_PERMISSIONS
admin LICENSES_SETTINGS USER_LICENSE_REVOKE USER_CHANGE_PERMISSIONS
admin LICENSES_SETTINGS TEMPORARY_LICENSES_EXPIRED_NOTIFICATION STATUS_UPDATE
admin LICENSES_SETTINGS RESELLER_TEMPORARY_LICENSES_EXPIRED_NOTIFICATION STATUS_UPDATE
admin LICENSES_SETTINGS UPDATE_DYNAMIC_LICENSE SETTING_MODIFICATION
admin LICENSES_SETTINGS CHROME_APP_USER_LICENSE_ASSIGNED USER_CHANGE_PERMISSIONS
admin LICENSES_SETTINGS CHROME_APP_USER_LICENSE_REVOKED USER_CHANGE_PERMISSIONS
admin MOBILE_SETTINGS ACTION_CANCELLED USER_UNCATEGORIZED
admin MOBILE_SETTINGS ACTION_REQUESTED USER_UNCATEGORIZED
admin MOBILE_SETTINGS ADD_MOBILE_CERTIFICATE SETTING_MODIFICATION
admin MOBILE_SETTINGS APPLE_DEP_SYNC_TRIGGERED STATUS_UPDATE
admin MOBILE_SETTINGS APPLE_DEP_TOKEN_SETUP_COMPLETE STATUS_UPDATE
admin MOBILE_SETTINGS APPLE_VPP_TOKEN_OPERATION STATUS_UPDATE
admin MOBILE_SETTINGS COMPANY_DEVICES_BULK_CREATION STATUS_UPDATE
admin MOBILE_SETTINGS COMPANY_OWNED_DEVICE_BLOCKED SETTING_MODIFICATION
admin MOBILE_SETTINGS COMPANY_DEVICE_DELETION SETTING_MODIFICATION
admin MOBILE_SETTINGS COMPANY_OWNED_DEVICE_UNBLOCKED SETTING_MODIFICATION
admin MOBILE_SETTINGS COMPANY_OWNED_DEVICE_WIPED SETTING_MODIFICATION
admin MOBILE_SETTINGS CUSTOMER_USER_DEVICE_DELETION_EVENT SETTING_MODIFICATION
admin MOBILE_SETTINGS CHANGE_MOBILE_APPLICATION_PERMISSION_GRANT SETTING_MODIFICATION
admin MOBILE_SETTINGS CHANGE_MOBILE_APPLICATION_PRIORITY_ORDER SETTING_MODIFICATION
admin MOBILE_SETTINGS REMOVE_MOBILE_APPLICATION_FROM_WHITELIST RESOURCE_PERMISSIONS_CHANGE
admin MOBILE_SETTINGS CHANGE_MOBILE_APPLICATION_SETTINGS SETTING_MODIFICATION
admin MOBILE_SETTINGS ADD_MOBILE_APPLICATION_TO_WHITELIST RESOURCE_PERMISSIONS_CHANGE
admin MOBILE_SETTINGS MOBILE_DEVICE_APPROVE SETTING_MODIFICATION
admin MOBILE_SETTINGS MOBILE_DEVICE_BLOCK SETTING_MODIFICATION
admin MOBILE_SETTINGS MOBILE_DEVICE_DELETE SETTING_MODIFICATION
admin MOBILE_SETTINGS MOBILE_DEVICE_WIPE SETTING_MODIFICATION
admin MOBILE_SETTINGS CHANGE_MOBILE_SETTING SETTING_MODIFICATION
admin MOBILE_SETTINGS CHANGE_ADMIN_RESTRICTIONS_PIN SETTING_MODIFICATION
admin MOBILE_SETTINGS CHANGE_MOBILE_WIRELESS_NETWORK SETTING_MODIFICATION
admin MOBILE_SETTINGS ADD_MOBILE_WIRELESS_NETWORK SETTING_CREATION
admin MOBILE_SETTINGS REMOVE_MOBILE_WIRELESS_NETWORK SETTING_DELETION
admin MOBILE_SETTINGS CHANGE_MOBILE_WIRELESS_NETWORK_PASSWORD SETTING_MODIFICATION
admin MOBILE_SETTINGS REMOVE_MOBILE_CERTIFICATE SETTING_MODIFICATION
admin MOBILE_SETTINGS ENROLL_FOR_GOOGLE_DEVICE_MANAGEMENT STATUS_UPDATE
admin MOBILE_SETTINGS USE_GOOGLE_MOBILE_MANAGEMENT STATUS_UPDATE
admin MOBILE_SETTINGS USE_GOOGLE_MOBILE_MANAGEMENT_FOR_NON_IOS STATUS_UPDATE
admin MOBILE_SETTINGS USE_GOOGLE_MOBILE_MANAGEMENT_FOR_IOS STATUS_UPDATE
admin MOBILE_SETTINGS MOBILE_ACCOUNT_WIPE SETTING_MODIFICATION
admin MOBILE_SETTINGS MOBILE_DEVICE_CANCEL_WIPE_THEN_APPROVE SETTING_MODIFICATION
admin MOBILE_SETTINGS MOBILE_DEVICE_CANCEL_WIPE_THEN_BLOCK SETTING_MODIFICATION
admin ORG_SETTINGS CHROME_LICENSES_ENABLED SETTING_MODIFICATION
admin ORG_SETTINGS CHROME_APPLICATION_LICENSE_RESERVATION_CREATED SETTING_CREATION
admin ORG_SETTINGS CHROME_APPLICATION_LICENSE_RESERVATION_DELETED SETTING_DELETION
admin ORG_SETTINGS CHROME_APPLICATION_LICENSE_RESERVATION_UPDATED SETTING_MODIFICATION
admin ORG_SETTINGS CREATE_DEVICE_ENROLLMENT_TOKEN STATUS_UPDATE
admin ORG_SETTINGS ASSIGN_CUSTOM_LOGO USER_RESOURCE_UPDATE_CONTENT
admin ORG_SETTINGS UNASSIGN_CUSTOM_LOGO USER_RESOURCE_UPDATE_CONTENT
admin ORG_SETTINGS CREATE_ENROLLMENT_TOKEN STATUS_UPDATE
admin ORG_SETTINGS REVOKE_ENROLLMENT_TOKEN STATUS_UPDATE
admin ORG_SETTINGS CHROME_LICENSES_ALLOWED STATUS_UPDATE
admin ORG_SETTINGS CREATE_ORG_UNIT USER_RESOURCE_CREATION
admin ORG_SETTINGS REMOVE_ORG_UNIT USER_RESOURCE_DELETION
admin ORG_SETTINGS EDIT_ORG_UNIT_DESCRIPTION USER_RESOURCE_UPDATE_CONTENT
admin ORG_SETTINGS MOVE_ORG_UNIT USER_RESOURCE_UPDATE_CONTENT
admin ORG_SETTINGS EDIT_ORG_UNIT_NAME USER_RESOURCE_UPDATE_CONTENT
admin ORG_SETTINGS REVOKE_DEVICE_ENROLLMENT_TOKEN STATUS_UPDATE
admin ORG_SETTINGS TOGGLE_SERVICE_ENABLED SETTING_MODIFICATION
admin SECURITY_SETTINGS CHANGE_CAA_APP_ASSIGNMENTS SETTING_MODIFICATION
admin SECURITY_SETTINGS UNDERAGE_BLOCK_ALL_THIRD_PARTY_API_ACCESS USER_UNCATEGORIZED
admin SECURITY_SETTINGS BLOCK_ALL_THIRD_PARTY_API_ACCESS GENERIC_EVENT
admin SECURITY_SETTINGS UNBLOCK_ALL_THIRD_PARTY_API_ACCESS GENERIC_EVENT
admin SECURITY_SETTINGS ALLOW_STRONG_AUTHENTICATION SETTING_MODIFICATION
admin SECURITY_SETTINGS UNDERAGE_SIGN_IN_ONLY_THIRD_PARTY_API_ACCESS USER_UNCATEGORIZED
admin SECURITY_SETTINGS SIGN_IN_ONLY_THIRD_PARTY_API_ACCESS GENERIC_EVENT
admin SECURITY_SETTINGS ALLOW_SERVICE_FOR_OAUTH2_ACCESS STATUS_UPDATE
admin SECURITY_SETTINGS DISALLOW_SERVICE_FOR_OAUTH2_ACCESS SETTING_MODIFICATION
admin SECURITY_SETTINGS CHANGE_APP_ACCESS_SETTINGS_COLLECTION_ID SETTING_MODIFICATION
admin SECURITY_SETTINGS ADD_TO_BLOCKED_OAUTH2_APPS STATUS_UPDATE
admin SECURITY_SETTINGS ADD_TO_LIMITED_OAUTH2_APPS STATUS_UPDATE
admin SECURITY_SETTINGS ADD_TO_TRUSTED_BY_OAUTH_SCOPE_OAUTH2_APPS STATUS_UPDATE
admin SECURITY_SETTINGS ADD_TO_CAA_EXEMPT_OAUTH2_APPS STATUS_UPDATE
admin SECURITY_SETTINGS REMOVE_FROM_CAA_EXEMPT_OAUTH2_APPS STATUS_UPDATE
admin SECURITY_SETTINGS REMOVE_FROM_TRUSTED_OAUTH2_APPS STATUS_UPDATE
admin SECURITY_SETTINGS REMOVE_FROM_BLOCKED_OAUTH2_APPS STATUS_UPDATE
admin SECURITY_SETTINGS REMOVE_FROM_LIMITED_OAUTH2_APPS STATUS_UPDATE
admin SECURITY_SETTINGS REMOVE_FROM_TRUSTED_BY_OAUTH_SCOPE_OAUTH2_APPS STATUS_UPDATE
admin SECURITY_SETTINGS ADD_TO_TRUSTED_OAUTH2_APPS STATUS_UPDATE
admin SECURITY_SETTINGS MULTIPLE_ADD_TO_BLOCKED_OAUTH2_APPS STATUS_UPDATE
admin SECURITY_SETTINGS MULTIPLE_ADD_TO_LIMITED_OAUTH2_APPS STATUS_UPDATE
admin SECURITY_SETTINGS MULTIPLE_ADD_TO_TRUSTED_BY_OAUTH_SCOPE_OAUTH2_APPS STATUS_UPDATE
admin SECURITY_SETTINGS MULTIPLE_ADD_TO_TRUSTED_OAUTH2_APPS STATUS_UPDATE
admin SECURITY_SETTINGS OAUTH_APPS_BULK_UPLOAD GENERIC_EVENT
admin SECURITY_SETTINGS OAUTH_APPS_BULK_UPLOAD_NOTIFICATION_SENT GENERIC_EVENT
admin SECURITY_SETTINGS BLOCK_ON_DEVICE_ACCESS STATUS_UPDATE
admin SECURITY_SETTINGS CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION SETTING_MODIFICATION
admin SECURITY_SETTINGS CHANGE_TWO_STEP_VERIFICATION_FREQUENCY SETTING_MODIFICATION
admin SECURITY_SETTINGS CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION SETTING_MODIFICATION
admin SECURITY_SETTINGS CHANGE_TWO_STEP_VERIFICATION_START_DATE SETTING_MODIFICATION
admin SECURITY_SETTINGS CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS SETTING_MODIFICATION
admin SECURITY_SETTINGS TOGGLE_CAA_ENABLEMENT SETTING_MODIFICATION
admin SECURITY_SETTINGS CHANGE_CAA_ERROR_MESSAGE SETTING_MODIFICATION
admin SECURITY_SETTINGS TOGGLE_CAA_REMEDIATION_ENABLEMENT SETTING_MODIFICATION
admin SECURITY_SETTINGS EDU_OVER_18_APPROVAL_WORKFLOW_DISABLED GENERIC_EVENT
admin SECURITY_SETTINGS EDU_DELEGATED_USER_APPROVAL_WORKFLOW_DISABLED GENERIC_EVENT
admin SECURITY_SETTINGS UNDERAGE_USER_APPROVAL_WORKFLOW_DISABLED GENERIC_EVENT
admin SECURITY_SETTINGS USER_APPROVAL_WORKFLOW_DISABLED GENERIC_EVENT
admin SECURITY_SETTINGS UNTRUST_DOMAIN_OWNED_OAUTH2_APPS STATUS_UPDATE
admin SECURITY_SETTINGS TRUST_DOMAIN_OWNED_OAUTH2_APPS STATUS_UPDATE
admin SECURITY_SETTINGS ENABLE_NON_ADMIN_USER_PASSWORD_RECOVERY SETTING_MODIFICATION
admin SECURITY_SETTINGS EDU_OVER_18_APPROVAL_WORKFLOW_ENABLED GENERIC_EVENT
admin SECURITY_SETTINGS EDU_DELEGATED_USER_APPROVAL_WORKFLOW_ENABLED GENERIC_EVENT
admin SECURITY_SETTINGS UNDERAGE_USER_APPROVAL_WORKFLOW_ENABLED GENERIC_EVENT
admin SECURITY_SETTINGS USER_APPROVAL_WORKFLOW_ENABLED GENERIC_EVENT
admin SECURITY_SETTINGS ENFORCE_STRONG_AUTHENTICATION SETTING_MODIFICATION
admin SECURITY_SETTINGS UPDATE_ERROR_MSG_FOR_RESTRICTED_OAUTH2_APPS SETTING_MODIFICATION
admin SECURITY_SETTINGS WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED SETTING_MODIFICATION
admin SECURITY_SETTINGS SESSION_CONTROL_SETTINGS_CHANGE SETTING_MODIFICATION
admin SECURITY_SETTINGS CHANGE_SESSION_LENGTH SETTING_MODIFICATION
admin SECURITY_SETTINGS UNBLOCK_ON_DEVICE_ACCESS STATUS_UPDATE
admin SECURITY_SETTINGS DOWNLOAD_PENDING_APP_USER_REQUESTS USER_UNCATEGORIZED
admin SITES_SETTINGS ADD_WEB_ADDRESS RESOURCE_CREATION
admin SITES_SETTINGS DELETE_WEB_ADDRESS RESOURCE_DELETION
admin SITES_SETTINGS CHANGE_SITES_SETTING SETTING_MODIFICATION
admin SITES_SETTINGS CHANGE_SITES_WEB_ADDRESS_MAPPING_UPDATES RESOURCE_WRITTEN
admin SITES_SETTINGS VIEW_SITE_DETAILS RESOURCE_READ
admin USER_SETTINGS DELETE_2SV_SCRATCH_CODES USER_UNCATEGORIZED
admin USER_SETTINGS GENERATE_2SV_SCRATCH_CODES USER_UNCATEGORIZED
admin USER_SETTINGS REVOKE_3LO_DEVICE_TOKENS USER_CHANGE_PERMISSIONS
admin USER_SETTINGS REVOKE_3LO_TOKEN USER_CHANGE_PERMISSIONS
admin USER_SETTINGS ACCEPT_USER_INVITATION USER_UNCATEGORIZED
admin USER_SETTINGS ADD_RECOVERY_EMAIL USER_UNCATEGORIZED
admin USER_SETTINGS ADD_RECOVERY_PHONE USER_UNCATEGORIZED
admin USER_SETTINGS GRANT_ADMIN_PRIVILEGE USER_CHANGE_PERMISSIONS
admin USER_SETTINGS REVOKE_ADMIN_PRIVILEGE USER_CHANGE_PERMISSIONS
admin USER_SETTINGS REVOKE_ASP USER_CHANGE_PERMISSIONS
admin USER_SETTINGS TOGGLE_AUTOMATIC_CONTACT_SHARING USER_CHANGE_PERMISSIONS
admin USER_SETTINGS BULK_UPLOAD USER_RESOURCE_CREATION
admin USER_SETTINGS BULK_UPLOAD_NOTIFICATION_SENT EMAIL_TRANSACTION
admin USER_SETTINGS CANCEL_USER_INVITE USER_UNCATEGORIZED
admin USER_SETTINGS CHANGE_USER_CUSTOM_FIELD USER_UNCATEGORIZED
admin USER_SETTINGS CHANGE_USER_EXTERNAL_ID USER_UNCATEGORIZED
admin USER_SETTINGS CHANGE_USER_GENDER USER_UNCATEGORIZED
admin USER_SETTINGS CHANGE_USER_IM USER_UNCATEGORIZED
admin USER_SETTINGS ENABLE_USER_IP_WHITELIST USER_UNCATEGORIZED
admin USER_SETTINGS CHANGE_USER_KEYWORD USER_UNCATEGORIZED
admin USER_SETTINGS CHANGE_USER_LANGUAGE USER_UNCATEGORIZED
admin USER_SETTINGS CHANGE_USER_LOCATION USER_UNCATEGORIZED
admin USER_SETTINGS CHANGE_USER_ORGANIZATION USER_UNCATEGORIZED
admin USER_SETTINGS CHANGE_USER_PHONE_NUMBER USER_UNCATEGORIZED
admin USER_SETTINGS CHANGE_RECOVERY_EMAIL USER_UNCATEGORIZED
admin USER_SETTINGS CHANGE_RECOVERY_PHONE USER_UNCATEGORIZED
admin USER_SETTINGS CHANGE_USER_RELATION USER_UNCATEGORIZED
admin USER_SETTINGS CHANGE_USER_ADDRESS USER_UNCATEGORIZED
admin USER_SETTINGS CREATE_EMAIL_MONITOR USER_UNCATEGORIZED
admin USER_SETTINGS CREATE_DATA_TRANSFER_REQUEST USER_UNCATEGORIZED
admin USER_SETTINGS GRANT_DELEGATED_ADMIN_PRIVILEGES USER_CHANGE_PERMISSIONS
admin USER_SETTINGS DELETE_ACCOUNT_INFO_DUMP USER_DELETION
admin USER_SETTINGS DELETE_EMAIL_MONITOR USER_UNCATEGORIZED
admin USER_SETTINGS DELETE_MAILBOX_DUMP USER_RESOURCE_DELETION
admin USER_SETTINGS DELETE_PROFILE_PHOTO USER_RESOURCE_DELETION
admin USER_SETTINGS ADD_DISPLAY_NAME USER_UNCATEGORIZED
admin USER_SETTINGS CHANGE_DISPLAY_NAME USER_UNCATEGORIZED
admin USER_SETTINGS REMOVE_DISPLAY_NAME USER_UNCATEGORIZED
admin USER_SETTINGS CHANGE_FIRST_NAME USER_UNCATEGORIZED
admin USER_SETTINGS GMAIL_RESET_USER USER_UNCATEGORIZED
admin USER_SETTINGS CHANGE_LAST_NAME USER_UNCATEGORIZED
admin USER_SETTINGS MAIL_ROUTING_DESTINATION_ADDED USER_UNCATEGORIZED
admin USER_SETTINGS MAIL_ROUTING_DESTINATION_REMOVED USER_UNCATEGORIZED
admin USER_SETTINGS ADD_NICKNAME USER_UNCATEGORIZED
admin USER_SETTINGS REMOVE_NICKNAME USER_UNCATEGORIZED
admin USER_SETTINGS PASSKEY_REVOKED USER_CHANGE_PERMISSIONS
admin USER_SETTINGS CHANGE_PASSWORD USER_CHANGE_PASSWORD
admin USER_SETTINGS CHANGE_PASSWORD_ON_NEXT_LOGIN USER_CHANGE_PASSWORD
admin USER_SETTINGS DOWNLOAD_PENDING_INVITES_LIST STATUS_UNCATEGORIZED
admin USER_SETTINGS UPDATE_PUBLIC_KEY_CERTIFICATE_STATUS USER_UNCATEGORIZED
admin USER_SETTINGS UPDATE_PUBLIC_KEY_CERTIFICATE USER_UNCATEGORIZED
admin USER_SETTINGS REMOVE_RECOVERY_EMAIL USER_UNCATEGORIZED
admin USER_SETTINGS REMOVE_RECOVERY_PHONE USER_UNCATEGORIZED
admin USER_SETTINGS REQUEST_ACCOUNT_INFO USER_UNCATEGORIZED
admin USER_SETTINGS REQUEST_MAILBOX_DUMP USER_UNCATEGORIZED
admin USER_SETTINGS RESEND_USER_INVITE EMAIL_TRANSACTION
admin USER_SETTINGS RESET_SIGNIN_COOKIES USER_RESOURCE_UPDATE_CONTENT
admin USER_SETTINGS SECURITY_KEY_REGISTERED_FOR_USER USER_RESOURCE_CREATION
admin USER_SETTINGS REVOKE_SECURITY_KEY USER_RESOURCE_UPDATE_PERMISSIONS
admin USER_SETTINGS USER_INVITE EMAIL_TRANSACTION
admin USER_SETTINGS VIEW_TEMP_PASSWORD USER_UNCATEGORIZED
admin USER_SETTINGS TURN_OFF_2_STEP_VERIFICATION USER_UNCATEGORIZED
admin USER_SETTINGS UNBLOCK_USER_SESSION USER_UNCATEGORIZED
admin USER_SETTINGS UNMANAGED_USERS_BULK_UPLOAD USER_RESOURCE_CREATION
admin USER_SETTINGS DOWNLOAD_UNMANAGED_USERS_LIST USER_UNCATEGORIZED
admin USER_SETTINGS UPDATE_PROFILE_PHOTO USER_UNCATEGORIZED
admin USER_SETTINGS UNENROLL_USER_FROM_TITANIUM USER_UNCATEGORIZED
admin USER_SETTINGS ARCHIVE_USER USER_UNCATEGORIZED
admin USER_SETTINGS UPDATE_BIRTHDATE USER_UNCATEGORIZED
admin USER_SETTINGS USER_CREATED_PASSKEY_REVOKE USER_CHANGE_PERMISSIONS
admin USER_SETTINGS CREATE_USER USER_CREATION
admin USER_SETTINGS DELETE_USER USER_DELETION
admin USER_SETTINGS DOWNGRADE_USER_FROM_GPLUS USER_CHANGE_PERMISSIONS
admin USER_SETTINGS USER_ENROLLED_IN_TWO_STEP_VERIFICATION USER_UNCATEGORIZED
admin USER_SETTINGS DOWNLOAD_USERLIST_CSV USER_UNCATEGORIZED
admin USER_SETTINGS DOWNLOAD_USERLIST USER_UNCATEGORIZED
admin USER_SETTINGS MOVE_USER_TO_ORG_UNIT USER_UNCATEGORIZED
admin USER_SETTINGS USER_PUT_IN_TWO_STEP_VERIFICATION_GRACE_PERIOD USER_UNCATEGORIZED
admin USER_SETTINGS RENAME_USER USER_UNCATEGORIZED
admin USER_SETTINGS UNENROLL_USER_FROM_STRONG_AUTH USER_UNCATEGORIZED
admin USER_SETTINGS SUSPEND_USER USER_UNCATEGORIZED
admin USER_SETTINGS UNARCHIVE_USER USER_UNCATEGORIZED
admin USER_SETTINGS UNDELETE_USER USER_UNCATEGORIZED
admin USER_SETTINGS UNSUSPEND_USER USER_UNCATEGORIZED
admin USER_SETTINGS UPGRADE_USER_TO_GPLUS USER_CHANGE_PERMISSIONS
admin USER_SETTINGS USERS_BULK_UPLOAD USER_RESOURCE_CREATION
admin USER_SETTINGS USERS_BULK_UPLOAD_NOTIFICATION_SENT EMAIL_TRANSACTION
calendar calendar_change change_calendar_acls USER_CHANGE_PERMISSIONS
calendar calendar_change change_calendar_country USER_RESOURCE_UPDATE_CONTENT
calendar calendar_change create_calendar USER_RESOURCE_CREATION
calendar calendar_change delete_calendar USER_RESOURCE_DELETION
calendar calendar_change change_calendar_description USER_RESOURCE_UPDATE_CONTENT
calendar calendar_change export_calendar RESOURCE_READ
calendar calendar_change change_calendar_location USER_RESOURCE_UPDATE_CONTENT
calendar calendar_change print_preview_calendar USER_RESOURCE_ACCESS
calendar calendar_change change_calendar_timezone USER_RESOURCE_UPDATE_CONTENT
calendar calendar_change change_calendar_title USER_RESOURCE_UPDATE_CONTENT
calendar notification notification_triggered GENERIC_EVENT
calendar subscription_change add_subscription USER_UNCATEGORIZED
calendar subscription_change delete_subscription STATUS_UPDATE
calendar appointment_schedule_change change_appointment_schedule USER_RESOURCE_UPDATE_CONTENT
calendar appointment_schedule_change create_appointment_schedule USER_RESOURCE_CREATION
calendar appointment_schedule_change delete_appointment_schedule USER_RESOURCE_DELETION
calendar event_change create_event USER_RESOURCE_UPDATE_CONTENT
calendar event_change delete_event USER_RESOURCE_UPDATE_CONTENT
calendar event_change add_event_guest USER_RESOURCE_UPDATE_CONTENT
calendar event_change change_event_guest_response_auto USER_UNCATEGORIZED
calendar event_change remove_event_guest USER_RESOURCE_UPDATE_CONTENT
calendar event_change change_event_guest_response USER_RESOURCE_UPDATE_CONTENT
calendar event_change change_event USER_RESOURCE_UPDATE_CONTENT
calendar event_change print_preview_event USER_RESOURCE_ACCESS
calendar event_change remove_event_from_trash USER_RESOURCE_UPDATE_CONTENT
calendar event_change restore_event USER_RESOURCE_UPDATE_CONTENT
calendar event_change change_event_start_time USER_RESOURCE_UPDATE_CONTENT
calendar event_change change_event_title USER_RESOURCE_UPDATE_CONTENT
calendar event_change transfer_event_completed USER_UNCATEGORIZED
calendar event_change transfer_event_requested USER_RESOURCE_UPDATE_PERMISSIONS
calendar interop interop_freebusy_lookup_outbound_successful USER_RESOURCE_ACCESS
calendar interop interop_freebusy_lookup_inbound_successful USER_RESOURCE_ACCESS
calendar interop interop_exchange_resource_availability_lookup_successful USER_RESOURCE_ACCESS
calendar interop interop_exchange_resource_list_lookup_successful USER_RESOURCE_ACCESS
calendar interop interop_freebusy_lookup_outbound_unsuccessful USER_RESOURCE_ACCESS
calendar interop interop_freebusy_lookup_inbound_unsuccessful USER_RESOURCE_ACCESS
calendar interop interop_exchange_resource_availability_lookup_unsuccessful USER_RESOURCE_ACCESS
calendar interop interop_exchange_resource_list_lookup_unsuccessful USER_RESOURCE_ACCESS
google_chat user_action add_room_member GROUP_MODIFICATION
google_chat user_action app_added USER_RESOURCE_CREATION
google_chat user_action app_invoked USER_RESOURCE_ACCESS
google_chat user_action app_removed USER_RESOURCE_DELETION
google_chat user_action attachment_download FILE_UNCATEGORIZED
google_chat user_action attachment_upload FILE_UNCATEGORIZED
google_chat user_action block_room GROUP_UNCATEGORIZED
google_chat user_action block_user USER_UNCATEGORIZED
google_chat user_action conversation_read USER_RESOURCE_ACCESS
google_chat user_action custom_status_updated SETTING_MODIFICATION
google_chat user_action direct_message_started USER_UNCATEGORIZED
google_chat user_action emoji_created USER_RESOURCE_CREATION
google_chat user_action emoji_deleted USER_RESOURCE_DELETION
google_chat user_action history_turned_off GROUP_MODIFICATION
google_chat user_action history_turned_on GROUP_MODIFICATION
google_chat user_action invite_accept GROUP_MODIFICATION
google_chat user_action invite_decline USER_UNCATEGORIZED
google_chat user_action invite_send USER_UNCATEGORIZED
google_chat user_action message_deleted USER_RESOURCE_DELETION
google_chat user_action message_edited USER_RESOURCE_UPDATE_CONTENT
google_chat user_action message_posted USER_RESOURCE_CREATION
google_chat user_action message_report_resolved USER_RESOURCE_UPDATE_CONTENT
google_chat user_action message_reported USER_UNCATEGORIZED
google_chat user_action reaction_added USER_UNCATEGORIZED
google_chat user_action reaction_removed USER_RESOURCE_UPDATE_CONTENT
google_chat user_action remove_room_member GROUP_MODIFICATION
google_chat user_action role_updated USER_UNCATEGORIZED
google_chat user_action room_created GROUP_CREATION
google_chat user_action room_deleted GROUP_DELETION
google_chat user_action room_details_updated GROUP_MODIFICATION
google_chat user_action room_left USER_UNCATEGORIZED
google_chat user_action room_name_updated GROUP_MODIFICATION
google_chat user_action room_unblocked GROUP_MODIFICATION
google_chat user_action unread_timestamp_updated USER_RESOURCE_UPDATE_CONTENT
google_chat user_action user_unblocked USER_CHANGE_PERMISSIONS
drive access deny_access_request USER_UNCATEGORIZED
drive access expire_access_request USER_RESOURCE_UPDATE_PERMISSIONS
drive access request_access USER_UNCATEGORIZED
drive access add_to_folder USER_RESOURCE_CREATION
drive access appeal_abuse_violation USER_UNCATEGORIZED
drive access approval_canceled USER_RESOURCE_UPDATE_PERMISSIONS
drive access approval_comment_added USER_UNCATEGORIZED
drive access approval_completed USER_RESOURCE_UPDATE_PERMISSIONS
drive access approval_decisions_reset USER_RESOURCE_UPDATE_PERMISSIONS
drive access approval_due_time_change USER_RESOURCE_UPDATE_PERMISSIONS
drive access approval_requested USER_UNCATEGORIZED
drive access approval_reviewer_change USER_UNCATEGORIZED
drive access approval_reviewer_responded USER_RESOURCE_UPDATE_PERMISSIONS
drive access create_comment GENERIC_EVENT
drive access delete_comment GENERIC_EVENT
drive access edit_comment GENERIC_EVENT
drive access reassign_comment GENERIC_EVENT
drive access reopen_comment GENERIC_EVENT
drive access resolve_comment GENERIC_EVENT
drive access connected_sheets_query USER_RESOURCE_ACCESS
drive access copy USER_RESOURCE_CREATION
drive access create USER_RESOURCE_CREATION
drive access delete USER_RESOURCE_DELETION
drive access download USER_RESOURCE_ACCESS
drive access email_as_attachment EMAIL_TRANSACTION
drive access edit USER_RESOURCE_UPDATE_CONTENT
drive access email_collaborators EMAIL_UNCATEGORIZED
drive access encrypt USER_RESOURCE_UPDATE_CONTENT
drive access cancel_esignature USER_RESOURCE_UPDATE_CONTENT
drive access complete_esignature FILE_CREATION
drive access request_esignature USER_UNCATEGORIZED
drive access review_esignature USER_RESOURCE_UPDATE_CONTENT
drive access download_forms_response USER_RESOURCE_ACCESS
drive access access_item_content USER_RESOURCE_ACCESS
drive access prefetch_item_content RESOURCE_READ
drive access sync_item_content USER_RESOURCE_UPDATE_CONTENT
drive access search RESOURCE_READ
drive access label_added GENERIC_EVENT
drive access label_added_by_item_create GENERIC_EVENT
drive access label_field_changed GENERIC_EVENT
drive access label_removed GENERIC_EVENT
drive access add_lock SETTING_MODIFICATION
drive access move USER_UNCATEGORIZED
drive access preview USER_RESOURCE_ACCESS
drive access print USER_UNCATEGORIZED
drive access remove_from_folder USER_RESOURCE_DELETION
drive access rename USER_RESOURCE_UPDATE_CONTENT
drive access report_abuse USER_UNCATEGORIZED
drive access untrash USER_RESOURCE_CREATION
drive access delete_revision USER_RESOURCE_UPDATE_CONTENT
drive access pin_revision USER_RESOURCE_UPDATE_CONTENT
drive access unpin_revision USER_RESOURCE_UPDATE_CONTENT
drive access create_script_trigger USER_RESOURCE_UPDATE_CONTENT
drive access delete_script_trigger USER_RESOURCE_UPDATE_CONTENT
drive access sheets_import_url GENERIC_EVENT
drive access sheets_import_range USER_RESOURCE_ACCESS
drive access source_copy USER_UNCATEGORIZED
drive access accept_suggestion USER_RESOURCE_UPDATE_CONTENT
drive access create_suggestion GENERIC_EVENT
drive access delete_suggestion GENERIC_EVENT
drive access reject_suggestion GENERIC_EVENT
drive access pause_sync_client USER_UNCATEGORIZED
drive access resume_sync_client USER_UNCATEGORIZED
drive access trash USER_RESOURCE_DELETION
drive access remove_lock SETTING_MODIFICATION
drive access unmovable_item_reparented USER_UNCATEGORIZED
drive access upload USER_RESOURCE_CREATION
drive access access_url GENERIC_EVENT
drive access delete_video_caption USER_RESOURCE_UPDATE_CONTENT
drive access download_video_caption USER_RESOURCE_ACCESS
drive access upload_video_caption USER_RESOURCE_UPDATE_CONTENT
drive access view USER_RESOURCE_ACCESS
drive acl_change apply_security_update STATUS_UPDATE
drive acl_change shared_drive_apply_security_update STATUS_UPDATE
drive acl_change shared_drive_remove_security_update STATUS_UPDATE
drive acl_change change_owner_hierarchy_reconciled USER_CHANGE_PERMISSIONS
drive acl_change change_owner USER_CHANGE_PERMISSIONS
drive acl_change publish_change USER_RESOURCE_UPDATE_PERMISSIONS
drive acl_change change_acl_editors USER_RESOURCE_UPDATE_PERMISSIONS
drive acl_change disable_inherited_permissions USER_RESOURCE_UPDATE_PERMISSIONS
drive acl_change enable_inherited_permissions USER_RESOURCE_UPDATE_PERMISSIONS
drive acl_change change_document_access_scope USER_RESOURCE_UPDATE_PERMISSIONS
drive acl_change change_document_access_scope_hierarchy_reconciled USER_RESOURCE_UPDATE_PERMISSIONS
drive acl_change change_document_visibility USER_RESOURCE_UPDATE_PERMISSIONS
drive acl_change change_document_visibility_hierarchy_reconciled USER_RESOURCE_UPDATE_PERMISSIONS
drive acl_change publish_new_version USER_UNCATEGORIZED
drive acl_change remove_security_update STATUS_UPDATE
drive acl_change shared_drive_membership_change USER_RESOURCE_UPDATE_PERMISSIONS
drive acl_change shared_drive_settings_change USER_RESOURCE_UPDATE_PERMISSIONS
drive acl_change sheets_import_range_access_change USER_RESOURCE_UPDATE_PERMISSIONS
drive acl_change change_user_access USER_CHANGE_PERMISSIONS
drive acl_change change_user_access_hierarchy_reconciled USER_CHANGE_PERMISSIONS
drive pooled_quota_metadata storage_usage_update GENERIC_EVENT
gcp CLOUD_OSLOGIN IMPORT_SSH_PUBLIC_KEY USER_UNCATEGORIZED
gcp CLOUD_OSLOGIN DELETE_POSIX_ACCOUNT USER_UNCATEGORIZED
gcp CLOUD_OSLOGIN DELETE_SSH_PUBLIC_KEY USER_UNCATEGORIZED
gcp CLOUD_OSLOGIN GET_SSH_PUBLIC_KEY USER_UNCATEGORIZED
gcp CLOUD_OSLOGIN GET_LOGIN_PROFILE USER_UNCATEGORIZED
gcp CLOUD_OSLOGIN UPDATE_SSH_PUBLIC_KEY USER_UNCATEGORIZED
gmail delivery_type delivery EMAIL_TRANSACTION
gplus comment_change create_comment GENERIC_EVENT
gplus comment_change delete_comment GENERIC_EVENT
gplus comment_change edit_comment GENERIC_EVENT
gplus plusone_change add_plusone STATUS_UPDATE
gplus plusone_change remove_plusone STATUS_UPDATE
gplus poll_vote_change add_poll_vote STATUS_UPDATE
gplus poll_vote_change remove_poll_vote STATUS_UPDATE
gplus post_change create_post USER_RESOURCE_CREATION
gplus post_change delete_post USER_RESOURCE_DELETION
gplus post_change content_manager_delete_post USER_RESOURCE_DELETION
gplus post_change edit_post USER_RESOURCE_UPDATE_CONTENT
groups acl_change change_acl_permission GROUP_MODIFICATION
groups moderator_action accept_invitation GROUP_MODIFICATION
groups moderator_action approve_join_request GROUP_MODIFICATION
groups moderator_action join GROUP_MODIFICATION
groups moderator_action join_via_mail GROUP_MODIFICATION
groups moderator_action request_to_join USER_UNCATEGORIZED
groups moderator_action request_to_join_via_mail GROUP_UNCATEGORIZED
groups moderator_action change_basic_setting SETTING_MODIFICATION
groups moderator_action create_group GROUP_CREATION
groups moderator_action delete_group GROUP_DELETION
groups moderator_action change_email_subscription_type GROUP_MODIFICATION
groups moderator_action change_identity_setting SETTING_MODIFICATION
groups moderator_action add_info_setting SETTING_CREATION
groups moderator_action change_info_setting SETTING_MODIFICATION
groups moderator_action remove_info_setting SETTING_DELETION
groups moderator_action change_new_members_restrictions_setting SETTING_MODIFICATION
groups moderator_action change_post_replies_setting SETTING_MODIFICATION
groups moderator_action change_spam_moderation_setting SETTING_MODIFICATION
groups moderator_action change_topic_setting SETTING_MODIFICATION
groups moderator_action moderate_message USER_UNCATEGORIZED
groups moderator_action always_post_from_user USER_UNCATEGORIZED
groups moderator_action add_user GROUP_MODIFICATION
groups moderator_action ban_user_with_moderation GROUP_MODIFICATION
groups moderator_action revoke_invitation USER_UNCATEGORIZED
groups moderator_action invite_user USER_UNCATEGORIZED
groups moderator_action reject_join_request USER_UNCATEGORIZED
groups moderator_action reinvite_user USER_UNCATEGORIZED
groups moderator_action remove_user GROUP_MODIFICATION
groups moderator_action unsubscribe_via_mail USER_UNCATEGORIZED
groups_enterprise moderator_action accept_invitation GROUP_MODIFICATION
groups_enterprise moderator_action add_info_setting SETTING_CREATION
groups_enterprise moderator_action add_member GROUP_MODIFICATION
groups_enterprise moderator_action add_member_role USER_CHANGE_PERMISSIONS
groups_enterprise moderator_action add_security_setting SETTING_CREATION
groups_enterprise moderator_action add_service_account_permission USER_CHANGE_PERMISSIONS
groups_enterprise moderator_action approve_join_request GROUP_MODIFICATION
groups_enterprise moderator_action ban_member_with_moderation GROUP_MODIFICATION
groups_enterprise moderator_action change_info_setting SETTING_MODIFICATION
groups_enterprise moderator_action change_security_setting SETTING_MODIFICATION
groups_enterprise moderator_action change_security_setting_state SETTING_MODIFICATION
groups_enterprise moderator_action create_group GROUP_CREATION
groups_enterprise moderator_action create_namespace GROUP_UNCATEGORIZED
groups_enterprise moderator_action delete_group GROUP_DELETION
groups_enterprise moderator_action delete_namespace GROUP_UNCATEGORIZED
groups_enterprise moderator_action add_dynamic_group_query GROUP_MODIFICATION
groups_enterprise moderator_action change_dynamic_group_query GROUP_MODIFICATION
groups_enterprise moderator_action invite_member USER_UNCATEGORIZED
groups_enterprise moderator_action join GROUP_MODIFICATION
groups_enterprise moderator_action add_membership_expiry GROUP_MODIFICATION
groups_enterprise moderator_action remove_membership_expiry GROUP_MODIFICATION
groups_enterprise moderator_action update_membership_expiry GROUP_MODIFICATION
groups_enterprise moderator_action reject_invitation USER_UNCATEGORIZED
groups_enterprise moderator_action reject_join_request USER_UNCATEGORIZED
groups_enterprise moderator_action remove_info_setting SETTING_DELETION
groups_enterprise moderator_action remove_member GROUP_MODIFICATION
groups_enterprise moderator_action remove_member_role GROUP_MODIFICATION
groups_enterprise moderator_action remove_security_setting SETTING_DELETION
groups_enterprise moderator_action remove_service_account_permission USER_CHANGE_PERMISSIONS
groups_enterprise moderator_action request_to_join USER_UNCATEGORIZED
groups_enterprise moderator_action revoke_invitation USER_UNCATEGORIZED
groups_enterprise moderator_action unban_member GROUP_MODIFICATION
login 2sv_change 2sv_disable USER_UNCATEGORIZED
login 2sv_change 2sv_enroll USER_UNCATEGORIZED
login password_change password_edit USER_CHANGE_PASSWORD
login recovery_info_change recovery_email_edit USER_UNCATEGORIZED
login recovery_info_change recovery_phone_edit USER_UNCATEGORIZED
login recovery_info_change recovery_secret_qa_edit USER_UNCATEGORIZED
login account_warning account_disabled_password_leak USER_UNCATEGORIZED
login account_warning passkey_enrolled SETTING_MODIFICATION
login account_warning passkey_removed SETTING_MODIFICATION
login account_warning suspicious_login USER_LOGIN
login account_warning suspicious_login_less_secure_app USER_LOGIN
login account_warning suspicious_programmatic_login USER_LOGIN
login account_warning user_signed_out_due_to_suspicious_session_cookie USER_LOGOUT
login account_warning account_disabled_generic USER_UNCATEGORIZED
login account_warning account_disabled_spamming_through_relay USER_UNCATEGORIZED
login account_warning account_disabled_spamming USER_UNCATEGORIZED
login account_warning account_disabled_hijacked USER_UNCATEGORIZED
login titanium_change titanium_enroll USER_UNCATEGORIZED
login titanium_change titanium_unenroll USER_UNCATEGORIZED
login attack_warning gov_attack_warning USER_UNCATEGORIZED
login blocked_sender_change blocked_sender USER_UNCATEGORIZED
login email_forwarding_change email_forwarding_out_of_domain USER_UNCATEGORIZED
login login login_failure USER_LOGIN
login login login_challenge USER_LOGIN
login login login_verification USER_LOGIN
login login logout USER_LOGOUT
login login risky_sensitive_action_allowed USER_LOGIN
login login risky_sensitive_action_blocked USER_LOGIN
login login login_success USER_LOGIN
google_meet call abuse_report_submitted USER_UNCATEGORIZED
google_meet call broadcast_activity USER_COMMUNICATION
google_meet call call_ended USER_COMMUNICATION
google_meet call livestream_watched USER_COMMUNICATION
google_meet conference_action consented_to_third_party_media_app STATUS_UPDATE
google_meet conference_action dialed_out USER_COMMUNICATION
google_meet conference_action send_chat_everyone USER_COMMUNICATION
google_meet conference_action hand_raised RESOURCE_WRITTEN
google_meet conference_action in_meet_broadcast_activity SETTING_MODIFICATION
google_meet conference_action see_chat_everyone USER_UNCATEGORIZED
google_meet conference_action see_chat_participants USER_UNCATEGORIZED
google_meet conference_action invitation_sent USER_RESOURCE_CREATION
google_meet conference_action knocking_accepted USER_COMMUNICATION
google_meet conference_action knocking_denied USER_COMMUNICATION
google_meet conference_action send_chat_contributors USER_COMMUNICATION
google_meet conference_action send_chat_hosts USER_COMMUNICATION
google_meet conference_action poll_answered USER_COMMUNICATION
google_meet conference_action poll_created USER_RESOURCE_CREATION
google_meet conference_action presentation_started USER_COMMUNICATION
google_meet conference_action presentation_stopped USER_COMMUNICATION
google_meet conference_action question_created USER_RESOURCE_CREATION
google_meet conference_action question_responded USER_COMMUNICATION
google_meet conference_action recording_activity USER_COMMUNICATION
google_meet conference_action ring_answered USER_COMMUNICATION
google_meet conference_action ring_missed USER_COMMUNICATION
google_meet conference_action ring_sent USER_COMMUNICATION
google_meet conference_action room_check_in RESOURCE_WRITTEN
google_meet conference_action room_check_out RESOURCE_WRITTEN
google_meet conference_action speech_translation_disallowed RESOURCE_WRITTEN
google_meet conference_action speech_translation_allowed RESOURCE_WRITTEN
google_meet conference_action smart_notes_session_started RESOURCE_WRITTEN
google_meet conference_action smart_notes_session_stopped RESOURCE_WRITTEN
google_meet conference_action transcription_activity STATUS_UPDATE
google_meet conference_action watermarking_active USER_COMMUNICATION
google_meet conference_action watermarking_starting USER_COMMUNICATION
google_meet conference_action watermarking_stopped USER_COMMUNICATION
google_meet conference_action whiteboard_started USER_COMMUNICATION
mobile device_applications APPLICATION_EVENT USER_RESOURCE_UPDATE_CONTENT
mobile device_applications APPLICATION_REPORT_EVENT STATUS_UPDATE
mobile device_updates DEVICE_REGISTER_UNREGISTER_EVENT If the ACCOUNT_STATE log field value is equal to REGISTERED, then the metadata.event_type UDM field is set to USER_RESOURCE_CREATION. Else if the ACCOUNT_STATE log field value is equal to UNREGISTERED, then the metadata.event_type UDM field is set to USER_RESOURCE_DELETION.
mobile device_updates ADVANCED_POLICY_SYNC_EVENT DEVICE_CONFIG_UPDATE
mobile device_updates DEVICE_ACTION_EVENT DEVICE_CONFIG_UPDATE
mobile device_updates DEVICE_COMPLIANCE_CHANGED_EVENT STATUS_UPDATE
mobile device_updates OS_UPDATED_EVENT DEVICE_CONFIG_UPDATE
mobile device_updates DEVICE_OWNERSHIP_CHANGE_EVENT STATUS_UPDATE
mobile device_updates DEVICE_SETTINGS_UPDATED_EVENT DEVICE_CONFIG_UPDATE
mobile device_updates APPLE_DEP_DEVICE_UPDATE_ON_APPLE_PORTAL_EVENT STATUS_UPDATE
mobile device_updates DEVICE_SYNC_EVENT STATUS_UPDATE
mobile device_updates RISK_SIGNAL_UPDATED_EVENT STATUS_UPDATE
mobile device_updates ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT STATUS_UPDATE
mobile suspicious_activity DEVICE_COMPROMISED_EVENT SCAN_HOST
mobile suspicious_activity FAILED_PASSWORD_ATTEMPTS_EVENT USER_LOGIN
mobile suspicious_activity SUSPICIOUS_ACTIVITY_EVENT STATUS_UPDATE
rules action_complete_type action_complete GENERIC_EVENT
rules label_applied_type label_applied GENERIC_EVENT
rules label_field_value_changed_type label_field_value_changed GENERIC_EVENT
rules label_removed_type label_removed GENERIC_EVENT
rules rule_match_type rule_match SCAN_UNCATEGORIZED
rules rule_trigger_type rule_trigger SCAN_UNCATEGORIZED
saml login login_failure USER_LOGIN
saml login login_success USER_LOGIN
token auth activity USER_RESOURCE_ACCESS
token auth authorize USER_RESOURCE_ACCESS
token auth deny USER_RESOURCE_ACCESS
token auth request USER_LOGIN
token auth revoke USER_RESOURCE_UPDATE_PERMISSIONS
user_accounts 2sv_change 2sv_disable USER_UNCATEGORIZED
user_accounts 2sv_change 2sv_enroll USER_UNCATEGORIZED
user_accounts password_change password_edit USER_CHANGE_PASSWORD
user_accounts recovery_info_change recovery_email_edit USER_UNCATEGORIZED
user_accounts recovery_info_change recovery_phone_edit USER_UNCATEGORIZED
user_accounts recovery_info_change recovery_secret_qa_edit USER_UNCATEGORIZED
user_accounts titanium_change titanium_enroll USER_UNCATEGORIZED
user_accounts titanium_change titanium_unenroll USER_UNCATEGORIZED
user_accounts email_forwarding_change email_forwarding_out_of_domain USER_UNCATEGORIZED
context_aware_access CONTEXT_AWARE_ACCESS_USER_EVENT ACCESS_DENY_EVENT USER_RESOURCE_ACCESS
context_aware_access CONTEXT_AWARE_ACCESS_USER_EVENT ACCESS_DENY_INTERNAL_ERROR_EVENT USER_RESOURCE_ACCESS
chrome CHROME_OS_ADD_REMOVE_USER_TYPE CHROME_OS_ADD_USER USER_CREATION
chrome CHROME_OS_ADD_REMOVE_USER_TYPE CHROME_OS_REMOVE_USER USER_DELETION
chrome DEVICE_BOOT_STATE_CHANGE_TYPE DEVICE_BOOT_STATE_CHANGE SETTING_MODIFICATION
chrome CHROME_OS_LOGIN_LOGOUT_TYPE CHROME_OS_LOGIN_FAILURE_EVENT USER_LOGIN
chrome CHROME_OS_LOGIN_LOGOUT_TYPE CHROME_OS_LOGIN_LOGOUT_EVENT USER_LOGIN
chrome CHROME_OS_LOGIN_LOGOUT_TYPE CHROME_OS_LOGIN_EVENT USER_LOGIN
chrome CHROME_OS_LOGIN_LOGOUT_TYPE CHROME_OS_LOGOUT_EVENT USER_LOGOUT
chrome CHROME_OS_REPORTING_DATA_LOST_TYPE CHROME_OS_REPORTING_DATA_LOST STATUS_UPDATE
chrome SAFE_BROWSING_PASSWORD_ALERT PASSWORD_CHANGED USER_CHANGE_PASSWORD
chrome SAFE_BROWSING_PASSWORD_ALERT PASSWORD_REUSE USER_UNCATEGORIZED
chrome DLP_EVENTS_TYPE DLP_EVENT SCAN_UNCATEGORIZED
chrome CONTENT_TRANSFER_TYPE CONTENT_TRANSFER GENERIC_EVENT
chrome CONTENT_UNSCANNED_TYPE CONTENT_UNSCANNED SCAN_UNCATEGORIZED
chrome EXTENSION_REQUEST_TYPE EXTENSION_REQUEST USER_UNCATEGORIZED
chrome LOGIN_EVENT_TYPE LOGIN_EVENT USER_LOGIN
chrome MALWARE_TRANSFER_TYPE MALWARE_TRANSFER SCAN_UNCATEGORIZED
chrome PASSWORD_BREACH_TYPE PASSWORD_BREACH SCAN_UNCATEGORIZED
chrome SENSITIVE_DATA_TRANSFER_TYPE SENSITIVE_DATA_TRANSFER SCAN_UNCATEGORIZED
chrome UNSAFE_SITE_VISIT_TYPE UNSAFE_SITE_VISIT NETWORK_CONNECTION
data_studio ACCESS ADD_REPORT_EMAIL_DELIVERY USER_UNCATEGORIZED
data_studio ACCESS CREATE USER_RESOURCE_CREATION
data_studio ACCESS DATA_EXPORT USER_RESOURCE_ACCESS
data_studio ACCESS DELETE USER_RESOURCE_DELETION
data_studio ACCESS DOWNLOAD_REPORT USER_RESOURCE_ACCESS
data_studio ACCESS EDIT USER_RESOURCE_UPDATE_CONTENT
data_studio ACCESS PARENT_WORKSPACE_CHANGE RESOURCE_WRITTEN
data_studio ACCESS RESTORE USER_RESOURCE_CREATION
data_studio ACCESS STOP_REPORT_EMAIL_DELIVERY USER_UNCATEGORIZED
data_studio ACCESS TRASH USER_RESOURCE_DELETION
data_studio ACCESS UPDATE_REPORT_EMAIL_DELIVERY USER_UNCATEGORIZED
data_studio ACCESS VIEW USER_RESOURCE_ACCESS
data_studio ACL_CHANGE CHANGE_DATA_SOURCE_ACCESS_TYPE USER_RESOURCE_UPDATE_PERMISSIONS
data_studio ACL_CHANGE CHANGE_ASSET_LINK_SHARING_ACCESS_TYPE USER_RESOURCE_UPDATE_PERMISSIONS
data_studio ACL_CHANGE CHANGE_ASSET_LINK_SHARING_VISIBILITY USER_RESOURCE_UPDATE_PERMISSIONS
data_studio ACL_CHANGE CHANGE_USER_ACCESS USER_CHANGE_PERMISSIONS
data_studio ACL_CHANGE CHANGE_USER_ACCESS_TO_ASSET_VIA_WORKSPACE USER_RESOURCE_UPDATE_PERMISSIONS
keep user_action deleted_attachment USER_RESOURCE_UPDATE_CONTENT
keep user_action uploaded_attachment USER_RESOURCE_UPDATE_CONTENT
keep user_action edited_note_content USER_RESOURCE_UPDATE_CONTENT
keep user_action created_note USER_RESOURCE_CREATION
keep user_action deleted_note USER_RESOURCE_DELETION
keep user_action modified_acl USER_RESOURCE_UPDATE_PERMISSIONS
vault user_action add_collaborator_begin STATUS_UPDATE
vault user_action add_collaborator_end STATUS_UPDATE
vault user_action add_litigation_hold_begin STATUS_UPDATE
vault user_action add_litigation_hold_end STATUS_UPDATE
vault user_action add_preservation_rule_begin STATUS_UPDATE
vault user_action add_preservation_rule_end STATUS_UPDATE
vault user_action add_retention_rule_begin STATUS_UPDATE
vault user_action add_retention_rule_end STATUS_UPDATE
vault user_action cancel_accelerated_deletion_begin STATUS_UPDATE
vault user_action cancel_accelerated_deletion_end STATUS_UPDATE
vault user_action close_investigation_begin STATUS_UPDATE
vault user_action close_investigation_end STATUS_UPDATE
vault user_action convert_saved_query_to_collection_begin STATUS_UPDATE
vault user_action convert_saved_query_to_collection_end STATUS_UPDATE
vault user_action create_accelerated_deletion_begin STATUS_UPDATE
vault user_action create_accelerated_deletion_end STATUS_UPDATE
vault user_action create_export_begin STATUS_UPDATE
vault user_action create_export_end STATUS_UPDATE
vault user_action create_investigation_begin STATUS_UPDATE
vault user_action create_investigation_end STATUS_UPDATE
vault user_action create_saved_query_begin STATUS_UPDATE
vault user_action create_saved_query_end STATUS_UPDATE
vault user_action delete_export_begin STATUS_UPDATE
vault user_action delete_export_end STATUS_UPDATE
vault user_action delete_export_fail STATUS_UPDATE
vault user_action delete_investigation_begin STATUS_UPDATE
vault user_action delete_investigation_end STATUS_UPDATE
vault user_action delete_preservation_rule_begin STATUS_UPDATE
vault user_action delete_preservation_rule_end STATUS_UPDATE
vault user_action delete_retention_rule_begin STATUS_UPDATE
vault user_action delete_retention_rule_end STATUS_UPDATE
vault user_action delete_saved_query_begin STATUS_UPDATE
vault user_action delete_saved_query_end STATUS_UPDATE
vault user_action deletion_search STATUS_UPDATE
vault user_action download_count_per_account_csv STATUS_UPDATE
vault user_action download_cross_matter_litigation_hold_report STATUS_UPDATE
vault user_action download_per_matter_litigation_hold_report STATUS_UPDATE
vault user_action export STATUS_UPDATE
vault user_action export_file_download STATUS_UPDATE
vault user_action get_count_operation STATUS_UPDATE
vault user_action legacy_export_download STATUS_UPDATE
vault user_action modify_default_retention_period_begin STATUS_UPDATE
vault user_action modify_default_retention_period_end STATUS_UPDATE
vault user_action obsolete_api_exports_list STATUS_UPDATE
vault user_action obsolete_api_holds_insert STATUS_UPDATE
vault user_action obsolete_api_holds_list STATUS_UPDATE
vault user_action obsolete_api_matters_delete STATUS_UPDATE
vault user_action obsolete_api_matters_get STATUS_UPDATE
vault user_action obsolete_api_matters_insert STATUS_UPDATE
vault user_action obsolete_api_matters_list STATUS_UPDATE
vault user_action obsolete_api_matters_update STATUS_UPDATE
vault user_action obsolete_preview_retention_rule_count STATUS_UPDATE
vault user_action preview_retention_rule STATUS_UPDATE
vault user_action remove_collaborator_begin STATUS_UPDATE
vault user_action remove_collaborator_end STATUS_UPDATE
vault user_action remove_litigation_hold_begin STATUS_UPDATE
vault user_action remove_litigation_hold_end STATUS_UPDATE
vault user_action reopen_investigation_begin STATUS_UPDATE
vault user_action reopen_investigation_end STATUS_UPDATE
vault user_action restore_investigation_begin STATUS_UPDATE
vault user_action restore_investigation_end STATUS_UPDATE
vault user_action search STATUS_UPDATE
vault user_action search_count STATUS_UPDATE
vault user_action update_investigation_details_begin STATUS_UPDATE
vault user_action update_investigation_details_end STATUS_UPDATE
vault user_action update_preservation_rule_add_holds_begin STATUS_UPDATE
vault user_action update_preservation_rule_add_holds_end STATUS_UPDATE
vault user_action update_preservation_rule_query_begin STATUS_UPDATE
vault user_action update_preservation_rule_query_end STATUS_UPDATE
vault user_action update_preservation_rule_remove_holds_begin STATUS_UPDATE
vault user_action update_preservation_rule_remove_holds_end STATUS_UPDATE
vault user_action update_retention_rule_begin STATUS_UPDATE
vault user_action update_retention_rule_end STATUS_UPDATE
vault user_action update_retention_settings STATUS_UPDATE
vault user_action update_saved_query_details_begin STATUS_UPDATE
vault user_action update_saved_query_details_end STATUS_UPDATE
vault user_action view_cross_matter_litigation_hold_report STATUS_UPDATE
vault user_action view_custodian_litigation_hold_report STATUS_UPDATE
vault user_action view_document STATUS_UPDATE
vault user_action view_document_information STATUS_UPDATE
vault user_action view_external_document STATUS_UPDATE
vault user_action view_investigation STATUS_UPDATE
vault user_action view_matter_audit_log STATUS_UPDATE
vault user_action view_per_matter_litigation_hold_report STATUS_UPDATE
vault user_action view_retention_policy STATUS_UPDATE
vault user_action view_retention_settings STATUS_UPDATE
vault user_action view_system_audit_log STATUS_UPDATE
gemini_in_workspace_apps ai_usage_event feature_utilization USER_RESOURCE_ACCESS
classroom add_on_update created_add_on_attachment USER_RESOURCE_CREATION
classroom add_on_update deleted_add_on_attachment USER_RESOURCE_DELETION
classroom add_on_update updated_add_on_attachment USER_RESOURCE_UPDATE_CONTENT
classroom add_on_update updated_add_on_attachment_submission_grade USER_RESOURCE_UPDATE_CONTENT
classroom course_membership_change user_added_to_course USER_RESOURCE_UPDATE_PERMISSIONS
classroom course_membership_change user_gained_preview_access_to_course USER_RESOURCE_UPDATE_PERMISSIONS
classroom course_membership_change user_invited_to_course USER_RESOURCE_UPDATE_PERMISSIONS
classroom course_membership_change user_joined_course USER_RESOURCE_UPDATE_CONTENT
classroom course_membership_change user_removed_from_course USER_RESOURCE_UPDATE_CONTENT
classroom course_update archived_course USER_RESOURCE_UPDATE_CONTENT
classroom course_update created_course USER_RESOURCE_CREATION
classroom course_update created_course_quick_link USER_RESOURCE_UPDATE_CONTENT
classroom course_update created_grade_category USER_RESOURCE_CREATION
classroom course_update deleted_course USER_RESOURCE_DELETION
classroom course_update deleted_course_quick_link USER_RESOURCE_UPDATE_CONTENT
classroom course_update deleted_grade_category USER_RESOURCE_DELETION
classroom course_update edited_course_quick_link USER_RESOURCE_UPDATE_CONTENT
classroom course_update edited_grade_category USER_RESOURCE_UPDATE_CONTENT
classroom course_update new_user_owns_course USER_RESOURCE_UPDATE_PERMISSIONS
classroom course_update restored_course USER_RESOURCE_CREATION
classroom course_update share_classwork_settings_updated_for_course SETTING_MODIFICATION
classroom course_update transferred_ownership_of_course USER_RESOURCE_UPDATE_PERMISSIONS
classroom course_update user_invited_to_own_course USER_RESOURCE_UPDATE_PERMISSIONS
classroom course_work_update changed_submission_state USER_RESOURCE_UPDATE_CONTENT
classroom course_work_update commented_announcement STATUS_UPDATE
classroom course_work_update commented_course_work GENERIC_EVENT
classroom course_work_update commented_submission_private GENERIC_EVENT
classroom course_work_update commented_submission_public GENERIC_EVENT
classroom course_work_update created_rubric_for_course_work USER_RESOURCE_CREATION
classroom course_work_update published_announcement STATUS_UPDATE
classroom course_work_update published_course_work USER_RESOURCE_CREATION
classroom course_work_update scored_rubric USER_RESOURCE_UPDATE_CONTENT
classroom course_work_update set_draft_grade USER_RESOURCE_UPDATE_CONTENT
classroom course_work_update set_grade USER_RESOURCE_UPDATE_CONTENT
classroom course_work_update unset_draft_grade USER_RESOURCE_UPDATE_CONTENT
classroom course_work_update unset_grade USER_RESOURCE_UPDATE_CONTENT
classroom course_work_update updated_announcement STATUS_UPDATE
classroom course_work_update updated_course_work USER_RESOURCE_UPDATE_CONTENT
classroom grade_export grade_export_for_course_work GENERIC_EVENT
classroom grade_export grade_export_for_submission GENERIC_EVENT
classroom guardian_update default_guardian_summaries_settings_updated_for_teacher GENERIC_EVENT
classroom guardian_update guardian_invited_for_student GENERIC_EVENT
classroom guardian_update guardian_removed_for_student GENERIC_EVENT
classroom guardian_update guardian_responded_to_invite GENERIC_EVENT
classroom guardian_update guardian_summaries_settings_updated_for_course SETTING_MODIFICATION
classroom guardian_update guardian_summaries_settings_updated_for_teacher GENERIC_EVENT
classroom guardian_update guardian_updated_email EMAIL_UNCATEGORIZED
classroom originality_report originality_report_created USER_RESOURCE_CREATION
assignments course_membership_change user_joined_course USER_RESOURCE_UPDATE_CONTENT
assignments course_membership_change user_removed_from_course USER_RESOURCE_UPDATE_CONTENT
assignments course_update created_course USER_RESOURCE_CREATION
assignments course_update deleted_course USER_RESOURCE_DELETION
assignments course_work_update changed_submission_state STATUS_UPDATE
assignments course_work_update published_course_work USER_RESOURCE_CREATION
assignments course_work_update set_grade USER_RESOURCE_UPDATE_CONTENT
cloud_search LIST_QUERY_SOURCES LIST_QUERY_SOURCES GENERIC_EVENT
cloud_search SEARCH_QUERY SEARCH GENERIC_EVENT
cloud_search SUGGEST_QUERY SUGGEST GENERIC_EVENT
tasks recurrence_change recurrence_created USER_RESOURCE_CREATION
tasks recurrence_change recurrence_created_from_task USER_RESOURCE_CREATION
tasks recurrence_change recurrence_deleted USER_RESOURCE_DELETION
tasks recurrence_change recurrence_modified USER_RESOURCE_UPDATE_CONTENT
tasks recurrence_change recurrence_title_changed USER_RESOURCE_UPDATE_CONTENT
tasks task_change task_assigned USER_RESOURCE_UPDATE_PERMISSIONS
tasks task_change task_completed USER_RESOURCE_UPDATE_CONTENT
tasks task_change task_created USER_RESOURCE_CREATION
tasks task_change task_deleted USER_RESOURCE_DELETION
tasks task_change task_marked_as_spam STATUS_UPDATE
tasks task_change task_modified USER_RESOURCE_UPDATE_CONTENT
tasks task_change task_moved_between_lists USER_RESOURCE_UPDATE_CONTENT
tasks task_change task_reassigned USER_RESOURCE_UPDATE_PERMISSIONS
tasks task_change task_restored USER_RESOURCE_CREATION
tasks task_change task_time_changed USER_RESOURCE_UPDATE_CONTENT
tasks task_change task_title_changed USER_RESOURCE_UPDATE_CONTENT
tasks task_change task_unassigned USER_RESOURCE_UPDATE_PERMISSIONS
tasks task_change task_uncompleted USER_RESOURCE_UPDATE_CONTENT
tasks task_list_change task_list_completed_tasks_deleted USER_RESOURCE_DELETION
tasks task_list_change task_list_created USER_RESOURCE_CREATION
tasks task_list_change task_list_deleted USER_RESOURCE_DELETION
tasks task_list_change task_list_structure_changed USER_RESOURCE_UPDATE_CONTENT
tasks task_list_change task_list_title_changed USER_RESOURCE_UPDATE_CONTENT
data_migration MIGRATION CRAWL_FAILURE STATUS_UPDATE
data_migration MIGRATION CREATE_CALENDAR RESOURCE_CREATION
data_migration MIGRATION CREATE_CALENDAR_ACL SETTING_MODIFICATION
data_migration MIGRATION CREATE_CALENDAR_EVENT RESOURCE_CREATION
data_migration MIGRATION CREATE_CALENDAR_USER_SETTINGS SETTING_CREATION
data_migration MIGRATION CREATE_CONTACT RESOURCE_CREATION
data_migration MIGRATION CREATE_CONTACT_GROUP RESOURCE_CREATION
data_migration MIGRATION CREATE_FILE FILE_CREATION
data_migration MIGRATION CREATE_FILE_VERSION FILE_CREATION
data_migration MIGRATION CREATE_FOLDER RESOURCE_CREATION
data_migration MIGRATION CREATE_GMAIL_LABEL STATUS_UPDATE
data_migration MIGRATION CREATE_GMAIL_MESSAGE STATUS_UPDATE
data_migration MIGRATION CREATE_SPACE RESOURCE_CREATION
data_migration MIGRATION CREATE_SPACE_MEMBERSHIP STATUS_UPDATE
data_migration MIGRATION CREATE_SPACE_MESSAGE STATUS_UPDATE
data_migration MIGRATION GO_LIVE_SPACE STATUS_UPDATE
data_migration MIGRATION_SETUP CREATE_CONNECTION SETTING_MODIFICATION
data_migration MIGRATION_SETUP CREATE_MIGRATION_MAP SETTING_MODIFICATION
data_migration MIGRATION_SETUP DELETE_CONNECTION SETTING_MODIFICATION
data_migration MIGRATION_SETUP EXIT_MIGRATION STATUS_UPDATE
data_migration MIGRATION_SETUP GRANT_CONSENT STATUS_UPDATE
data_migration MIGRATION_SETUP REQUEST_CONNECTION_VERIFICATION STATUS_UPDATE
data_migration MIGRATION_SETUP START_MIGRATION STATUS_UPDATE
data_migration MIGRATION_SETUP START_MIGRATION_REPORT_DOWNLOAD USER_UNCATOGARIZED
data_migration MIGRATION_SETUP START_MIGRATION_SETUP STATUS_UPDATE
data_migration MIGRATION_SETUP START_MIGRATION_SUMMARY_REPORT_DOWNLOAD USER_UNCATOGARIZED
data_migration MIGRATION_SETUP STOP_MIGRATION STATUS_UPDATE
data_migration MIGRATION_SETUP UPDATE_MIGRATION_SETTINGS SETTING_MODIFICATION
meet_hardware ACTIVITY EVENT_BOARDCAM_PRESENT_ENDED STATUS_UPDATE
meet_hardware ACTIVITY EVENT_BOARDCAM_PRESENT_STARTED STATUS_UPDATE
meet_hardware ACTIVITY EVENT_BYOD_ENTERED STATUS_UPDATE
meet_hardware ACTIVITY EVENT_BYOD_EXITED STATUS_UPDATE
meet_hardware ACTIVITY EVENT_LOCAL_PRESENT_ENDED STATUS_UPDATE
meet_hardware ACTIVITY EVENT_LOCAL_PRESENT_STARTED STATUS_UPDATE
meet_hardware ACTIVITY EVENT_MEET_CALL_DISCONNECTED USER_COMMUNICATION
meet_hardware ACTIVITY EVENT_MEET_CALL_JOINED USER_COMMUNICATION
meet_hardware ACTIVITY EVENT_SLEEP_SCREEN_ENTERED STATUS_UPDATE
meet_hardware ACTIVITY EVENT_SLEEP_SCREEN_EXITED STATUS_UPDATE
meet_hardware ACTIVITY EVENT_TEAMS_CALL_DISCONNECTED USER_COMMUNICATION
meet_hardware ACTIVITY EVENT_TEAMS_CALL_JOINED USER_COMMUNICATION
meet_hardware ACTIVITY EVENT_WEBEX_CALL_DISCONNECTED USER_COMMUNICATION
meet_hardware ACTIVITY EVENT_WEBEX_CALL_JOINED USER_COMMUNICATION
meet_hardware ACTIVITY EVENT_ZOOM_CALL_DISCONNECTED USER_COMMUNICATION
meet_hardware ACTIVITY EVENT_ZOOM_CALL_JOINED USER_COMMUNICATION
meet_hardware FEEDBACK_FILED EVENT_FEEDBACK_FILED USER_UNCATEGORIZED
meet_hardware RESTART EVENT_RESTART_APP STATUS_UPDATE
meet_hardware RESTART EVENT_RESTART_MACHINE STATUS_UPDATE
meet_hardware RESTART EVENT_RESTART_UNKNOWN STATUS_UPDATE
meet_hardware SOFTWARE_UPDATE EVENT_BROWSER_UPDATE DEVICE_CONFIG_UPDATE
meet_hardware SOFTWARE_UPDATE EVENT_CLIENT_APP_UPDATE DEVICE_CONFIG_UPDATE
meet_hardware SOFTWARE_UPDATE EVENT_OS_UPDATE DEVICE_CONFIG_UPDATE
meet_hardware issue EVENT_ADD_ON_CAMERA_ATTACHED STATUS_UPDATE
meet_hardware issue EVENT_ADD_ON_CAMERA_DETACHED STATUS_UPDATE
meet_hardware issue EVENT_CAMERA_ATTACHED STATUS_UPDATE
meet_hardware issue EVENT_CAMERA_DETACHED STATUS_UPDATE
meet_hardware issue EVENT_DEFAULT_CAMERA_SET SETTING_MODIFICATION
meet_hardware issue EVENT_DEFAULT_CAMERA_UNSET SETTING_MODIFICATION
meet_hardware issue EVENT_DEFAULT_MICROPHONE_SET SETTING_MODIFICATION
meet_hardware issue EVENT_DEFAULT_MICROPHONE_UNSET SETTING_MODIFICATION
meet_hardware issue EVENT_DEFAULT_SPEAKER_SET SETTING_MODIFICATION
meet_hardware issue EVENT_DEFAULT_SPEAKER_UNSET SETTING_MODIFICATION
meet_hardware issue EVENT_DEFAULT_VIDEO_CAPTURE_CONTENT_CAMERA_SET SETTING_MODIFICATION
meet_hardware issue EVENT_DEFAULT_VIDEO_CAPTURE_CONTENT_CAMERA_UNSET SETTING_MODIFICATION
meet_hardware issue EVENT_DEVICE_FOUND STATUS_UPDATE
meet_hardware issue EVENT_DEVICE_MISSING STATUS_UPDATE
meet_hardware issue EVENT_DISPLAY_ATTACHED STATUS_UPDATE
meet_hardware issue EVENT_DISPLAY_DETACHED STATUS_UPDATE
meet_hardware issue EVENT_FRONTEND_LOAD_AUTH_FAILURE_ERROR STATUS_UPDATE
meet_hardware issue EVENT_FRONTEND_LOAD_BAD_STATUS_CODE_4XX_ERROR STATUS_UPDATE
meet_hardware issue EVENT_FRONTEND_LOAD_BAD_STATUS_CODE_5XX_ERROR STATUS_UPDATE
meet_hardware issue EVENT_FRONTEND_LOAD_FIRMWARE_UPDATE_ENDED STATUS_UPDATE
meet_hardware issue EVENT_FRONTEND_LOAD_NETWORK_INTERRUPTED_ERROR STATUS_UPDATE
meet_hardware issue EVENT_FRONTEND_LOAD_SHIM_FRAMEWORK_ERROR STATUS_UPDATE
meet_hardware issue EVENT_FRONTEND_LOAD_SUCCESS STATUS_UPDATE
meet_hardware issue EVENT_FRONTEND_LOAD_TIMEOUT_ERROR STATUS_UPDATE
meet_hardware issue EVENT_FRONTEND_LOAD_TRANSPORT_FAILURE_ERROR STATUS_UPDATE
meet_hardware issue EVENT_FRONTEND_LOAD_WAITING_FOR_NETWORK STATUS_UPDATE
meet_hardware issue EVENT_FRONTEND_LOAD_WAIT_FOR_DEVICE_FIRMWARE_UPDATE STATUS_UPDATE
meet_hardware issue EVENT_FRONTEND_LOAD_WEBVIEW_ERROR STATUS_UPDATE
meet_hardware issue EVENT_FRONTEND_LOAD_WEBVIEW_EXIT_ERROR STATUS_UPDATE
meet_hardware issue EVENT_HANDHELD_CONTROLLER_ATTACHED STATUS_UPDATE
meet_hardware issue EVENT_HANDHELD_CONTROLLER_DETACHED STATUS_UPDATE
meet_hardware issue EVENT_MIC_ATTACHED STATUS_UPDATE
meet_hardware issue EVENT_MIC_DETACHED STATUS_UPDATE
meet_hardware issue EVENT_SPEAKER_ATTACHED STATUS_UPDATE
meet_hardware issue EVENT_SPEAKER_DETACHED STATUS_UPDATE
meet_hardware issue EVENT_TOUCH_CONTROLLER_ATTACHED STATUS_UPDATE
meet_hardware issue EVENT_TOUCH_CONTROLLER_DETACHED STATUS_UPDATE
meet_hardware issue EVENT_VIDEO_CAPTURE_CONTENT_CAMERA_ATTACHED STATUS_UPDATE
meet_hardware issue EVENT_VIDEO_CAPTURE_CONTENT_CAMERA_DETACHED STATUS_UPDATE
directory_sync DIRECTORY_SYNC_ENTITY ADDED_GROUP_MEMBERSHIP GROUP_MODIFICATION
directory_sync DIRECTORY_SYNC_ENTITY CLOUD_DIRECTORY_READ If the ENTITY_TYPE log field value is equal to USER, then the metadata.event_type UDM field is set to USER_UNCATEGORIZED. Else the metadata.event_type UDM field is set to GROUP_UNCATEGORIZED.
directory_sync DIRECTORY_SYNC_ENTITY CLOUD_DIRECTORY_READ_FINISHED If the ENTITY_TYPE log field value is equal to USER, then the metadata.event_type UDM field is set to USER_UNCATEGORIZED. Else the metadata.event_type UDM field is set to GROUP_UNCATEGORIZED.
directory_sync DIRECTORY_SYNC_ENTITY ENTITY_CHANGES If the ENTITY_TYPE log field value is equal to USER, then the metadata.event_type UDM field is set to USER_UNCATEGORIZED. Else the metadata.event_type UDM field is set to GROUP_UNCATEGORIZED.
directory_sync DIRECTORY_SYNC_ENTITY ENTITY_CREATED If the ENTITY_TYPE log field value is equal to USER, then the metadata.event_type UDM field is set to USER_UNCATEGORIZED. Else the metadata.event_type UDM field is set to GROUP_UNCATEGORIZED.
directory_sync DIRECTORY_SYNC_ENTITY ENTITY_EXCLUDED If the ENTITY_TYPE log field value is equal to USER, then the metadata.event_type UDM field is set to USER_UNCATEGORIZED. Else the metadata.event_type UDM field is set to GROUP_UNCATEGORIZED.
directory_sync DIRECTORY_SYNC_ENTITY ENTITY_EXCLUSIONS_SUMMARY If the ENTITY_TYPE log field value is equal to USER, then the metadata.event_type UDM field is set to USER_UNCATEGORIZED. Else the metadata.event_type UDM field is set to GROUP_UNCATEGORIZED.
directory_sync DIRECTORY_SYNC_ENTITY ENTITY_NOT_CREATED If the ENTITY_TYPE log field value is equal to USER, then the metadata.event_type UDM field is set to USER_UNCATEGORIZED. Else the metadata.event_type UDM field is set to GROUP_UNCATEGORIZED.
directory_sync DIRECTORY_SYNC_ENTITY ENTITY_SKIPPED If the ENTITY_TYPE log field value is equal to USER, then the metadata.event_type UDM field is set to USER_UNCATEGORIZED. Else the metadata.event_type UDM field is set to GROUP_UNCATEGORIZED.
directory_sync DIRECTORY_SYNC_ENTITY ENTITY_SYNC_FAILED If the ENTITY_TYPE log field value is equal to USER, then the metadata.event_type UDM field is set to USER_UNCATEGORIZED. Else the metadata.event_type UDM field is set to GROUP_UNCATEGORIZED.
directory_sync DIRECTORY_SYNC_ENTITY ENTITY_UPDATED If the ENTITY_TYPE log field value is equal to USER, then the metadata.event_type UDM field is set to USER_UNCATEGORIZED. Else the metadata.event_type UDM field is set to GROUP_UNCATEGORIZED.
directory_sync DIRECTORY_SYNC_ENTITY ERROR If the ENTITY_TYPE log field value is equal to USER, then the metadata.event_type UDM field is set to USER_UNCATEGORIZED. Else the metadata.event_type UDM field is set to GROUP_UNCATEGORIZED.
directory_sync DIRECTORY_SYNC_ENTITY OBJECT_DEPROVISIONED If the ENTITY_TYPE log field value is equal to USER, then the metadata.event_type UDM field is set to USER_UNCATEGORIZED. Else the metadata.event_type UDM field is set to GROUP_UNCATEGORIZED.
directory_sync DIRECTORY_SYNC_ENTITY REMOTE_DIRECTORY_ENTITY_READ If the ENTITY_TYPE log field value is equal to USER, then the metadata.event_type UDM field is set to USER_UNCATEGORIZED. Else the metadata.event_type UDM field is set to GROUP_UNCATEGORIZED.
directory_sync DIRECTORY_SYNC_ENTITY REMOTE_DIRECTORY_READ If the ENTITY_TYPE log field value is equal to USER, then the metadata.event_type UDM field is set to USER_UNCATEGORIZED. Else the metadata.event_type UDM field is set to GROUP_UNCATEGORIZED.
directory_sync DIRECTORY_SYNC_ENTITY REMOTE_DIRECTORY_READ_FINISHED If the ENTITY_TYPE log field value is equal to USER, then the metadata.event_type UDM field is set to USER_UNCATEGORIZED. Else the metadata.event_type UDM field is set to GROUP_UNCATEGORIZED.
directory_sync DIRECTORY_SYNC_ENTITY REMOVED_GROUP_MEMBERSHIP GROUP_MODIFICATION
directory_sync DIRECTORY_SYNC_ENTITY TARGET_ENTITY_SKIPPED If the ENTITY_TYPE log field value is equal to USER, then the metadata.event_type UDM field is set to USER_UNCATEGORIZED. Else the metadata.event_type UDM field is set to GROUP_UNCATEGORIZED.
directory_sync DIRECTORY_SYNC_ENTITY UPDATED_GROUP_MEMBERSHIP GROUP_MODIFICATION
directory_sync DIRECTORY_SYNC_EXECUTION SYNC_RUN_END STATUS_UPDATE
directory_sync DIRECTORY_SYNC_EXECUTION SYNC_RUN_FAILED STATUS_UPDATE
directory_sync DIRECTORY_SYNC_EXECUTION SYNC_RUN_FAILED_RETRY STATUS_UPDATE
directory_sync DIRECTORY_SYNC_EXECUTION SYNC_RUN_START STATUS_UPDATE
ldap ldap_operation bind_failure NETWORK_CONNECTION
ldap ldap_operation bind_success NETWORK_CONNECTION
ldap ldap_operation search_failed USER_RESOURCE_ACCESS
ldap ldap_operation search_success USER_RESOURCE_ACCESS
ldap ldap_operation unbind NETWORK_UNCATEGORIZED
profile USER_INITIATED_EVENT PROFILE_MUTATE_BY_USER USER_UNCATEGORIZED
access_evaluation access_token_evaluation allow_token_impersonation USER_UNCATEGORIZED
access_evaluation access_token_evaluation allow_token_request USER_UNCATEGORIZED
access_evaluation credential_validation allow_credential_validation_request GENERIC_EVENT
admin_data_action AUDIT_LOGGING SENSITIVE_AUDIT_EVENTS_ACCESSED USER_RESOURCE_ACCESS
admin_data_action AUDIT_LOGGING SENSITIVE_AUDIT_EVENTS_HIDDEN USER_RESOURCE_UPDATE_CONTENT
admin_data_action AUDIT_LOGGING SENSITIVE_AUDIT_EVENTS_UNHIDDEN USER_RESOURCE_UPDATE_CONTENT
contacts mutate_contact_data accept_merge_and_fix_suggestions STATUS_UPDATE
contacts mutate_contact_data add_to_contacts STATUS_UPDATE
contacts mutate_contact_data create_multiple_contacts STATUS_UPDATE
contacts mutate_contact_data delete_contacts STATUS_UPDATE
contacts mutate_contact_data delete_trashed_contacts STATUS_UPDATE
contacts mutate_contact_data hide_contacts STATUS_UPDATE
contacts mutate_contact_data import_contacts STATUS_UPDATE
contacts mutate_contact_data recover_trashed_contacts STATUS_UPDATE
contacts significant_view export_contacts STATUS_UPDATE
contacts significant_view print_contacts STATUS_UPDATE
takeout USER_TAKEOUT COMPLETED_USER_TAKEOUT USER_UNCATEGORIZED
takeout USER_TAKEOUT DOWNLOADED_USER_TAKEOUT USER_UNCATEGORIZED
takeout USER_TAKEOUT SCHEDULED_USER_TAKEOUT USER_UNCATEGORIZED
takeout USER_TAKEOUT STARTED_USER_TAKEOUT USER_UNCATEGORIZED
graduation GRADUATION_ACCOUNT_MIGRATION COMPLETED_ACCOUNT_MIGRATION USER_UNCATEGORIZED
graduation GRADUATION_ACCOUNT_MIGRATION STARTED_ACCOUNT_MIGRATION USER_UNCATEGORIZED

Field mapping reference: WORKSPACE_ACTIVITY-Common Fields

The following table lists common fields of the WORKSPACE_ACTIVITY log type and their corresponding UDM fields.

Log field UDM mapping Logic
actor.callerType principal.user.attribute.labels[caller_type] If the events.name log field value does not contain one of the following values:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_challenge
  • login_verification
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
  • CHROMEOS_AFFILIATED_UNLOCK_FAILURE
  • CHROMEOS_AFFILIATED_UNLOCK_SUCCESS
  • CHROME_OS_CRD_CLIENT_CONNECTED
  • CHROMEOS_AFFILIATED_LOCK_SUCCESS
  • FAILED_PASSWORD_ATTEMPTS_EVENT
  • request
, then the principal.user.attribute.labels.key UDM field is set to actor_caller_type and the actor.callerType log field is mapped to the principal.user.attribute.labels.value UDM field.
Otherwise, the target.user.attribute.labels.key UDM field is set to actor_caller_type and the actor.callerType log field is mapped to the target.user.attribute.labels.value UDM field.
actor.email principal.user.email_addresses If the id.applicationName log field value is equal to gmail, then destination_email log field value is set to false.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to destination, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to address, then if the events.parameters.msgValue.parameter.multiMessageValue.parameter.value log field value is equal to the actor.email log field value, then destination_email log field value is set to true. Else if the events.parameters.msgValue.parameter.name log field value is equal to flattened_destinations, then if the events.parameters.msgValue.parameter.value log field value is equal to the actor.email log field value, then destination_email log field value is set to true.
If the destination_email log field value is equal to true, then the actor.email log field is mapped to the target.user.email_addresses UDM field. Otherwise, the actor.email log field is mapped to the principal.user.email_addresses UDM field.
If the events.name log field value contain one of the following values:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_challenge
  • login_verification
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
  • CHROMEOS_AFFILIATED_UNLOCK_FAILURE
  • CHROMEOS_AFFILIATED_UNLOCK_SUCCESS
  • CHROME_OS_CRD_CLIENT_CONNECTED
  • CHROMEOS_AFFILIATED_LOCK_SUCCESS
  • FAILED_PASSWORD_ATTEMPTS_EVENT
  • delivery
  • request
, then the actor.email log field is mapped to the target.user.email_addresses UDM field.
Else if the id.applicationName log field value is not equal to gmail, then The actor.email log field is mapped to the principal.user.email_addresses UDM field.
actor.email network.email.to
actor.email security_result.about.email
actor.key principal.user.attribute.labels[actor_key] If the actor.profileId log field value is not empty, then if the events.name log field value contain one of the following values:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_challenge
  • login_verification
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
  • CHROMEOS_AFFILIATED_UNLOCK_FAILURE
  • CHROMEOS_AFFILIATED_UNLOCK_SUCCESS
  • CHROME_OS_CRD_CLIENT_CONNECTED
  • CHROMEOS_AFFILIATED_LOCK_SUCCESS
  • FAILED_PASSWORD_ATTEMPTS_EVENT
  • request
, then the target.user.attribute.labels.key UDM field is set to actor_key and the actor.key log field is mapped to the target.user.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to actor_key and the actor.key log field is mapped to the principal.user.attribute.labels.value UDM field.
actor.key principal.user.userid If the actor.callerType log field value is equal to KEY, then if the events.name log field value contain one of the following values:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_challenge
  • login_verification
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
  • CHROMEOS_AFFILIATED_UNLOCK_FAILURE
  • CHROMEOS_AFFILIATED_UNLOCK_SUCCESS
  • CHROME_OS_CRD_CLIENT_CONNECTED
  • CHROMEOS_AFFILIATED_LOCK_SUCCESS
  • FAILED_PASSWORD_ATTEMPTS_EVENT
  • request
, then the actor.key log field is mapped to the target.user.userid UDM field. Otherwise, the actor.key log field is mapped to the principal.user.userid UDM field.
actor.profileId target.user.product_object_id If the events.name log field value contain one of the following values:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_challenge
  • login_verification
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
  • CHROMEOS_AFFILIATED_UNLOCK_FAILURE
  • CHROMEOS_AFFILIATED_UNLOCK_SUCCESS
  • CHROME_OS_CRD_CLIENT_CONNECTED
  • CHROMEOS_AFFILIATED_LOCK_SUCCESS
  • FAILED_PASSWORD_ATTEMPTS_EVENT
  • request
, then the actor.profileId log field is mapped to the target.user.product_object_id UDM field.
Otherwise, the actor.profileId log field is mapped to the principal.user.product_object_id UDM field.
events.name metadata.product_event_type If the id.applicationName log field value is not equal to gmail, then the events.name log field is mapped to the metadata.product_event_type UDM field.
events.type security_result.category_details If the message log field value matches the regular expression pattern: events.*type and the id.applicationName log field value is not equal to gmail, then the events.type log field is mapped to the security_result.category_details UDM field.
id.applicationName metadata.product_name
id.customerId about.resource.product_object_id
id.time metadata.event_timestamp If the id.time log field value is not empty and the id.applicationName log field value is not equal to gmail, then The unix_time field is extracted from id.time log field using the Grok pattern.
If the unix_time log field value is not empty, then the unix_time extracted field is mapped to the metadata.event_timestamp UDM field.
Otherwise, the id.time log field is mapped to the metadata.event_timestamp UDM field.
id.uniqueQualifier, etag metadata.product_log_id If the id.uniqueQualifier log field value is not empty, then the id.uniqueQualifier log field is mapped to the metadata.product_log_id UDM field. If the etag log field value is not empty, then the additional.fields.key UDM field is set to etag and the etag log field is mapped to the additional.fields.value UDM field.
Otherwise, the etag log field is mapped to the metadata.product_log_id UDM field.
ipAddress principal.ip
ipAddress principal.asset.ip
kind additional.fields[kind]
ownerDomain target.administrative_domain If the target.resource log field value is not empty, then the ownerDomain log field is mapped to the target.administrative_domain UDM field.
Else if the principal.resource log field value is not empty, then the ownerDomain log field is mapped to the principal.administrative_domain UDM field.
If the id.applicationName log field value is equal to gmail, then the ownerDomain log field is mapped to the principal.administrative_domain UDM field.
metadata.vendor_name The metadata.vendor_name UDM field is set to Google Workspace.
actor.gaiaId principal.user.product_object_id If the events.name log field value contain one of the following values:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_challenge
  • login_verification
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
  • CHROMEOS_AFFILIATED_UNLOCK_FAILURE
  • CHROMEOS_AFFILIATED_UNLOCK_SUCCESS
  • CHROME_OS_CRD_CLIENT_CONNECTED
  • CHROMEOS_AFFILIATED_LOCK_SUCCESS
  • FAILED_PASSWORD_ATTEMPTS_EVENT
  • request
, then the actor.gaiaId log field is mapped to the target.user.product_object_id UDM field.
Otherwise, the actor.gaiaId log field is mapped to the principal.user.product_object_id UDM field.
actor.orgunitPath principal.user.attribute.labels[org_unit_path] If the events.name log field value contain one of the following values:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_challenge
  • login_verification
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
  • CHROMEOS_AFFILIATED_UNLOCK_FAILURE
  • CHROMEOS_AFFILIATED_UNLOCK_SUCCESS
  • CHROME_OS_CRD_CLIENT_CONNECTED
  • CHROMEOS_AFFILIATED_LOCK_SUCCESS
  • FAILED_PASSWORD_ATTEMPTS_EVENT
  • request
, then
Iterate through log field actor.orgunitPath:
The target.user.attribute.labels.key UDM field is set to org_unit_path and the actor.orgunitPath log field is mapped to the target.user.attribute.labels.value UDM field.
Otherwise,
iterate through log field actor.orgunitPath:
The principal.user.attribute.labels.key UDM field is set to org_unit_path and the actor.orgunitPath log field is mapped to the principal.user.attribute.labels.value UDM field.
actor.groupId principal.user.group_identifiers If the events.name log field value contain one of the following values:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_challenge
  • login_verification
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
  • CHROMEOS_AFFILIATED_UNLOCK_FAILURE
  • CHROMEOS_AFFILIATED_UNLOCK_SUCCESS
  • CHROME_OS_CRD_CLIENT_CONNECTED
  • CHROMEOS_AFFILIATED_LOCK_SUCCESS
  • FAILED_PASSWORD_ATTEMPTS_EVENT
  • request
, then the actor.groupId log field is mapped to the target.user.group_identifiers UDM field.
Otherwise, the actor.groupId log field is mapped to the principal.user.group_identifiers UDM field.
actor.applicationInfo.oauthClientId additional.fields[oauth_client_id]
actor.applicationInfo.impersonation additional.fields[impersonation]
events.resourceIds about.resource.attribute.labels[resource_id] Iterate through log field events.resourceIds:
The about.resource.attribute.labels.key UDM field is set to a value generated from the template resource_id_%{index}, where %{index} is replaced with the value of the index log field and the events.resourceIds log field is mapped to the about.resource.attribute.labels.value UDM field.
resourceDetails.id about.resource.product_object_id Iterate through log field resourceDetails:
if the resourceDetails.id log field value is not empty, then the resourceDetails.id log field is mapped to the about.resource.product_object_id UDM field.
resourceDetails.title about.resource.name Iterate through log field resourceDetails:
if the resourceDetails.title log field value is not empty, then the resourceDetails.title log field is mapped to the about.resource.name UDM field.
resourceDetails.type about.resource.resource_subtype Iterate through log field resourceDetails:
if the resourceDetails.type log field value is not empty, then the resourceDetails.type log field is mapped to the about.resource.resource_subtype UDM field.
resourceDetails.application_id about.resource.attribute.labels[application_id] Iterate through log field resourceDetails:
if the resourceDetails.application_id log field value is not empty, then the about.resource.attribute.labels.key UDM field is set to application_id and the resourceDetails.application_id log field is mapped to the about.resource.attribute.labels.value UDM field.
resourceDetails.relation about.resource.attribute.labels[relation] Iterate through log field resourceDetails:
if the resourceDetails.relation log field value is not empty, then the about.resource.attribute.labels.key UDM field is set to relation and The resourceDetails.relation log field is mapped to the about.resource.attribute.labels.value UDM field.
resourceDetails.ownerEmail about.resource.attribute.labels[owner_email] Iterate through log field resourceDetails:
if the resourceDetails.ownerEmail log field value is not empty, then the about.resource.attribute.labels.key UDM field is set to owner_email and the resourceDetails.ownerEmail log field is mapped to the about.resource.attribute.labels.value UDM field.
resourceDetails.appliedLabels.id about.resource.attribute.labels[applied_labels_id] Iterate through log field resourceDetails:
iterate through log field resourceDetails.appliedLabels:
The about.resource.attribute.labels.key UDM field is set to a value generated from the template applied_labels_%{index1}_id, where %{index1} is replaced with the value of the index1 log field and the resourceDetails.appliedLabels.id log field is mapped to the about.resource.attribute.labels.value UDM field.
resourceDetails.appliedLabels.title about.resource.attribute.labels[applied_labels_title] Iterate through log field resourceDetails:
iterate through log field resourceDetails.appliedLabels:
The about.resource.attribute.labels.key UDM field is set to a value generated from the template applied_labels_%{index1}_title, where %{index1} is replaced with the value of the index1 log field and the resourceDetails.appliedLabels.title log field is mapped to the about.resource.attribute.labels.value UDM field.
resourceDetails.appliedLabels.reason.reasonType about.resource.attribute.labels[applied_labels_reason] Iterate through log field resourceDetails:
iterate through log field resourceDetails.appliedLabels:
The about.resource.attribute.labels.key UDM field is set to a value generated from the template applied_labels_%{index1}_reason, where %{index1} is replaced with the value of the index1 log field and the resourceDetails.appliedLabels.reason.reasonType log field is mapped to the about.resource.attribute.labels.value UDM field.
resourceDetails.appliedLabels.fieldValues.reason.reasonType about.resource.attribute.labels[applied_labels_field_value_reason] Iterate through log field resourceDetails:
iterate through log field resourceDetails.appliedLabels:
iterate through log field resourceDetails.appliedLabels.fieldValues:
The about.resource.attribute.labels.key UDM field is set to a value generated from the template applied_labels_%{index1}_field_values_%{index2}_reason, where %{index1} and %{index2} are replaced with the values of the index1 and index2 log fields and the resourceDetails.appliedLabels.fieldValues.reason.reasonType log field is mapped to the about.resource.attribute.labels.value UDM field.
resourceDetails.appliedLabels.fieldValues about.resource.attribute.labels[applied_labels_field_values_id] Iterate through log field resourceDetails:
iterate through log field resourceDetails.appliedLabels:
iterate through log field resourceDetails.appliedLabels.fieldValues:
The about.resource.attribute.labels.key UDM field is set to a value generated from the template applied_labels_%{index1}_field_values_%{index2}_id, where %{index1} and %{index2} are replaced with the values of the index1 and index2 log fields and the resourceDetails.appliedLabels.fieldValues.id log field is mapped to the about.resource.attribute.labels.value UDM field.
resourceDetails.appliedLabels.fieldValues.displayName about.resource.attribute.labels[applied_labels_field_values_displayName] Iterate through log field resourceDetails:
iterate through log field resourceDetails.appliedLabels:
iterate through log field resourceDetails.appliedLabels.fieldValues:
The about.resource.attribute.labels.key UDM field is set to a value generated from the template applied_labels_%{index1}_field_values_%{index2}_display_name, where %{index1} and %{index2} are replaced with the values of the index1 and index2 log fields and the resourceDetails.appliedLabels.fieldValues.displayName log field is mapped to the about.resource.attribute.labels.value UDM field.
resourceDetails.appliedLabels.fieldValues.type about.resource.attribute.labels[applied_labels_field_values_type] Iterate through log field resourceDetails:
iterate through log field resourceDetails.appliedLabels:
iterate through log field resourceDetails.appliedLabels.fieldValues:
The about.resource.attribute.labels.key UDM field is set to a value generated from the template applied_labels_%{index1}_field_values_%{index2}_type, where %{index1} and %{index2} are replaced with the values of the index1 and index2 log fields and the resourceDetails.appliedLabels.fieldValues.type log field is mapped to the about.resource.attribute.labels.value UDM field.
resourceDetails.appliedLabels.fieldValues.dateValue.year about.resource.attribute.labels[applied_labels_field_values_date_value_year] Iterate through log field resourceDetails:
iterate through log field resourceDetails.appliedLabels:
iterate through log field resourceDetails.appliedLabels.fieldValues:
The about.resource.attribute.labels.key UDM field is set to a value generated from the template applied_labels_%{index1}_field_values_%{index2}_date_value_year, where %{index1} and %{index2} are replaced with the values of the index1 and index2 log fields and the resourceDetails.appliedLabels.fieldValues.dateValue.year log field is mapped to the about.resource.attribute.labels.value UDM field.
resourceDetails.appliedLabels.fieldValues.dateValue.month about.resource.attribute.labels[applied_labels_field_values_date_value_month] Iterate through log field resourceDetails:
iterate through log field resourceDetails.appliedLabels:
iterate through log field resourceDetails.appliedLabels.fieldValues:
The about.resource.attribute.labels.key UDM field is set to a value generated from the template applied_labels_%{index1}_field_values_%{index2}_date_value_month, where %{index1} and %{index2} are replaced with the values of the index1 and index2 log fields and the resourceDetails.appliedLabels.fieldValues.dateValue.month log field is mapped to the about.resource.attribute.labels.value UDM field.
resourceDetails.appliedLabels.fieldValues.dateValue.day about.resource.attribute.labels[applied_labels_field_values_date_value_day] Iterate through log field resourceDetails:
iterate through log field resourceDetails.appliedLabels:
iterate through log field resourceDetails.appliedLabels.fieldValues:
The about.resource.attribute.labels.key UDM field is set to a value generated from the template applied_labels_%{index1}_field_values_%{index2}_date_value_day, where %{index1} and %{index2} are replaced with the values of the index1 and index2 log fields and the resourceDetails.appliedLabels.fieldValues.dateValue.day log field is mapped to the about.resource.attribute.labels.value UDM field.
resourceDetails.appliedLabels.fieldValues.selectionListValue.values.id about.resource.attribute.labels[applied_labels_field_values_selection_list_value_id] Iterate through log field resourceDetails:
iterate through log field resourceDetails.appliedLabels:
iterate through log field resourceDetails.appliedLabels.fieldValues:
iterate through log field resourceDetails.appliedLabels.fieldValues.selectionListValue.values:
The about.resource.attribute.labels.key UDM field is set to a value generated from the template applied_labels_%{index1}_field_values_%{index2}_selection_list_value_%{index3}_id, where %{index1}, %{index2}, and %{index3} are replaced with the values of the index1, index2, and index3 log fields and the resourceDetails.appliedLabels.fieldValues.selectionListValue.values.id log field is mapped to the about.resource.attribute.labels.value UDM field.
resourceDetails.appliedLabels.fieldValues.selectionListValue.values.displayName about.resource.attribute.labels[applied_labels_field_values_selection_list_value_display_name] Iterate through log field resourceDetails:
iterate through log field resourceDetails.appliedLabels:
iterate through log field resourceDetails.appliedLabels.fieldValues:
iterate through log field resourceDetails.appliedLabels.fieldValues.selectionListValue.values:
The about.resource.attribute.labels.key UDM field is set to a value generated from the template applied_labels_%{index1}_field_values_%{index2}_selection_list_value_%{index3}_display_name, where %{index1}, %{index2}, and %{index3} are replaced with the values of the index1, index2, and index3 log fields and the resourceDetails.appliedLabels.fieldValues.selectionListValue.values.displayName log field is mapped to the about.resource.attribute.labels.value UDM field.
resourceDetails.appliedLabels.fieldValues.selectionValue.displayName about.resource.attribute.labels[applied_labels_field_values_selection_value_display_name] Iterate through log field resourceDetails:
iterate through log field resourceDetails.appliedLabels:
iterate through log field resourceDetails.appliedLabels.fieldValues:
The about.resource.attribute.labels.key UDM field is set to a value generated from the template applied_labels_%{index1}_field_values_%{index2}_selection_value_display_name, where %{index1} and %{index2} are replaced with the values of the index1 and index2 log fields and the resourceDetails.appliedLabels.fieldValues.selectionValue.displayName log field is mapped to the about.resource.attribute.labels.value UDM field.
resourceDetails.appliedLabels.fieldValues.selectionValue.id about.resource.attribute.labels[applied_labels_field_values_selection_value_id] Iterate through log field resourceDetails:
iterate through log field resourceDetails.appliedLabels:
iterate through log field resourceDetails.appliedLabels.fieldValues:
The about.resource.attribute.labels.key UDM field is set to a value generated from the template applied_labels_%{index1}_field_values_%{index2}_selection_value_id, where %{index1} and %{index2} are replaced with the values of the index1 and index2 log fields and the resourceDetails.appliedLabels.fieldValues.selectionValue.id log field is mapped to the about.resource.attribute.labels.value UDM field.
resourceDetails.appliedLabels.fieldValues.selectionValue.badged about.resource.attribute.labels[applied_labels_field_values_selection_value_badged] Iterate through log field resourceDetails:
iterate through log field resourceDetails.appliedLabels:
iterate through log field resourceDetails.appliedLabels.fieldValues:
The about.resource.attribute.labels.key UDM field is set to a value generated from the template applied_labels_%{index1}_field_values_%{index2}_selection_value_badged, where %{index1} and %{index2} are replaced with the values of the index1 and index2 log fields and the resourceDetails.appliedLabels.fieldValues.selectionValue.badged log field is mapped to the about.resource.attribute.labels.value UDM field.
resourceDetails.appliedLabels.fieldValues.textListValue.values about.resource.attribute.labels[applied_labels_field_values_text_list_value_values] Iterate through log field resourceDetails:
iterate through log field resourceDetails.appliedLabels:
iterate through log field resourceDetails.appliedLabels.fieldValues:
iterate through log field resourceDetails.appliedLabels.fieldValues.textListValue.values:
The about.resource.attribute.labels.key UDM field is set to a value generated from the template applied_labels_%{index1}_field_values_%{index2}_text_list_value_%{index3}_values, where %{index1}, %{index2}, and %{index3} are replaced with the values of the index1, index2, and index3 log fields and the resourceDetails.appliedLabels.fieldValues.textListValue.values log field is mapped to the about.resource.attribute.labels.value UDM field.
resourceDetails.appliedLabels.fieldValues.userListValue.values.email about.resource.attribute.labels[applied_labels_field_values_user_list_value_email] Iterate through log field resourceDetails:
iterate through log field resourceDetails.appliedLabels:
iterate through log field resourceDetails.appliedLabels.fieldValues:
iterate through log field resourceDetails.appliedLabels.fieldValues.userListValue.values:
The about.resource.attribute.labels.key UDM field is set to a value generated from the template applied_labels_%{index1}_field_values_%{index2}_user_list_value_%{index3}_email, where %{index1}, %{index2}, and %{index3} are replaced with the values of the index1, index2, and index3 log fields and the resourceDetails.appliedLabels.fieldValues.userListValue.values.email log field is mapped to the about.resource.attribute.labels.value UDM field.
networkInfo.ipAsn principal.ip_geo_artifact.network.asn Iterate through log field networkInfo.ipAsn:
The networkInfo.ipAsn log field is mapped to the principal.ip_geo_artifact.network.asn UDM field.
networkInfo.subdivisionCode principal.location.state
networkInfo.regionCode principal.location.country_or_region
actor.applicationInfo.applicationName principal.application
userDeviceInfo.deviceOsVersion principal.platform_version
userDeviceInfo.deviceId principal.asset_id If the userDeviceInfo.deviceId log field value is not empty, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{userDeviceInfo.deviceId}, where %{userDeviceInfo.deviceId} is replaced with the value of the userDeviceInfo.deviceId log field.
userDeviceInfo.deviceType principal.asset.attribute.labels[device_type]
principal.platform If the userDeviceInfo.deviceType log field value is equal to ANDROID_SYNC, then the principal.platform UDM field is set to ANDROID.
Else if the userDeviceInfo.deviceType log field value is equal to CHROME_OS_SYNC, then the principal.platform UDM field is set to CHROME_OS.
Else if the userDeviceInfo.deviceType log field value is equal to IOS_SYNC, then the principal.platform UDM field is set to IOS.
Else if the userDeviceInfo.deviceType log field value is equal to DESKTOP_MAC, then the principal.platform UDM field is set to MAC.
Else if the userDeviceInfo.deviceType log field value is equal to DESKTOP_WINDOWS, then the principal.platform UDM field is set to WINDOWS.
Else if the userDeviceInfo.deviceType log field value is equal to DESKTOP_LINUX, then The principal.platform UDM field is set to LINUX.
Else if the userDeviceInfo.deviceType log field value is equal to DESKTOP_CHROME_OS, then the principal.platform UDM field is set to CHROME_OS.
Else if the userDeviceInfo.deviceType log field value is not empty, then the principal.platform UDM field is set to UNKNOWN_PLATFORM.
events.status.httpStatusCode network.http.response_code
events.status.eventStatus security_result.action_details
security_result.action If the events.status.eventStatus log field value contain one of the following values:
  • SUCCEEDED
  • SUCCEEDED_WITH_WARNINGS
, then the security_result.action UDM field is set to ALLOW.
Else if the events.status.eventStatus log field value is equal to FAILED, then the security_result.action UDM field is set to FAIL.
Otherwise, the security_result.action UDM field is set to UNKNOWN_ACTION.
events.status.errorCode security_result.detection_fields[errorCode]
events.status.errorMessage security_result.description
resourceDetails.ownerDetails.ownerType about.resource.attribute.labels[ownerType] Iterate through log field resourceDetails:
The about.resource.attribute.labels.key UDM field is set to ownerType and the resourceDetails.ownerDetails.ownerType log field is mapped to the about.resource.attribute.labels.value UDM field.
resourceDetails.ownerDetails.ownerIdentity.customerIdentity.id about.resource.attribute.labels[ownerIdentity_customerIdentity_id] Iterate through log field resourceDetails:
iterate through log field resourceDetails.ownerDetails.ownerIdentity:
The about.resource.attribute.labels.key UDM field is set to a value generated from the template ownerIdentity_%{index1}_customerIdentity_id, where %{index1} is replaced with the value of the index1 log field and the resourceDetails.ownerDetails.ownerIdentity.customerIdentity.id log field is mapped to the about.resource.attribute.labels.value UDM field.
resourceDetails.ownerDetails.ownerIdentity.userIdentity.userEmail about.resource.attribute.labels[ownerIdentity_userIdentity_userEmail] Iterate through log field resourceDetails:
iterate through log field resourceDetails.ownerDetails.ownerIdentity:
The about.resource.attribute.labels.key UDM field is set to a value generated from the template ownerIdentity_%{index1}_userIdentity_userEmail, where %{index1} is replaced with the value of the index1 log field and the resourceDetails.ownerDetails.ownerIdentity.userIdentity.userEmail log field is mapped to the about.resource.attribute.labels.value UDM field.
resourceDetails.ownerDetails.ownerIdentity.userIdentity.id about.resource.attribute.labels[ownerIdentity_userIdentity_id] Iterate through log field resourceDetails:
iterate through log field resourceDetails.ownerDetails.ownerIdentity:
The about.resource.attribute.labels.key UDM field is set to a value generated from the template ownerIdentity_%{index1}_userIdentity_id, where %{index1} is replaced with the value of the index1 log field and the resourceDetails.ownerDetails.ownerIdentity.userIdentity.id log field is mapped to the about.resource.attribute.labels.value UDM field.
resourceDetails.ownerDetails.ownerIdentity.groupIdentity.groupEmail about.resource.attribute.labels[ownerIdentity_groupIdentity_groupEmail] Iterate through log field resourceDetails:
iterate through log field resourceDetails.ownerDetails.ownerIdentity:
The about.resource.attribute.labels.key UDM field is set to a value generated from the template ownerIdentity_%{index1}_groupIdentity_groupEmail, where %{index1} is replaced with the value of the index1 log field and the resourceDetails.ownerDetails.ownerIdentity.groupIdentity.groupEmail log field is mapped to the about.resource.attribute.labels.value UDM field.
resourceDetails.ownerDetails.ownerIdentity.groupIdentity.id about.resource.attribute.labels[ownerIdentity_groupIdentity_id] Iterate through log field resourceDetails:
iterate through log field resourceDetails.ownerDetails.ownerIdentity:
The about.resource.attribute.labels.key UDM field is set to a value generated from the template ownerIdentity_%{index1}_groupIdentity_id, where %{index1} is replaced with the value of the index1 log field and the resourceDetails.ownerDetails.ownerIdentity.groupIdentity.id log field is mapped to the about.resource.attribute.labels.value UDM field.
resourceDetails.ownerDetails.ownerIdentity.sharedDriveIdentity.sharedDriveName about.resource.attribute.labels[ownerIdentity_sharedDriveIdentity_sharedDriveName] Iterate through log field resourceDetails:
iterate through log field resourceDetails.ownerDetails.ownerIdentity:
The about.resource.attribute.labels.key UDM field is set to a value generated from the template ownerIdentity_%{index1}_sharedDriveIdentity_sharedDriveName, where %{index1} is replaced with the value of the index1 log field and the resourceDetails.ownerDetails.ownerIdentity.sharedDriveIdentity.sharedDriveName log field is mapped to the about.resource.attribute.labels.value UDM field.
resourceDetails.ownerDetails.ownerIdentity.sharedDriveIdentity.id about.resource.attribute.labels[ownerIdentity_sharedDriveIdentity_id] Iterate through log field resourceDetails:
iterate through log field resourceDetails.ownerDetails.ownerIdentity:
The about.resource.attribute.labels.key UDM field is set to a value generated from the template ownerIdentity_%{index1}_sharedDriveIdentity_id, where %{index1} is replaced with the value of the index1 log field and the resourceDetails.ownerDetails.ownerIdentity.sharedDriveIdentity.id log field is mapped to the about.resource.attribute.labels.value UDM field.
isAgenticAction additional.fields[isAgenticAction]
principal.ai.type If the actor.agentAttributionInfo.agentType log field value contain one of the following values:
  • WORKSPACE_STUDIO_AGENT
  • GEMINI_ENTERPRISE_AGENT
, then the principal.ai.type UDM field is set to AGENT.
Otherwise, the principal.ai.type UDM field is set to AI_TYPE_UNSPECIFIED.
actor.agentAttributionInfo.agentId principal.ai.product_object_id
actor.agentAttributionInfo.agentName principal.ai.display_name
actor.agentAttributionInfo.agentOwner.id principal.ai.owners.userid
actor.agentAttributionInfo.agentOwner.email principal.ai.owners.email_addresses

Field mapping reference: WORKSPACE_ACTIVITY

Field mapping reference: workspace activity access_transparency application

The following table provides the log fields to UDM field mapping corresponding to events for the access_transparency application.

Event Name Log field UDM mapping Logic
ACCESS ACCESS_APPROVAL_ALERT_CENTER_IDS additional.fields[access_approval_alert_center_ids]
ACCESS ACCESS_APPROVAL_REQUEST_IDS additional.fields[access_approval_request_ids]
ACCESS ACCESS_APPROVALS_SCOPING additional.fields[access_approvals_scoping]
ACCESS ACCESS_MANAGEMENT_POLICY additional.fields[access_management_policy]
ACCESS ACCESS_MANAGEMENT_POLICY_SCOPING additional.fields[access_management_policy_scoping]
ACCESS ACCESS_MANAGEMENT_RULE_URLS additional.fields[access_management_rule_urls]
ACCESS ACCESS_MANAGEMENT_SCOPING additional.fields[access_management_scoping]
ACCESS ACTOR_HOME_OFFICE principal.user.office_address.country_or_region
ACCESS GSUITE_PRODUCT_NAME target.application The target.application UDM field is set to Access Transparency.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to GSUITE_PRODUCT_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
ACCESS JUSTIFICATIONS additional.fields[justifications]
ACCESS LOG_ID additional.fields[log_id]
ACCESS ON_BEHALF_OF additional.fields[on_behalf_of]
ACCESS OWNER_EMAIL target.user.email_addresses
ACCESS RESOURCE_NAME target.resource.name
ACCESS TICKETS additional.fields[tickets]

Field mapping reference: workspace activity chrome application

The following table provides the log fields to UDM field mapping corresponding to events for the chrome application.

Event Name Log field UDM mapping Logic
CHROME_OS_ADD_USER DEVICE_NAME principal.hostname
CHROME_OS_ADD_USER DEVICE_NAME principal.asset.hostname
CHROME_OS_ADD_USER DEVICE_PLATFORM principal.asset.platform_software.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_PLATFORM, then if the events.parameters.value log field value is windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value is mac, then the principal.asset.platform_software.platform UDM field is set to MAC. Else if the events.parameters.value log field value is linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
CHROME_OS_ADD_USER DEVICE_USER target.user.user_display_name
CHROME_OS_ADD_USER DIRECTORY_DEVICE_ID principal.asset.attribute.labels[directory_device_id]
CHROME_OS_ADD_USER EVENT_REASON security_result.summary
CHROME_OS_ADD_USER TIMESTAMP additional.fields[timestamp]
CHROME_OS_ADD_USER target.application The target.application UDM field is set to Chrome.
CHROME_OS_REMOVE_USER DEVICE_NAME principal.hostname
CHROME_OS_REMOVE_USER DEVICE_NAME principal.asset.hostname
CHROME_OS_REMOVE_USER DEVICE_PLATFORM principal.asset.platform_software.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_PLATFORM, then if the events.parameters.value log field value is windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value is mac, then the principal.asset.platform_software.platform UDM field is set to MAC. Else if the events.parameters.value log field value is linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
CHROME_OS_REMOVE_USER DEVICE_USER target.user.user_display_name
CHROME_OS_REMOVE_USER DIRECTORY_DEVICE_ID principal.asset.attribute.labels[directory_device_id]
CHROME_OS_REMOVE_USER EVENT_REASON security_result.summary
CHROME_OS_REMOVE_USER REMOVE_USER_REASON security_result.description
CHROME_OS_REMOVE_USER TIMESTAMP additional.fields[timestamp]
CHROME_OS_REMOVE_USER target.application The target.application UDM field is set to Chrome.
DEVICE_BOOT_STATE_CHANGE DEVICE_NAME principal.hostname
DEVICE_BOOT_STATE_CHANGE DEVICE_NAME principal.asset.hostname
DEVICE_BOOT_STATE_CHANGE DEVICE_PLATFORM principal.asset.platform_software.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_PLATFORM, then if the events.parameters.value log field value is windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value is mac, then the principal.asset.platform_software.platform UDM field is set to MAC. Else if the events.parameters.value log field value is linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
DEVICE_BOOT_STATE_CHANGE DIRECTORY_DEVICE_ID principal.asset.attribute.labels[directory_device_id]
DEVICE_BOOT_STATE_CHANGE EVENT_REASON security_result.summary
DEVICE_BOOT_STATE_CHANGE NEW_BOOT_MODE principal.asset.attribute.labels[new_boot_mode]
DEVICE_BOOT_STATE_CHANGE PREVIOUS_BOOT_MODE principal.asset.attribute.labels[previous_boot_mode]
DEVICE_BOOT_STATE_CHANGE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
DEVICE_BOOT_STATE_CHANGE TIMESTAMP additional.fields[timestamp]
DEVICE_BOOT_STATE_CHANGE target.application The target.application UDM field is set to Chrome.
CHROME_OS_LOGIN_FAILURE_EVENT DEVICE_NAME principal.hostname
CHROME_OS_LOGIN_FAILURE_EVENT DEVICE_NAME principal.asset.hostname
CHROME_OS_LOGIN_FAILURE_EVENT DEVICE_PLATFORM principal.asset.platform_software.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_PLATFORM, then if the events.parameters.value log field value is windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value is mac, then the principal.asset.platform_software.platform UDM field is set to MAC. Else if the events.parameters.value log field value is linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
CHROME_OS_LOGIN_FAILURE_EVENT DEVICE_USER principal.user.user_display_name
CHROME_OS_LOGIN_FAILURE_EVENT DIRECTORY_DEVICE_ID principal.asset.attribute.labels[directory_device_id]
CHROME_OS_LOGIN_FAILURE_EVENT EVENT_REASON security_result.summary
CHROME_OS_LOGIN_FAILURE_EVENT LOGIN_FAILURE_REASON security_result.description
CHROME_OS_LOGIN_FAILURE_EVENT TIMESTAMP additional.fields[timestamp]
CHROME_OS_LOGIN_FAILURE_EVENT target.application The target.application UDM field is set to Chrome.
CHROME_OS_LOGIN_FAILURE_EVENT extensions.auth.type The extensions.auth.type UDM field is set to SSO.
CHROME_OS_LOGIN_FAILURE_EVENT extensions.auth.mechanism The extensions.auth.mechanism UDM field is set to USERNAME_PASSWORD.
CHROME_OS_LOGIN_LOGOUT_EVENT DEVICE_NAME principal.hostname
CHROME_OS_LOGIN_LOGOUT_EVENT DEVICE_NAME principal.asset.hostname
CHROME_OS_LOGIN_LOGOUT_EVENT DEVICE_PLATFORM principal.asset.platform_software.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_PLATFORM, then if the events.parameters.value log field value is windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value is mac, then the principal.asset.platform_software.platform UDM field is set to MAC. Else if the events.parameters.value log field value is linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
CHROME_OS_LOGIN_LOGOUT_EVENT DEVICE_USER principal.user.user_display_name
CHROME_OS_LOGIN_LOGOUT_EVENT DIRECTORY_DEVICE_ID principal.asset.attribute.labels[directory_device_id]
CHROME_OS_LOGIN_LOGOUT_EVENT EVENT_REASON security_result.summary
CHROME_OS_LOGIN_LOGOUT_EVENT TIMESTAMP additional.fields[timestamp]
CHROME_OS_LOGIN_LOGOUT_EVENT target.application The target.application UDM field is set to Chrome.
CHROME_OS_LOGIN_LOGOUT_EVENT extensions.auth.type The extensions.auth.type UDM field is set to SSO.
CHROME_OS_LOGIN_LOGOUT_EVENT extensions.auth.mechanism The extensions.auth.mechanism UDM field is set to USERNAME_PASSWORD.
CHROME_OS_LOGIN_EVENT DEVICE_NAME principal.hostname
CHROME_OS_LOGIN_EVENT DEVICE_NAME principal.asset.hostname
CHROME_OS_LOGIN_EVENT DEVICE_PLATFORM principal.asset.platform_software.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_PLATFORM, then if the events.parameters.value log field value is windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value is mac, then the principal.asset.platform_software.platform UDM field is set to MAC. Else if the events.parameters.value log field value is linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
CHROME_OS_LOGIN_EVENT DEVICE_USER principal.user.user_display_name
CHROME_OS_LOGIN_EVENT DIRECTORY_DEVICE_ID principal.asset.attribute.labels[directory_device_id]
CHROME_OS_LOGIN_EVENT EVENT_REASON security_result.summary
CHROME_OS_LOGIN_EVENT TIMESTAMP additional.fields[timestamp]
CHROME_OS_LOGIN_EVENT target.application The target.application UDM field is set to Chrome.
CHROME_OS_LOGIN_EVENT extensions.auth.type The extensions.auth.type UDM field is set to SSO.
CHROME_OS_LOGIN_EVENT extensions.auth.mechanism The extensions.auth.mechanism UDM field is set to USERNAME_PASSWORD.
CHROME_OS_LOGOUT_EVENT DEVICE_NAME principal.hostname
CHROME_OS_LOGOUT_EVENT DEVICE_NAME principal.asset.hostname
CHROME_OS_LOGOUT_EVENT DEVICE_PLATFORM principal.asset.platform_software.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_PLATFORM, then if the events.parameters.value log field value is windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value is mac, then the principal.asset.platform_software.platform UDM field is set to MAC. Else if the events.parameters.value log field value is linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
CHROME_OS_LOGOUT_EVENT DEVICE_USER principal.user.user_display_name
CHROME_OS_LOGOUT_EVENT DIRECTORY_DEVICE_ID principal.asset.attribute.labels[directory_device_id]
CHROME_OS_LOGOUT_EVENT EVENT_REASON security_result.summary
CHROME_OS_LOGOUT_EVENT TIMESTAMP additional.fields[timestamp]
CHROME_OS_LOGOUT_EVENT target.application The target.application UDM field is set to Chrome.
CHROME_OS_LOGOUT_EVENT extensions.auth.type The extensions.auth.type UDM field is set to SSO.
CHROME_OS_LOGOUT_EVENT extensions.auth.mechanism The extensions.auth.mechanism UDM field is set to USERNAME_PASSWORD.
CHROME_OS_REPORTING_DATA_LOST DEVICE_NAME principal.hostname
CHROME_OS_REPORTING_DATA_LOST DEVICE_NAME principal.asset.hostname
CHROME_OS_REPORTING_DATA_LOST DEVICE_PLATFORM principal.asset.platform_software.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_PLATFORM, then if the events.parameters.value log field value is windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value is mac, then the principal.asset.platform_software.platform UDM field is set to MAC. Else if the events.parameters.value log field value is linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
CHROME_OS_REPORTING_DATA_LOST DIRECTORY_DEVICE_ID principal.asset.attribute.labels[directory_device_id]
CHROME_OS_REPORTING_DATA_LOST EVENT_REASON security_result.summary
CHROME_OS_REPORTING_DATA_LOST TIMESTAMP additional.fields[timestamp]
CHROME_OS_REPORTING_DATA_LOST target.application The target.application UDM field is set to Chrome.
PASSWORD_CHANGED BROWSER_VERSION target.resource.attribute.labels[browser_version]
PASSWORD_CHANGED CLIENT_TYPE target.resource.attribute.labels[client_type]
PASSWORD_CHANGED DEVICE_ID principal.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The principal.asset_id UDM field is set to a value generated from the template AssetId:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
PASSWORD_CHANGED DEVICE_NAME principal.hostname
PASSWORD_CHANGED DEVICE_NAME principal.asset.hostname
PASSWORD_CHANGED DEVICE_PLATFORM principal.asset.platform_software.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_PLATFORM, then if the events.parameters.value log field value is windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value is mac, then the principal.asset.platform_software.platform UDM field is set to MAC. Else if the events.parameters.value log field value is linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
PASSWORD_CHANGED DEVICE_USER principal.user.user_display_name
PASSWORD_CHANGED DIRECTORY_DEVICE_ID principal.asset.attribute.labels[directory_device_id]
PASSWORD_CHANGED PROFILE_USER_NAME about.user.user_display_name
PASSWORD_CHANGED TIMESTAMP additional.fields[timestamp]
PASSWORD_CHANGED TRIGGER_USER target.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to TRIGGER_USER, then if the events.parameters.value log field value matches the regular expression pattern: ^.+@.+$, then the events.parameters.value log field is mapped to the target.user.email_addresses UDM field. Otherwise, the events.parameters.value log field is mapped to the target.user.userid UDM field.
PASSWORD_CHANGED USER_AGENT network.http.user_agent
PASSWORD_CHANGED VIRTUAL_DEVICE_ID additional.fields[virtual_device_id]
PASSWORD_CHANGED target.application The target.application UDM field is set to Chrome.
PASSWORD_REUSE BROWSER_VERSION target.resource.attribute.labels[browser_version]
PASSWORD_REUSE CLIENT_TYPE target.resource.attribute.labels[client_type]
PASSWORD_REUSE DEVICE_ID principal.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The principal.asset_id UDM field is set to a value generated from the template AssetId:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
PASSWORD_REUSE DEVICE_NAME principal.hostname
PASSWORD_REUSE DEVICE_NAME principal.asset.hostname
PASSWORD_REUSE DEVICE_PLATFORM principal.asset.platform_software.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_PLATFORM, then if the events.parameters.value log field value is windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value is mac, then the principal.asset.platform_software.platform UDM field is set to MAC. Else if the events.parameters.value log field value is linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
PASSWORD_REUSE DEVICE_USER principal.user.user_display_name
PASSWORD_REUSE DIRECTORY_DEVICE_ID principal.asset.attribute.labels[directory_device_id]
PASSWORD_REUSE EVENT_REASON security_result.summary
PASSWORD_REUSE EVENT_RESULT security_result.action_details
PASSWORD_REUSE EVENT_RESULT security_result.action Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to EVENT_RESULT, then if the events.parameters.value log field value contain one of the following values:
  • BLOCK
  • BLOCKED
, then the security_result.action UDM field is set to BLOCK. Else if the events.parameters.value log field value is equal to ALLOWED, then the security_result.action UDM field is set to ALLOW.
PASSWORD_REUSE PROFILE_USER_NAME about.user.user_display_name
PASSWORD_REUSE TIMESTAMP additional.fields[timestamp]
PASSWORD_REUSE TRIGGER_USER target.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to TRIGGER_USER, then if the events.parameters.value log field value matches the regular expression pattern: ^.+@.+$, then the events.parameters.value log field is mapped to the target.user.email_addresses UDM field. Otherwise, the events.parameters.value log field is mapped to the target.user.userid UDM field.
PASSWORD_REUSE URL target.url
PASSWORD_REUSE USER_AGENT network.http.user_agent
PASSWORD_REUSE VIRTUAL_DEVICE_ID additional.fields[virtual_device_id]
PASSWORD_REUSE target.application The target.application UDM field is set to Chrome.
DLP_EVENT BROWSER_VERSION target.resource.attribute.labels[browser_version]
DLP_EVENT CLIENT_TYPE target.resource.attribute.labels[client_type]
DLP_EVENT DEVICE_NAME principal.hostname
DLP_EVENT DEVICE_NAME principal.asset.hostname
DLP_EVENT DEVICE_PLATFORM principal.asset.platform_software.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_PLATFORM, then if the events.parameters.value log field value is windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value is mac, then the principal.asset.platform_software.platform UDM field is set to MAC. Else if the events.parameters.value log field value is linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
DLP_EVENT DEVICE_USER principal.user.user_display_name
DLP_EVENT EVENT_REASON security_result.summary
DLP_EVENT EVENT_RESULT security_result.action_details
DLP_EVENT EVENT_RESULT security_result.action Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to EVENT_RESULT, then if the events.parameters.value log field value contain one of the following values:
  • BLOCK
  • BLOCKED
, then the security_result.action UDM field is set to BLOCK. Else if the events.parameters.value log field value is equal to ALLOWED, then the security_result.action UDM field is set to ALLOW.
DLP_EVENT TIMESTAMP additional.fields[timestamp]
DLP_EVENT TRIGGER_DESTINATION additional.fields[trigger_destination]
DLP_EVENT TRIGGER_SOURCE additional.fields[trigger_source]
DLP_EVENT TRIGGER_TYPE security_result.detection_fields[trigger_type]
DLP_EVENT TRIGGERED_RULES_REASON security_result.rule_labels[triggerd_rules_reason]
DLP_EVENT URL target.url
DLP_EVENT USER_AGENT network.http.user_agent
DLP_EVENT target.application The target.application UDM field is set to Chrome.
CONTENT_TRANSFER BROWSER_VERSION target.resource.attribute.labels[browser_version]
CONTENT_TRANSFER CLIENT_TYPE target.resource.attribute.labels[client_type]
CONTENT_TRANSFER CONTENT_HASH target.file.sha256 Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to CONTENT_HASH, then if the events.parameters.value log field value matches the regular expression pattern: ^[a-f0-9]{64}$, then the events.parameters.value log field is mapped to the target.file.sha256 UDM field.
Else if the events.parameters.value log field value matches the regular expression pattern: ^[a-fA-F0-9]{32}$, then the events.parameters.value log field is mapped to the target.file.md5 UDM field.
Otherwise, the events.parameters.value log field is mapped to the target.file.sha1 UDM field.
CONTENT_TRANSFER CONTENT_NAME target.file.full_path
CONTENT_TRANSFER CONTENT_NAME target.file.file_type Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to CONTENT_NAME, then the file_type field is extracted from events.parameters.value log field using the Grok pattern. file_type log field value is set to a value generated from the template FILE_TYPE_%{file_type}, where %{file_type} is replaced with the value of the file_type log field. If the file_type log field value contain one of the following values:
  • FILE_TYPE_ACE
  • FILE_TYPE_ANDROID
  • FILE_TYPE_APPLE
  • FILE_TYPE_APPLE_PLIST
  • FILE_TYPE_APPLEDOUBLE
  • FILE_TYPE_APPLESCRIPT
  • FILE_TYPE_APPLESCRIPT_COMPILED
  • FILE_TYPE_APPLESINGLE
  • FILE_TYPE_ARC
  • FILE_TYPE_ARJ
  • FILE_TYPE_ASD
  • FILE_TYPE_ASF
  • FILE_TYPE_AVI
  • FILE_TYPE_AWK
  • FILE_TYPE_BLACKHOLE
  • FILE_TYPE_BMP
  • FILE_TYPE_BZIP
  • FILE_TYPE_C
  • FILE_TYPE_CAB
  • FILE_TYPE_CAP
  • FILE_TYPE_CHM
  • FILE_TYPE_COFF
  • FILE_TYPE_COOKIE
  • FILE_TYPE_CPP
  • FILE_TYPE_CRX
  • FILE_TYPE_DEB
  • FILE_TYPE_DIB
  • FILE_TYPE_DIVX
  • FILE_TYPE_DMG
  • FILE_TYPE_DOC
  • FILE_TYPE_DOCX
  • FILE_TYPE_DOS_COM
  • FILE_TYPE_DOS_EXE
  • FILE_TYPE_DYALOG
  • FILE_TYPE_DZIP
  • FILE_TYPE_EBOOK
  • FILE_TYPE_ELF
  • FILE_TYPE_EMAIL_TYPE
  • FILE_TYPE_EMF
  • FILE_TYPE_EOT
  • FILE_TYPE_EPS
  • FILE_TYPE_FLA
  • FILE_TYPE_FLAC
  • FILE_TYPE_FLC
  • FILE_TYPE_FLI
  • FILE_TYPE_FLV
  • FILE_TYPE_FORTRAN
  • FILE_TYPE_FPX
  • FILE_TYPE_GIF
  • FILE_TYPE_GIMP
  • FILE_TYPE_GUL
  • FILE_TYPE_GZIP
  • FILE_TYPE_HTML
  • FILE_TYPE_HWP
  • FILE_TYPE_ICO
  • FILE_TYPE_IN_DESIGN
  • FILE_TYPE_IPHONE
  • FILE_TYPE_ISOIMAGE
  • FILE_TYPE_JAR
  • FILE_TYPE_JAVA
  • FILE_TYPE_JAVA_BYTECODE
  • FILE_TYPE_JAVASCRIPT
  • FILE_TYPE_JNG
  • FILE_TYPE_JPEG
  • FILE_TYPE_KGB
  • FILE_TYPE_LATEX
  • FILE_TYPE_LINUX
  • FILE_TYPE_LINUX_KERNEL
  • FILE_TYPE_LNK
  • FILE_TYPE_MACH_O
  • FILE_TYPE_MACINTOSH
  • FILE_TYPE_MACINTOSH_HFS
  • FILE_TYPE_MACINTOSH_LIB
  • FILE_TYPE_MIDI
  • FILE_TYPE_MOV
  • FILE_TYPE_MP3
  • FILE_TYPE_MP4
  • FILE_TYPE_MPEG
  • FILE_TYPE_MSCOMPRESS
  • FILE_TYPE_MSI
  • FILE_TYPE_NE_DLL
  • FILE_TYPE_NE_EXE
  • FILE_TYPE_ODF
  • FILE_TYPE_ODG
  • FILE_TYPE_ODP
  • FILE_TYPE_ODS
  • FILE_TYPE_ODT
  • FILE_TYPE_OGG
  • FILE_TYPE_OUTLOOK
  • FILE_TYPE_PALMOS
  • FILE_TYPE_PASCAL
  • FILE_TYPE_PDF
  • FILE_TYPE_PE_DLL
  • FILE_TYPE_PE_EXE
  • FILE_TYPE_PERL
  • FILE_TYPE_PHP
  • FILE_TYPE_PKG
  • FILE_TYPE_PNG
  • FILE_TYPE_POWERSHELL
  • FILE_TYPE_PPSX
  • FILE_TYPE_PPT
  • FILE_TYPE_PPTX
  • FILE_TYPE_PS
  • FILE_TYPE_PSD
  • FILE_TYPE_PYTHON
  • FILE_TYPE_QUICKTIME
  • FILE_TYPE_RAR
  • FILE_TYPE_RM
  • FILE_TYPE_ROM
  • FILE_TYPE_RPM
  • FILE_TYPE_RTF
  • FILE_TYPE_RUBY
  • FILE_TYPE_RZIP
  • FILE_TYPE_SCRIPT
  • FILE_TYPE_SEVENZIP
  • FILE_TYPE_SHELLSCRIPT
  • FILE_TYPE_SVG
  • FILE_TYPE_SWF
  • FILE_TYPE_SYMBIAN
  • FILE_TYPE_T3GP
  • FILE_TYPE_TAR
  • FILE_TYPE_TARGA
  • FILE_TYPE_TEXT
  • FILE_TYPE_TIFF
  • FILE_TYPE_TORRENT
  • FILE_TYPE_TTF
  • FILE_TYPE_UNSPECIFIED
  • FILE_TYPE_VBA
  • FILE_TYPE_WAV
  • FILE_TYPE_WEBP
  • FILE_TYPE_WINCE
  • FILE_TYPE_WMA
  • FILE_TYPE_WMV
  • FILE_TYPE_WOFF
  • FILE_TYPE_XLS
  • FILE_TYPE_XLSX
  • FILE_TYPE_XML
  • FILE_TYPE_XPI
  • FILE_TYPE_XWD
  • FILE_TYPE_ZIP
  • FILE_TYPE_ZLIB
, then the file_type log field is mapped to the target.file.file_type UDM field.
CONTENT_TRANSFER CONTENT_SIZE target.file.size
CONTENT_TRANSFER CONTENT_TYPE target.file.mime_type
CONTENT_TRANSFER CONTENT_TRANSFER_METHOD security_result.detection_fields[content_transfer_method]
CONTENT_TRANSFER DEVICE_ID principal.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The principal.asset_id UDM field is set to a value generated from the template AssetId:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
CONTENT_TRANSFER DEVICE_NAME principal.hostname
CONTENT_TRANSFER DEVICE_NAME principal.asset.hostname
CONTENT_TRANSFER DEVICE_PLATFORM principal.asset.platform_software.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_PLATFORM, then if the events.parameters.value log field value is windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value is mac, then the principal.asset.platform_software.platform UDM field is set to MAC. Else if the events.parameters.value log field value is linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
CONTENT_TRANSFER DEVICE_USER principal.user.user_display_name
CONTENT_TRANSFER DIRECTORY_DEVICE_ID principal.asset.attribute.labels[directory_device_id]
CONTENT_TRANSFER EVENT_RESULT security_result.action_details
CONTENT_TRANSFER EVENT_RESULT security_result.action Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to EVENT_RESULT, then if the events.parameters.value log field value contain one of the following values:
  • BLOCK
  • BLOCKED
, then the security_result.action UDM field is set to BLOCK. Else if the events.parameters.value log field value is equal to ALLOWED, then the security_result.action UDM field is set to ALLOW.
CONTENT_TRANSFER PROFILE_USER_NAME about.user.user_display_name
CONTENT_TRANSFER SCAN_ID additional.fields[scan_id]
CONTENT_TRANSFER TIMESTAMP additional.fields[timestamp]
CONTENT_TRANSFER TRIGGER_TYPE security_result.detection_fields[trigger_type]
CONTENT_TRANSFER URL target.url
CONTENT_TRANSFER USER_AGENT network.http.user_agent
CONTENT_TRANSFER VIRTUAL_DEVICE_ID additional.fields[virtual_device_id]
CONTENT_TRANSFER target.application The target.application UDM field is set to Chrome.
CONTENT_UNSCANNED BROWSER_VERSION target.resource.attribute.labels[browser_version]
CONTENT_UNSCANNED CLIENT_TYPE target.resource.attribute.labels[client_type]
CONTENT_UNSCANNED CONTENT_HASH target.file.sha256 Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to CONTENT_HASH, then if the events.parameters.value log field value matches the regular expression pattern: ^[a-f0-9]{64}$, then the events.parameters.value log field is mapped to the target.file.sha256 UDM field.
Else if the events.parameters.value log field value matches the regular expression pattern: ^[a-fA-F0-9]{32}$, then the events.parameters.value log field is mapped to the target.file.md5 UDM field.
Otherwise, the events.parameters.value log field is mapped to the target.file.sha1 UDM field.
CONTENT_UNSCANNED CONTENT_NAME target.file.full_path
CONTENT_UNSCANNED CONTENT_NAME target.file.file_type Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to CONTENT_NAME, then the file_type field is extracted from events.parameters.value log field using the Grok pattern. file_type log field value is set to a value generated from the template FILE_TYPE_%{file_type}, where %{file_type} is replaced with the value of the file_type log field. If the file_type log field value contain one of the following values:
  • FILE_TYPE_ACE
  • FILE_TYPE_ANDROID
  • FILE_TYPE_APPLE
  • FILE_TYPE_APPLE_PLIST
  • FILE_TYPE_APPLEDOUBLE
  • FILE_TYPE_APPLESCRIPT
  • FILE_TYPE_APPLESCRIPT_COMPILED
  • FILE_TYPE_APPLESINGLE
  • FILE_TYPE_ARC
  • FILE_TYPE_ARJ
  • FILE_TYPE_ASD
  • FILE_TYPE_ASF
  • FILE_TYPE_AVI
  • FILE_TYPE_AWK
  • FILE_TYPE_BLACKHOLE
  • FILE_TYPE_BMP
  • FILE_TYPE_BZIP
  • FILE_TYPE_C
  • FILE_TYPE_CAB
  • FILE_TYPE_CAP
  • FILE_TYPE_CHM
  • FILE_TYPE_COFF
  • FILE_TYPE_COOKIE
  • FILE_TYPE_CPP
  • FILE_TYPE_CRX
  • FILE_TYPE_DEB
  • FILE_TYPE_DIB
  • FILE_TYPE_DIVX
  • FILE_TYPE_DMG
  • FILE_TYPE_DOC
  • FILE_TYPE_DOCX
  • FILE_TYPE_DOS_COM
  • FILE_TYPE_DOS_EXE
  • FILE_TYPE_DYALOG
  • FILE_TYPE_DZIP
  • FILE_TYPE_EBOOK
  • FILE_TYPE_ELF
  • FILE_TYPE_EMAIL_TYPE
  • FILE_TYPE_EMF
  • FILE_TYPE_EOT
  • FILE_TYPE_EPS
  • FILE_TYPE_FLA
  • FILE_TYPE_FLAC
  • FILE_TYPE_FLC
  • FILE_TYPE_FLI
  • FILE_TYPE_FLV
  • FILE_TYPE_FORTRAN
  • FILE_TYPE_FPX
  • FILE_TYPE_GIF
  • FILE_TYPE_GIMP
  • FILE_TYPE_GUL
  • FILE_TYPE_GZIP
  • FILE_TYPE_HTML
  • FILE_TYPE_HWP
  • FILE_TYPE_ICO
  • FILE_TYPE_IN_DESIGN
  • FILE_TYPE_IPHONE
  • FILE_TYPE_ISOIMAGE
  • FILE_TYPE_JAR
  • FILE_TYPE_JAVA
  • FILE_TYPE_JAVA_BYTECODE
  • FILE_TYPE_JAVASCRIPT
  • FILE_TYPE_JNG
  • FILE_TYPE_JPEG
  • FILE_TYPE_KGB
  • FILE_TYPE_LATEX
  • FILE_TYPE_LINUX
  • FILE_TYPE_LINUX_KERNEL
  • FILE_TYPE_LNK
  • FILE_TYPE_MACH_O
  • FILE_TYPE_MACINTOSH
  • FILE_TYPE_MACINTOSH_HFS
  • FILE_TYPE_MACINTOSH_LIB
  • FILE_TYPE_MIDI
  • FILE_TYPE_MOV
  • FILE_TYPE_MP3
  • FILE_TYPE_MP4
  • FILE_TYPE_MPEG
  • FILE_TYPE_MSCOMPRESS
  • FILE_TYPE_MSI
  • FILE_TYPE_NE_DLL
  • FILE_TYPE_NE_EXE
  • FILE_TYPE_ODF
  • FILE_TYPE_ODG
  • FILE_TYPE_ODP
  • FILE_TYPE_ODS
  • FILE_TYPE_ODT
  • FILE_TYPE_OGG
  • FILE_TYPE_OUTLOOK
  • FILE_TYPE_PALMOS
  • FILE_TYPE_PASCAL
  • FILE_TYPE_PDF
  • FILE_TYPE_PE_DLL
  • FILE_TYPE_PE_EXE
  • FILE_TYPE_PERL
  • FILE_TYPE_PHP
  • FILE_TYPE_PKG
  • FILE_TYPE_PNG
  • FILE_TYPE_POWERSHELL
  • FILE_TYPE_PPSX
  • FILE_TYPE_PPT
  • FILE_TYPE_PPTX
  • FILE_TYPE_PS
  • FILE_TYPE_PSD
  • FILE_TYPE_PYTHON
  • FILE_TYPE_QUICKTIME
  • FILE_TYPE_RAR
  • FILE_TYPE_RM
  • FILE_TYPE_ROM
  • FILE_TYPE_RPM
  • FILE_TYPE_RTF
  • FILE_TYPE_RUBY
  • FILE_TYPE_RZIP
  • FILE_TYPE_SCRIPT
  • FILE_TYPE_SEVENZIP
  • FILE_TYPE_SHELLSCRIPT
  • FILE_TYPE_SVG
  • FILE_TYPE_SWF
  • FILE_TYPE_SYMBIAN
  • FILE_TYPE_T3GP
  • FILE_TYPE_TAR
  • FILE_TYPE_TARGA
  • FILE_TYPE_TEXT
  • FILE_TYPE_TIFF
  • FILE_TYPE_TORRENT
  • FILE_TYPE_TTF
  • FILE_TYPE_UNSPECIFIED
  • FILE_TYPE_VBA
  • FILE_TYPE_WAV
  • FILE_TYPE_WEBP
  • FILE_TYPE_WINCE
  • FILE_TYPE_WMA
  • FILE_TYPE_WMV
  • FILE_TYPE_WOFF
  • FILE_TYPE_XLS
  • FILE_TYPE_XLSX
  • FILE_TYPE_XML
  • FILE_TYPE_XPI
  • FILE_TYPE_XWD
  • FILE_TYPE_ZIP
  • FILE_TYPE_ZLIB
, then the file_type log field is mapped to the target.file.file_type UDM field.
CONTENT_UNSCANNED CONTENT_SIZE target.file.size
CONTENT_UNSCANNED CONTENT_TYPE target.file.mime_type
CONTENT_UNSCANNED CONTENT_TRANSFER_METHOD security_result.detection_fields[content_transfer_method]
CONTENT_UNSCANNED DEVICE_ID principal.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The principal.asset_id UDM field is set to a value generated from the template AssetId:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
CONTENT_UNSCANNED DEVICE_NAME principal.hostname
CONTENT_UNSCANNED DEVICE_NAME principal.asset.hostname
CONTENT_UNSCANNED DEVICE_PLATFORM principal.asset.platform_software.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_PLATFORM, then if the events.parameters.value log field value is windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value is mac, then the principal.asset.platform_software.platform UDM field is set to MAC. Else if the events.parameters.value log field value is linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
CONTENT_UNSCANNED DEVICE_USER principal.user.user_display_name
CONTENT_UNSCANNED DIRECTORY_DEVICE_ID principal.asset.attribute.labels[directory_device_id]
CONTENT_UNSCANNED EVENT_REASON security_result.summary
CONTENT_UNSCANNED EVENT_RESULT security_result.action_details
CONTENT_UNSCANNED EVENT_RESULT security_result.action Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to EVENT_RESULT, then if the events.parameters.value log field value contain one of the following values:
  • BLOCK
  • BLOCKED
, then the security_result.action UDM field is set to BLOCK. Else if the events.parameters.value log field value is equal to ALLOWED, then the security_result.action UDM field is set to ALLOW.
CONTENT_UNSCANNED PROFILE_USER_NAME about.user.user_display_name
CONTENT_UNSCANNED TIMESTAMP additional.fields[timestamp]
CONTENT_UNSCANNED TRIGGER_TYPE security_result.detection_fields[trigger_type]
CONTENT_UNSCANNED URL target.url
CONTENT_UNSCANNED USER_AGENT network.http.user_agent
CONTENT_UNSCANNED VIRTUAL_DEVICE_ID additional.fields[virtual_device_id]
CONTENT_UNSCANNED target.application The target.application UDM field is set to Chrome.
EXTENSION_REQUEST APP_NAME target.application The target.application UDM field is set to Chrome.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to APP_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
EXTENSION_REQUEST CLIENT_TYPE target.resource.attribute.labels[client_type]
EXTENSION_REQUEST DEVICE_NAME principal.hostname
EXTENSION_REQUEST DEVICE_NAME principal.asset.hostname
EXTENSION_REQUEST DEVICE_USER principal.user.user_display_name
EXTENSION_REQUEST DIRECTORY_DEVICE_ID principal.asset.attribute.labels[directory_device_id]
EXTENSION_REQUEST ORG_UNIT_NAME additional.fields[org_unit_name]
EXTENSION_REQUEST TIMESTAMP additional.fields[timestamp]
EXTENSION_REQUEST USER_JUSTIFICATION security_result.detection_fields[user_justification]
LOGIN_EVENT BROWSER_VERSION target.resource.attribute.labels[browser_version]
LOGIN_EVENT CLIENT_TYPE target.resource.attribute.labels[client_type]
LOGIN_EVENT DEVICE_NAME principal.hostname
LOGIN_EVENT DEVICE_NAME principal.asset.hostname
LOGIN_EVENT DEVICE_PLATFORM principal.asset.platform_software.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_PLATFORM, then if the events.parameters.value log field value is windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value is mac, then the principal.asset.platform_software.platform UDM field is set to MAC. Else if the events.parameters.value log field value is linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
LOGIN_EVENT DEVICE_USER principal.user.user_display_name
LOGIN_EVENT DIRECTORY_DEVICE_ID principal.asset.attribute.labels[directory_device_id]
LOGIN_EVENT FEDERATED_ORIGIN additional.fields[federated_origin]
LOGIN_EVENT IS_FEDERATED additional.fields[is_federated]
LOGIN_EVENT LOGIN_USER_NAME target.user.user_display_name
LOGIN_EVENT PROFILE_USER_NAME about.user.user_display_name
LOGIN_EVENT TIMESTAMP additional.fields[timestamp]
LOGIN_EVENT URL target.url
LOGIN_EVENT USER_AGENT network.http.user_agent
LOGIN_EVENT VIRTUAL_DEVICE_ID additional.fields[virtual_device_id]
LOGIN_EVENT target.application The target.application UDM field is set to Chrome.
LOGIN_EVENT extensions.auth.type The extensions.auth.type UDM field is set to SSO.
LOGIN_EVENT extensions.auth.mechanism The extensions.auth.mechanism UDM field is set to USERNAME_PASSWORD.
MALWARE_TRANSFER BROWSER_VERSION target.resource.attribute.labels[browser_version]
MALWARE_TRANSFER CLIENT_TYPE target.resource.attribute.labels[client_type]
MALWARE_TRANSFER CONTENT_HASH target.file.sha256 Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to CONTENT_HASH, then if the events.parameters.value log field value matches the regular expression pattern: ^[a-f0-9]{64}$, then the events.parameters.value log field is mapped to the target.file.sha256 UDM field.
Else if the events.parameters.value log field value matches the regular expression pattern: ^[a-fA-F0-9]{32}$, then the events.parameters.value log field is mapped to the target.file.md5 UDM field.
Otherwise, the events.parameters.value log field is mapped to the target.file.sha1 UDM field.
MALWARE_TRANSFER CONTENT_NAME target.file.full_path
MALWARE_TRANSFER CONTENT_NAME target.file.file_type Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to CONTENT_NAME, then the file_type field is extracted from events.parameters.value log field using the Grok pattern. file_type log field value is set to a value generated from the template FILE_TYPE_%{file_type}, where %{file_type} is replaced with the value of the file_type log field. If the file_type log field value contain one of the following values:
  • FILE_TYPE_ACE
  • FILE_TYPE_ANDROID
  • FILE_TYPE_APPLE
  • FILE_TYPE_APPLE_PLIST
  • FILE_TYPE_APPLEDOUBLE
  • FILE_TYPE_APPLESCRIPT
  • FILE_TYPE_APPLESCRIPT_COMPILED
  • FILE_TYPE_APPLESINGLE
  • FILE_TYPE_ARC
  • FILE_TYPE_ARJ
  • FILE_TYPE_ASD
  • FILE_TYPE_ASF
  • FILE_TYPE_AVI
  • FILE_TYPE_AWK
  • FILE_TYPE_BLACKHOLE
  • FILE_TYPE_BMP
  • FILE_TYPE_BZIP
  • FILE_TYPE_C
  • FILE_TYPE_CAB
  • FILE_TYPE_CAP
  • FILE_TYPE_CHM
  • FILE_TYPE_COFF
  • FILE_TYPE_COOKIE
  • FILE_TYPE_CPP
  • FILE_TYPE_CRX
  • FILE_TYPE_DEB
  • FILE_TYPE_DIB
  • FILE_TYPE_DIVX
  • FILE_TYPE_DMG
  • FILE_TYPE_DOC
  • FILE_TYPE_DOCX
  • FILE_TYPE_DOS_COM
  • FILE_TYPE_DOS_EXE
  • FILE_TYPE_DYALOG
  • FILE_TYPE_DZIP
  • FILE_TYPE_EBOOK
  • FILE_TYPE_ELF
  • FILE_TYPE_EMAIL_TYPE
  • FILE_TYPE_EMF
  • FILE_TYPE_EOT
  • FILE_TYPE_EPS
  • FILE_TYPE_FLA
  • FILE_TYPE_FLAC
  • FILE_TYPE_FLC
  • FILE_TYPE_FLI
  • FILE_TYPE_FLV
  • FILE_TYPE_FORTRAN
  • FILE_TYPE_FPX
  • FILE_TYPE_GIF
  • FILE_TYPE_GIMP
  • FILE_TYPE_GUL
  • FILE_TYPE_GZIP
  • FILE_TYPE_HTML
  • FILE_TYPE_HWP
  • FILE_TYPE_ICO
  • FILE_TYPE_IN_DESIGN
  • FILE_TYPE_IPHONE
  • FILE_TYPE_ISOIMAGE
  • FILE_TYPE_JAR
  • FILE_TYPE_JAVA
  • FILE_TYPE_JAVA_BYTECODE
  • FILE_TYPE_JAVASCRIPT
  • FILE_TYPE_JNG
  • FILE_TYPE_JPEG
  • FILE_TYPE_KGB
  • FILE_TYPE_LATEX
  • FILE_TYPE_LINUX
  • FILE_TYPE_LINUX_KERNEL
  • FILE_TYPE_LNK
  • FILE_TYPE_MACH_O
  • FILE_TYPE_MACINTOSH
  • FILE_TYPE_MACINTOSH_HFS
  • FILE_TYPE_MACINTOSH_LIB
  • FILE_TYPE_MIDI
  • FILE_TYPE_MOV
  • FILE_TYPE_MP3
  • FILE_TYPE_MP4
  • FILE_TYPE_MPEG
  • FILE_TYPE_MSCOMPRESS
  • FILE_TYPE_MSI
  • FILE_TYPE_NE_DLL
  • FILE_TYPE_NE_EXE
  • FILE_TYPE_ODF
  • FILE_TYPE_ODG
  • FILE_TYPE_ODP
  • FILE_TYPE_ODS
  • FILE_TYPE_ODT
  • FILE_TYPE_OGG
  • FILE_TYPE_OUTLOOK
  • FILE_TYPE_PALMOS
  • FILE_TYPE_PASCAL
  • FILE_TYPE_PDF
  • FILE_TYPE_PE_DLL
  • FILE_TYPE_PE_EXE
  • FILE_TYPE_PERL
  • FILE_TYPE_PHP
  • FILE_TYPE_PKG
  • FILE_TYPE_PNG
  • FILE_TYPE_POWERSHELL
  • FILE_TYPE_PPSX
  • FILE_TYPE_PPT
  • FILE_TYPE_PPTX
  • FILE_TYPE_PS
  • FILE_TYPE_PSD
  • FILE_TYPE_PYTHON
  • FILE_TYPE_QUICKTIME
  • FILE_TYPE_RAR
  • FILE_TYPE_RM
  • FILE_TYPE_ROM
  • FILE_TYPE_RPM
  • FILE_TYPE_RTF
  • FILE_TYPE_RUBY
  • FILE_TYPE_RZIP
  • FILE_TYPE_SCRIPT
  • FILE_TYPE_SEVENZIP
  • FILE_TYPE_SHELLSCRIPT
  • FILE_TYPE_SVG
  • FILE_TYPE_SWF
  • FILE_TYPE_SYMBIAN
  • FILE_TYPE_T3GP
  • FILE_TYPE_TAR
  • FILE_TYPE_TARGA
  • FILE_TYPE_TEXT
  • FILE_TYPE_TIFF
  • FILE_TYPE_TORRENT
  • FILE_TYPE_TTF
  • FILE_TYPE_UNSPECIFIED
  • FILE_TYPE_VBA
  • FILE_TYPE_WAV
  • FILE_TYPE_WEBP
  • FILE_TYPE_WINCE
  • FILE_TYPE_WMA
  • FILE_TYPE_WMV
  • FILE_TYPE_WOFF
  • FILE_TYPE_XLS
  • FILE_TYPE_XLSX
  • FILE_TYPE_XML
  • FILE_TYPE_XPI
  • FILE_TYPE_XWD
  • FILE_TYPE_ZIP
  • FILE_TYPE_ZLIB
, then the file_type log field is mapped to the target.file.file_type UDM field.
MALWARE_TRANSFER CONTENT_SIZE target.file.size
MALWARE_TRANSFER CONTENT_TYPE target.file.mime_type
MALWARE_TRANSFER CONTENT_TRANSFER_METHOD security_result.detection_fields[content_transfer_method]
MALWARE_TRANSFER DEVICE_ID principal.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The principal.asset_id UDM field is set to a value generated from the template AssetId:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
MALWARE_TRANSFER DEVICE_NAME principal.hostname
MALWARE_TRANSFER DEVICE_NAME principal.asset.hostname
MALWARE_TRANSFER DEVICE_PLATFORM principal.asset.platform_software.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_PLATFORM, then if the events.parameters.value log field value is windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value is mac, then the principal.asset.platform_software.platform UDM field is set to MAC. Else if the events.parameters.value log field value is linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
MALWARE_TRANSFER DEVICE_USER principal.user.user_display_name
MALWARE_TRANSFER DIRECTORY_DEVICE_ID principal.asset.attribute.labels[directory_device_id]
MALWARE_TRANSFER EVENT_REASON security_result.summary
MALWARE_TRANSFER EVENT_RESULT security_result.action_details
MALWARE_TRANSFER EVENT_RESULT security_result.action Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to EVENT_RESULT, then if the events.parameters.value log field value contain one of the following values:
  • BLOCK
  • BLOCKED
, then the security_result.action UDM field is set to BLOCK. Else if the events.parameters.value log field value is equal to ALLOWED, then the security_result.action UDM field is set to ALLOW.
MALWARE_TRANSFER EVIDENCE_LOCKER_FILEPATH additional.fields[evidence_locker_filepath]
MALWARE_TRANSFER PROFILE_USER_NAME about.user.user_display_name
MALWARE_TRANSFER SCAN_ID additional.fields[scan_id]
MALWARE_TRANSFER TIMESTAMP additional.fields[timestamp]
MALWARE_TRANSFER TRIGGER_TYPE security_result.detection_fields[trigger_type]
MALWARE_TRANSFER URL target.url
MALWARE_TRANSFER USER_AGENT network.http.user_agent
MALWARE_TRANSFER USER_JUSTIFICATION security_result.detection_fields[user_justification]
MALWARE_TRANSFER VIRTUAL_DEVICE_ID additional.fields[virtual_device_id]
MALWARE_TRANSFER target.application The target.application UDM field is set to Chrome.
PASSWORD_BREACH BROWSER_VERSION target.resource.attribute.labels[browser_version]
PASSWORD_BREACH CLIENT_TYPE target.resource.attribute.labels[client_type]
PASSWORD_BREACH DEVICE_NAME principal.hostname
PASSWORD_BREACH DEVICE_NAME principal.asset.hostname
PASSWORD_BREACH DEVICE_PLATFORM principal.asset.platform_software.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_PLATFORM, then if the events.parameters.value log field value is windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value is mac, then the principal.asset.platform_software.platform UDM field is set to MAC. Else if the events.parameters.value log field value is linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
PASSWORD_BREACH DEVICE_USER target.user.user_display_name
PASSWORD_BREACH DIRECTORY_DEVICE_ID principal.asset.attribute.labels[directory_device_id]
PASSWORD_BREACH EVENT_REASON security_result.summary
PASSWORD_BREACH EVENT_RESULT security_result.action_details
PASSWORD_BREACH EVENT_RESULT security_result.action Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to EVENT_RESULT, then if the events.parameters.value log field value contain one of the following values:
  • BLOCK
  • BLOCKED
, then the security_result.action UDM field is set to BLOCK. Else if the events.parameters.value log field value is equal to ALLOWED, then the security_result.action UDM field is set to ALLOW.
PASSWORD_BREACH PROFILE_USER_NAME about.user.user_display_name
PASSWORD_BREACH TIMESTAMP additional.fields[timestamp]
PASSWORD_BREACH TRIGGER_TYPE security_result.detection_fields[trigger_type]
PASSWORD_BREACH TRIGGER_USER target.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to TRIGGER_USER, then if the events.parameters.value log field value matches the regular expression pattern: ^.+@.+$, then the events.parameters.value log field is mapped to the target.user.email_addresses UDM field. Otherwise, the events.parameters.value log field is mapped to the target.user.userid UDM field.
PASSWORD_BREACH URL target.url
PASSWORD_BREACH USER_AGENT network.http.user_agent
PASSWORD_BREACH VIRTUAL_DEVICE_ID additional.fields[virtual_device_id]
PASSWORD_BREACH target.application The target.application UDM field is set to Chrome.
SENSITIVE_DATA_TRANSFER BROWSER_VERSION target.resource.attribute.labels[browser_version]
SENSITIVE_DATA_TRANSFER CLIENT_TYPE target.resource.attribute.labels[client_type]
SENSITIVE_DATA_TRANSFER CONTENT_HASH target.file.sha256 Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to CONTENT_HASH, then if the events.parameters.value log field value matches the regular expression pattern: ^[a-f0-9]{64}$, then the events.parameters.value log field is mapped to the target.file.sha256 UDM field.
Else if the events.parameters.value log field value matches the regular expression pattern: ^[a-fA-F0-9]{32}$, then the events.parameters.value log field is mapped to the target.file.md5 UDM field.
Otherwise, the events.parameters.value log field is mapped to the target.file.sha1 UDM field.
SENSITIVE_DATA_TRANSFER CONTENT_NAME target.file.full_path
SENSITIVE_DATA_TRANSFER CONTENT_NAME target.file.file_type Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to CONTENT_NAME, then the file_type field is extracted from events.parameters.value log field using the Grok pattern. file_type log field value is set to a value generated from the template FILE_TYPE_%{file_type}, where %{file_type} is replaced with the value of the file_type log field. If the file_type log field value contain one of the following values:
  • FILE_TYPE_ACE
  • FILE_TYPE_ANDROID
  • FILE_TYPE_APPLE
  • FILE_TYPE_APPLE_PLIST
  • FILE_TYPE_APPLEDOUBLE
  • FILE_TYPE_APPLESCRIPT
  • FILE_TYPE_APPLESCRIPT_COMPILED
  • FILE_TYPE_APPLESINGLE
  • FILE_TYPE_ARC
  • FILE_TYPE_ARJ
  • FILE_TYPE_ASD
  • FILE_TYPE_ASF
  • FILE_TYPE_AVI
  • FILE_TYPE_AWK
  • FILE_TYPE_BLACKHOLE
  • FILE_TYPE_BMP
  • FILE_TYPE_BZIP
  • FILE_TYPE_C
  • FILE_TYPE_CAB
  • FILE_TYPE_CAP
  • FILE_TYPE_CHM
  • FILE_TYPE_COFF
  • FILE_TYPE_COOKIE
  • FILE_TYPE_CPP
  • FILE_TYPE_CRX
  • FILE_TYPE_DEB
  • FILE_TYPE_DIB
  • FILE_TYPE_DIVX
  • FILE_TYPE_DMG
  • FILE_TYPE_DOC
  • FILE_TYPE_DOCX
  • FILE_TYPE_DOS_COM
  • FILE_TYPE_DOS_EXE
  • FILE_TYPE_DYALOG
  • FILE_TYPE_DZIP
  • FILE_TYPE_EBOOK
  • FILE_TYPE_ELF
  • FILE_TYPE_EMAIL_TYPE
  • FILE_TYPE_EMF
  • FILE_TYPE_EOT
  • FILE_TYPE_EPS
  • FILE_TYPE_FLA
  • FILE_TYPE_FLAC
  • FILE_TYPE_FLC
  • FILE_TYPE_FLI
  • FILE_TYPE_FLV
  • FILE_TYPE_FORTRAN
  • FILE_TYPE_FPX
  • FILE_TYPE_GIF
  • FILE_TYPE_GIMP
  • FILE_TYPE_GUL
  • FILE_TYPE_GZIP
  • FILE_TYPE_HTML
  • FILE_TYPE_HWP
  • FILE_TYPE_ICO
  • FILE_TYPE_IN_DESIGN
  • FILE_TYPE_IPHONE
  • FILE_TYPE_ISOIMAGE
  • FILE_TYPE_JAR
  • FILE_TYPE_JAVA
  • FILE_TYPE_JAVA_BYTECODE
  • FILE_TYPE_JAVASCRIPT
  • FILE_TYPE_JNG
  • FILE_TYPE_JPEG
  • FILE_TYPE_KGB
  • FILE_TYPE_LATEX
  • FILE_TYPE_LINUX
  • FILE_TYPE_LINUX_KERNEL
  • FILE_TYPE_LNK
  • FILE_TYPE_MACH_O
  • FILE_TYPE_MACINTOSH
  • FILE_TYPE_MACINTOSH_HFS
  • FILE_TYPE_MACINTOSH_LIB
  • FILE_TYPE_MIDI
  • FILE_TYPE_MOV
  • FILE_TYPE_MP3
  • FILE_TYPE_MP4
  • FILE_TYPE_MPEG
  • FILE_TYPE_MSCOMPRESS
  • FILE_TYPE_MSI
  • FILE_TYPE_NE_DLL
  • FILE_TYPE_NE_EXE
  • FILE_TYPE_ODF
  • FILE_TYPE_ODG
  • FILE_TYPE_ODP
  • FILE_TYPE_ODS
  • FILE_TYPE_ODT
  • FILE_TYPE_OGG
  • FILE_TYPE_OUTLOOK
  • FILE_TYPE_PALMOS
  • FILE_TYPE_PASCAL
  • FILE_TYPE_PDF
  • FILE_TYPE_PE_DLL
  • FILE_TYPE_PE_EXE
  • FILE_TYPE_PERL
  • FILE_TYPE_PHP
  • FILE_TYPE_PKG
  • FILE_TYPE_PNG
  • FILE_TYPE_POWERSHELL
  • FILE_TYPE_PPSX
  • FILE_TYPE_PPT
  • FILE_TYPE_PPTX
  • FILE_TYPE_PS
  • FILE_TYPE_PSD
  • FILE_TYPE_PYTHON
  • FILE_TYPE_QUICKTIME
  • FILE_TYPE_RAR
  • FILE_TYPE_RM
  • FILE_TYPE_ROM
  • FILE_TYPE_RPM
  • FILE_TYPE_RTF
  • FILE_TYPE_RUBY
  • FILE_TYPE_RZIP
  • FILE_TYPE_SCRIPT
  • FILE_TYPE_SEVENZIP
  • FILE_TYPE_SHELLSCRIPT
  • FILE_TYPE_SVG
  • FILE_TYPE_SWF
  • FILE_TYPE_SYMBIAN
  • FILE_TYPE_T3GP
  • FILE_TYPE_TAR
  • FILE_TYPE_TARGA
  • FILE_TYPE_TEXT
  • FILE_TYPE_TIFF
  • FILE_TYPE_TORRENT
  • FILE_TYPE_TTF
  • FILE_TYPE_UNSPECIFIED
  • FILE_TYPE_VBA
  • FILE_TYPE_WAV
  • FILE_TYPE_WEBP
  • FILE_TYPE_WINCE
  • FILE_TYPE_WMA
  • FILE_TYPE_WMV
  • FILE_TYPE_WOFF
  • FILE_TYPE_XLS
  • FILE_TYPE_XLSX
  • FILE_TYPE_XML
  • FILE_TYPE_XPI
  • FILE_TYPE_XWD
  • FILE_TYPE_ZIP
  • FILE_TYPE_ZLIB
, then the file_type log field is mapped to the target.file.file_type UDM field.
SENSITIVE_DATA_TRANSFER CONTENT_SIZE target.file.size
SENSITIVE_DATA_TRANSFER CONTENT_TYPE target.file.mime_type
SENSITIVE_DATA_TRANSFER CONTENT_TRANSFER_METHOD security_result.detection_fields[content_transfer_method]
SENSITIVE_DATA_TRANSFER DEVICE_ID principal.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The principal.asset_id UDM field is set to a value generated from the template AssetId:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
SENSITIVE_DATA_TRANSFER DEVICE_NAME principal.hostname
SENSITIVE_DATA_TRANSFER DEVICE_NAME principal.asset.hostname
SENSITIVE_DATA_TRANSFER DEVICE_PLATFORM principal.asset.platform_software.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_PLATFORM, then if the events.parameters.value log field value is windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value is mac, then the principal.asset.platform_software.platform UDM field is set to MAC. Else if the events.parameters.value log field value is linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
SENSITIVE_DATA_TRANSFER DEVICE_USER principal.user.user_display_name
SENSITIVE_DATA_TRANSFER DIRECTORY_DEVICE_ID principal.asset.attribute.labels[directory_device_id]
SENSITIVE_DATA_TRANSFER EVENT_RESULT security_result.action_details
SENSITIVE_DATA_TRANSFER security_result.action Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to EVENT_RESULT, then if the events.parameters.value log field value contain one of the following values:
  • BLOCK
  • BLOCKED
, then the security_result.action UDM field is set to BLOCK. Else if the events.parameters.value log field value is equal to ALLOWED, then the security_result.action UDM field is set to ALLOW.
SENSITIVE_DATA_TRANSFER EVIDENCE_LOCKER_FILEPATH additional.fields[evidence_locker_filepath]
SENSITIVE_DATA_TRANSFER PROFILE_USER_NAME about.user.user_display_name
SENSITIVE_DATA_TRANSFER SCAN_ID additional.fields[scan_id]
SENSITIVE_DATA_TRANSFER TIMESTAMP additional.fields[timestamp]
SENSITIVE_DATA_TRANSFER TRIGGER_TYPE security_result.detection_fields[trigger_type]
SENSITIVE_DATA_TRANSFER TRIGGERED_RULES_REASON security_result.rule_labels[triggerd_rules_reason]
SENSITIVE_DATA_TRANSFER URL target.url
SENSITIVE_DATA_TRANSFER USER_AGENT network.http.user_agent
SENSITIVE_DATA_TRANSFER USER_JUSTIFICATION security_result.detection_fields[user_justification]
SENSITIVE_DATA_TRANSFER VIRTUAL_DEVICE_ID additional.fields[virtual_device_id]
SENSITIVE_DATA_TRANSFER target.application The target.application UDM field is set to Chrome.
UNSAFE_SITE_VISIT BROWSER_VERSION target.resource.attribute.labels[browser_version]
UNSAFE_SITE_VISIT CLIENT_TYPE target.resource.attribute.labels[client_type]
UNSAFE_SITE_VISIT DEVICE_ID principal.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The principal.asset_id UDM field is set to a value generated from the template AssetId:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
UNSAFE_SITE_VISIT DEVICE_NAME principal.hostname
UNSAFE_SITE_VISIT DEVICE_NAME principal.asset.hostname
UNSAFE_SITE_VISIT DEVICE_PLATFORM principal.asset.platform_software.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_PLATFORM, then if the events.parameters.value log field value is windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value is mac, then the principal.asset.platform_software.platform UDM field is set to MAC. Else if the events.parameters.value log field value is linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
UNSAFE_SITE_VISIT DEVICE_USER target.user.user_display_name
UNSAFE_SITE_VISIT DIRECTORY_DEVICE_ID principal.asset.attribute.labels[directory_device_id]
UNSAFE_SITE_VISIT EVENT_REASON security_result.summary
UNSAFE_SITE_VISIT EVENT_RESULT security_result.action_details
UNSAFE_SITE_VISIT EVENT_RESULT security_result.action Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to EVENT_RESULT, then if the events.parameters.value log field value contain one of the following values:
  • BLOCK
  • BLOCKED
, then the security_result.action UDM field is set to BLOCK. Else if the events.parameters.value log field value is equal to ALLOWED, then the security_result.action UDM field is set to ALLOW.
UNSAFE_SITE_VISIT PROFILE_USER_NAME about.user.user_display_name
UNSAFE_SITE_VISIT TIMESTAMP additional.fields[timestamp]
UNSAFE_SITE_VISIT URL target.url
UNSAFE_SITE_VISIT USER_AGENT network.http.user_agent
UNSAFE_SITE_VISIT VIRTUAL_DEVICE_ID additional.fields[virtual_device_id]
UNSAFE_SITE_VISIT target.application The target.application UDM field is set to Chrome.

Field mapping reference: workspace activity context_aware_access application

The following table provides the log fields to UDM field mapping corresponding to events for the context_aware_access application.

Event Name Log field UDM mapping Logic
ACCESS_DENY_EVENT BLOCKED_API_ACCESS target.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to BLOCKED_API_ACCESS, then
Iterate through log field events.parameters.multiValue:
if the index2 log field value is equal to 0, then the events.parameters.multiValue log field is mapped to the target.resource.name UDM field. Otherwise, the target.resource.name UDM field is set to a value generated from the template %{target.resource.name}, %{events.parameters.multiValue}, where %{target.resource.name} and %{events.parameters.multiValue} are replaced with the values of the target.resource.name and events.parameters.multiValue log fields.
ACCESS_DENY_EVENT CAA_ACCESS_LEVEL_APPLIED additional.fields[caa_access_level_applied] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to CAA_ACCESS_LEVEL_APPLIED, then
Iterate through log field events.parameters.multiValue:
if the index2 log field value is equal to 0, then the additional.fields.key UDM field is set to caa_access_level_applied and the events.parameters.multiValue log field is mapped to the additional.fields.value UDM field. Otherwise, the additional.fields.key UDM field is set to caa_access_level_applied and the additional.fields.value UDM field is set to a value generated from the template %{additional.fields[caa_access_level_applied]}, %{events.parameters.multiValue}, where %{additional.fields[caa_access_level_applied]} and %{events.parameters.multiValue} are replaced with the values of the additional.fields[caa_access_level_applied] and events.parameters.multiValue log fields.
ACCESS_DENY_EVENT CAA_ACCESS_LEVEL_SATISFIED additional.fields[caa_access_level_satisfied] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to CAA_ACCESS_LEVEL_SATISFIED, then
Iterate through log field events.parameters.multiValue:
if the index2 log field value is equal to 0, then the additional.fields.key UDM field is set to caa_access_level_satisfied and the events.parameters.multiValue log field is mapped to the additional.fields.value UDM field. Otherwise, the additional.fields.key UDM field is set to caa_access_level_satisfied and the additional.fields.value UDM field is set to a value generated from the template %{additional.fields[caa_access_level_satisfied]}, %{events.parameters.multiValue}, where %{additional.fields[caa_access_level_satisfied]} and %{events.parameters.multiValue} are replaced with the values of the additional.fields[caa_access_level_satisfied] and events.parameters.multiValue log fields.
ACCESS_DENY_EVENT CAA_ACCESS_LEVEL_UNSATISFIED additional.fields[caa_access_level_unsatisfied] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to CAA_ACCESS_LEVEL_UNSATISFIED, then
Iterate through log field events.parameters.multiValue:
if the index2 log field value is equal to 0, then the additional.fields.key UDM field is set to caa_access_level_unsatisfied and the events.parameters.multiValue log field is mapped to the additional.fields.value UDM field. Otherwise, the additional.fields.key UDM field is set to caa_access_level_unsatisfied and the additional.fields.value UDM field is set to a value generated from the template %{additional.fields[caa_access_level_unsatisfied]}, %{events.parameters.multiValue}, where %{additional.fields[caa_access_level_unsatisfied]} and %{events.parameters.multiValue} are replaced with the values of the additional.fields[caa_access_level_unsatisfied] and events.parameters.multiValue log fields.
ACCESS_DENY_EVENT CAA_APPLICATION target.application The target.application UDM field is set to Context Aware Access.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to CAA_DEVICE_ID, then the events.parameters.value log field is mapped to the target.application UDM field.
ACCESS_DENY_EVENT CAA_DEVICE_ID principal.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to CAA_DEVICE_ID, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
ACCESS_DENY_EVENT target.resource.resource_type The target.resource.resource_type UDM field is set to CLOUD_PROJECT.
ACCESS_DENY_EVENT CAA_DEVICE_STATE additional.fields[caa_device_state]

Field mapping reference: workspace activity gplus application

The following table provides the log fields to UDM field mapping corresponding to events for the gplus application.

Event Name Log field UDM mapping Logic
create_comment attachment_type target.resource.attribute.labels[attachment_type]
create_comment comment_resource_name additional.fields[comment_resource_name]
create_comment post_permalink target.resource.attribute.labels[post_permalink]
create_comment post_resource_name target.resource.product_object_id
create_comment post_visibility target.resource.attribute.labels[post_visibility]
create_comment target.application The target.application UDM field is set to Currents.
delete_comment comment_resource_name additional.fields[comment_resource_name]
delete_comment post_resource_name target.resource.product_object_id
delete_comment post_visibility target.resource.attribute.labels[post_visibility]
delete_comment target.application The target.application UDM field is set to Currents.
edit_comment attachment_type target.resource.attribute.labels[attachment_type]
edit_comment comment_resource_name additional.fields[comment_resource_name]
edit_comment post_permalink target.resource.attribute.labels[post_permalink]
edit_comment post_resource_name target.resource.product_object_id
edit_comment post_visibility target.resource.attribute.labels[post_visibility]
edit_comment target.application The target.application UDM field is set to Currents.
add_plusone comment_resource_name additional.fields[comment_resource_name]
add_plusone plusone_context target.resource.attribute.labels[plusone_context] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to plusone_context, then if the events.parameters.value log field value is equal to post, then the target.resource.attribute.labels.key UDM field is set to plusone_context and the events.parameters.value log field is mapped to the target.resource.attribute.labels.value UDM field. Otherwise, the additional.fields.key UDM field is set to plusone_context and the events.parameters.value log field is mapped to the additional.fields.value UDM field.
add_plusone post_permalink target.resource.attribute.labels[post_permalink]
add_plusone post_resource_name target.resource.product_object_id
add_plusone post_visibility target.resource.attribute.labels[post_visibility]
add_plusone target.application The target.application UDM field is set to Currents.
remove_plusone comment_resource_name additional.fields[comment_resource_name]
remove_plusone plusone_context target.resource.attribute.labels[plusone_context] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to plusone_context, then if the events.parameters.value log field value is equal to post, then the target.resource.attribute.labels.key UDM field is set to plusone_context and the events.parameters.value log field is mapped to the target.resource.attribute.labels.value UDM field. Otherwise, the additional.fields.key UDM field is set to plusone_context and the events.parameters.value log field is mapped to the additional.fields.value UDM field.
remove_plusone post_permalink target.resource.attribute.labels[post_permalink]
remove_plusone post_resource_name target.resource.product_object_id
remove_plusone post_visibility target.resource.attribute.labels[post_visibility]
remove_plusone target.application The target.application UDM field is set to Currents.
add_poll_vote post_permalink target.resource.attribute.labels[post_permalink]
add_poll_vote post_resource_name target.resource.product_object_id
add_poll_vote post_visibility target.resource.attribute.labels[post_visibility]
add_poll_vote target.application The target.application UDM field is set to Currents.
remove_poll_vote post_permalink target.resource.attribute.labels[post_permalink]
remove_poll_vote post_resource_name target.resource.product_object_id
remove_poll_vote post_visibility target.resource.attribute.labels[post_visibility]
remove_poll_vote target.application The target.application UDM field is set to Currents.
create_post attachment_type target.resource.attribute.labels[attachment_type]
create_post post_permalink target.resource.attribute.labels[post_permalink]
create_post post_resource_name target.resource.product_object_id
create_post post_visibility target.resource.attribute.labels[post_visibility]
create_post target.application The target.application UDM field is set to Currents.
delete_post target.application The target.application UDM field is set to Currents.
delete_post post_resource_name target.resource.product_object_id
content_manager_delete_post post_author_name target.resource.attribute.labels[post_author_name]
content_manager_delete_post post_resource_name target.resource.product_object_id
content_manager_delete_post target.application The target.application UDM field is set to Currents.
edit_post attachment_type target.resource.attribute.labels[attachment_type]
edit_post post_permalink target.resource.attribute.labels[post_permalink]
edit_post post_resource_name target.resource.product_object_id
edit_post post_visibility target.resource.attribute.labels[post_visibility]
edit_post target.application The target.application UDM field is set to Currents.

Field mapping reference: workspace activity data_studio application

The following table provides the log fields to UDM field mapping corresponding to events for the data_studio application.

Event Name Log field UDM mapping Logic
ADD_REPORT_EMAIL_DELIVERY ASSET_ID target.resource.product_object_id
ADD_REPORT_EMAIL_DELIVERY ASSET_NAME target.resource.name
ADD_REPORT_EMAIL_DELIVERY ASSET_TYPE target.resource.resource_subtype
ADD_REPORT_EMAIL_DELIVERY OWNER_EMAIL target.resource.attribute.labels[owner_email]
ADD_REPORT_EMAIL_DELIVERY PARENT_WORKSPACE_ID target.resource_ancestors.product_object_id
ADD_REPORT_EMAIL_DELIVERY target.application The target.application UDM field is set to Data Studio.
CREATE ASSET_ID target.resource.product_object_id
CREATE ASSET_NAME target.resource.name
CREATE ASSET_TYPE target.resource.resource_subtype
CREATE CONNECTOR_TYPE target.resource.attribute.labels[connector_type]
CREATE EMBEDDED_IN_REPORT_ID target.resource.attribute.labels[embedded_in_report_id]
CREATE OWNER_EMAIL target.resource.attribute.labels[owner_email]
CREATE PARENT_WORKSPACE_ID target.resource_ancestors.product_object_id
CREATE PRIOR_VISIBILITY target.resource.attribute.labels[prior_visibility]
CREATE VISIBILITY target.resource.attribute.labels[visibility]
CREATE target.application The target.application UDM field is set to Data Studio.
DATA_EXPORT ASSET_ID target.resource.product_object_id
DATA_EXPORT ASSET_NAME target.resource.name
DATA_EXPORT ASSET_TYPE target.resource.resource_subtype
DATA_EXPORT CONNECTOR_TYPE target.resource.attribute.labels[connector_type]
DATA_EXPORT DATA_EXPORT_TYPE target.resource.attribute.labels[data_export_type]
DATA_EXPORT EMBEDDED_IN_REPORT_ID target.resource.attribute.labels[embedded_in_report_id]
DATA_EXPORT OWNER_EMAIL target.resource.attribute.labels[owner_email]
DATA_EXPORT PARENT_WORKSPACE_ID target.resource_ancestors.product_object_id
DATA_EXPORT PRIOR_VISIBILITY target.resource.attribute.labels[prior_visibility]
DATA_EXPORT VISIBILITY target.resource.attribute.labels[visibility]
DATA_EXPORT target.application The target.application UDM field is set to Data Studio.
DELETE ASSET_ID target.resource.product_object_id
DELETE ASSET_NAME target.resource.name
DELETE ASSET_TYPE target.resource.resource_subtype
DELETE CONNECTOR_TYPE target.resource.attribute.labels[connector_type]
DELETE EMBEDDED_IN_REPORT_ID target.resource.attribute.labels[embedded_in_report_id]
DELETE OWNER_EMAIL target.resource.attribute.labels[owner_email]
DELETE PARENT_WORKSPACE_ID target.resource_ancestors.product_object_id
DELETE PRIOR_VISIBILITY target.resource.attribute.labels[prior_visibility]
DELETE VISIBILITY target.resource.attribute.labels[visibility]
DELETE target.application The target.application UDM field is set to Data Studio.
DOWNLOAD_REPORT ASSET_ID target.resource.product_object_id
DOWNLOAD_REPORT ASSET_NAME target.resource.name
DOWNLOAD_REPORT ASSET_TYPE target.resource.resource_subtype
DOWNLOAD_REPORT CONNECTOR_TYPE target.resource.attribute.labels[connector_type]
DOWNLOAD_REPORT EMBEDDED_IN_REPORT_ID target.resource.attribute.labels[embedded_in_report_id]
DOWNLOAD_REPORT OWNER_EMAIL target.resource.attribute.labels[owner_email]
DOWNLOAD_REPORT PARENT_WORKSPACE_ID target.resource_ancestors.product_object_id
DOWNLOAD_REPORT PRIOR_VISIBILITY target.resource.attribute.labels[prior_visibility]
DOWNLOAD_REPORT VISIBILITY target.resource.attribute.labels[visibility]
DOWNLOAD_REPORT target.application The target.application UDM field is set to Data Studio.
EDIT ASSET_ID target.resource.product_object_id
EDIT ASSET_NAME target.resource.name
EDIT ASSET_TYPE target.resource.resource_subtype
EDIT CONNECTOR_TYPE target.resource.attribute.labels[connector_type]
EDIT EMBEDDED_IN_REPORT_ID target.resource.attribute.labels[embedded_in_report_id]
EDIT OWNER_EMAIL target.resource.attribute.labels[owner_email]
EDIT PARENT_WORKSPACE_ID target.resource_ancestors.product_object_id
EDIT PRIOR_VISIBILITY target.resource.attribute.labels[prior_visibility]
EDIT VISIBILITY target.resource.attribute.labels[visibility]
EDIT target.application The target.application UDM field is set to Data Studio.
PARENT_WORKSPACE_CHANGE ASSET_ID target.resource.product_object_id
PARENT_WORKSPACE_CHANGE ASSET_NAME target.resource.name
PARENT_WORKSPACE_CHANGE ASSET_TYPE target.resource.resource_subtype
PARENT_WORKSPACE_CHANGE CONNECTOR_TYPE target.resource.attribute.labels[connector_type]
PARENT_WORKSPACE_CHANGE CURRENT_VALUE target.resource.attribute.labels[current_value]
PARENT_WORKSPACE_CHANGE EMBEDDED_IN_REPORT_ID target.resource.attribute.labels[embedded_in_report_id]
PARENT_WORKSPACE_CHANGE OWNER_EMAIL target.resource.attribute.labels[owner_email]
PARENT_WORKSPACE_CHANGE PARENT_WORKSPACE_ID target.resource_ancestors.product_object_id
PARENT_WORKSPACE_CHANGE PREVIOUS_VALUE target.resource.attribute.labels[previous_value]
PARENT_WORKSPACE_CHANGE target.application The target.application UDM field is set to Data Studio.
RESTORE ASSET_ID target.resource.product_object_id
RESTORE ASSET_NAME target.resource.name
RESTORE ASSET_TYPE target.resource.resource_subtype
RESTORE CONNECTOR_TYPE target.resource.attribute.labels[connector_type]
RESTORE EMBEDDED_IN_REPORT_ID target.resource.attribute.labels[embedded_in_report_id]
RESTORE OWNER_EMAIL target.resource.attribute.labels[owner_email]
RESTORE PARENT_WORKSPACE_ID target.resource_ancestors.product_object_id
RESTORE PRIOR_VISIBILITY target.resource.attribute.labels[prior_visibility]
RESTORE VISIBILITY target.resource.attribute.labels[visibility]
RESTORE target.application The target.application UDM field is set to Data Studio.
STOP_REPORT_EMAIL_DELIVERY ASSET_ID target.resource.product_object_id
STOP_REPORT_EMAIL_DELIVERY ASSET_NAME target.resource.name
STOP_REPORT_EMAIL_DELIVERY ASSET_TYPE target.resource.resource_subtype
STOP_REPORT_EMAIL_DELIVERY OWNER_EMAIL target.resource.attribute.labels[owner_email]
STOP_REPORT_EMAIL_DELIVERY PARENT_WORKSPACE_ID target.resource_ancestors.product_object_id
STOP_REPORT_EMAIL_DELIVERY target.application The target.application UDM field is set to Data Studio.
TRASH ASSET_ID target.resource.product_object_id
TRASH ASSET_NAME target.resource.name
TRASH ASSET_TYPE target.resource.resource_subtype
TRASH CONNECTOR_TYPE target.resource.attribute.labels[connector_type]
TRASH EMBEDDED_IN_REPORT_ID target.resource.attribute.labels[embedded_in_report_id]
TRASH OWNER_EMAIL target.resource.attribute.labels[owner_email]
TRASH PARENT_WORKSPACE_ID target.resource_ancestors.product_object_id
TRASH PRIOR_VISIBILITY target.resource.attribute.labels[prior_visibility]
TRASH VISIBILITY target.resource.attribute.labels[visibility]
TRASH target.application The target.application UDM field is set to Data Studio.
UPDATE_REPORT_EMAIL_DELIVERY ASSET_ID target.resource.product_object_id
UPDATE_REPORT_EMAIL_DELIVERY ASSET_NAME target.resource.name
UPDATE_REPORT_EMAIL_DELIVERY ASSET_TYPE target.resource.resource_subtype
UPDATE_REPORT_EMAIL_DELIVERY OWNER_EMAIL target.resource.attribute.labels[owner_email]
UPDATE_REPORT_EMAIL_DELIVERY PARENT_WORKSPACE_ID target.resource_ancestors.product_object_id
UPDATE_REPORT_EMAIL_DELIVERY target.application The target.application UDM field is set to Data Studio.
VIEW ASSET_ID target.resource.product_object_id
VIEW ASSET_NAME target.resource.name
VIEW ASSET_TYPE target.resource.resource_subtype
VIEW CONNECTOR_TYPE target.resource.attribute.labels[connector_type]
VIEW EMBEDDED_IN_REPORT_ID target.resource.attribute.labels[embedded_in_report_id]
VIEW OWNER_EMAIL target.resource.attribute.labels[owner_email]
VIEW PARENT_WORKSPACE_ID target.resource_ancestors.product_object_id
VIEW PRIOR_VISIBILITY target.resource.attribute.labels[prior_visibility]
VIEW VISIBILITY target.resource.attribute.labels[visibility]
VIEW target.application The target.application UDM field is set to Data Studio.
CHANGE_DATA_SOURCE_ACCESS_TYPE ASSET_ID target.resource.product_object_id
CHANGE_DATA_SOURCE_ACCESS_TYPE ASSET_NAME target.resource.name
CHANGE_DATA_SOURCE_ACCESS_TYPE ASSET_TYPE target.resource.resource_subtype
CHANGE_DATA_SOURCE_ACCESS_TYPE CONNECTOR_TYPE target.resource.attribute.labels[connector_type]
CHANGE_DATA_SOURCE_ACCESS_TYPE CURRENT_VALUE target.resource.attribute.labels[current_value]
CHANGE_DATA_SOURCE_ACCESS_TYPE EMBEDDED_IN_REPORT_ID target.resource.attribute.labels[embedded_in_report_id]
CHANGE_DATA_SOURCE_ACCESS_TYPE NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_DATA_SOURCE_ACCESS_TYPE OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_DATA_SOURCE_ACCESS_TYPE OWNER_EMAIL target.resource.attribute.labels[owner_email]
CHANGE_DATA_SOURCE_ACCESS_TYPE PARENT_WORKSPACE_ID target.resource_ancestors.product_object_id
CHANGE_DATA_SOURCE_ACCESS_TYPE PREVIOUS_VALUE target.resource.attribute.labels[previous_value]
CHANGE_DATA_SOURCE_ACCESS_TYPE PRIOR_VISIBILITY target.resource.attribute.labels[prior_visibility]
CHANGE_DATA_SOURCE_ACCESS_TYPE VISIBILITY target.resource.attribute.labels[visibility]
CHANGE_DATA_SOURCE_ACCESS_TYPE target.application The target.application UDM field is set to Data Studio.
CHANGE_ASSET_LINK_SHARING_ACCESS_TYPE ASSET_ID target.resource.product_object_id
CHANGE_ASSET_LINK_SHARING_ACCESS_TYPE ASSET_NAME target.resource.name
CHANGE_ASSET_LINK_SHARING_ACCESS_TYPE ASSET_TYPE target.resource.resource_subtype
CHANGE_ASSET_LINK_SHARING_ACCESS_TYPE CONNECTOR_TYPE target.resource.attribute.labels[connector_type]
CHANGE_ASSET_LINK_SHARING_ACCESS_TYPE CURRENT_VALUE target.resource.attribute.labels[current_value]
CHANGE_ASSET_LINK_SHARING_ACCESS_TYPE EMBEDDED_IN_REPORT_ID target.resource.attribute.labels[embedded_in_report_id]
CHANGE_ASSET_LINK_SHARING_ACCESS_TYPE NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_ASSET_LINK_SHARING_ACCESS_TYPE OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_ASSET_LINK_SHARING_ACCESS_TYPE OWNER_EMAIL target.resource.attribute.labels[owner_email]
CHANGE_ASSET_LINK_SHARING_ACCESS_TYPE PARENT_WORKSPACE_ID target.resource_ancestors.product_object_id
CHANGE_ASSET_LINK_SHARING_ACCESS_TYPE PREVIOUS_VALUE target.resource.attribute.labels[previous_value]
CHANGE_ASSET_LINK_SHARING_ACCESS_TYPE PRIOR_VISIBILITY target.resource.attribute.labels[prior_visibility]
CHANGE_ASSET_LINK_SHARING_ACCESS_TYPE TARGET_DOMAIN target.domain.name
CHANGE_ASSET_LINK_SHARING_ACCESS_TYPE VISIBILITY target.resource.attribute.labels[visibility]
CHANGE_ASSET_LINK_SHARING_ACCESS_TYPE target.application The target.application UDM field is set to Data Studio.
CHANGE_ASSET_LINK_SHARING_VISIBILITY ASSET_ID target.resource.product_object_id
CHANGE_ASSET_LINK_SHARING_VISIBILITY ASSET_NAME target.resource.name
CHANGE_ASSET_LINK_SHARING_VISIBILITY ASSET_TYPE target.resource.resource_subtype
CHANGE_ASSET_LINK_SHARING_VISIBILITY CONNECTOR_TYPE target.resource.attribute.labels[connector_type]
CHANGE_ASSET_LINK_SHARING_VISIBILITY CURRENT_VALUE target.resource.attribute.labels[current_value]
CHANGE_ASSET_LINK_SHARING_VISIBILITY EMBEDDED_IN_REPORT_ID target.resource.attribute.labels[embedded_in_report_id]
CHANGE_ASSET_LINK_SHARING_VISIBILITY NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_ASSET_LINK_SHARING_VISIBILITY OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_ASSET_LINK_SHARING_VISIBILITY OWNER_EMAIL target.resource.attribute.labels[owner_email]
CHANGE_ASSET_LINK_SHARING_VISIBILITY PARENT_WORKSPACE_ID target.resource_ancestors.product_object_id
CHANGE_ASSET_LINK_SHARING_VISIBILITY PREVIOUS_VALUE target.resource.attribute.labels[previous_value]
CHANGE_ASSET_LINK_SHARING_VISIBILITY PRIOR_VISIBILITY target.resource.attribute.labels[prior_visibility]
CHANGE_ASSET_LINK_SHARING_VISIBILITY TARGET_DOMAIN target.domain.name
CHANGE_ASSET_LINK_SHARING_VISIBILITY VISIBILITY target.resource.attribute.labels[visibility]
CHANGE_ASSET_LINK_SHARING_VISIBILITY target.application The target.application UDM field is set to Data Studio.
CHANGE_USER_ACCESS ASSET_ID target.resource.product_object_id
CHANGE_USER_ACCESS ASSET_NAME target.resource.name
CHANGE_USER_ACCESS ASSET_TYPE target.resource.resource_subtype
CHANGE_USER_ACCESS CONNECTOR_TYPE target.resource.attribute.labels[connector_type]
CHANGE_USER_ACCESS CURRENT_VALUE target.resource.attribute.labels[current_value]
CHANGE_USER_ACCESS EMBEDDED_IN_REPORT_ID target.resource.attribute.labels[embedded_in_report_id]
CHANGE_USER_ACCESS NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_USER_ACCESS OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_USER_ACCESS OWNER_EMAIL target.resource.attribute.labels[owner_email]
CHANGE_USER_ACCESS PARENT_WORKSPACE_ID target.resource_ancestors.product_object_id
CHANGE_USER_ACCESS PREVIOUS_VALUE target.resource.attribute.labels[previous_value]
CHANGE_USER_ACCESS PRIOR_VISIBILITY target.resource.attribute.labels[prior_visibility]
CHANGE_USER_ACCESS TARGET_USER_EMAIL target.user.email_addresses
CHANGE_USER_ACCESS VISIBILITY target.resource.attribute.labels[visibility]
CHANGE_USER_ACCESS target.application The target.application UDM field is set to Data Studio.
CHANGE_USER_ACCESS_TO_ASSET_VIA_WORKSPACE ASSET_ID target.resource.product_object_id
CHANGE_USER_ACCESS_TO_ASSET_VIA_WORKSPACE ASSET_NAME target.resource.name
CHANGE_USER_ACCESS_TO_ASSET_VIA_WORKSPACE ASSET_TYPE target.resource.resource_subtype
CHANGE_USER_ACCESS_TO_ASSET_VIA_WORKSPACE CONNECTOR_TYPE target.resource.attribute.labels[connector_type]
CHANGE_USER_ACCESS_TO_ASSET_VIA_WORKSPACE CURRENT_VALUE target.resource.attribute.labels[current_value]
CHANGE_USER_ACCESS_TO_ASSET_VIA_WORKSPACE EMBEDDED_IN_REPORT_ID target.resource.attribute.labels[embedded_in_report_id]
CHANGE_USER_ACCESS_TO_ASSET_VIA_WORKSPACE OWNER_EMAIL target.resource.attribute.labels[owner_email]
CHANGE_USER_ACCESS_TO_ASSET_VIA_WORKSPACE PARENT_WORKSPACE_ID target.resource_ancestors.product_object_id
CHANGE_USER_ACCESS_TO_ASSET_VIA_WORKSPACE PREVIOUS_VALUE target.resource.attribute.labels[previous_value]
CHANGE_USER_ACCESS_TO_ASSET_VIA_WORKSPACE PRIOR_VISIBILITY target.resource.attribute.labels[prior_visibility]
CHANGE_USER_ACCESS_TO_ASSET_VIA_WORKSPACE TARGET_USER_EMAIL target.user.email_addresses
CHANGE_USER_ACCESS_TO_ASSET_VIA_WORKSPACE VISIBILITY target.resource.attribute.labels[visibility]
CHANGE_USER_ACCESS_TO_ASSET_VIA_WORKSPACE target.application The target.application UDM field is set to Data Studio.

Field mapping reference: workspace activity mobile application

The following table provides the log fields to UDM field mapping corresponding to events for the mobile application.

Event Name Log field UDM mapping Logic
APPLICATION_EVENT APK_SHA256_HASH target.resource.attribute.labels[apk_sha256_hash]
APPLICATION_EVENT APPLICATION_ID target.resource.attribute.labels[application_id]
APPLICATION_EVENT APPLICATION_STATE target.resource.attribute.labels[application_state]
APPLICATION_EVENT DEVICE_ID target.resource.product_object_id
APPLICATION_EVENT DEVICE_MODEL target.asset.hardware.model
APPLICATION_EVENT DEVICE_TYPE target.resource.resource_subtype
APPLICATION_EVENT IOS_VENDOR_ID target.resource.attribute.labels[ios_vendor_id]
APPLICATION_EVENT NEW_VALUE target.resource.attribute.labels[new_value]
APPLICATION_EVENT PHA_CATEGORY security_result.category_details
APPLICATION_EVENT RESOURCE_ID target.resource.attribute.labels[resource_id]
APPLICATION_EVENT SECURITY_EVENT_ID additional.fields[security_event_id]
APPLICATION_EVENT SERIAL_NUMBER target.asset.hardware.serial_number
APPLICATION_EVENT USER_EMAIL principal.user.email_addresses
APPLICATION_EVENT target.application The target.application UDM field is set to Mobile.
APPLICATION_EVENT target.resource.resource_type The target.resource.resource_type UDM field is set to DEVICE.
APPLICATION_EVENT target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template AssetId:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
APPLICATION_REPORT_EVENT APPLICATION_ID target.resource.attribute.labels[application_id]
APPLICATION_REPORT_EVENT APPLICATION_MESSAGE target.resource.attribute.labels[application_message]
APPLICATION_REPORT_EVENT APPLICATION_REPORT_KEY target.resource.attribute.labels[application_report_key]
APPLICATION_REPORT_EVENT APPLICATION_REPORT_SEVERITY security_result.severity_details
APPLICATION_REPORT_EVENT APPLICATION_REPORT_TIMESTAMP target.resource.attribute.labels[application_report_timestamp]
APPLICATION_REPORT_EVENT DEVICE_APP_COMPLIANCE security_result.detection_fields[device_app_compliance]
APPLICATION_REPORT_EVENT DEVICE_ID target.resource.product_object_id
APPLICATION_REPORT_EVENT DEVICE_MODEL target.asset.hardware.model
APPLICATION_REPORT_EVENT DEVICE_TYPE target.resource.resource_subtype
APPLICATION_REPORT_EVENT RESOURCE_ID target.resource.attribute.labels[resource_id]
APPLICATION_REPORT_EVENT SERIAL_NUMBER target.asset.hardware.serial_number
APPLICATION_REPORT_EVENT USER_EMAIL principal.user.email_addresses
APPLICATION_REPORT_EVENT target.application The target.application UDM field is set to Mobile.
APPLICATION_REPORT_EVENT target.resource.resource_type The target.resource.resource_type UDM field is set to DEVICE.
APPLICATION_REPORT_EVENT target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template AssetId:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
DEVICE_REGISTER_UNREGISTER_EVENT ACCOUNT_STATE target.resource.attribute.labels[account_state]
DEVICE_REGISTER_UNREGISTER_EVENT BASIC_INTEGRITY target.resource.attribute.labels[basic_integrity]
DEVICE_REGISTER_UNREGISTER_EVENT CTS_PROFILE_MATCH target.resource.attribute.labels[cts_profile_match]
DEVICE_REGISTER_UNREGISTER_EVENT DEVICE_ID target.resource.product_object_id
DEVICE_REGISTER_UNREGISTER_EVENT DEVICE_MODEL target.asset.hardware.model
DEVICE_REGISTER_UNREGISTER_EVENT DEVICE_TYPE target.resource.resource_subtype
DEVICE_REGISTER_UNREGISTER_EVENT IOS_VENDOR_ID target.resource.attribute.labels[ios_vendor_id]
DEVICE_REGISTER_UNREGISTER_EVENT OS_VERSION target.asset.platform_software.platform_version
DEVICE_REGISTER_UNREGISTER_EVENT REGISTER_PRIVILEGE additional.fields[register_privilege]
DEVICE_REGISTER_UNREGISTER_EVENT RESOURCE_ID target.resource.attribute.labels[resource_id]
DEVICE_REGISTER_UNREGISTER_EVENT SECURITY_PATCH_LEVEL additional.fields[security_patch_level]
DEVICE_REGISTER_UNREGISTER_EVENT SERIAL_NUMBER target.asset.hardware.serial_number
DEVICE_REGISTER_UNREGISTER_EVENT USER_EMAIL principal.user.email_addresses
DEVICE_REGISTER_UNREGISTER_EVENT target.application The target.application UDM field is set to Mobile.
DEVICE_REGISTER_UNREGISTER_EVENT target.resource.resource_type The target.resource.resource_type UDM field is set to DEVICE.
DEVICE_REGISTER_UNREGISTER_EVENT target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template AssetId:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
ADVANCED_POLICY_SYNC_EVENT DEVICE_ID target.resource.product_object_id
ADVANCED_POLICY_SYNC_EVENT DEVICE_MODEL target.asset.hardware.model
ADVANCED_POLICY_SYNC_EVENT DEVICE_TYPE target.resource.resource_subtype
ADVANCED_POLICY_SYNC_EVENT NEW_VALUE target.resource.attribute.labels[new_value]
ADVANCED_POLICY_SYNC_EVENT OS_EDITION target.resource.attribute.labels[os_edition]
ADVANCED_POLICY_SYNC_EVENT OS_VERSION target.asset.platform_software.platform_version
ADVANCED_POLICY_SYNC_EVENT POLICY_NAME security_result.rule_name
ADVANCED_POLICY_SYNC_EVENT POLICY_SYNC_RESULT additional.fields[policy_sync_result]
ADVANCED_POLICY_SYNC_EVENT POLICY_SYNC_TYPE additional.fields[policy_sync_type]
ADVANCED_POLICY_SYNC_EVENT RESOURCE_ID target.resource.attribute.labels[resource_id]
ADVANCED_POLICY_SYNC_EVENT SERIAL_NUMBER target.asset.hardware.serial_number
ADVANCED_POLICY_SYNC_EVENT USER_EMAIL principal.user.email_addresses
ADVANCED_POLICY_SYNC_EVENT VALUE additional.fields[value]
ADVANCED_POLICY_SYNC_EVENT WINDOWS_SYNCML_POLICY_STATUS_CODE additional.fields[windows_syncml_policy_status_code]
ADVANCED_POLICY_SYNC_EVENT target.application The target.application UDM field is set to Mobile.
ADVANCED_POLICY_SYNC_EVENT target.resource.resource_type The target.resource.resource_type UDM field is set to DEVICE.
ADVANCED_POLICY_SYNC_EVENT target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template AssetId:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
DEVICE_ACTION_EVENT ACTION_EXECUTION_STATUS target.resource.attribute.labels[action_execution_status]
DEVICE_ACTION_EVENT ACTION_ID security_result.detection_fields[action_id]
DEVICE_ACTION_EVENT ACTION_TYPE security_result.action_details
DEVICE_ACTION_EVENT DEVICE_ID target.resource.product_object_id
DEVICE_ACTION_EVENT DEVICE_MODEL target.asset.hardware.model
DEVICE_ACTION_EVENT DEVICE_TYPE target.resource.resource_subtype
DEVICE_ACTION_EVENT IOS_VENDOR_ID target.resource.attribute.labels[ios_vendor_id]
DEVICE_ACTION_EVENT RESOURCE_ID target.resource.attribute.labels[resource_id]
DEVICE_ACTION_EVENT SERIAL_NUMBER target.asset.hardware.serial_number
DEVICE_ACTION_EVENT USER_EMAIL principal.user.email_addresses
DEVICE_ACTION_EVENT target.application The target.application UDM field is set to Mobile.
DEVICE_ACTION_EVENT target.resource.resource_type The target.resource.resource_type UDM field is set to DEVICE.
DEVICE_ACTION_EVENT target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template AssetId:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
DEVICE_COMPLIANCE_CHANGED_EVENT DEVICE_COMPLIANCE target.resource.attribute.labels[device_compliance]
DEVICE_COMPLIANCE_CHANGED_EVENT DEVICE_DEACTIVATION_REASON target.resource.attribute.labels[device_deactivation_reason]
DEVICE_COMPLIANCE_CHANGED_EVENT DEVICE_ID target.resource.product_object_id
DEVICE_COMPLIANCE_CHANGED_EVENT DEVICE_MODEL target.asset.hardware.model
DEVICE_COMPLIANCE_CHANGED_EVENT DEVICE_TYPE target.resource.resource_subtype
DEVICE_COMPLIANCE_CHANGED_EVENT RESOURCE_ID target.resource.attribute.labels[resource_id]
DEVICE_COMPLIANCE_CHANGED_EVENT SERIAL_NUMBER target.asset.hardware.serial_number
DEVICE_COMPLIANCE_CHANGED_EVENT USER_EMAIL principal.user.email_addresses
DEVICE_COMPLIANCE_CHANGED_EVENT target.application The target.application UDM field is set to Mobile.
DEVICE_COMPLIANCE_CHANGED_EVENT target.resource.resource_type The target.resource.resource_type UDM field is set to DEVICE.
DEVICE_COMPLIANCE_CHANGED_EVENT target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template AssetId:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
OS_UPDATED_EVENT DEVICE_ID target.resource.product_object_id
OS_UPDATED_EVENT DEVICE_MODEL target.asset.hardware.model
OS_UPDATED_EVENT DEVICE_TYPE target.resource.resource_subtype
OS_UPDATED_EVENT IOS_VENDOR_ID target.resource.attribute.labels[ios_vendor_id]
OS_UPDATED_EVENT NEW_VALUE target.resource.attribute.labels[new_value]
OS_UPDATED_EVENT OLD_VALUE target.resource.attribute.labels[old_value]
OS_UPDATED_EVENT OS_PROPERTY target.resource.attribute.labels[os_property]
OS_UPDATED_EVENT RESOURCE_ID target.resource.attribute.labels[resource_id]
OS_UPDATED_EVENT SERIAL_NUMBER target.asset.hardware.serial_number
OS_UPDATED_EVENT USER_EMAIL principal.user.email_addresses
OS_UPDATED_EVENT target.application The target.application UDM field is set to Mobile.
OS_UPDATED_EVENT target.resource.resource_type The target.resource.resource_type UDM field is set to DEVICE.
OS_UPDATED_EVENT target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template AssetId:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
DEVICE_OWNERSHIP_CHANGE_EVENT DEVICE_ID target.resource.product_object_id
DEVICE_OWNERSHIP_CHANGE_EVENT DEVICE_MODEL target.asset.hardware.model
DEVICE_OWNERSHIP_CHANGE_EVENT DEVICE_OWNERSHIP target.resource.attribute.labels[device_ownership]
DEVICE_OWNERSHIP_CHANGE_EVENT DEVICE_TYPE target.resource.resource_subtype
DEVICE_OWNERSHIP_CHANGE_EVENT NEW_DEVICE_ID target.resource.attribute.labels[new_device_id]
DEVICE_OWNERSHIP_CHANGE_EVENT RESOURCE_ID target.resource.attribute.labels[resource_id]
DEVICE_OWNERSHIP_CHANGE_EVENT SERIAL_NUMBER target.asset.hardware.serial_number
DEVICE_OWNERSHIP_CHANGE_EVENT USER_EMAIL principal.user.email_addresses
DEVICE_OWNERSHIP_CHANGE_EVENT target.application The target.application UDM field is set to Mobile.
DEVICE_OWNERSHIP_CHANGE_EVENT target.resource.resource_type The target.resource.resource_type UDM field is set to DEVICE.
DEVICE_OWNERSHIP_CHANGE_EVENT target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template AssetId:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
DEVICE_SETTINGS_UPDATED_EVENT DEVICE_ID target.resource.product_object_id
DEVICE_SETTINGS_UPDATED_EVENT DEVICE_MODEL target.asset.hardware.model
DEVICE_SETTINGS_UPDATED_EVENT DEVICE_SETTING target.resource.attribute.labels[device_setting]
DEVICE_SETTINGS_UPDATED_EVENT DEVICE_TYPE target.resource.resource_subtype
DEVICE_SETTINGS_UPDATED_EVENT NEW_VALUE target.resource.attribute.labels[new_value]
DEVICE_SETTINGS_UPDATED_EVENT OLD_VALUE target.resource.attribute.labels[old_value]
DEVICE_SETTINGS_UPDATED_EVENT RESOURCE_ID target.resource.attribute.labels[resource_id]
DEVICE_SETTINGS_UPDATED_EVENT SERIAL_NUMBER target.asset.hardware.serial_number
DEVICE_SETTINGS_UPDATED_EVENT USER_EMAIL principal.user.email_addresses
DEVICE_SETTINGS_UPDATED_EVENT target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
DEVICE_SETTINGS_UPDATED_EVENT target.application The target.application UDM field is set to Mobile.
DEVICE_SETTINGS_UPDATED_EVENT target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template AssetId:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
APPLE_DEP_DEVICE_UPDATE_ON_APPLE_PORTAL_EVENT DEVICE_STATUS_ON_APPLE_PORTAL target.resource.attribute.labels[device_status_on_apple_portal]
APPLE_DEP_DEVICE_UPDATE_ON_APPLE_PORTAL_EVENT SERIAL_NUMBER target.asset.hardware.serial_number
APPLE_DEP_DEVICE_UPDATE_ON_APPLE_PORTAL_EVENT target.application The target.application UDM field is set to Mobile.
APPLE_DEP_DEVICE_UPDATE_ON_APPLE_PORTAL_EVENT target.resource.resource_type The target.resource.resource_type UDM field is set to DEVICE.
DEVICE_SYNC_EVENT BASIC_INTEGRITY target.resource.attribute.labels[basic_integrity]
DEVICE_SYNC_EVENT CTS_PROFILE_MATCH target.resource.attribute.labels[cts_profile_match]
DEVICE_SYNC_EVENT DEVICE_ID target.resource.product_object_id
DEVICE_SYNC_EVENT DEVICE_MODEL target.asset.hardware.model
DEVICE_SYNC_EVENT DEVICE_TYPE target.resource.resource_subtype
DEVICE_SYNC_EVENT IOS_VENDOR_ID target.resource.attribute.labels[ios_vendor_id]
DEVICE_SYNC_EVENT OS_VERSION target.asset.platform_software.platform_version
DEVICE_SYNC_EVENT RESOURCE_ID target.resource.attribute.labels[resource_id]
DEVICE_SYNC_EVENT SECURITY_PATCH_LEVEL additional.fields[security_patch_level]
DEVICE_SYNC_EVENT SERIAL_NUMBER target.asset.hardware.serial_number
DEVICE_SYNC_EVENT USER_EMAIL principal.user.email_addresses
DEVICE_SYNC_EVENT target.application The target.application UDM field is set to Mobile.
DEVICE_SYNC_EVENT target.resource.resource_type The target.resource.resource_type UDM field is set to DEVICE.
DEVICE_SYNC_EVENT target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template AssetId:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
RISK_SIGNAL_UPDATED_EVENT DEVICE_ID target.resource.product_object_id
RISK_SIGNAL_UPDATED_EVENT DEVICE_MODEL target.asset.hardware.model
RISK_SIGNAL_UPDATED_EVENT DEVICE_TYPE target.resource.resource_subtype
RISK_SIGNAL_UPDATED_EVENT IOS_VENDOR_ID target.resource.attribute.labels[ios_vendor_id]
RISK_SIGNAL_UPDATED_EVENT NEW_VALUE target.resource.attribute.labels[new_value]
RISK_SIGNAL_UPDATED_EVENT OLD_VALUE target.resource.attribute.labels[old_value]
RISK_SIGNAL_UPDATED_EVENT RESOURCE_ID target.resource.attribute.labels[resource_id]
RISK_SIGNAL_UPDATED_EVENT RISK_SIGNAL additional.fields[risk_signal]
RISK_SIGNAL_UPDATED_EVENT SERIAL_NUMBER target.asset.hardware.serial_number
RISK_SIGNAL_UPDATED_EVENT USER_EMAIL principal.user.email_addresses
RISK_SIGNAL_UPDATED_EVENT target.application The target.application UDM field is set to Mobile.
RISK_SIGNAL_UPDATED_EVENT target.resource.resource_type The target.resource.resource_type UDM field is set to DEVICE.
RISK_SIGNAL_UPDATED_EVENT target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template AssetId:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT DEVICE_ID target.resource.product_object_id
ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT DEVICE_MODEL target.asset.hardware.model
ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT DEVICE_TYPE target.resource.resource_subtype
ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT RESOURCE_ID target.resource.attribute.labels[resource_id]
ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT SERIAL_NUMBER target.asset.hardware.serial_number
ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT USER_EMAIL principal.user.email_addresses
ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT target.application The target.application UDM field is set to Mobile.
ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT target.resource.resource_type The target.resource.resource_type UDM field is set to DEVICE.
ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template AssetId:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
DEVICE_COMPROMISED_EVENT DEVICE_COMPROMISED_STATE target.resource.attribute.labels[device_compromised_state]
DEVICE_COMPROMISED_EVENT DEVICE_ID target.resource.product_object_id
DEVICE_COMPROMISED_EVENT DEVICE_MODEL target.asset.hardware.model
DEVICE_COMPROMISED_EVENT DEVICE_TYPE target.resource.resource_subtype
DEVICE_COMPROMISED_EVENT IOS_VENDOR_ID target.resource.attribute.labels[ios_vendor_id]
DEVICE_COMPROMISED_EVENT RESOURCE_ID target.resource.attribute.labels[resource_id]
DEVICE_COMPROMISED_EVENT SERIAL_NUMBER target.asset.hardware.serial_number
DEVICE_COMPROMISED_EVENT USER_EMAIL principal.user.email_addresses
DEVICE_COMPROMISED_EVENT target.application The target.application UDM field is set to Mobile.
DEVICE_COMPROMISED_EVENT target.resource.resource_type The target.resource.resource_type UDM field is set to DEVICE.
DEVICE_COMPROMISED_EVENT target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template AssetId:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
FAILED_PASSWORD_ATTEMPTS_EVENT DEVICE_ID target.resource.product_object_id
FAILED_PASSWORD_ATTEMPTS_EVENT DEVICE_MODEL target.asset.hardware.model
FAILED_PASSWORD_ATTEMPTS_EVENT DEVICE_TYPE target.resource.resource_subtype
FAILED_PASSWORD_ATTEMPTS_EVENT FAILED_PASSWD_ATTEMPTS additional.fields[failed_passwd_attempts]
FAILED_PASSWORD_ATTEMPTS_EVENT RESOURCE_ID target.resource.attribute.labels[resource_id]
FAILED_PASSWORD_ATTEMPTS_EVENT SERIAL_NUMBER target.asset.hardware.serial_number
FAILED_PASSWORD_ATTEMPTS_EVENT USER_EMAIL target.user.email_addresses
FAILED_PASSWORD_ATTEMPTS_EVENT target.application The target.application UDM field is set to Mobile.
FAILED_PASSWORD_ATTEMPTS_EVENT extensions.auth.mechanism The extensions.auth.mechanism UDM field is set to USERNAME_PASSWORD.
FAILED_PASSWORD_ATTEMPTS_EVENT extensions.auth.type If the events.name log field value is equal to FAILED_PASSWORD_ATTEMPTS_EVENT, then the extensions.auth.type UDM field is set to SSO.
FAILED_PASSWORD_ATTEMPTS_EVENT target.resource.resource_type The target.resource.resource_type UDM field is set to DEVICE.
FAILED_PASSWORD_ATTEMPTS_EVENT target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template AssetId:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
SUSPICIOUS_ACTIVITY_EVENT DEVICE_ID target.resource.product_object_id
SUSPICIOUS_ACTIVITY_EVENT DEVICE_MODEL target.asset.hardware.model
SUSPICIOUS_ACTIVITY_EVENT DEVICE_PROPERTY target.resource.attribute.labels[device_property]
SUSPICIOUS_ACTIVITY_EVENT DEVICE_TYPE target.resource.resource_subtype
SUSPICIOUS_ACTIVITY_EVENT IOS_VENDOR_ID target.resource.attribute.labels[ios_vendor_id]
SUSPICIOUS_ACTIVITY_EVENT NEW_VALUE target.resource.attribute.labels[new_value]
SUSPICIOUS_ACTIVITY_EVENT OLD_VALUE target.resource.attribute.labels[old_value]
SUSPICIOUS_ACTIVITY_EVENT RESOURCE_ID target.resource.attribute.labels[resource_id]
SUSPICIOUS_ACTIVITY_EVENT SERIAL_NUMBER target.asset.hardware.serial_number
SUSPICIOUS_ACTIVITY_EVENT USER_EMAIL principal.user.email_addresses
SUSPICIOUS_ACTIVITY_EVENT target.application The target.application UDM field is set to Mobile.
SUSPICIOUS_ACTIVITY_EVENT target.resource.resource_type The target.resource.resource_type UDM field is set to DEVICE.
SUSPICIOUS_ACTIVITY_EVENT target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template AssetId:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.

Field mapping reference: workspace activity groups_enterprise application

The following table provides the log fields to UDM field mapping corresponding to events for the groups_enterprise application.

Event Name Log field UDM mapping Logic
accept_invitation group_id target.group.email_addresses
accept_invitation namespace target.group.group_display_name
accept_invitation target.application The target.application UDM field is set to Enterprise Groups.
add_info_setting group_id target.group.email_addresses
add_info_setting info_setting target.resource.name
add_info_setting namespace target.group.group_display_name
add_info_setting value target.resource.attribute.labels[value]
add_info_setting target.application The target.application UDM field is set to Enterprise Groups.
add_info_setting target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
add_member group_id target.group.email_addresses
add_member member_id target.user.email_addresses
add_member member_role target.user.attribute.roles.name
add_member member_type target.user.attribute.labels[member_type]
add_member namespace target.group.group_display_name
add_member target.application The target.application UDM field is set to Enterprise Groups.
add_member_role group_id target.group.email_addresses
add_member_role member_id target.user.email_addresses
add_member_role member_role target.user.attribute.roles.name
add_member_role member_type target.user.attribute.labels[member_type]
add_member_role namespace target.group.group_display_name
add_member_role target.application The target.application UDM field is set to Enterprise Groups.
add_security_setting group_id target.group.email_addresses
add_security_setting namespace target.group.group_display_name
add_security_setting security_setting target.resource.name
add_security_setting value target.resource.attribute.labels[value]
add_security_setting target.application The target.application UDM field is set to Enterprise Groups.
add_security_setting target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
add_service_account_permission member_id target.user.email_addresses
add_service_account_permission member_role target.user.attribute.roles.name
add_service_account_permission member_type target.user.attribute.labels[member_type]
add_service_account_permission namespace target.group.group_display_name
add_service_account_permission target.application The target.application UDM field is set to Enterprise Groups.
approve_join_request group_id target.group.email_addresses
approve_join_request member_id target.user.email_addresses
approve_join_request member_type target.user.attribute.labels[member_type]
approve_join_request namespace target.group.group_display_name
approve_join_request target.application The target.application UDM field is set to Enterprise Groups.
ban_member_with_moderation group_id target.group.email_addresses
ban_member_with_moderation member_id target.user.email_addresses
ban_member_with_moderation member_type target.user.attribute.labels[member_type]
ban_member_with_moderation namespace target.group.group_display_name
ban_member_with_moderation target.application The target.application UDM field is set to Enterprise Groups.
change_info_setting group_id target.group.email_addresses
change_info_setting info_setting target.resource.name
change_info_setting namespace target.group.group_display_name
change_info_setting new_value target.resource.attribute.labels[new_value]
change_info_setting old_value target.resource.attribute.labels[old_value]
change_info_setting target.application The target.application UDM field is set to Enterprise Groups.
change_info_setting target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
change_security_setting group_id target.group.email_addresses
change_security_setting namespace target.group.group_display_name
change_security_setting new_value target.resource.attribute.labels[new_value]
change_security_setting old_value target.resource.attribute.labels[old_value]
change_security_setting security_setting target.resource.name
change_security_setting target.application The target.application UDM field is set to Enterprise Groups.
change_security_setting target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
change_security_setting_state group_id target.group.email_addresses
change_security_setting_state namespace target.group.group_display_name
change_security_setting_state new_value target.resource.attribute.labels[new_value]
change_security_setting_state old_value target.resource.attribute.labels[old_value]
change_security_setting_state security_setting_state additional.fields[security_setting_state]
change_security_setting_state target.application The target.application UDM field is set to Enterprise Groups.
change_security_setting_state target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
create_group group_id target.group.email_addresses
create_group namespace target.group.group_display_name
create_group target.application The target.application UDM field is set to Enterprise Groups.
create_namespace target.application The target.application UDM field is set to Enterprise Groups.
create_namespace namespace target.group.group_display_name
delete_group group_id target.group.email_addresses
delete_group namespace target.group.group_display_name
delete_group target.application The target.application UDM field is set to Enterprise Groups.
delete_namespace target.application The target.application UDM field is set to Enterprise Groups.
delete_namespace namespace target.group.group_display_name
add_dynamic_group_query dynamic_group_query target.group.attribute.labels[dynamic_group_query]
add_dynamic_group_query group_id target.group.email_addresses
add_dynamic_group_query namespace target.group.group_display_name
add_dynamic_group_query target.application The target.application UDM field is set to Enterprise Groups.
change_dynamic_group_query group_id target.group.email_addresses
change_dynamic_group_query namespace target.group.group_display_name
change_dynamic_group_query new_value target.resource.attribute.labels[new_value]
change_dynamic_group_query old_value target.resource.attribute.labels[old_value]
change_dynamic_group_query target.application The target.application UDM field is set to Enterprise Groups.
invite_member group_id target.group.email_addresses
invite_member member_id target.user.email_addresses
invite_member member_type target.user.attribute.labels[member_type]
invite_member namespace target.group.group_display_name
invite_member target.application The target.application UDM field is set to Enterprise Groups.
join group_id target.group.email_addresses
join namespace target.group.group_display_name
join target.application The target.application UDM field is set to Enterprise Groups.
add_membership_expiry group_id target.group.email_addresses
add_membership_expiry member_id target.user.email_addresses
add_membership_expiry member_type target.user.attribute.labels[member_type]
add_membership_expiry membership_expiry target.user.attribute.labels[membership_expiry]
add_membership_expiry target.application The target.application UDM field is set to Enterprise Groups.
remove_membership_expiry group_id target.group.email_addresses
remove_membership_expiry member_id target.user.email_addresses
remove_membership_expiry member_type target.user.attribute.labels[member_type]
remove_membership_expiry old_value target.resource.attribute.labels[old_value]
remove_membership_expiry target.application The target.application UDM field is set to Enterprise Groups.
update_membership_expiry group_id target.group.email_addresses
update_membership_expiry member_id target.user.email_addresses
update_membership_expiry member_type target.user.attribute.labels[member_type]
update_membership_expiry new_value target.resource.attribute.labels[new_value]
update_membership_expiry old_value target.resource.attribute.labels[old_value]
update_membership_expiry target.application The target.application UDM field is set to Enterprise Groups.
reject_invitation group_id target.group.email_addresses
reject_invitation namespace target.group.group_display_name
reject_invitation target.application The target.application UDM field is set to Enterprise Groups.
reject_join_request group_id target.group.email_addresses
reject_join_request member_id target.user.email_addresses
reject_join_request member_type target.user.attribute.labels[member_type]
reject_join_request namespace target.group.group_display_name
reject_join_request target.application The target.application UDM field is set to Enterprise Groups.
remove_info_setting group_id target.group.email_addresses
remove_info_setting info_setting target.resource.name
remove_info_setting namespace target.group.group_display_name
remove_info_setting value target.resource.attribute.labels[value]
remove_info_setting target.application The target.application UDM field is set to Enterprise Groups.
remove_info_setting target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
remove_member group_id target.group.email_addresses
remove_member member_id target.user.email_addresses
remove_member member_type target.user.attribute.labels[member_type]
remove_member namespace target.group.group_display_name
remove_member target.application The target.application UDM field is set to Enterprise Groups.
remove_member_role group_id target.group.email_addresses
remove_member_role member_id target.user.email_addresses
remove_member_role member_role target.user.attribute.roles.name
remove_member_role member_type target.user.attribute.labels[member_type]
remove_member_role namespace target.group.group_display_name
remove_member_role target.application The target.application UDM field is set to Enterprise Groups.
remove_security_setting group_id target.group.email_addresses
remove_security_setting namespace target.group.group_display_name
remove_security_setting security_setting target.resource.name
remove_security_setting value target.resource.attribute.labels[value]
remove_security_setting target.application The target.application UDM field is set to Enterprise Groups.
remove_security_setting target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
remove_service_account_permission member_id target.user.email_addresses
remove_service_account_permission member_role target.user.attribute.roles.name
remove_service_account_permission member_type target.user.attribute.labels[member_type]
remove_service_account_permission namespace target.group.group_display_name
remove_service_account_permission target.application The target.application UDM field is set to Enterprise Groups.
request_to_join target.application The target.application UDM field is set to Enterprise Groups.
request_to_join group_id target.group.email_addresses
request_to_join namespace target.group.group_display_name
revoke_invitation group_id target.group.email_addresses
revoke_invitation member_id target.user.email_addresses
revoke_invitation member_type target.user.attribute.labels[member_type]
revoke_invitation namespace target.group.group_display_name
revoke_invitation target.application The target.application UDM field is set to Enterprise Groups.
unban_member group_id target.group.email_addresses
unban_member member_id target.user.email_addresses
unban_member member_type target.user.attribute.labels[member_type]
unban_member namespace target.group.group_display_name
unban_member target.application The target.application UDM field is set to Enterprise Groups.

Field mapping reference: workspace activity calendar application

The following table provides the log fields to UDM field mapping corresponding to events for the calendar application.

Event Name Log field UDM mapping Logic
change_calendar_acls access_level target.resource.attribute.labels[access_level]
change_calendar_acls api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
change_calendar_acls calendar_id target.resource.product_object_id
change_calendar_acls grantee_email target.user.email_addresses
change_calendar_acls user_agent network.http.user_agent
change_calendar_acls target.application The target.application UDM field is set to Google Calendar.
change_calendar_acls api_kind principal.resource.attribute.labels[api_kind]
change_calendar_country api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
change_calendar_country calendar_country target.resource.attribute.labels[calendar_country]
change_calendar_country calendar_id target.resource.product_object_id
change_calendar_country user_agent network.http.user_agent
change_calendar_country target.application The target.application UDM field is set to Google Calendar.
change_calendar_country api_kind principal.resource.attribute.labels[api_kind]
create_calendar api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
create_calendar calendar_id target.resource.product_object_id
create_calendar user_agent network.http.user_agent
create_calendar target.application The target.application UDM field is set to Google Calendar.
create_calendar api_kind principal.resource.attribute.labels[api_kind]
delete_calendar api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
delete_calendar calendar_id target.resource.product_object_id
delete_calendar user_agent network.http.user_agent
delete_calendar target.application The target.application UDM field is set to Google Calendar.
delete_calendar api_kind principal.resource.attribute.labels[api_kind]
change_calendar_description api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
change_calendar_description calendar_description target.resource.attribute.labels[calendar_description]
change_calendar_description calendar_id target.resource.product_object_id
change_calendar_description user_agent network.http.user_agent
change_calendar_description target.application The target.application UDM field is set to Google Calendar.
change_calendar_description api_kind principal.resource.attribute.labels[api_kind]
export_calendar api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
export_calendar calendar_id target.resource.product_object_id
export_calendar user_agent network.http.user_agent
export_calendar target.application The target.application UDM field is set to Google Calendar.
export_calendar api_kind principal.resource.attribute.labels[api_kind]
change_calendar_location api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
change_calendar_location calendar_id target.resource.product_object_id
change_calendar_location calendar_location target.resource.attribute.labels[calendar_location]
change_calendar_location user_agent network.http.user_agent
change_calendar_location target.application The target.application UDM field is set to Google Calendar.
change_calendar_location api_kind principal.resource.attribute.labels[api_kind]
print_preview_calendar api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
print_preview_calendar calendar_id target.resource.product_object_id
print_preview_calendar requested_period_end additional.fields[requested_period_end]
print_preview_calendar requested_period_start additional.fields[requested_period_start]
print_preview_calendar user_agent network.http.user_agent
print_preview_calendar target.application The target.application UDM field is set to Google Calendar.
print_preview_calendar api_kind principal.resource.attribute.labels[api_kind]
change_calendar_timezone api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
change_calendar_timezone calendar_id target.resource.product_object_id
change_calendar_timezone calendar_timezone target.resource.attribute.labels[calendar_timezone]
change_calendar_timezone user_agent network.http.user_agent
change_calendar_timezone target.application The target.application UDM field is set to Google Calendar.
change_calendar_timezone api_kind principal.resource.attribute.labels[api_kind]
change_calendar_title api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
change_calendar_title calendar_id target.resource.product_object_id
change_calendar_title calendar_title target.resource.name
change_calendar_title user_agent network.http.user_agent
change_calendar_title target.application The target.application UDM field is set to Google Calendar.
change_calendar_title api_kind principal.resource.attribute.labels[api_kind]
notification_triggered api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
notification_triggered calendar_id target.resource.product_object_id
notification_triggered event_id target.resource.attribute.labels[event_id]
notification_triggered notification_message_id target.resource.attribute.labels[notification_message_id]
notification_triggered notification_method target.resource.attribute.labels[notification_method]
notification_triggered notification_type target.resource.resource_subtype
notification_triggered recipient_email target.user.email_addresses
notification_triggered target.application The target.application UDM field is set to Google Calendar.
notification_triggered api_kind principal.resource.attribute.labels[api_kind]
add_subscription api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
add_subscription calendar_id target.resource.product_object_id
add_subscription event_id target.resource.attribute.labels[event_id]
add_subscription notification_method target.resource.attribute.labels[notification_method]
add_subscription notification_type target.resource.resource_subtype
add_subscription subscriber_calendar_id target.resource.attribute.labels[subscriber_calendar_id]
add_subscription user_agent network.http.user_agent
add_subscription target.application The target.application UDM field is set to Google Calendar.
add_subscription api_kind principal.resource.attribute.labels[api_kind]
delete_subscription api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
delete_subscription calendar_id target.resource.product_object_id
delete_subscription event_id target.resource.attribute.labels[event_id]
delete_subscription notification_method target.resource.attribute.labels[notification_method]
delete_subscription notification_type target.resource.resource_subtype
delete_subscription subscriber_calendar_id target.resource.attribute.labels[subscriber_calendar_id]
delete_subscription user_agent network.http.user_agent
delete_subscription target.application The target.application UDM field is set to Google Calendar.
delete_subscription api_kind principal.resource.attribute.labels[api_kind]
change_appointment_schedule api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
change_appointment_schedule calendar_id target.resource.product_object_id
change_appointment_schedule client_side_encrypted target.resource.attribute.labels[client_side_encrypted]
change_appointment_schedule end_time target.resource.attribute.labels[end_time]
change_appointment_schedule event_id target.resource.attribute.labels[event_id]
change_appointment_schedule is_recurring target.resource.attribute.labels[is_recurring]
change_appointment_schedule organizer_calendar_id target.resource.attribute.labels[organizer_calendar_id]
change_appointment_schedule recurring target.resource.attribute.labels[recurring]
change_appointment_schedule start_time target.resource.attribute.labels[start_time]
change_appointment_schedule user_agent network.http.user_agent
change_appointment_schedule target.application The target.application UDM field is set to Google Calendar.
change_appointment_schedule api_kind principal.resource.attribute.labels[api_kind]
create_appointment_schedule api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
create_appointment_schedule calendar_id target.resource.product_object_id
create_appointment_schedule client_side_encrypted target.resource.attribute.labels[client_side_encrypted]
create_appointment_schedule end_time target.resource.attribute.labels[end_time]
create_appointment_schedule event_id target.resource.attribute.labels[event_id]
create_appointment_schedule is_recurring target.resource.attribute.labels[is_recurring]
create_appointment_schedule organizer_calendar_id target.resource.attribute.labels[organizer_calendar_id]
create_appointment_schedule recurring target.resource.attribute.labels[recurring]
create_appointment_schedule start_time target.resource.attribute.labels[start_time]
create_appointment_schedule user_agent network.http.user_agent
create_appointment_schedule target.application The target.application UDM field is set to Google Calendar.
create_appointment_schedule api_kind principal.resource.attribute.labels[api_kind]
delete_appointment_schedule api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
delete_appointment_schedule calendar_id target.resource.product_object_id
delete_appointment_schedule client_side_encrypted target.resource.attribute.labels[client_side_encrypted]
delete_appointment_schedule end_time target.resource.attribute.labels[end_time]
delete_appointment_schedule event_id target.resource.attribute.labels[event_id]
delete_appointment_schedule is_recurring target.resource.attribute.labels[is_recurring]
delete_appointment_schedule organizer_calendar_id target.resource.attribute.labels[organizer_calendar_id]
delete_appointment_schedule recurring target.resource.attribute.labels[recurring]
delete_appointment_schedule start_time target.resource.attribute.labels[start_time]
delete_appointment_schedule user_agent network.http.user_agent
delete_appointment_schedule target.application The target.application UDM field is set to Google Calendar.
delete_appointment_schedule api_kind principal.resource.attribute.labels[api_kind]
create_event api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
create_event calendar_id target.resource.product_object_id
create_event end_time target.resource.attribute.labels[end_time]
create_event event_id target.resource.attribute.labels[event_id]
create_event event_title target.resource.name
create_event notification_message_id target.resource.attribute.labels[notification_message_id]
create_event organizer_calendar_id target.resource.attribute.labels[organizer_calendar_id]
create_event recipient_email target.user.email_addresses
create_event start_time target.resource.attribute.labels[start_time]
create_event user_agent network.http.user_agent
create_event target.application The target.application UDM field is set to Google Calendar.
create_event api_kind principal.resource.attribute.labels[api_kind]
delete_event api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
delete_event calendar_id target.resource.product_object_id
delete_event event_id target.resource.attribute.labels[event_id]
delete_event event_title target.resource.name
delete_event notification_message_id target.resource.attribute.labels[notification_message_id]
delete_event organizer_calendar_id target.resource.attribute.labels[organizer_calendar_id]
delete_event recipient_email target.user.email_addresses
delete_event user_agent network.http.user_agent
delete_event target.application The target.application UDM field is set to Google Calendar.
delete_event api_kind principal.resource.attribute.labels[api_kind]
add_event_guest api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
add_event_guest calendar_id target.resource.product_object_id
add_event_guest event_guest additional.fields[event_guest]
add_event_guest event_id target.resource.attribute.labels[event_id]
add_event_guest event_title target.resource.name
add_event_guest notification_message_id target.resource.attribute.labels[notification_message_id]
add_event_guest organizer_calendar_id target.resource.attribute.labels[organizer_calendar_id]
add_event_guest recipient_email target.user.email_addresses
add_event_guest user_agent network.http.user_agent
add_event_guest target.application The target.application UDM field is set to Google Calendar.
add_event_guest api_kind principal.resource.attribute.labels[api_kind]
change_event_guest_response_auto api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
change_event_guest_response_auto calendar_id target.resource.product_object_id
change_event_guest_response_auto event_guest additional.fields[event_guest]
change_event_guest_response_auto event_id target.resource.attribute.labels[event_id]
change_event_guest_response_auto event_response_status target.resource.attribute.labels[event_response_status]
change_event_guest_response_auto event_title target.resource.name
change_event_guest_response_auto organizer_calendar_id target.resource.attribute.labels[organizer_calendar_id]
change_event_guest_response_auto user_agent network.http.user_agent
change_event_guest_response_auto target.application The target.application UDM field is set to Google Calendar.
change_event_guest_response_auto api_kind principal.resource.attribute.labels[api_kind]
remove_event_guest api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
remove_event_guest calendar_id target.resource.product_object_id
remove_event_guest event_guest additional.fields[event_guest]
remove_event_guest event_id target.resource.attribute.labels[event_id]
remove_event_guest event_title target.resource.name
remove_event_guest notification_message_id target.resource.attribute.labels[notification_message_id]
remove_event_guest organizer_calendar_id target.resource.attribute.labels[organizer_calendar_id]
remove_event_guest recipient_email target.user.email_addresses
remove_event_guest user_agent network.http.user_agent
remove_event_guest target.application The target.application UDM field is set to Google Calendar.
remove_event_guest api_kind principal.resource.attribute.labels[api_kind]
change_event_guest_response api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
change_event_guest_response calendar_id target.resource.product_object_id
change_event_guest_response event_guest additional.fields[event_guest]
change_event_guest_response event_id target.resource.attribute.labels[event_id]
change_event_guest_response event_response_status target.resource.attribute.labels[event_response_status]
change_event_guest_response event_title target.resource.name
change_event_guest_response notification_message_id target.resource.attribute.labels[notification_message_id]
change_event_guest_response organizer_calendar_id target.resource.attribute.labels[organizer_calendar_id]
change_event_guest_response recipient_email target.user.email_addresses
change_event_guest_response user_agent network.http.user_agent
change_event_guest_response target.application The target.application UDM field is set to Google Calendar.
change_event_guest_response api_kind principal.resource.attribute.labels[api_kind]
change_event api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
change_event calendar_id target.resource.product_object_id
change_event event_id target.resource.attribute.labels[event_id]
change_event event_title target.resource.name
change_event notification_message_id target.resource.attribute.labels[notification_message_id]
change_event organizer_calendar_id target.resource.attribute.labels[organizer_calendar_id]
change_event recipient_email target.user.email_addresses
change_event user_agent network.http.user_agent
change_event target.application The target.application UDM field is set to Google Calendar.
change_event api_kind principal.resource.attribute.labels[api_kind]
print_preview_event api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
print_preview_event calendar_id target.resource.product_object_id
print_preview_event client_side_encrypted target.resource.attribute.labels[client_side_encrypted]
print_preview_event end_time target.resource.attribute.labels[end_time]
print_preview_event event_id target.resource.attribute.labels[event_id]
print_preview_event event_title target.resource.name
print_preview_event is_recurring target.resource.attribute.labels[is_recurring]
print_preview_event organizer_calendar_id target.resource.attribute.labels[organizer_calendar_id]
print_preview_event recurring target.resource.attribute.labels[recurring]
print_preview_event start_time target.resource.attribute.labels[start_time]
print_preview_event user_agent network.http.user_agent
print_preview_event target.application The target.application UDM field is set to Google Calendar.
print_preview_event api_kind principal.resource.attribute.labels[api_kind]
remove_event_from_trash api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
remove_event_from_trash calendar_id target.resource.product_object_id
remove_event_from_trash event_id target.resource.attribute.labels[event_id]
remove_event_from_trash event_title target.resource.name
remove_event_from_trash organizer_calendar_id target.resource.attribute.labels[organizer_calendar_id]
remove_event_from_trash user_agent network.http.user_agent
remove_event_from_trash target.application The target.application UDM field is set to Google Calendar.
remove_event_from_trash api_kind principal.resource.attribute.labels[api_kind]
restore_event api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
restore_event calendar_id target.resource.product_object_id
restore_event event_id target.resource.attribute.labels[event_id]
restore_event event_title target.resource.name
restore_event notification_message_id target.resource.attribute.labels[notification_message_id]
restore_event organizer_calendar_id target.resource.attribute.labels[organizer_calendar_id]
restore_event recipient_email target.user.email_addresses
restore_event user_agent network.http.user_agent
restore_event target.application The target.application UDM field is set to Google Calendar.
restore_event api_kind principal.resource.attribute.labels[api_kind]
change_event_start_time api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
change_event_start_time calendar_id target.resource.product_object_id
change_event_start_time event_id target.resource.attribute.labels[event_id]
change_event_start_time event_title target.resource.name
change_event_start_time notification_message_id target.resource.attribute.labels[notification_message_id]
change_event_start_time organizer_calendar_id target.resource.attribute.labels[organizer_calendar_id]
change_event_start_time recipient_email target.user.email_addresses
change_event_start_time start_time target.resource.attribute.labels[start_time]
change_event_start_time user_agent network.http.user_agent
change_event_start_time target.application The target.application UDM field is set to Google Calendar.
change_event_start_time api_kind principal.resource.attribute.labels[api_kind]
change_event_title api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
change_event_title calendar_id target.resource.product_object_id
change_event_title event_id target.resource.attribute.labels[event_id]
change_event_title event_title target.resource.name
change_event_title notification_message_id target.resource.attribute.labels[notification_message_id]
change_event_title old_event_title target.resource.attribute.labels[old_event_title]
change_event_title organizer_calendar_id target.resource.attribute.labels[organizer_calendar_id]
change_event_title recipient_email target.user.email_addresses
change_event_title user_agent network.http.user_agent
change_event_title target.application The target.application UDM field is set to Google Calendar.
change_event_title api_kind principal.resource.attribute.labels[api_kind]
transfer_event_completed api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
transfer_event_completed calendar_id target.resource.product_object_id
transfer_event_completed client_side_encrypted target.resource.attribute.labels[client_side_encrypted]
transfer_event_completed end_time target.resource.attribute.labels[end_time]
transfer_event_completed event_id target.resource.attribute.labels[event_id]
transfer_event_completed event_title target.resource.name
transfer_event_completed is_recurring target.resource.attribute.labels[is_recurring]
transfer_event_completed organizer_calendar_id target.resource.attribute.labels[organizer_calendar_id]
transfer_event_completed recurring target.resource.attribute.labels[recurring]
transfer_event_completed start_time target.resource.attribute.labels[start_time]
transfer_event_completed user_agent network.http.user_agent
transfer_event_completed target.application The target.application UDM field is set to Google Calendar.
transfer_event_completed api_kind principal.resource.attribute.labels[api_kind]
transfer_event_requested api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
transfer_event_requested calendar_id target.resource.product_object_id
transfer_event_requested client_side_encrypted target.resource.attribute.labels[client_side_encrypted]
transfer_event_requested end_time target.resource.attribute.labels[end_time]
transfer_event_requested event_id target.resource.attribute.labels[event_id]
transfer_event_requested event_title target.resource.name
transfer_event_requested grantee_email target.user.email_addresses
transfer_event_requested is_recurring target.resource.attribute.labels[is_recurring]
transfer_event_requested organizer_calendar_id target.resource.attribute.labels[organizer_calendar_id]
transfer_event_requested recurring target.resource.attribute.labels[recurring]
transfer_event_requested start_time target.resource.attribute.labels[start_time]
transfer_event_requested user_agent network.http.user_agent
transfer_event_requested target.application The target.application UDM field is set to Google Calendar.
transfer_event_requested api_kind principal.resource.attribute.labels[api_kind]
interop_freebusy_lookup_outbound_successful api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
interop_freebusy_lookup_outbound_successful calendar_id target.resource.product_object_id
interop_freebusy_lookup_outbound_successful remote_ews_url target.url
interop_freebusy_lookup_outbound_successful requested_period_end additional.fields[requested_period_end]
interop_freebusy_lookup_outbound_successful requested_period_start additional.fields[requested_period_start]
interop_freebusy_lookup_outbound_successful target.application The target.application UDM field is set to Google Calendar.
interop_freebusy_lookup_outbound_successful api_kind principal.resource.attribute.labels[api_kind]
interop_freebusy_lookup_inbound_successful api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
interop_freebusy_lookup_inbound_successful calendar_id target.resource.product_object_id
interop_freebusy_lookup_inbound_successful requested_period_end additional.fields[requested_period_end]
interop_freebusy_lookup_inbound_successful requested_period_start additional.fields[requested_period_start]
interop_freebusy_lookup_inbound_successful target.application The target.application UDM field is set to Google Calendar.
interop_freebusy_lookup_inbound_successful api_kind principal.resource.attribute.labels[api_kind]
interop_exchange_resource_availability_lookup_successful api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
interop_exchange_resource_availability_lookup_successful calendar_id target.resource.product_object_id
interop_exchange_resource_availability_lookup_successful remote_ews_url target.url
interop_exchange_resource_availability_lookup_successful requested_period_end additional.fields[requested_period_end]
interop_exchange_resource_availability_lookup_successful requested_period_start additional.fields[requested_period_start]
interop_exchange_resource_availability_lookup_successful target.application The target.application UDM field is set to Google Calendar.
interop_exchange_resource_availability_lookup_successful api_kind principal.resource.attribute.labels[api_kind]
interop_exchange_resource_list_lookup_successful api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
interop_exchange_resource_list_lookup_successful interop_error_code metadata.description
interop_exchange_resource_list_lookup_successful remote_ews_url target.url
interop_exchange_resource_list_lookup_successful target.application The target.application UDM field is set to Google Calendar.
interop_exchange_resource_list_lookup_successful api_kind principal.resource.attribute.labels[api_kind]
interop_freebusy_lookup_outbound_unsuccessful api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
interop_freebusy_lookup_outbound_unsuccessful calendar_id target.resource.product_object_id
interop_freebusy_lookup_outbound_unsuccessful interop_error_code metadata.description
interop_freebusy_lookup_outbound_unsuccessful remote_ews_url target.url
interop_freebusy_lookup_outbound_unsuccessful requested_period_end additional.fields[requested_period_end]
interop_freebusy_lookup_outbound_unsuccessful requested_period_start additional.fields[requested_period_start]
interop_freebusy_lookup_outbound_unsuccessful target.application The target.application UDM field is set to Google Calendar.
interop_freebusy_lookup_outbound_unsuccessful api_kind principal.resource.attribute.labels[api_kind]
interop_freebusy_lookup_inbound_unsuccessful api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
interop_freebusy_lookup_inbound_unsuccessful calendar_id target.resource.product_object_id
interop_freebusy_lookup_inbound_unsuccessful interop_error_code metadata.description
interop_freebusy_lookup_inbound_unsuccessful requested_period_end additional.fields[requested_period_end]
interop_freebusy_lookup_inbound_unsuccessful requested_period_start additional.fields[requested_period_start]
interop_freebusy_lookup_inbound_unsuccessful target.application The target.application UDM field is set to Google Calendar.
interop_freebusy_lookup_inbound_unsuccessful api_kind principal.resource.attribute.labels[api_kind]
interop_exchange_resource_availability_lookup_unsuccessful api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
interop_exchange_resource_availability_lookup_unsuccessful calendar_id target.resource.product_object_id
interop_exchange_resource_availability_lookup_unsuccessful interop_error_code metadata.description
interop_exchange_resource_availability_lookup_unsuccessful remote_ews_url target.url
interop_exchange_resource_availability_lookup_unsuccessful requested_period_end additional.fields[requested_period_end]
interop_exchange_resource_availability_lookup_unsuccessful requested_period_start additional.fields[requested_period_start]
interop_exchange_resource_availability_lookup_unsuccessful target.application The target.application UDM field is set to Google Calendar.
interop_exchange_resource_availability_lookup_unsuccessful api_kind principal.resource.attribute.labels[api_kind]
interop_exchange_resource_list_lookup_unsuccessful api_kind principal.resource.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to api_kind, then if the events.parameters.value log field value is equal to android, then the principal.resource.name UDM field is set to Android device. Else if the events.parameters.value log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API. Else if the events.parameters.value log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API. Else if the events.parameters.value log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API. Else if the events.parameters.value log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API. Else if the events.parameters.value log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS. Else if the events.parameters.value log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail. Else if the events.parameters.value log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
interop_exchange_resource_list_lookup_unsuccessful interop_error_code metadata.description
interop_exchange_resource_list_lookup_unsuccessful remote_ews_url target.url
interop_exchange_resource_list_lookup_unsuccessful target.application The target.application UDM field is set to Google Calendar.
interop_exchange_resource_list_lookup_unsuccessful api_kind principal.resource.attribute.labels[api_kind]

Field mapping reference: workspace activity google_chat application

The following table provides the log fields to UDM field mapping corresponding to events for the google_chat application. fields.

Event Name Log field UDM mapping Logic
add_room_member actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
add_room_member actor_type principal.user.attribute.labels[actor_type]
add_room_member room_id target.group.product_object_id
add_room_member target_users target.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to target_users, then
Iterate through log field events.parameters.multiValue:
The events.parameters.multiValue log field is mapped to the target.user.email_addresses UDM field.
add_room_member target.application The target.application UDM field is set to Google Chat.
app_added actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
app_added actor_type principal.user.attribute.labels[actor_type]
app_added conversation_ownership target.resource.attribute.labels[conversation_ownership]
app_added conversation_type target.resource.attribute.labels[conversation_type]
app_added external_room target.group.attribute.labels[external_room]
app_added room_id target.group.product_object_id
app_added room_name target.group.group_display_name
app_added target.application The target.application UDM field is set to Google Chat.
app_invoked actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
app_invoked actor_type principal.user.attribute.labels[actor_type]
app_invoked conversation_ownership target.resource.attribute.labels[conversation_ownership]
app_invoked conversation_type target.resource.attribute.labels[conversation_type]
app_invoked external_room target.group.attribute.labels[external_room]
app_invoked room_id target.group.product_object_id
app_invoked room_name target.group.group_display_name
app_invoked target.application The target.application UDM field is set to Google Chat.
app_removed actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
app_removed actor_type principal.user.attribute.labels[actor_type]
app_removed conversation_ownership target.resource.attribute.labels[conversation_ownership]
app_removed conversation_type target.resource.attribute.labels[conversation_type]
app_removed external_room target.group.attribute.labels[external_room]
app_removed room_id target.group.product_object_id
app_removed room_name target.group.group_display_name
app_removed target.application The target.application UDM field is set to Google Chat.
attachment_download actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
attachment_download attachment_hash target.file.sha256
attachment_download attachment_name target.file.names
attachment_download attachment_url target.file.full_path
attachment_download room_id target.group.product_object_id
attachment_download target.application The target.application UDM field is set to Google Chat.
attachment_upload actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
attachment_upload attachment_hash target.file.sha256
attachment_upload attachment_name target.file.names
attachment_upload conversation_ownership target.resource.attribute.labels[conversation_ownership]
attachment_upload conversation_type target.resource.attribute.labels[conversation_type]
attachment_upload dlp_scan_status security_result.action_details
attachment_upload room_id target.group.product_object_id
attachment_upload target.application The target.application UDM field is set to Google Chat.
block_room actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
block_room room_id target.group.product_object_id
block_room target.application The target.application UDM field is set to Google Chat.
block_user actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
block_user room_id target.group.product_object_id
block_user target_users target.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to target_users, then
Iterate through log field events.parameters.multiValue:
The events.parameters.multiValue log field is mapped to the target.user.email_addresses UDM field.
block_user target.application The target.application UDM field is set to Google Chat.
conversation_read actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
conversation_read actor_type principal.user.attribute.labels[actor_type]
conversation_read conversation_ownership target.resource.attribute.labels[conversation_ownership]
conversation_read conversation_type target.resource.attribute.labels[conversation_type]
conversation_read room_id target.group.product_object_id
conversation_read target.application The target.application UDM field is set to Google Chat.
custom_status_updated target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
custom_status_updated target.application The target.application UDM field is set to Google Chat.
custom_status_updated actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
direct_message_started actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
direct_message_started conversation_ownership target.resource.attribute.labels[conversation_ownership]
direct_message_started conversation_type target.resource.attribute.labels[conversation_type]
direct_message_started dlp_scan_status security_result.action_details
direct_message_started message_id target.resource.product_object_id
direct_message_started room_id target.group.product_object_id
direct_message_started target.application The target.application UDM field is set to Google Chat.
emoji_created actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
emoji_created emoji_shortcode target.resource.name
emoji_created filename target.file.names
emoji_created target.application The target.application UDM field is set to Google Chat.
emoji_deleted actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
emoji_deleted emoji_shortcode target.resource.name
emoji_deleted filename target.file.names
emoji_deleted target.application The target.application UDM field is set to Google Chat.
history_turned_off actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
history_turned_off room_id target.group.product_object_id
history_turned_off target.application The target.application UDM field is set to Google Chat.
history_turned_on actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
history_turned_on room_id target.group.product_object_id
history_turned_on target.application The target.application UDM field is set to Google Chat.
invite_accept actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
invite_accept room_id target.group.product_object_id
invite_accept target.application The target.application UDM field is set to Google Chat.
invite_decline actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
invite_decline room_id target.group.product_object_id
invite_decline target.application The target.application UDM field is set to Google Chat.
invite_send actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
invite_send room_id target.group.product_object_id
invite_send target_users target.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to target_users, then
Iterate through log field events.parameters.multiValue:
The events.parameters.multiValue log field is mapped to the target.user.email_addresses UDM field.
invite_send target.application The target.application UDM field is set to Google Chat.
message_deleted actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
message_deleted actor_type principal.user.attribute.labels[actor_type]
message_deleted message_id target.resource.product_object_id
message_deleted room_id target.group.product_object_id
message_deleted target.application The target.application UDM field is set to Google Chat.
message_edited actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
message_edited attachment_hash target.file.sha256
message_edited attachment_name target.file.names
message_edited attachment_status target.resource.attribute.labels[attachment_status]
message_edited dlp_scan_status security_result.action_details
message_edited message_id target.resource.product_object_id
message_edited message_type target.resource.resource_subtype
message_edited room_id target.group.product_object_id
message_edited target.application The target.application UDM field is set to Google Chat.
message_posted actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
message_posted attachment_hash target.file.sha256
message_posted attachment_name target.file.names
message_posted attachment_status target.resource.attribute.labels[attachment_status]
message_posted conversation_ownership target.resource.attribute.labels[conversation_ownership]
message_posted conversation_type target.resource.attribute.labels[conversation_type]
message_posted dlp_scan_status security_result.action_details
message_posted message_id target.resource.product_object_id
message_posted message_type target.resource.resource_subtype
message_posted room_id target.group.product_object_id
message_posted target.application The target.application UDM field is set to Google Chat.
message_report_resolved actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
message_report_resolved actor_type principal.user.attribute.labels[actor_type]
message_report_resolved message_id target.resource.product_object_id
message_report_resolved report_id target.resource.attribute.labels[report_id]
message_report_resolved report_type target.resource.attribute.labels[report_type]
message_report_resolved target.application The target.application UDM field is set to Google Chat.
message_reported actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
message_reported message_id target.resource.product_object_id
message_reported report_id target.resource.attribute.labels[report_id]
message_reported report_type target.resource.attribute.labels[report_type]
message_reported room_id target.group.product_object_id
message_reported target.resource.resource_subtype The target.resource.resource_subtype UDM field is set to Google Chat - Message.
message_reported target_users target.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to target_users, then
Iterate through log field events.parameters.multiValue:
The events.parameters.multiValue log field is mapped to the target.user.email_addresses UDM field.
message_reported target.application The target.application UDM field is set to Google Chat.
reaction_added actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
reaction_added conversation_ownership target.resource.attribute.labels[conversation_ownership]
reaction_added conversation_type target.resource.attribute.labels[conversation_type]
reaction_added message_id target.resource.product_object_id
reaction_added room_id target.group.product_object_id
reaction_added target.application The target.application UDM field is set to Google Chat.
reaction_removed actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
reaction_removed conversation_ownership target.resource.attribute.labels[conversation_ownership]
reaction_removed conversation_type target.resource.attribute.labels[conversation_type]
reaction_removed message_id target.resource.product_object_id
reaction_removed room_id target.group.product_object_id
reaction_removed target.application The target.application UDM field is set to Google Chat.
remove_room_member actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
remove_room_member actor_type principal.user.attribute.labels[actor_type]
remove_room_member room_id target.group.product_object_id
remove_room_member target_users target.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to target_users, then
Iterate through log field events.parameters.multiValue:
The events.parameters.multiValue log field is mapped to the target.user.email_addresses UDM field.
remove_room_member target.application The target.application UDM field is set to Google Chat.
role_updated actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
role_updated actor_type principal.user.attribute.labels[actor_type]
role_updated room_id target.group.product_object_id
role_updated target_user_role target.user.attribute.roles.name
role_updated target_users target.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to target_users, then
Iterate through log field events.parameters.multiValue:
The events.parameters.multiValue log field is mapped to the target.user.email_addresses UDM field.
role_updated target.application The target.application UDM field is set to Google Chat.
room_created actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
room_created conversation_ownership target.resource.attribute.labels[conversation_ownership]
room_created conversation_type target.resource.attribute.labels[conversation_type]
room_created room_id target.group.product_object_id
room_created target.application The target.application UDM field is set to Google Chat.
room_deleted actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
room_deleted actor_type principal.user.attribute.labels[actor_type]
room_deleted room_id target.group.product_object_id
room_deleted target.application The target.application UDM field is set to Google Chat.
room_details_updated actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
room_details_updated actor_type principal.user.attribute.labels[actor_type]
room_details_updated room_id target.group.product_object_id
room_details_updated target.application The target.application UDM field is set to Google Chat.
room_left actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
room_left room_id target.group.product_object_id
room_left target.application The target.application UDM field is set to Google Chat.
room_name_updated actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
room_name_updated actor_type principal.user.attribute.labels[actor_type]
room_name_updated room_id target.group.product_object_id
room_name_updated target.application The target.application UDM field is set to Google Chat.
room_unblocked actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
room_unblocked room_id target.group.product_object_id
room_unblocked target.application The target.application UDM field is set to Google Chat.
unread_timestamp_updated actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
unread_timestamp_updated room_id target.group.product_object_id
unread_timestamp_updated target.application The target.application UDM field is set to Google Chat.
user_unblocked actor principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to actor, then if the events.parameters.value log field value is not equal to the actor.email log field value, then the events.parameters.value log field is mapped to the principal.user.email_addresses UDM field.
user_unblocked target_users target.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to target_users, then
Iterate through log field events.parameters.multiValue:
The events.parameters.multiValue log field is mapped to the target.user.email_addresses UDM field.
user_unblocked target.application The target.application UDM field is set to Google Chat.

Field mapping reference: workspace activity gcp application

The following table provides the log fields to UDM field mapping corresponding to events for the gcp application.

Event Name Log field UDM mapping Logic
IMPORT_SSH_PUBLIC_KEY target.application The target.application UDM field is set to Google Cloud Platform.
IMPORT_SSH_PUBLIC_KEY USER_EMAIL target.user.email_addresses
DELETE_POSIX_ACCOUNT target.application The target.application UDM field is set to Google Cloud Platform.
DELETE_POSIX_ACCOUNT USER_EMAIL target.user.email_addresses
DELETE_SSH_PUBLIC_KEY target.application The target.application UDM field is set to Google Cloud Platform.
DELETE_SSH_PUBLIC_KEY USER_EMAIL target.user.email_addresses
GET_SSH_PUBLIC_KEY target.application The target.application UDM field is set to Google Cloud Platform.
GET_SSH_PUBLIC_KEY USER_EMAIL target.user.email_addresses
GET_LOGIN_PROFILE target.application The target.application UDM field is set to Google Cloud Platform.
GET_LOGIN_PROFILE USER_EMAIL target.user.email_addresses
UPDATE_SSH_PUBLIC_KEY target.application The target.application UDM field is set to Google Cloud Platform.
UPDATE_SSH_PUBLIC_KEY USER_EMAIL target.user.email_addresses

Field mapping reference: workspace activity drive application

The following table provides the log fields to UDM field mapping corresponding to events for the gcp application.

Event Name Log field UDM mapping Logic
deny_access_request actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
deny_access_request actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
deny_access_request billable additional.fields[billable]
deny_access_request doc_id target.resource.product_object_id
deny_access_request doc_title target.resource.name
deny_access_request doc_type target.resource.attribute.labels[doc_type]
deny_access_request is_encrypted additional.fields[is_encrypted]
deny_access_request originating_app_id additional.fields[originating_app_id]
deny_access_request owner about.user.email_addresses
deny_access_request owner target.resource.attribute.labels[owner]
deny_access_request owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
deny_access_request owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
deny_access_request primary_event additional.fields[primary_event]
deny_access_request target_user target.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to target, then target log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to target_user, then target_user log field value is set to the events.parameters.value log field value.
If the target_user log field value is not empty and the target log field value is not equal to the target_user log field value, then if the target_user log field value matches the regular expression pattern: ^.+@.+$, then the target_user log field is mapped to the target.user.email_addresses UDM field. Otherwise, the target.user.attribute.labels.key UDM field is set to target_user and The target_user log field is mapped to the target.user.attribute.labels.value UDM field.
deny_access_request target_user additional.fields[target_user]
deny_access_request shared_drive_id target.resource_ancestors.product_object_id
deny_access_request visibility target.resource.attribute.labels[visibility]
deny_access_request target.application The target.application UDM field is set to Google Drive.
expire_access_request actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
expire_access_request actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
expire_access_request billable additional.fields[billable]
expire_access_request doc_id target.resource.product_object_id
expire_access_request doc_title target.resource.name
expire_access_request doc_type target.resource.attribute.labels[doc_type]
expire_access_request is_encrypted additional.fields[is_encrypted]
expire_access_request originating_app_id additional.fields[originating_app_id]
expire_access_request owner about.user.email_addresses
expire_access_request owner target.resource.attribute.labels[owner]
expire_access_request owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
expire_access_request owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
expire_access_request primary_event additional.fields[primary_event]
expire_access_request target_user target.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to target, then target log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to target_user, then target_user log field value is set to the events.parameters.value log field value.
If the target_user log field value is not empty and the target log field value is not equal to the target_user log field value, then if the target_user log field value matches the regular expression pattern: ^.+@.+$, then the target_user log field is mapped to the target.user.email_addresses UDM field. Otherwise, the target.user.attribute.labels.key UDM field is set to target_user and The target_user log field is mapped to the target.user.attribute.labels.value UDM field.
expire_access_request target_user additional.fields[target_user]
expire_access_request shared_drive_id target.resource_ancestors.product_object_id
expire_access_request visibility target.resource.attribute.labels[visibility]
expire_access_request target.application The target.application UDM field is set to Google Drive.
request_access actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
request_access actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
request_access billable additional.fields[billable]
request_access doc_id target.resource.product_object_id
request_access doc_title target.resource.name
request_access doc_type target.resource.attribute.labels[doc_type]
request_access is_encrypted additional.fields[is_encrypted]
request_access originating_app_id additional.fields[originating_app_id]
request_access owner about.user.email_addresses
request_access owner target.resource.attribute.labels[owner]
request_access owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
request_access owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
request_access primary_event additional.fields[primary_event]
request_access requested_role target.user.attribute.roles.name
request_access target_user target.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to target, then target log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to target_user, then target_user log field value is set to the events.parameters.value log field value.
If the target_user log field value is not empty and the target log field value is not equal to the target_user log field value, then if the target_user log field value matches the regular expression pattern: ^.+@.+$, then the target_user log field is mapped to the target.user.email_addresses UDM field. Otherwise, the target.user.attribute.labels.key UDM field is set to target_user and The target_user log field is mapped to the target.user.attribute.labels.value UDM field.
request_access target_user additional.fields[target_user]
request_access shared_drive_id target.resource_ancestors.product_object_id
request_access visibility target.resource.attribute.labels[visibility]
request_access target.application The target.application UDM field is set to Google Drive.
add_to_folder actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
add_to_folder actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
add_to_folder billable additional.fields[billable]
add_to_folder destination_folder_id target.resource_ancestors.product_object_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to destination_folder_id, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the events.parameters.multiValue log field is mapped to the target.resource_ancestors.product_object_id UDM field. Otherwise, the target.resource_ancestors.product_object_id UDM field is set to a value generated from the template %{target.resource_ancestors.product_object_id}, %{events.parameters.multiValue}, where %{target.resource_ancestors.product_object_id} and %{events.parameters.multiValue} are replaced with the values of the target.resource_ancestors.product_object_id and events.parameters.multiValue log fields.
add_to_folder destination_folder_title target.resource_ancestors.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to destination_folder_title, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the events.parameters.multiValue log field is mapped to the target.resource_ancestors.name UDM field. Otherwise, the target.resource_ancestors.name UDM field is set to a value generated from the template %{target.resource_ancestors.name}, %{events.parameters.multiValue}, where %{target.resource_ancestors.name} and %{events.parameters.multiValue} are replaced with the values of the target.resource_ancestors.name and events.parameters.multiValue log fields.
add_to_folder doc_id target.resource.product_object_id
add_to_folder doc_title target.resource.name
add_to_folder doc_type target.resource.attribute.labels[doc_type]
add_to_folder is_encrypted additional.fields[is_encrypted]
add_to_folder originating_app_id additional.fields[originating_app_id]
add_to_folder owner about.user.email_addresses
add_to_folder owner target.resource.attribute.labels[owner]
add_to_folder owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
add_to_folder owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
add_to_folder primary_event additional.fields[primary_event]
add_to_folder shared_drive_id target.resource_ancestors.product_object_id
add_to_folder visibility target.resource.attribute.labels[visibility]
add_to_folder target.application The target.application UDM field is set to Google Drive.
appeal_abuse_violation actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
appeal_abuse_violation actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
appeal_abuse_violation billable additional.fields[billable]
appeal_abuse_violation doc_id target.resource.product_object_id
appeal_abuse_violation doc_title target.resource.name
appeal_abuse_violation doc_type target.resource.attribute.labels[doc_type]
appeal_abuse_violation is_encrypted additional.fields[is_encrypted]
appeal_abuse_violation originating_app_id additional.fields[originating_app_id]
appeal_abuse_violation owner about.user.email_addresses
appeal_abuse_violation owner target.resource.attribute.labels[owner]
appeal_abuse_violation owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
appeal_abuse_violation owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
appeal_abuse_violation primary_event additional.fields[primary_event]
appeal_abuse_violation shared_drive_id target.resource_ancestors.product_object_id
appeal_abuse_violation visibility target.resource.attribute.labels[visibility]
appeal_abuse_violation target.application The target.application UDM field is set to Google Drive.
approval_canceled actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
approval_canceled actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
approval_canceled billable additional.fields[billable]
approval_canceled doc_id target.resource.product_object_id
approval_canceled doc_title target.resource.name
approval_canceled doc_type target.resource.attribute.labels[doc_type]
approval_canceled is_encrypted additional.fields[is_encrypted]
approval_canceled originating_app_id additional.fields[originating_app_id]
approval_canceled owner about.user.email_addresses
approval_canceled owner target.resource.attribute.labels[owner]
approval_canceled owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
approval_canceled owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
approval_canceled primary_event additional.fields[primary_event]
approval_canceled shared_drive_id target.resource_ancestors.product_object_id
approval_canceled visibility target.resource.attribute.labels[visibility]
approval_canceled target.application The target.application UDM field is set to Google Drive.
approval_comment_added actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
approval_comment_added actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
approval_comment_added billable additional.fields[billable]
approval_comment_added doc_id target.resource.product_object_id
approval_comment_added doc_title target.resource.name
approval_comment_added doc_type target.resource.attribute.labels[doc_type]
approval_comment_added is_encrypted additional.fields[is_encrypted]
approval_comment_added originating_app_id additional.fields[originating_app_id]
approval_comment_added owner about.user.email_addresses
approval_comment_added owner target.resource.attribute.labels[owner]
approval_comment_added owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
approval_comment_added owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
approval_comment_added primary_event additional.fields[primary_event]
approval_comment_added shared_drive_id target.resource_ancestors.product_object_id
approval_comment_added visibility target.resource.attribute.labels[visibility]
approval_comment_added target.application The target.application UDM field is set to Google Drive.
approval_completed actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
approval_completed actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
approval_completed billable additional.fields[billable]
approval_completed doc_id target.resource.product_object_id
approval_completed doc_title target.resource.name
approval_completed doc_type target.resource.attribute.labels[doc_type]
approval_completed is_encrypted additional.fields[is_encrypted]
approval_completed originating_app_id additional.fields[originating_app_id]
approval_completed owner about.user.email_addresses
approval_completed owner target.resource.attribute.labels[owner]
approval_completed owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
approval_completed owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
approval_completed primary_event additional.fields[primary_event]
approval_completed shared_drive_id target.resource_ancestors.product_object_id
approval_completed visibility target.resource.attribute.labels[visibility]
approval_completed target.application The target.application UDM field is set to Google Drive.
approval_decisions_reset actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
approval_decisions_reset actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
approval_decisions_reset billable additional.fields[billable]
approval_decisions_reset doc_id target.resource.product_object_id
approval_decisions_reset doc_title target.resource.name
approval_decisions_reset doc_type target.resource.attribute.labels[doc_type]
approval_decisions_reset is_encrypted additional.fields[is_encrypted]
approval_decisions_reset originating_app_id additional.fields[originating_app_id]
approval_decisions_reset owner about.user.email_addresses
approval_decisions_reset owner target.resource.attribute.labels[owner]
approval_decisions_reset owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
approval_decisions_reset owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
approval_decisions_reset primary_event additional.fields[primary_event]
approval_decisions_reset shared_drive_id target.resource_ancestors.product_object_id
approval_decisions_reset visibility target.resource.attribute.labels[visibility]
approval_decisions_reset target.application The target.application UDM field is set to Google Drive.
approval_due_time_change actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
approval_due_time_change actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
approval_due_time_change billable additional.fields[billable]
approval_due_time_change doc_id target.resource.product_object_id
approval_due_time_change doc_title target.resource.name
approval_due_time_change doc_type target.resource.attribute.labels[doc_type]
approval_due_time_change is_encrypted additional.fields[is_encrypted]
approval_due_time_change originating_app_id additional.fields[originating_app_id]
approval_due_time_change owner about.user.email_addresses
approval_due_time_change owner target.resource.attribute.labels[owner]
approval_due_time_change owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
approval_due_time_change owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
approval_due_time_change primary_event additional.fields[primary_event]
approval_due_time_change shared_drive_id target.resource_ancestors.product_object_id
approval_due_time_change visibility target.resource.attribute.labels[visibility]
approval_due_time_change target.application The target.application UDM field is set to Google Drive.
approval_requested actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
approval_requested actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
approval_requested billable additional.fields[billable]
approval_requested doc_id target.resource.product_object_id
approval_requested doc_title target.resource.name
approval_requested doc_type target.resource.attribute.labels[doc_type]
approval_requested is_encrypted additional.fields[is_encrypted]
approval_requested originating_app_id additional.fields[originating_app_id]
approval_requested owner about.user.email_addresses
approval_requested owner target.resource.attribute.labels[owner]
approval_requested owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
approval_requested owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
approval_requested primary_event additional.fields[primary_event]
approval_requested shared_drive_id target.resource_ancestors.product_object_id
approval_requested visibility target.resource.attribute.labels[visibility]
approval_requested target.application The target.application UDM field is set to Google Drive.
approval_reviewer_change actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
approval_reviewer_change actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
approval_reviewer_change billable additional.fields[billable]
approval_reviewer_change doc_id target.resource.product_object_id
approval_reviewer_change doc_title target.resource.name
approval_reviewer_change doc_type target.resource.attribute.labels[doc_type]
approval_reviewer_change is_encrypted additional.fields[is_encrypted]
approval_reviewer_change originating_app_id additional.fields[originating_app_id]
approval_reviewer_change owner about.user.email_addresses
approval_reviewer_change owner target.resource.attribute.labels[owner]
approval_reviewer_change owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
approval_reviewer_change owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
approval_reviewer_change primary_event additional.fields[primary_event]
approval_reviewer_change shared_drive_id target.resource_ancestors.product_object_id
approval_reviewer_change visibility target.resource.attribute.labels[visibility]
approval_reviewer_change target.application The target.application UDM field is set to Google Drive.
approval_reviewer_responded actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
approval_reviewer_responded actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
approval_reviewer_responded billable additional.fields[billable]
approval_reviewer_responded doc_id target.resource.product_object_id
approval_reviewer_responded doc_title target.resource.name
approval_reviewer_responded doc_type target.resource.attribute.labels[doc_type]
approval_reviewer_responded is_encrypted additional.fields[is_encrypted]
approval_reviewer_responded originating_app_id additional.fields[originating_app_id]
approval_reviewer_responded owner about.user.email_addresses
approval_reviewer_responded owner target.resource.attribute.labels[owner]
approval_reviewer_responded owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
approval_reviewer_responded owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
approval_reviewer_responded primary_event additional.fields[primary_event]
approval_reviewer_responded shared_drive_id target.resource_ancestors.product_object_id
approval_reviewer_responded visibility target.resource.attribute.labels[visibility]
approval_reviewer_responded target.application The target.application UDM field is set to Google Drive.
create_comment actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
create_comment actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
create_comment billable additional.fields[billable]
create_comment doc_id target.resource.product_object_id
create_comment doc_title target.resource.name
create_comment doc_type target.resource.attribute.labels[doc_type]
create_comment is_encrypted additional.fields[is_encrypted]
create_comment originating_app_id additional.fields[originating_app_id]
create_comment owner about.user.email_addresses
create_comment owner target.resource.attribute.labels[owner]
create_comment owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
create_comment owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
create_comment primary_event additional.fields[primary_event]
create_comment shared_drive_id target.resource_ancestors.product_object_id
create_comment visibility target.resource.attribute.labels[visibility]
create_comment target.application The target.application UDM field is set to Google Drive.
delete_comment actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
delete_comment actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
delete_comment billable additional.fields[billable]
delete_comment doc_id target.resource.product_object_id
delete_comment doc_title target.resource.name
delete_comment doc_type target.resource.attribute.labels[doc_type]
delete_comment is_encrypted additional.fields[is_encrypted]
delete_comment originating_app_id additional.fields[originating_app_id]
delete_comment owner about.user.email_addresses
delete_comment owner target.resource.attribute.labels[owner]
delete_comment owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
delete_comment owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
delete_comment primary_event additional.fields[primary_event]
delete_comment shared_drive_id target.resource_ancestors.product_object_id
delete_comment visibility target.resource.attribute.labels[visibility]
delete_comment target.application The target.application UDM field is set to Google Drive.
edit_comment actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
edit_comment actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
edit_comment billable additional.fields[billable]
edit_comment doc_id target.resource.product_object_id
edit_comment doc_title target.resource.name
edit_comment doc_type target.resource.attribute.labels[doc_type]
edit_comment is_encrypted additional.fields[is_encrypted]
edit_comment originating_app_id additional.fields[originating_app_id]
edit_comment owner about.user.email_addresses
edit_comment owner target.resource.attribute.labels[owner]
edit_comment owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
edit_comment owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
edit_comment primary_event additional.fields[primary_event]
edit_comment shared_drive_id target.resource_ancestors.product_object_id
edit_comment visibility target.resource.attribute.labels[visibility]
edit_comment target.application The target.application UDM field is set to Google Drive.
reassign_comment actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
reassign_comment actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
reassign_comment billable additional.fields[billable]
reassign_comment doc_id target.resource.product_object_id
reassign_comment doc_title target.resource.name
reassign_comment doc_type target.resource.attribute.labels[doc_type]
reassign_comment is_encrypted additional.fields[is_encrypted]
reassign_comment originating_app_id additional.fields[originating_app_id]
reassign_comment owner about.user.email_addresses
reassign_comment owner target.resource.attribute.labels[owner]
reassign_comment owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
reassign_comment owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
reassign_comment primary_event additional.fields[primary_event]
reassign_comment shared_drive_id target.resource_ancestors.product_object_id
reassign_comment visibility target.resource.attribute.labels[visibility]
reassign_comment target.application The target.application UDM field is set to Google Drive.
reopen_comment actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
reopen_comment actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
reopen_comment billable additional.fields[billable]
reopen_comment doc_id target.resource.product_object_id
reopen_comment doc_title target.resource.name
reopen_comment doc_type target.resource.attribute.labels[doc_type]
reopen_comment is_encrypted additional.fields[is_encrypted]
reopen_comment originating_app_id additional.fields[originating_app_id]
reopen_comment owner about.user.email_addresses
reopen_comment owner target.resource.attribute.labels[owner]
reopen_comment owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
reopen_comment owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
reopen_comment primary_event additional.fields[primary_event]
reopen_comment shared_drive_id target.resource_ancestors.product_object_id
reopen_comment visibility target.resource.attribute.labels[visibility]
reopen_comment target.application The target.application UDM field is set to Google Drive.
resolve_comment actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
resolve_comment actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
resolve_comment billable additional.fields[billable]
resolve_comment doc_id target.resource.product_object_id
resolve_comment doc_title target.resource.name
resolve_comment doc_type target.resource.attribute.labels[doc_type]
resolve_comment is_encrypted additional.fields[is_encrypted]
resolve_comment originating_app_id additional.fields[originating_app_id]
resolve_comment owner about.user.email_addresses
resolve_comment owner target.resource.attribute.labels[owner]
resolve_comment owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
resolve_comment owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
resolve_comment primary_event additional.fields[primary_event]
resolve_comment shared_drive_id target.resource_ancestors.product_object_id
resolve_comment visibility target.resource.attribute.labels[visibility]
resolve_comment target.application The target.application UDM field is set to Google Drive.
connected_sheets_query actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
connected_sheets_query actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
connected_sheets_query billable additional.fields[billable]
connected_sheets_query data_connection_id additional.fields[data_connection_id]
connected_sheets_query delegating_principal about.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to delegating_principal, then if the events.parameters.value log field value is equal to the actor log field value the email log field value and the events.parameters.value log field value matches the regular expression pattern: ^.+@.+$, then the events.parameters.value log field is mapped to the about.user.email_addresses UDM field.
connected_sheets_query doc_id target.resource.product_object_id
connected_sheets_query doc_title target.resource.name
connected_sheets_query doc_type target.resource.attribute.labels[doc_type]
connected_sheets_query execution_id additional.fields[execution_id] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to execution_id, then
Iterate through log field events.parameters.multiValue:
if the index2 log field value is equal to 0, then the additional.fields.key UDM field is set to execution_id and the events.parameters.multiValue log field is mapped to the additional.fields.value UDM field. Otherwise, the additional.fields.key UDM field is set to execution_id and the additional.fields.value UDM field is set to a value generated from the template %{additional.fields[execution_id]}, %{events.parameters.multiValue}, where %{additional.fields[execution_id]} and %{events.parameters.multiValue} are replaced with the values of the additional.fields[execution_id] and events.parameters.multiValue log fields.
connected_sheets_query execution_trigger additional.fields[execution_trigger]
connected_sheets_query is_encrypted additional.fields[is_encrypted]
connected_sheets_query originating_app_id additional.fields[originating_app_id]
connected_sheets_query owner about.user.email_addresses
connected_sheets_query owner target.resource.attribute.labels[owner]
connected_sheets_query owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
connected_sheets_query owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
connected_sheets_query primary_event additional.fields[primary_event]
connected_sheets_query query_type additional.fields[query_type]
connected_sheets_query shared_drive_id target.resource_ancestors.product_object_id
connected_sheets_query visibility target.resource.attribute.labels[visibility]
connected_sheets_query target.application The target.application UDM field is set to Google Drive.
copy actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
copy actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
copy billable additional.fields[billable]
copy copy_type additional.fields[copy_type]
copy doc_id src.resource.product_object_id
copy doc_title src.resource.name
copy doc_type src.resource.attribute.labels[doc_type]
copy encryption_change security_result.detection_fields[encryption_change]
copy is_encrypted additional.fields[is_encrypted]
copy new_value target.file.names Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to new_value, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the events.parameters.multiValue log field is mapped to the target.file.names UDM field. Otherwise, the target.file.names UDM field is set to a value generated from the template %{target.file.names}, %{events.parameters.multiValue}, where %{target.file.names} and %{events.parameters.multiValue} are replaced with the values of the target.file.names and events.parameters.multiValue log fields.
copy old_value src.file.names Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to old_value, then
Iterate through log field events.parameters.multiValue:
if the index2 log field value is equal to 0, then the events.parameters.multiValue log field is mapped to the src.file.names UDM field. Otherwise, the src.file.names UDM field is set to a value generated from the template %{src.file.names}, %{events.parameters.multiValue}, where %{src.file.names} and %{events.parameters.multiValue} are replaced with the values of the src.file.names and events.parameters.multiValue log fields.
copy originating_app_id additional.fields[originating_app_id]
copy owner about.user.email_addresses
copy owner target.resource.attribute.labels[owner]
copy owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
copy owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
copy primary_event additional.fields[primary_event]
copy shared_drive_id target.resource_ancestors.product_object_id
copy visibility target.resource.attribute.labels[visibility]
copy target.application The target.application UDM field is set to Google Drive.
create actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
create actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
create billable additional.fields[billable]
create doc_id target.resource.product_object_id
create doc_title target.resource.name
create doc_type target.resource.attribute.labels[doc_type]
create encryption_enforcement_option additional.fields[encryption_enforcement_option]
create is_encrypted additional.fields[is_encrypted]
create originating_app_id additional.fields[originating_app_id]
create owner about.user.email_addresses
create owner target.resource.attribute.labels[owner]
create owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
create owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
create primary_event additional.fields[primary_event]
create shared_drive_id target.resource_ancestors.product_object_id
create visibility target.resource.attribute.labels[visibility]
create target.application The target.application UDM field is set to Google Drive.
delete actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
delete actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
delete billable additional.fields[billable]
delete deletion_reason security_result.description
delete doc_id target.resource.product_object_id
delete doc_title target.resource.name
delete doc_type target.resource.attribute.labels[doc_type]
delete is_encrypted additional.fields[is_encrypted]
delete originating_app_id additional.fields[originating_app_id]
delete owner about.user.email_addresses
delete owner target.resource.attribute.labels[owner]
delete owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
delete owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
delete primary_event additional.fields[primary_event]
delete shared_drive_id target.resource_ancestors.product_object_id
delete visibility target.resource.attribute.labels[visibility]
delete target.application The target.application UDM field is set to Google Drive.
download actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
download actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
download billable additional.fields[billable]
download doc_id target.resource.product_object_id
download doc_title target.resource.name
download doc_type target.resource.attribute.labels[doc_type]
download is_encrypted additional.fields[is_encrypted]
download originating_app_id additional.fields[originating_app_id]
download owner about.user.email_addresses
download owner target.resource.attribute.labels[owner]
download owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
download owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
download primary_event additional.fields[primary_event]
download shared_drive_id target.resource_ancestors.product_object_id
download visibility target.resource.attribute.labels[visibility]
download target.application The target.application UDM field is set to Google Drive.
email_as_attachment actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
email_as_attachment actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
email_as_attachment billable additional.fields[billable]
email_as_attachment doc_id target.resource.product_object_id
email_as_attachment doc_title target.resource.name
email_as_attachment doc_type target.resource.attribute.labels[doc_type]
email_as_attachment is_encrypted additional.fields[is_encrypted]
email_as_attachment originating_app_id additional.fields[originating_app_id]
email_as_attachment owner about.user.email_addresses
email_as_attachment owner target.resource.attribute.labels[owner]
email_as_attachment owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
email_as_attachment owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
email_as_attachment primary_event additional.fields[primary_event]
email_as_attachment target.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to target, then if the events.parameters.value log field value matches the regular expression pattern: ^.+@.+$, then the events.parameters.value log field is mapped to the target.user.email_addresses UDM field. Otherwise, the target.user.attribute.labels.key UDM field is set to target and the events.parameters.value log field is mapped to the target.user.attribute.labels.value UDM field.
email_as_attachment target_user target.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to target, then target log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to target_user, then target_user log field value is set to the events.parameters.value log field value.
If the target_user log field value is not empty and the target log field value is not equal to the target_user log field value, then if the target_user log field value matches the regular expression pattern: ^.+@.+$, then the target_user log field is mapped to the target.user.email_addresses UDM field. Otherwise, the target.user.attribute.labels.key UDM field is set to target_user and The target_user log field is mapped to the target.user.attribute.labels.value UDM field.
email_as_attachment target_user additional.fields[target_user]
email_as_attachment shared_drive_id target.resource_ancestors.product_object_id
email_as_attachment visibility target.resource.attribute.labels[visibility]
email_as_attachment target.application The target.application UDM field is set to Google Drive.
edit actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
edit actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
edit billable additional.fields[billable]
edit doc_id target.resource.product_object_id
edit doc_title target.resource.name
edit doc_type target.resource.attribute.labels[doc_type]
edit is_encrypted additional.fields[is_encrypted]
edit originating_app_id additional.fields[originating_app_id]
edit owner about.user.email_addresses
edit owner target.resource.attribute.labels[owner]
edit owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
edit owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
edit primary_event additional.fields[primary_event]
edit shared_drive_id target.resource_ancestors.product_object_id
edit visibility target.resource.attribute.labels[visibility]
edit target.application The target.application UDM field is set to Google Drive.
email_collaborators actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
email_collaborators actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
email_collaborators billable additional.fields[billable]
email_collaborators doc_id target.resource.product_object_id
email_collaborators doc_title target.resource.name
email_collaborators doc_type target.resource.attribute.labels[doc_type]
email_collaborators is_encrypted additional.fields[is_encrypted]
email_collaborators originating_app_id additional.fields[originating_app_id]
email_collaborators owner about.user.email_addresses
email_collaborators owner target.resource.attribute.labels[owner]
email_collaborators owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
email_collaborators owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
email_collaborators primary_event additional.fields[primary_event]
email_collaborators recipients target.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to recipients, then
Iterate through log field events.parameters.multiValue:
if the events.parameters.multiValue log field value matches the regular expression pattern: ^.+@.+$, then if the index1 log field value is equal to 0, then the events.parameters.multiValue log field is mapped to the target.user.email_addresses UDM field. Otherwise, the target.user.email_addresses UDM field is set to a value generated from the template %{target.user.email_addresses}, %{events.parameters.multiValue}, where %{target.user.email_addresses} and %{events.parameters.multiValue} are replaced with the values of the target.user.email_addresses and events.parameters.multiValue log fields.
email_collaborators shared_drive_id target.resource_ancestors.product_object_id
email_collaborators visibility target.resource.attribute.labels[visibility]
email_collaborators target.application The target.application UDM field is set to Google Drive.
encrypt actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
encrypt actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
encrypt billable additional.fields[billable]
encrypt doc_id target.resource.product_object_id
encrypt doc_title target.resource.name
encrypt doc_type target.resource.attribute.labels[doc_type]
encrypt encryption_change security_result.detection_fields[encryption_change]
encrypt is_encrypted additional.fields[is_encrypted]
encrypt originating_app_id additional.fields[originating_app_id]
encrypt owner about.user.email_addresses
encrypt owner target.resource.attribute.labels[owner]
encrypt owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
encrypt owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
encrypt primary_event additional.fields[primary_event]
encrypt shared_drive_id target.resource_ancestors.product_object_id
encrypt visibility target.resource.attribute.labels[visibility]
encrypt target.application The target.application UDM field is set to Google Drive.
cancel_esignature actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
cancel_esignature actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
cancel_esignature billable additional.fields[billable]
cancel_esignature doc_id target.resource.product_object_id
cancel_esignature doc_title target.resource.name
cancel_esignature doc_type target.resource.attribute.labels[doc_type]
cancel_esignature is_encrypted additional.fields[is_encrypted]
cancel_esignature originating_app_id additional.fields[originating_app_id]
cancel_esignature owner about.user.email_addresses
cancel_esignature owner target.resource.attribute.labels[owner]
cancel_esignature owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
cancel_esignature owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
cancel_esignature primary_event additional.fields[primary_event]
cancel_esignature shared_drive_id target.resource_ancestors.product_object_id
cancel_esignature visibility target.resource.attribute.labels[visibility]
cancel_esignature target.application The target.application UDM field is set to Google Drive.
complete_esignature actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
complete_esignature actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
complete_esignature billable additional.fields[billable]
complete_esignature doc_id target.resource.product_object_id
complete_esignature doc_title target.resource.name
complete_esignature doc_type target.resource.attribute.labels[doc_type]
complete_esignature esignature_status additional.fields[esignature_status]
complete_esignature is_encrypted additional.fields[is_encrypted]
complete_esignature originating_app_id additional.fields[originating_app_id]
complete_esignature owner about.user.email_addresses
complete_esignature owner target.resource.attribute.labels[owner]
complete_esignature owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
complete_esignature owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
complete_esignature primary_event additional.fields[primary_event]
complete_esignature shared_drive_id target.resource_ancestors.product_object_id
complete_esignature visibility target.resource.attribute.labels[visibility]
complete_esignature target.application The target.application UDM field is set to Google Drive.
request_esignature actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
request_esignature actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
request_esignature billable additional.fields[billable]
request_esignature doc_id target.resource.product_object_id
request_esignature doc_title target.resource.name
request_esignature doc_type target.resource.attribute.labels[doc_type]
request_esignature is_encrypted additional.fields[is_encrypted]
request_esignature originating_app_id additional.fields[originating_app_id]
request_esignature owner about.user.email_addresses
request_esignature owner target.resource.attribute.labels[owner]
request_esignature owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
request_esignature owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
request_esignature primary_event additional.fields[primary_event]
request_esignature shared_drive_id target.resource_ancestors.product_object_id
request_esignature visibility target.resource.attribute.labels[visibility]
request_esignature target.application The target.application UDM field is set to Google Drive.
review_esignature actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
review_esignature actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
review_esignature billable additional.fields[billable]
review_esignature doc_id target.resource.product_object_id
review_esignature doc_title target.resource.name
review_esignature doc_type target.resource.attribute.labels[doc_type]
review_esignature esignature_decision security_result.action_details
review_esignature is_encrypted additional.fields[is_encrypted]
review_esignature originating_app_id additional.fields[originating_app_id]
review_esignature owner about.user.email_addresses
review_esignature owner target.resource.attribute.labels[owner]
review_esignature owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
review_esignature owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
review_esignature primary_event additional.fields[primary_event]
review_esignature shared_drive_id target.resource_ancestors.product_object_id
review_esignature visibility target.resource.attribute.labels[visibility]
review_esignature target.application The target.application UDM field is set to Google Drive.
download_forms_response actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
download_forms_response actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
download_forms_response billable additional.fields[billable]
download_forms_response doc_id target.resource.product_object_id
download_forms_response doc_title target.resource.name
download_forms_response doc_type target.resource.attribute.labels[doc_type]
download_forms_response is_encrypted additional.fields[is_encrypted]
download_forms_response originating_app_id additional.fields[originating_app_id]
download_forms_response owner about.user.email_addresses
download_forms_response owner target.resource.attribute.labels[owner]
download_forms_response owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
download_forms_response owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
download_forms_response primary_event additional.fields[primary_event]
download_forms_response shared_drive_id target.resource_ancestors.product_object_id
download_forms_response visibility target.resource.attribute.labels[visibility]
download_forms_response target.application The target.application UDM field is set to Google Drive.
access_item_content actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
access_item_content actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
access_item_content api_method additional.fields[api_method]
access_item_content billable additional.fields[billable]
access_item_content doc_id target.resource.product_object_id
access_item_content doc_title target.resource.name
access_item_content doc_type target.resource.attribute.labels[doc_type]
access_item_content is_encrypted additional.fields[is_encrypted]
access_item_content originating_app_id additional.fields[originating_app_id]
access_item_content owner about.user.email_addresses
access_item_content owner target.resource.attribute.labels[owner]
access_item_content owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
access_item_content owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
access_item_content primary_event additional.fields[primary_event]
access_item_content shared_drive_id target.resource_ancestors.product_object_id
access_item_content visibility target.resource.attribute.labels[visibility]
access_item_content target.application The target.application UDM field is set to Google Drive.
prefetch_item_content actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
prefetch_item_content actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
prefetch_item_content billable additional.fields[billable]
prefetch_item_content doc_id target.resource.product_object_id
prefetch_item_content doc_title target.resource.name
prefetch_item_content doc_type target.resource.attribute.labels[doc_type]
prefetch_item_content is_encrypted additional.fields[is_encrypted]
prefetch_item_content originating_app_id additional.fields[originating_app_id]
prefetch_item_content owner about.user.email_addresses
prefetch_item_content owner target.resource.attribute.labels[owner]
prefetch_item_content owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
prefetch_item_content owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
prefetch_item_content primary_event additional.fields[primary_event]
prefetch_item_content shared_drive_id target.resource_ancestors.product_object_id
prefetch_item_content visibility target.resource.attribute.labels[visibility]
prefetch_item_content target.application The target.application UDM field is set to Google Drive.
sync_item_content actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
sync_item_content actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
sync_item_content billable additional.fields[billable]
sync_item_content doc_id target.resource.product_object_id
sync_item_content doc_title target.resource.name
sync_item_content doc_type target.resource.attribute.labels[doc_type]
sync_item_content is_encrypted additional.fields[is_encrypted]
sync_item_content originating_app_id additional.fields[originating_app_id]
sync_item_content owner about.user.email_addresses
sync_item_content owner target.resource.attribute.labels[owner]
sync_item_content owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
sync_item_content owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
sync_item_content primary_event additional.fields[primary_event]
sync_item_content shared_drive_id target.resource_ancestors.product_object_id
sync_item_content visibility target.resource.attribute.labels[visibility]
sync_item_content target.application The target.application UDM field is set to Google Drive.
search actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
search actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
search billable additional.fields[billable]
search originating_app_id additional.fields[originating_app_id]
search parsed_query additional.fields[parsed_query]
search primary_event additional.fields[primary_event]
search user_query additional.fields[user_query]
search target.application The target.application UDM field is set to Google Drive.
label_added doc_id target.resource.product_object_id
label_added doc_title target.resource.name
label_added doc_type target.resource.attribute.labels[doc_type]
label_added is_encrypted additional.fields[is_encrypted]
label_added label additional.fields[label]
label_added label_title additional.fields[label_title]
label_added originating_app_id additional.fields[originating_app_id]
label_added owner about.user.email_addresses
label_added owner target.resource.attribute.labels[owner]
label_added owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
label_added owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
label_added primary_event additional.fields[primary_event]
label_added reason security_result.summary
label_added shared_drive_id target.resource_ancestors.product_object_id
label_added visibility target.resource.attribute.labels[visibility]
label_added target.application The target.application UDM field is set to Google Drive.
label_added_by_item_create doc_id target.resource.product_object_id
label_added_by_item_create doc_title target.resource.name
label_added_by_item_create doc_type target.resource.attribute.labels[doc_type]
label_added_by_item_create is_encrypted additional.fields[is_encrypted]
label_added_by_item_create label additional.fields[label]
label_added_by_item_create label_title additional.fields[label_title]
label_added_by_item_create originating_app_id additional.fields[originating_app_id]
label_added_by_item_create owner about.user.email_addresses
label_added_by_item_create owner target.resource.attribute.labels[owner]
label_added_by_item_create owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
label_added_by_item_create owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
label_added_by_item_create primary_event additional.fields[primary_event]
label_added_by_item_create reason security_result.summary
label_added_by_item_create shared_drive_id target.resource_ancestors.product_object_id
label_added_by_item_create visibility target.resource.attribute.labels[visibility]
label_added_by_item_create target.application The target.application UDM field is set to Google Drive.
label_field_changed doc_id target.resource.product_object_id
label_field_changed doc_title target.resource.name
label_field_changed doc_type target.resource.attribute.labels[doc_type]
label_field_changed field additional.fields[field]
label_field_changed field_id additional.fields[field_id]
label_field_changed is_encrypted additional.fields[is_encrypted]
label_field_changed label additional.fields[label]
label_field_changed label_title additional.fields[label_title]
label_field_changed new_value target.resource.attribute.labels[new_value] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to new_value, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the target.resource.attribute.labels.key UDM field is set to new_value and the events.parameters.multiValue log field is mapped to the target.resource.attribute.labels.value UDM field. Otherwise, the target.resource.attribute.labels.key UDM field is set to new_value and the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[new_value]}, %{events.parameters.multiValue}, where %{target.resource.attribute.labels[new_value]} and %{events.parameters.multiValue} are replaced with the values of the target.resource.attribute.labels[new_value] and events.parameters.multiValue log fields.
label_field_changed new_value_id target.resource.attribute.labels[new_value_id] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to new_value_id, then
Iterate through log field events.parameters.multiValue:
The target.resource.attribute.labels.key UDM field is set to new_value_id. If the index1 log field value is equal to 0, then the events.parameters.multiValue log field is mapped to the target.resource.attribute.labels.value UDM field. Otherwise, the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels.value}, %{events.parameters.multiValue}, where %{target.resource.attribute.labels.value} and %{events.parameters.multiValue} are replaced with the values of the target.resource.attribute.labels.value and events.parameters.multiValue log fields.
label_field_changed old_value target.resource.attribute.labels[old_value] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to old_value, then
Iterate through log field events.parameters.multiValue:
if the index2 log field value is equal to 0, then the target.resource.attribute.labels.key UDM field is set to old_value and the events.parameters.multiValue log field is mapped to the target.resource.attribute.labels.value UDM field. Otherwise, the target.resource.attribute.labels.key UDM field is set to old_value and the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[old_value]}, %{events.parameters.multiValue}, where %{target.resource.attribute.labels[old_value]} and %{events.parameters.multiValue} are replaced with the values of the target.resource.attribute.labels[old_value] and events.parameters.multiValue log fields.
label_field_changed old_value_id target.resource.attribute.labels[old_value_id] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to old_value_id, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the target.resource.attribute.labels.key UDM field is set to old_value_id and the events.parameters.multiValue log field is mapped to the target.resource.attribute.labels.value UDM field. Otherwise, the target.resource.attribute.labels.key UDM field is set to old_value_id and the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[old_value_id]}, %{events.parameters.multiValue}, where %{target.resource.attribute.labels[old_value_id]} and %{events.parameters.multiValue} are replaced with the values of the target.resource.attribute.labels[old_value_id] and events.parameters.multiValue log fields.
label_field_changed originating_app_id additional.fields[originating_app_id]
label_field_changed owner about.user.email_addresses
label_field_changed owner target.resource.attribute.labels[owner]
label_field_changed owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
label_field_changed owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
label_field_changed primary_event additional.fields[primary_event]
label_field_changed reason security_result.summary
label_field_changed shared_drive_id target.resource_ancestors.product_object_id
label_field_changed visibility target.resource.attribute.labels[visibility]
label_field_changed target.application The target.application UDM field is set to Google Drive.
label_removed doc_id target.resource.product_object_id
label_removed doc_title target.resource.name
label_removed doc_type target.resource.attribute.labels[doc_type]
label_removed is_encrypted additional.fields[is_encrypted]
label_removed label additional.fields[label]
label_removed label_title additional.fields[label_title]
label_removed originating_app_id additional.fields[originating_app_id]
label_removed owner about.user.email_addresses
label_removed owner target.resource.attribute.labels[owner]
label_removed owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
label_removed owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
label_removed primary_event additional.fields[primary_event]
label_removed reason security_result.summary
label_removed shared_drive_id target.resource_ancestors.product_object_id
label_removed visibility target.resource.attribute.labels[visibility]
label_removed target.application The target.application UDM field is set to Google Drive.
add_lock actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
add_lock actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
add_lock billable additional.fields[billable]
add_lock doc_id target.resource.product_object_id
add_lock doc_title target.resource.name
add_lock doc_type target.resource.attribute.labels[doc_type]
add_lock is_encrypted additional.fields[is_encrypted]
add_lock lock_type target.resource.attribute.labels[lock_type]
add_lock originating_app_id additional.fields[originating_app_id]
add_lock owner about.user.email_addresses
add_lock owner target.resource.attribute.labels[owner]
add_lock owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
add_lock owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
add_lock primary_event additional.fields[primary_event]
add_lock shared_drive_id target.resource_ancestors.product_object_id
add_lock visibility target.resource.attribute.labels[visibility]
add_lock target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
add_lock target.application The target.application UDM field is set to Google Drive.
move actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
move actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
move billable additional.fields[billable]
move destination_folder_id target.resource_ancestors.product_object_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to destination_folder_id, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the events.parameters.multiValue log field is mapped to the target.resource_ancestors.product_object_id UDM field. Otherwise, the target.resource_ancestors.product_object_id UDM field is set to a value generated from the template %{target.resource_ancestors.product_object_id}, %{events.parameters.multiValue}, where %{target.resource_ancestors.product_object_id} and %{events.parameters.multiValue} are replaced with the values of the target.resource_ancestors.product_object_id and events.parameters.multiValue log fields.
move destination_folder_title target.resource_ancestors.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to destination_folder_title, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the events.parameters.multiValue log field is mapped to the target.resource_ancestors.name UDM field. Otherwise, the target.resource_ancestors.name UDM field is set to a value generated from the template %{target.resource_ancestors.name}, %{events.parameters.multiValue}, where %{target.resource_ancestors.name} and %{events.parameters.multiValue} are replaced with the values of the target.resource_ancestors.name and events.parameters.multiValue log fields.
move doc_id target.resource.product_object_id
move doc_id src.resource.product_object_id
move doc_title target.resource.name
move doc_title src.resource.name
move doc_type target.resource.attribute.labels[doc_type]
move doc_type src.resource.attribute.labels[doc_type]
move is_encrypted additional.fields[is_encrypted]
move originating_app_id additional.fields[originating_app_id]
move owner about.user.email_addresses
move owner target.resource.attribute.labels[owner]
move owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
move owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
move primary_event additional.fields[primary_event]
move source_folder_id principal.resource_ancestors.product_object_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to source_folder_id, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the events.parameters.multiValue log field is mapped to the principal.resource_ancestors.product_object_id UDM field and the events.parameters.multiValue log field is mapped to the src.resource_ancestors.product_object_id UDM field. Otherwise, the principal.resource_ancestors.product_object_id UDM field is set to a value generated from the template %{principal.resource_ancestors.product_object_id}, %{events.parameters.multiValue}, where %{principal.resource_ancestors.product_object_id} and %{events.parameters.multiValue} are replaced with the values of the principal.resource_ancestors.product_object_id and events.parameters.multiValue log fields and the src.resource_ancestors.product_object_id UDM field is set to a value generated from the template %{src.resource_ancestors.product_object_id}, %{events.parameters.multiValue}, where %{src.resource_ancestors.product_object_id} and %{events.parameters.multiValue} are replaced with the values of the src.resource_ancestors.product_object_id and events.parameters.multiValue log fields.
move source_folder_title principal.resource_ancestors.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to source_folder_title, then
Iterate through log field events.parameters.multiValue:
if the index2 log field value is equal to 0, then the events.parameters.multiValue log field is mapped to the principal.resource_ancestors.name UDM field and the events.parameters.multiValue log field is mapped to the src.resource_ancestors.name UDM field. Otherwise, the principal.resource_ancestors.name UDM field is set to a value generated from the template %{principal.resource_ancestors.name}, %{events.parameters.multiValue}, where %{principal.resource_ancestors.name} and %{events.parameters.multiValue} are replaced with the values of the principal.resource_ancestors.name and events.parameters.multiValue log fields and the src.resource_ancestors.name UDM field is set to a value generated from the template %{src.resource_ancestors.name}, %{events.parameters.multiValue}, where %{src.resource_ancestors.name} and %{events.parameters.multiValue} are replaced with the values of the src.resource_ancestors.name and events.parameters.multiValue log fields.
move shared_drive_id target.resource_ancestors.product_object_id
move visibility target.resource.attribute.labels[visibility]
move target.application The target.application UDM field is set to Google Drive.
preview actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
preview actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
preview billable additional.fields[billable]
preview doc_id target.resource.product_object_id
preview doc_title target.resource.name
preview doc_type target.resource.attribute.labels[doc_type]
preview is_encrypted additional.fields[is_encrypted]
preview originating_app_id additional.fields[originating_app_id]
preview owner about.user.email_addresses
preview owner target.resource.attribute.labels[owner]
preview owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
preview owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
preview primary_event additional.fields[primary_event]
preview shared_drive_id target.resource_ancestors.product_object_id
preview visibility target.resource.attribute.labels[visibility]
preview target.application The target.application UDM field is set to Google Drive.
print actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
print actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
print billable additional.fields[billable]
print doc_id target.resource.product_object_id
print doc_title target.resource.name
print doc_type target.resource.attribute.labels[doc_type]
print is_encrypted additional.fields[is_encrypted]
print originating_app_id additional.fields[originating_app_id]
print owner about.user.email_addresses
print owner target.resource.attribute.labels[owner]
print owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
print owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
print primary_event additional.fields[primary_event]
print shared_drive_id target.resource_ancestors.product_object_id
print visibility target.resource.attribute.labels[visibility]
print target.application The target.application UDM field is set to Google Drive.
remove_from_folder actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
remove_from_folder actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
remove_from_folder billable additional.fields[billable]
remove_from_folder doc_id target.resource.product_object_id
remove_from_folder doc_title target.resource.name
remove_from_folder doc_type target.resource.attribute.labels[doc_type]
remove_from_folder is_encrypted additional.fields[is_encrypted]
remove_from_folder originating_app_id additional.fields[originating_app_id]
remove_from_folder owner about.user.email_addresses
remove_from_folder owner target.resource.attribute.labels[owner]
remove_from_folder owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
remove_from_folder owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
remove_from_folder primary_event additional.fields[primary_event]
remove_from_folder source_folder_id principal.resource_ancestors.product_object_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to source_folder_id, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the events.parameters.multiValue log field is mapped to the principal.resource_ancestors.product_object_id UDM field and the events.parameters.multiValue log field is mapped to the src.resource_ancestors.product_object_id UDM field. Otherwise, the principal.resource_ancestors.product_object_id UDM field is set to a value generated from the template %{principal.resource_ancestors.product_object_id}, %{events.parameters.multiValue}, where %{principal.resource_ancestors.product_object_id} and %{events.parameters.multiValue} are replaced with the values of the principal.resource_ancestors.product_object_id and events.parameters.multiValue log fields and the src.resource_ancestors.product_object_id UDM field is set to a value generated from the template %{src.resource_ancestors.product_object_id}, %{events.parameters.multiValue}, where %{src.resource_ancestors.product_object_id} and %{events.parameters.multiValue} are replaced with the values of the src.resource_ancestors.product_object_id and events.parameters.multiValue log fields.
remove_from_folder source_folder_title principal.resource_ancestors.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to source_folder_title, then
Iterate through log field events.parameters.multiValue:
if the index2 log field value is equal to 0, then the events.parameters.multiValue log field is mapped to the principal.resource_ancestors.name UDM field and the events.parameters.multiValue log field is mapped to the src.resource_ancestors.name UDM field. Otherwise, the principal.resource_ancestors.name UDM field is set to a value generated from the template %{principal.resource_ancestors.name}, %{events.parameters.multiValue}, where %{principal.resource_ancestors.name} and %{events.parameters.multiValue} are replaced with the values of the principal.resource_ancestors.name and events.parameters.multiValue log fields and the src.resource_ancestors.name UDM field is set to a value generated from the template %{src.resource_ancestors.name}, %{events.parameters.multiValue}, where %{src.resource_ancestors.name} and %{events.parameters.multiValue} are replaced with the values of the src.resource_ancestors.name and events.parameters.multiValue log fields.
remove_from_folder shared_drive_id target.resource_ancestors.product_object_id
remove_from_folder visibility target.resource.attribute.labels[visibility]
remove_from_folder target.application The target.application UDM field is set to Google Drive.
rename actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
rename actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
rename billable additional.fields[billable]
rename doc_id target.resource.product_object_id
rename doc_title target.resource.name
rename doc_type target.resource.attribute.labels[doc_type]
rename is_encrypted additional.fields[is_encrypted]
rename new_value target.resource.attribute.labels[new_value] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to new_value, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the target.resource.attribute.labels.key UDM field is set to new_value and the events.parameters.multiValue log field is mapped to the target.resource.attribute.labels.value UDM field. Otherwise, the target.resource.attribute.labels.key UDM field is set to new_value and the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[new_value]}, %{events.parameters.multiValue}, where %{target.resource.attribute.labels[new_value]} and %{events.parameters.multiValue} are replaced with the values of the target.resource.attribute.labels[new_value] and events.parameters.multiValue log fields.
rename old_value target.resource.attribute.labels[old_value] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to old_value, then
Iterate through log field events.parameters.multiValue:
if the index2 log field value is equal to 0, then the target.resource.attribute.labels.key UDM field is set to old_value and the events.parameters.multiValue log field is mapped to the target.resource.attribute.labels.value UDM field. Otherwise, the target.resource.attribute.labels.key UDM field is set to old_value and the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[old_value]}, %{events.parameters.multiValue}, where %{target.resource.attribute.labels[old_value]} and %{events.parameters.multiValue} are replaced with the values of the target.resource.attribute.labels[old_value] and events.parameters.multiValue log fields.
rename originating_app_id additional.fields[originating_app_id]
rename owner about.user.email_addresses
rename owner target.resource.attribute.labels[owner]
rename owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
rename owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
rename primary_event additional.fields[primary_event]
rename shared_drive_id target.resource_ancestors.product_object_id
rename visibility target.resource.attribute.labels[visibility]
rename target.application The target.application UDM field is set to Google Drive.
report_abuse actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
report_abuse actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
report_abuse billable additional.fields[billable]
report_abuse doc_id target.resource.product_object_id
report_abuse doc_title target.resource.name
report_abuse doc_type target.resource.attribute.labels[doc_type]
report_abuse is_encrypted additional.fields[is_encrypted]
report_abuse originating_app_id additional.fields[originating_app_id]
report_abuse owner about.user.email_addresses
report_abuse owner target.resource.attribute.labels[owner]
report_abuse owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
report_abuse owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
report_abuse primary_event additional.fields[primary_event]
report_abuse shared_drive_id target.resource_ancestors.product_object_id
report_abuse visibility target.resource.attribute.labels[visibility]
report_abuse target.application The target.application UDM field is set to Google Drive.
untrash actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
untrash actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
untrash billable additional.fields[billable]
untrash doc_id target.resource.product_object_id
untrash doc_title target.resource.name
untrash doc_type target.resource.attribute.labels[doc_type]
untrash is_encrypted additional.fields[is_encrypted]
untrash originating_app_id additional.fields[originating_app_id]
untrash owner about.user.email_addresses
untrash owner target.resource.attribute.labels[owner]
untrash owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
untrash owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
untrash primary_event additional.fields[primary_event]
untrash shared_drive_id target.resource_ancestors.product_object_id
untrash visibility target.resource.attribute.labels[visibility]
untrash target.application The target.application UDM field is set to Google Drive.
delete_revision actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
delete_revision actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
delete_revision billable additional.fields[billable]
delete_revision doc_id target.resource.product_object_id
delete_revision doc_title target.resource.name
delete_revision doc_type target.resource.attribute.labels[doc_type]
delete_revision is_encrypted additional.fields[is_encrypted]
delete_revision originating_app_id additional.fields[originating_app_id]
delete_revision owner about.user.email_addresses
delete_revision owner target.resource.attribute.labels[owner]
delete_revision owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
delete_revision owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
delete_revision primary_event additional.fields[primary_event]
delete_revision revision_create_timestamp target.resource.attribute.labels[revision_create_timestamp]
delete_revision revision_id target.resource.attribute.labels[revision_id]
delete_revision shared_drive_id target.resource_ancestors.product_object_id
delete_revision visibility target.resource.attribute.labels[visibility]
delete_revision target.application The target.application UDM field is set to Google Drive.
pin_revision actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
pin_revision actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
pin_revision billable additional.fields[billable]
pin_revision doc_id target.resource.product_object_id
pin_revision doc_title target.resource.name
pin_revision doc_type target.resource.attribute.labels[doc_type]
pin_revision is_encrypted additional.fields[is_encrypted]
pin_revision originating_app_id additional.fields[originating_app_id]
pin_revision owner about.user.email_addresses
pin_revision owner target.resource.attribute.labels[owner]
pin_revision owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
pin_revision owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
pin_revision primary_event additional.fields[primary_event]
pin_revision revision_create_timestamp target.resource.attribute.labels[revision_create_timestamp]
pin_revision revision_id target.resource.attribute.labels[revision_id]
pin_revision shared_drive_id target.resource_ancestors.product_object_id
pin_revision visibility target.resource.attribute.labels[visibility]
pin_revision target.application The target.application UDM field is set to Google Drive.
unpin_revision actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
unpin_revision actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
unpin_revision billable additional.fields[billable]
unpin_revision doc_id target.resource.product_object_id
unpin_revision doc_title target.resource.name
unpin_revision doc_type target.resource.attribute.labels[doc_type]
unpin_revision is_encrypted additional.fields[is_encrypted]
unpin_revision originating_app_id additional.fields[originating_app_id]
unpin_revision owner about.user.email_addresses
unpin_revision owner target.resource.attribute.labels[owner]
unpin_revision owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
unpin_revision owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
unpin_revision primary_event additional.fields[primary_event]
unpin_revision revision_create_timestamp target.resource.attribute.labels[revision_create_timestamp]
unpin_revision revision_id target.resource.attribute.labels[revision_id]
unpin_revision shared_drive_id target.resource_ancestors.product_object_id
unpin_revision visibility target.resource.attribute.labels[visibility]
unpin_revision target.application The target.application UDM field is set to Google Drive.
create_script_trigger actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
create_script_trigger actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
create_script_trigger billable additional.fields[billable]
create_script_trigger doc_id target.resource.product_object_id
create_script_trigger doc_title target.resource.name
create_script_trigger doc_type target.resource.attribute.labels[doc_type]
create_script_trigger is_encrypted additional.fields[is_encrypted]
create_script_trigger originating_app_id additional.fields[originating_app_id]
create_script_trigger owner about.user.email_addresses
create_script_trigger owner target.resource.attribute.labels[owner]
create_script_trigger owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
create_script_trigger owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
create_script_trigger primary_event additional.fields[primary_event]
create_script_trigger script_container_app additional.fields[script_container_app]
create_script_trigger script_container_id additional.fields[script_container_id]
create_script_trigger script_trigger_id additional.fields[script_trigger_id]
create_script_trigger script_trigger_source_app additional.fields[script_trigger_source_app]
create_script_trigger script_trigger_type additional.fields[script_trigger_type]
create_script_trigger shared_drive_id target.resource_ancestors.product_object_id
create_script_trigger visibility target.resource.attribute.labels[visibility]
create_script_trigger target.application The target.application UDM field is set to Google Drive.
delete_script_trigger actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
delete_script_trigger actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
delete_script_trigger billable additional.fields[billable]
delete_script_trigger doc_id target.resource.product_object_id
delete_script_trigger doc_title target.resource.name
delete_script_trigger doc_type target.resource.attribute.labels[doc_type]
delete_script_trigger is_encrypted additional.fields[is_encrypted]
delete_script_trigger originating_app_id additional.fields[originating_app_id]
delete_script_trigger owner about.user.email_addresses
delete_script_trigger owner target.resource.attribute.labels[owner]
delete_script_trigger owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
delete_script_trigger owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
delete_script_trigger primary_event additional.fields[primary_event]
delete_script_trigger script_container_app additional.fields[script_container_app]
delete_script_trigger script_container_id additional.fields[script_container_id]
delete_script_trigger script_trigger_id additional.fields[script_trigger_id]
delete_script_trigger script_trigger_source_app additional.fields[script_trigger_source_app]
delete_script_trigger script_trigger_type additional.fields[script_trigger_type]
delete_script_trigger shared_drive_id target.resource_ancestors.product_object_id
delete_script_trigger visibility target.resource.attribute.labels[visibility]
delete_script_trigger target.application The target.application UDM field is set to Google Drive.
sheets_import_url accessed_url target.url Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to accessed_url, then
Iterate through log field events.parameters.multiValue:
if the index2 log field value is equal to 0, then the events.parameters.multiValue log field is mapped to the target.url UDM field. Otherwise, the target.url UDM field is set to a value generated from the template %{target.url}, %{events.parameters.multiValue}, where %{target.url} and %{events.parameters.multiValue} are replaced with the values of the target.url and events.parameters.multiValue log fields.
sheets_import_url actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
sheets_import_url actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
sheets_import_url billable additional.fields[billable]
sheets_import_url doc_id target.resource.product_object_id
sheets_import_url doc_title target.resource.name
sheets_import_url doc_type target.resource.attribute.labels[doc_type]
sheets_import_url is_encrypted additional.fields[is_encrypted]
sheets_import_url originating_app_id additional.fields[originating_app_id]
sheets_import_url owner about.user.email_addresses
sheets_import_url owner target.resource.attribute.labels[owner]
sheets_import_url owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
sheets_import_url owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
sheets_import_url primary_event additional.fields[primary_event]
sheets_import_url shared_drive_id target.resource_ancestors.product_object_id
sheets_import_url visibility target.resource.attribute.labels[visibility]
sheets_import_url target.application The target.application UDM field is set to Google Drive.
sheets_import_range doc_id target.resource.product_object_id
sheets_import_range doc_title target.resource.name
sheets_import_range doc_type target.resource.attribute.labels[doc_type]
sheets_import_range is_encrypted additional.fields[is_encrypted]
sheets_import_range originating_app_id additional.fields[originating_app_id]
sheets_import_range owner about.user.email_addresses
sheets_import_range owner target.resource.attribute.labels[owner]
sheets_import_range owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
sheets_import_range owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
sheets_import_range primary_event additional.fields[primary_event]
sheets_import_range sheets_import_range_recipient_doc target.resource.attribute.labels[sheets_import_range_recipient_doc]
sheets_import_range shared_drive_id target.resource_ancestors.product_object_id
sheets_import_range visibility target.resource.attribute.labels[visibility]
sheets_import_range target.application The target.application UDM field is set to Google Drive.
source_copy actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
source_copy actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
source_copy billable additional.fields[billable]
source_copy copy_type additional.fields[copy_type]
source_copy doc_id target.resource.product_object_id
source_copy doc_title target.resource.name
source_copy doc_type target.resource.attribute.labels[doc_type]
source_copy encryption_change security_result.detection_fields[encryption_change]
source_copy is_encrypted additional.fields[is_encrypted]
source_copy new_value target.file.names Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to new_value, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the events.parameters.multiValue log field is mapped to the target.file.names UDM field. Otherwise, the target.file.names UDM field is set to a value generated from the template %{target.file.names}, %{events.parameters.multiValue}, where %{target.file.names} and %{events.parameters.multiValue} are replaced with the values of the target.file.names and events.parameters.multiValue log fields.
source_copy old_value src.file.names Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to old_value, then
Iterate through log field events.parameters.multiValue:
if the index2 log field value is equal to 0, then the events.parameters.multiValue log field is mapped to the src.file.names UDM field. Otherwise, the src.file.names UDM field is set to a value generated from the template %{src.file.names}, %{events.parameters.multiValue}, where %{src.file.names} and %{events.parameters.multiValue} are replaced with the values of the src.file.names and events.parameters.multiValue log fields.
source_copy originating_app_id additional.fields[originating_app_id]
source_copy owner about.user.email_addresses
source_copy owner target.resource.attribute.labels[owner]
source_copy owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
source_copy owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
source_copy primary_event additional.fields[primary_event]
source_copy shared_drive_id target.resource_ancestors.product_object_id
source_copy visibility target.resource.attribute.labels[visibility]
source_copy target.application The target.application UDM field is set to Google Drive.
accept_suggestion actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
accept_suggestion actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
accept_suggestion billable additional.fields[billable]
accept_suggestion doc_id target.resource.product_object_id
accept_suggestion doc_title target.resource.name
accept_suggestion doc_type target.resource.attribute.labels[doc_type]
accept_suggestion is_encrypted additional.fields[is_encrypted]
accept_suggestion originating_app_id additional.fields[originating_app_id]
accept_suggestion owner about.user.email_addresses
accept_suggestion owner target.resource.attribute.labels[owner]
accept_suggestion owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
accept_suggestion owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
accept_suggestion primary_event additional.fields[primary_event]
accept_suggestion shared_drive_id target.resource_ancestors.product_object_id
accept_suggestion visibility target.resource.attribute.labels[visibility]
accept_suggestion target.application The target.application UDM field is set to Google Drive.
create_suggestion actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
create_suggestion actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
create_suggestion billable additional.fields[billable]
create_suggestion doc_id target.resource.product_object_id
create_suggestion doc_title target.resource.name
create_suggestion doc_type target.resource.attribute.labels[doc_type]
create_suggestion is_encrypted additional.fields[is_encrypted]
create_suggestion originating_app_id additional.fields[originating_app_id]
create_suggestion owner about.user.email_addresses
create_suggestion owner target.resource.attribute.labels[owner]
create_suggestion owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
create_suggestion owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
create_suggestion primary_event additional.fields[primary_event]
create_suggestion shared_drive_id target.resource_ancestors.product_object_id
create_suggestion visibility target.resource.attribute.labels[visibility]
create_suggestion target.application The target.application UDM field is set to Google Drive.
delete_suggestion actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
delete_suggestion actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
delete_suggestion billable additional.fields[billable]
delete_suggestion doc_id target.resource.product_object_id
delete_suggestion doc_title target.resource.name
delete_suggestion doc_type target.resource.attribute.labels[doc_type]
delete_suggestion is_encrypted additional.fields[is_encrypted]
delete_suggestion originating_app_id additional.fields[originating_app_id]
delete_suggestion owner about.user.email_addresses
delete_suggestion owner target.resource.attribute.labels[owner]
delete_suggestion owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
delete_suggestion owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
delete_suggestion primary_event additional.fields[primary_event]
delete_suggestion shared_drive_id target.resource_ancestors.product_object_id
delete_suggestion visibility target.resource.attribute.labels[visibility]
delete_suggestion target.application The target.application UDM field is set to Google Drive.
reject_suggestion actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
reject_suggestion actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
reject_suggestion billable additional.fields[billable]
reject_suggestion doc_id target.resource.product_object_id
reject_suggestion doc_title target.resource.name
reject_suggestion doc_type target.resource.attribute.labels[doc_type]
reject_suggestion is_encrypted additional.fields[is_encrypted]
reject_suggestion originating_app_id additional.fields[originating_app_id]
reject_suggestion owner about.user.email_addresses
reject_suggestion owner target.resource.attribute.labels[owner]
reject_suggestion owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
reject_suggestion owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
reject_suggestion primary_event additional.fields[primary_event]
reject_suggestion shared_drive_id target.resource_ancestors.product_object_id
reject_suggestion visibility target.resource.attribute.labels[visibility]
reject_suggestion target.application The target.application UDM field is set to Google Drive.
pause_sync_client primary_event additional.fields[primary_event]
pause_sync_client target_user target.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to target, then target log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to target_user, then target_user log field value is set to the events.parameters.value log field value.
If the target_user log field value is not empty and the target log field value is not equal to the target_user log field value, then if the target_user log field value matches the regular expression pattern: ^.+@.+$, then the target_user log field is mapped to the target.user.email_addresses UDM field. Otherwise, the target.user.attribute.labels.key UDM field is set to target_user and The target_user log field is mapped to the target.user.attribute.labels.value UDM field.
pause_sync_client target_user additional.fields[target_user]
pause_sync_client target.application The target.application UDM field is set to Google Drive.
resume_sync_client primary_event additional.fields[primary_event]
resume_sync_client target.application The target.application UDM field is set to Google Drive.
trash actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
trash actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
trash billable additional.fields[billable]
trash doc_id target.resource.product_object_id
trash doc_title target.resource.name
trash doc_type target.resource.attribute.labels[doc_type]
trash is_encrypted additional.fields[is_encrypted]
trash originating_app_id additional.fields[originating_app_id]
trash owner about.user.email_addresses
trash owner target.resource.attribute.labels[owner]
trash owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
trash owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
trash primary_event additional.fields[primary_event]
trash shared_drive_id target.resource_ancestors.product_object_id
trash visibility target.resource.attribute.labels[visibility]
trash target.application The target.application UDM field is set to Google Drive.
remove_lock actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
remove_lock actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
remove_lock billable additional.fields[billable]
remove_lock doc_id target.resource.product_object_id
remove_lock doc_title target.resource.name
remove_lock doc_type target.resource.attribute.labels[doc_type]
remove_lock is_encrypted additional.fields[is_encrypted]
remove_lock lock_type target.resource.attribute.labels[lock_type]
remove_lock originating_app_id additional.fields[originating_app_id]
remove_lock owner about.user.email_addresses
remove_lock owner target.resource.attribute.labels[owner]
remove_lock owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
remove_lock owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
remove_lock primary_event additional.fields[primary_event]
remove_lock shared_drive_id target.resource_ancestors.product_object_id
remove_lock visibility target.resource.attribute.labels[visibility]
remove_lock target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
remove_lock target.application The target.application UDM field is set to Google Drive.
unmovable_item_reparented actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
unmovable_item_reparented actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
unmovable_item_reparented billable additional.fields[billable]
unmovable_item_reparented destination_folder_id target.resource_ancestors.product_object_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to destination_folder_id, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the events.parameters.multiValue log field is mapped to the target.resource_ancestors.product_object_id UDM field. Otherwise, the target.resource_ancestors.product_object_id UDM field is set to a value generated from the template %{target.resource_ancestors.product_object_id}, %{events.parameters.multiValue}, where %{target.resource_ancestors.product_object_id} and %{events.parameters.multiValue} are replaced with the values of the target.resource_ancestors.product_object_id and events.parameters.multiValue log fields.
unmovable_item_reparented destination_folder_title target.resource_ancestors.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to destination_folder_title, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the events.parameters.multiValue log field is mapped to the target.resource_ancestors.name UDM field. Otherwise, the target.resource_ancestors.name UDM field is set to a value generated from the template %{target.resource_ancestors.name}, %{events.parameters.multiValue}, where %{target.resource_ancestors.name} and %{events.parameters.multiValue} are replaced with the values of the target.resource_ancestors.name and events.parameters.multiValue log fields.
unmovable_item_reparented doc_id target.resource.product_object_id
unmovable_item_reparented doc_id src.resource.product_object_id
unmovable_item_reparented doc_title target.resource.name
unmovable_item_reparented doc_title src.resource.name
unmovable_item_reparented doc_type target.resource.attribute.labels[doc_type]
unmovable_item_reparented doc_type src.resource.attribute.labels[doc_type]
unmovable_item_reparented is_encrypted additional.fields[is_encrypted]
unmovable_item_reparented originating_app_id additional.fields[originating_app_id]
unmovable_item_reparented owner about.user.email_addresses
unmovable_item_reparented owner target.resource.attribute.labels[owner]
unmovable_item_reparented owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
unmovable_item_reparented owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
unmovable_item_reparented primary_event additional.fields[primary_event]
unmovable_item_reparented source_folder_id principal.resource_ancestors.product_object_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to source_folder_id, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the events.parameters.multiValue log field is mapped to the principal.resource_ancestors.product_object_id UDM field and the events.parameters.multiValue log field is mapped to the src.resource_ancestors.product_object_id UDM field. Otherwise, the principal.resource_ancestors.product_object_id UDM field is set to a value generated from the template %{principal.resource_ancestors.product_object_id}, %{events.parameters.multiValue}, where %{principal.resource_ancestors.product_object_id} and %{events.parameters.multiValue} are replaced with the values of the principal.resource_ancestors.product_object_id and events.parameters.multiValue log fields and the src.resource_ancestors.product_object_id UDM field is set to a value generated from the template %{src.resource_ancestors.product_object_id}, %{events.parameters.multiValue}, where %{src.resource_ancestors.product_object_id} and %{events.parameters.multiValue} are replaced with the values of the src.resource_ancestors.product_object_id and events.parameters.multiValue log fields.
unmovable_item_reparented source_folder_title principal.resource_ancestors.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to source_folder_title, then
Iterate through log field events.parameters.multiValue:
if the index2 log field value is equal to 0, then the events.parameters.multiValue log field is mapped to the principal.resource_ancestors.name UDM field and the events.parameters.multiValue log field is mapped to the src.resource_ancestors.name UDM field. Otherwise, the principal.resource_ancestors.name UDM field is set to a value generated from the template %{principal.resource_ancestors.name}, %{events.parameters.multiValue}, where %{principal.resource_ancestors.name} and %{events.parameters.multiValue} are replaced with the values of the principal.resource_ancestors.name and events.parameters.multiValue log fields and the src.resource_ancestors.name UDM field is set to a value generated from the template %{src.resource_ancestors.name}, %{events.parameters.multiValue}, where %{src.resource_ancestors.name} and %{events.parameters.multiValue} are replaced with the values of the src.resource_ancestors.name and events.parameters.multiValue log fields.
unmovable_item_reparented shared_drive_id target.resource_ancestors.product_object_id
unmovable_item_reparented visibility target.resource.attribute.labels[visibility]
unmovable_item_reparented target.application The target.application UDM field is set to Google Drive.
upload actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
upload actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
upload billable additional.fields[billable]
upload doc_id target.resource.product_object_id
upload doc_title target.resource.name
upload doc_type target.resource.attribute.labels[doc_type]
upload encryption_enforcement_option additional.fields[encryption_enforcement_option]
upload is_encrypted additional.fields[is_encrypted]
upload originating_app_id additional.fields[originating_app_id]
upload owner about.user.email_addresses
upload owner target.resource.attribute.labels[owner]
upload owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
upload owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
upload primary_event additional.fields[primary_event]
upload shared_drive_id target.resource_ancestors.product_object_id
upload visibility target.resource.attribute.labels[visibility]
upload target.application The target.application UDM field is set to Google Drive.
access_url accessed_url target.url Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to accessed_url, then
Iterate through log field events.parameters.multiValue:
if the index2 log field value is equal to 0, then the events.parameters.multiValue log field is mapped to the target.url UDM field. Otherwise, the target.url UDM field is set to a value generated from the template %{target.url}, %{events.parameters.multiValue}, where %{target.url} and %{events.parameters.multiValue} are replaced with the values of the target.url and events.parameters.multiValue log fields.
access_url actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
access_url actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
access_url billable additional.fields[billable]
access_url doc_id target.resource.product_object_id
access_url doc_title target.resource.name
access_url doc_type target.resource.attribute.labels[doc_type]
access_url is_encrypted additional.fields[is_encrypted]
access_url originating_app_id additional.fields[originating_app_id]
access_url owner about.user.email_addresses
access_url owner target.resource.attribute.labels[owner]
access_url owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
access_url owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
access_url primary_event additional.fields[primary_event]
access_url script_id additional.fields[script_id]
access_url shared_drive_id target.resource_ancestors.product_object_id
access_url visibility target.resource.attribute.labels[visibility]
access_url target.application The target.application UDM field is set to Google Drive.
delete_video_caption actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
delete_video_caption actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
delete_video_caption billable additional.fields[billable]
delete_video_caption doc_id target.resource.product_object_id
delete_video_caption doc_title target.resource.name
delete_video_caption doc_type target.resource.attribute.labels[doc_type]
delete_video_caption is_encrypted additional.fields[is_encrypted]
delete_video_caption originating_app_id additional.fields[originating_app_id]
delete_video_caption owner about.user.email_addresses
delete_video_caption owner target.resource.attribute.labels[owner]
delete_video_caption owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
delete_video_caption owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
delete_video_caption primary_event additional.fields[primary_event]
delete_video_caption shared_drive_id target.resource_ancestors.product_object_id
delete_video_caption track_name additional.fields[track_name]
delete_video_caption visibility target.resource.attribute.labels[visibility]
delete_video_caption target.application The target.application UDM field is set to Google Drive.
download_video_caption actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
download_video_caption actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
download_video_caption billable additional.fields[billable]
download_video_caption doc_id target.resource.product_object_id
download_video_caption doc_title target.resource.name
download_video_caption doc_type target.resource.attribute.labels[doc_type]
download_video_caption is_encrypted additional.fields[is_encrypted]
download_video_caption originating_app_id additional.fields[originating_app_id]
download_video_caption owner about.user.email_addresses
download_video_caption owner target.resource.attribute.labels[owner]
download_video_caption owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
download_video_caption owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
download_video_caption primary_event additional.fields[primary_event]
download_video_caption shared_drive_id target.resource_ancestors.product_object_id
download_video_caption track_name additional.fields[track_name]
download_video_caption visibility target.resource.attribute.labels[visibility]
download_video_caption target.application The target.application UDM field is set to Google Drive.
upload_video_caption actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
upload_video_caption actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
upload_video_caption billable additional.fields[billable]
upload_video_caption doc_id target.resource.product_object_id
upload_video_caption doc_title target.resource.name
upload_video_caption doc_type target.resource.attribute.labels[doc_type]
upload_video_caption is_encrypted additional.fields[is_encrypted]
upload_video_caption originating_app_id additional.fields[originating_app_id]
upload_video_caption owner about.user.email_addresses
upload_video_caption owner target.resource.attribute.labels[owner]
upload_video_caption owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
upload_video_caption owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
upload_video_caption primary_event additional.fields[primary_event]
upload_video_caption shared_drive_id target.resource_ancestors.product_object_id
upload_video_caption track_name additional.fields[track_name]
upload_video_caption visibility target.resource.attribute.labels[visibility]
upload_video_caption target.application The target.application UDM field is set to Google Drive.
view actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
view actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
view billable additional.fields[billable]
view doc_id target.resource.product_object_id
view doc_title target.resource.name
view doc_type target.resource.attribute.labels[doc_type]
view is_encrypted additional.fields[is_encrypted]
view originating_app_id additional.fields[originating_app_id]
view owner about.user.email_addresses
view owner target.resource.attribute.labels[owner]
view owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
view owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
view primary_event additional.fields[primary_event]
view shared_drive_id target.resource_ancestors.product_object_id
view visibility target.resource.attribute.labels[visibility]
view target.application The target.application UDM field is set to Google Drive.
apply_security_update actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
apply_security_update actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
apply_security_update billable additional.fields[billable]
apply_security_update doc_id target.resource.product_object_id
apply_security_update doc_title target.resource.name
apply_security_update doc_type target.resource.attribute.labels[doc_type]
apply_security_update is_encrypted additional.fields[is_encrypted]
apply_security_update originating_app_id additional.fields[originating_app_id]
apply_security_update owner about.user.email_addresses
apply_security_update owner target.resource.attribute.labels[owner]
apply_security_update owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
apply_security_update owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
apply_security_update primary_event additional.fields[primary_event]
apply_security_update shared_drive_id target.resource_ancestors.product_object_id
apply_security_update visibility target.resource.attribute.labels[visibility]
apply_security_update target.application The target.application UDM field is set to Google Drive.
shared_drive_apply_security_update actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
shared_drive_apply_security_update actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
shared_drive_apply_security_update billable additional.fields[billable]
shared_drive_apply_security_update doc_id target.resource.product_object_id
shared_drive_apply_security_update doc_title target.resource.name
shared_drive_apply_security_update doc_type target.resource.attribute.labels[doc_type]
shared_drive_apply_security_update is_encrypted additional.fields[is_encrypted]
shared_drive_apply_security_update originating_app_id additional.fields[originating_app_id]
shared_drive_apply_security_update owner about.user.email_addresses
shared_drive_apply_security_update owner target.resource.attribute.labels[owner]
shared_drive_apply_security_update owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
shared_drive_apply_security_update owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
shared_drive_apply_security_update primary_event additional.fields[primary_event]
shared_drive_apply_security_update shared_drive_id target.resource_ancestors.product_object_id
shared_drive_apply_security_update visibility target.resource.attribute.labels[visibility]
shared_drive_apply_security_update target.application The target.application UDM field is set to Google Drive.
shared_drive_remove_security_update actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
shared_drive_remove_security_update actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
shared_drive_remove_security_update billable additional.fields[billable]
shared_drive_remove_security_update doc_id target.resource.product_object_id
shared_drive_remove_security_update doc_title target.resource.name
shared_drive_remove_security_update doc_type target.resource.attribute.labels[doc_type]
shared_drive_remove_security_update is_encrypted additional.fields[is_encrypted]
shared_drive_remove_security_update originating_app_id additional.fields[originating_app_id]
shared_drive_remove_security_update owner about.user.email_addresses
shared_drive_remove_security_update owner target.resource.attribute.labels[owner]
shared_drive_remove_security_update owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
shared_drive_remove_security_update owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
shared_drive_remove_security_update primary_event additional.fields[primary_event]
shared_drive_remove_security_update shared_drive_id target.resource_ancestors.product_object_id
shared_drive_remove_security_update visibility target.resource.attribute.labels[visibility]
shared_drive_remove_security_update target.application The target.application UDM field is set to Google Drive.
change_owner_hierarchy_reconciled actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
change_owner_hierarchy_reconciled actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
change_owner_hierarchy_reconciled billable additional.fields[billable]
change_owner_hierarchy_reconciled doc_id target.resource.product_object_id
change_owner_hierarchy_reconciled doc_title target.resource.name
change_owner_hierarchy_reconciled doc_type target.resource.attribute.labels[doc_type]
change_owner_hierarchy_reconciled is_encrypted additional.fields[is_encrypted]
change_owner_hierarchy_reconciled new_owner target.user.attribute.labels[new_owner]
change_owner_hierarchy_reconciled new_owner_is_shared_drive target.resource.attribute.labels[new_owner_is_shared_drive]
change_owner_hierarchy_reconciled new_owner_shared_drive_id target.resource.attribute.labels[new_owner_shared_drive_id]
change_owner_hierarchy_reconciled originating_app_id additional.fields[originating_app_id]
change_owner_hierarchy_reconciled owner about.user.email_addresses
change_owner_hierarchy_reconciled owner target.resource.attribute.labels[owner]
change_owner_hierarchy_reconciled owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
change_owner_hierarchy_reconciled owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
change_owner_hierarchy_reconciled primary_event additional.fields[primary_event]
change_owner_hierarchy_reconciled shared_drive_id target.resource_ancestors.product_object_id
change_owner_hierarchy_reconciled visibility target.resource.attribute.labels[visibility]
change_owner_hierarchy_reconciled target.application The target.application UDM field is set to Google Drive.
change_owner actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
change_owner actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
change_owner billable additional.fields[billable]
change_owner doc_id target.resource.product_object_id
change_owner doc_title target.resource.name
change_owner doc_type target.resource.attribute.labels[doc_type]
change_owner is_encrypted additional.fields[is_encrypted]
change_owner new_owner target.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to new_owner, then If the events.parameters.value log field value matches the regular expression pattern: ^.+@.+$, then the events.parameters.value log field is mapped to the target.user.email_addresses UDM field. Otherwise, the target.user.attribute.labels.key UDM field is set to new_owner and The events.parameters.value log field is mapped to the target.user.attribute.labels.value UDM field.
change_owner new_owner_is_shared_drive target.resource.attribute.labels[new_owner_is_shared_drive]
change_owner new_owner_shared_drive_id target.resource.attribute.labels[new_owner_shared_drive_id]
change_owner originating_app_id additional.fields[originating_app_id]
change_owner owner about.user.email_addresses
change_owner owner target.resource.attribute.labels[owner]
change_owner owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
change_owner owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
change_owner primary_event additional.fields[primary_event]
change_owner shared_drive_id target.resource_ancestors.product_object_id
change_owner visibility target.resource.attribute.labels[visibility]
change_owner target.application The target.application UDM field is set to Google Drive.
publish_change actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
publish_change actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
publish_change billable additional.fields[billable]
publish_change doc_id target.resource.product_object_id
publish_change doc_title target.resource.name
publish_change doc_type target.resource.attribute.labels[doc_type]
publish_change is_encrypted additional.fields[is_encrypted]
publish_change new_publish_visibility target.resource.attribute.labels[new_publish_visibility]
publish_change new_value target.resource.attribute.labels[new_value] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to new_value, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the target.resource.attribute.labels.key UDM field is set to new_value and the events.parameters.multiValue log field is mapped to the target.resource.attribute.labels.value UDM field. Otherwise, the target.resource.attribute.labels.key UDM field is set to new_value and the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[new_value]}, %{events.parameters.multiValue}, where %{target.resource.attribute.labels[new_value]} and %{events.parameters.multiValue} are replaced with the values of the target.resource.attribute.labels[new_value] and events.parameters.multiValue log fields.
publish_change old_publish_visibility target.resource.attribute.labels[old_publish_visibility]
publish_change old_value target.resource.attribute.labels[old_value] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to old_value, then
Iterate through log field events.parameters.multiValue:
if the index2 log field value is equal to 0, then the target.resource.attribute.labels.key UDM field is set to old_value and the events.parameters.multiValue log field is mapped to the target.resource.attribute.labels.value UDM field. Otherwise, the target.resource.attribute.labels.key UDM field is set to old_value and the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[old_value]}, %{events.parameters.multiValue}, where %{target.resource.attribute.labels[old_value]} and %{events.parameters.multiValue} are replaced with the values of the target.resource.attribute.labels[old_value] and events.parameters.multiValue log fields.
publish_change originating_app_id additional.fields[originating_app_id]
publish_change owner about.user.email_addresses
publish_change owner target.resource.attribute.labels[owner]
publish_change owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
publish_change owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
publish_change primary_event additional.fields[primary_event]
publish_change shared_drive_id target.resource_ancestors.product_object_id
publish_change visibility target.resource.attribute.labels[visibility]
publish_change target.application The target.application UDM field is set to Google Drive.
change_acl_editors actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
change_acl_editors actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
change_acl_editors billable additional.fields[billable]
change_acl_editors doc_id target.resource.product_object_id
change_acl_editors doc_title target.resource.name
change_acl_editors doc_type target.resource.attribute.labels[doc_type]
change_acl_editors is_encrypted additional.fields[is_encrypted]
change_acl_editors new_value target.resource.attribute.labels[new_value] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to new_value, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the target.resource.attribute.labels.key UDM field is set to new_value and the events.parameters.multiValue log field is mapped to the target.resource.attribute.labels.value UDM field. Otherwise, the target.resource.attribute.labels.key UDM field is set to new_value and the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[new_value]}, %{events.parameters.multiValue}, where %{target.resource.attribute.labels[new_value]} and %{events.parameters.multiValue} are replaced with the values of the target.resource.attribute.labels[new_value] and events.parameters.multiValue log fields.
change_acl_editors old_value target.resource.attribute.labels[old_value] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to old_value, then
Iterate through log field events.parameters.multiValue:
if the index2 log field value is equal to 0, then the target.resource.attribute.labels.key UDM field is set to old_value and the events.parameters.multiValue log field is mapped to the target.resource.attribute.labels.value UDM field. Otherwise, the target.resource.attribute.labels.key UDM field is set to old_value and the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[old_value]}, %{events.parameters.multiValue}, where %{target.resource.attribute.labels[old_value]} and %{events.parameters.multiValue} are replaced with the values of the target.resource.attribute.labels[old_value] and events.parameters.multiValue log fields.
change_acl_editors old_visibility target.resource.attribute.labels[old_visibility]
change_acl_editors originating_app_id additional.fields[originating_app_id]
change_acl_editors owner about.user.email_addresses
change_acl_editors owner target.resource.attribute.labels[owner]
change_acl_editors owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
change_acl_editors owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
change_acl_editors primary_event additional.fields[primary_event]
change_acl_editors shared_drive_id target.resource_ancestors.product_object_id
change_acl_editors visibility target.resource.attribute.labels[visibility]
change_acl_editors visibility_change target.resource.attribute.labels[visibility_change]
change_acl_editors target.application The target.application UDM field is set to Google Drive.
disable_inherited_permissions actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
disable_inherited_permissions actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
disable_inherited_permissions billable additional.fields[billable]
disable_inherited_permissions doc_id target.resource.product_object_id
disable_inherited_permissions doc_title target.resource.name
disable_inherited_permissions doc_type target.resource.attribute.labels[doc_type]
disable_inherited_permissions is_encrypted additional.fields[is_encrypted]
disable_inherited_permissions originating_app_id additional.fields[originating_app_id]
disable_inherited_permissions owner about.user.email_addresses
disable_inherited_permissions owner target.resource.attribute.labels[owner]
disable_inherited_permissions owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
disable_inherited_permissions owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
disable_inherited_permissions primary_event additional.fields[primary_event]
disable_inherited_permissions shared_drive_id target.resource_ancestors.product_object_id
disable_inherited_permissions visibility target.resource.attribute.labels[visibility]
disable_inherited_permissions target.application The target.application UDM field is set to Google Drive.
enable_inherited_permissions actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
enable_inherited_permissions actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
enable_inherited_permissions billable additional.fields[billable]
enable_inherited_permissions doc_id target.resource.product_object_id
enable_inherited_permissions doc_title target.resource.name
enable_inherited_permissions doc_type target.resource.attribute.labels[doc_type]
enable_inherited_permissions is_encrypted additional.fields[is_encrypted]
enable_inherited_permissions originating_app_id additional.fields[originating_app_id]
enable_inherited_permissions owner about.user.email_addresses
enable_inherited_permissions owner target.resource.attribute.labels[owner]
enable_inherited_permissions owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
enable_inherited_permissions owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
enable_inherited_permissions primary_event additional.fields[primary_event]
enable_inherited_permissions shared_drive_id target.resource_ancestors.product_object_id
enable_inherited_permissions visibility target.resource.attribute.labels[visibility]
enable_inherited_permissions target.application The target.application UDM field is set to Google Drive.
change_document_access_scope actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
change_document_access_scope actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
change_document_access_scope billable additional.fields[billable]
change_document_access_scope doc_id target.resource.product_object_id
change_document_access_scope doc_title target.resource.name
change_document_access_scope doc_type target.resource.attribute.labels[doc_type]
change_document_access_scope is_encrypted additional.fields[is_encrypted]
change_document_access_scope new_value target.resource.attribute.labels[new_value] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to new_value, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the target.resource.attribute.labels.key UDM field is set to new_value and the events.parameters.multiValue log field is mapped to the target.resource.attribute.labels.value UDM field. Otherwise, the target.resource.attribute.labels.key UDM field is set to new_value and the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[new_value]}, %{events.parameters.multiValue}, where %{target.resource.attribute.labels[new_value]} and %{events.parameters.multiValue} are replaced with the values of the target.resource.attribute.labels[new_value] and events.parameters.multiValue log fields.
change_document_access_scope old_value target.resource.attribute.labels[old_value] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to old_value, then
Iterate through log field events.parameters.multiValue:
if the index2 log field value is equal to 0, then the target.resource.attribute.labels.key UDM field is set to old_value and the events.parameters.multiValue log field is mapped to the target.resource.attribute.labels.value UDM field. Otherwise, the target.resource.attribute.labels.key UDM field is set to old_value and the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[old_value]}, %{events.parameters.multiValue}, where %{target.resource.attribute.labels[old_value]} and %{events.parameters.multiValue} are replaced with the values of the target.resource.attribute.labels[old_value] and events.parameters.multiValue log fields.
change_document_access_scope old_visibility target.resource.attribute.labels[old_visibility]
change_document_access_scope originating_app_id additional.fields[originating_app_id]
change_document_access_scope owner about.user.email_addresses
change_document_access_scope owner target.resource.attribute.labels[owner]
change_document_access_scope owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
change_document_access_scope owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
change_document_access_scope primary_event additional.fields[primary_event]
change_document_access_scope target_domain target.domain.name
change_document_access_scope shared_drive_id target.resource_ancestors.product_object_id
change_document_access_scope visibility target.resource.attribute.labels[visibility]
change_document_access_scope visibility_change target.resource.attribute.labels[visibility_change]
change_document_access_scope target.application The target.application UDM field is set to Google Drive.
change_document_access_scope_hierarchy_reconciled actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
change_document_access_scope_hierarchy_reconciled actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
change_document_access_scope_hierarchy_reconciled billable additional.fields[billable]
change_document_access_scope_hierarchy_reconciled doc_id target.resource.product_object_id
change_document_access_scope_hierarchy_reconciled doc_title target.resource.name
change_document_access_scope_hierarchy_reconciled doc_type target.resource.attribute.labels[doc_type]
change_document_access_scope_hierarchy_reconciled is_encrypted additional.fields[is_encrypted]
change_document_access_scope_hierarchy_reconciled new_value target.resource.attribute.labels[new_value] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to new_value, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the target.resource.attribute.labels.key UDM field is set to new_value and the events.parameters.multiValue log field is mapped to the target.resource.attribute.labels.value UDM field. Otherwise, the target.resource.attribute.labels.key UDM field is set to new_value and the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[new_value]}, %{events.parameters.multiValue}, where %{target.resource.attribute.labels[new_value]} and %{events.parameters.multiValue} are replaced with the values of the target.resource.attribute.labels[new_value] and events.parameters.multiValue log fields.
change_document_access_scope_hierarchy_reconciled old_value target.resource.attribute.labels[old_value] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to old_value, then
Iterate through log field events.parameters.multiValue:
if the index2 log field value is equal to 0, then the target.resource.attribute.labels.key UDM field is set to old_value and the events.parameters.multiValue log field is mapped to the target.resource.attribute.labels.value UDM field. Otherwise, the target.resource.attribute.labels.key UDM field is set to old_value and the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[old_value]}, %{events.parameters.multiValue}, where %{target.resource.attribute.labels[old_value]} and %{events.parameters.multiValue} are replaced with the values of the target.resource.attribute.labels[old_value] and events.parameters.multiValue log fields.
change_document_access_scope_hierarchy_reconciled old_visibility target.resource.attribute.labels[old_visibility]
change_document_access_scope_hierarchy_reconciled originating_app_id additional.fields[originating_app_id]
change_document_access_scope_hierarchy_reconciled owner about.user.email_addresses
change_document_access_scope_hierarchy_reconciled owner target.resource.attribute.labels[owner]
change_document_access_scope_hierarchy_reconciled owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
change_document_access_scope_hierarchy_reconciled owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
change_document_access_scope_hierarchy_reconciled primary_event additional.fields[primary_event]
change_document_access_scope_hierarchy_reconciled target_domain target.domain.name
change_document_access_scope_hierarchy_reconciled shared_drive_id target.resource_ancestors.product_object_id
change_document_access_scope_hierarchy_reconciled visibility target.resource.attribute.labels[visibility]
change_document_access_scope_hierarchy_reconciled visibility_change target.resource.attribute.labels[visibility_change]
change_document_access_scope_hierarchy_reconciled target.application The target.application UDM field is set to Google Drive.
change_document_visibility actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
change_document_visibility actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
change_document_visibility billable additional.fields[billable]
change_document_visibility doc_id target.resource.product_object_id
change_document_visibility doc_title target.resource.name
change_document_visibility doc_type target.resource.attribute.labels[doc_type]
change_document_visibility is_encrypted additional.fields[is_encrypted]
change_document_visibility new_value target.resource.attribute.labels[new_value] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to new_value, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the target.resource.attribute.labels.key UDM field is set to new_value and the events.parameters.multiValue log field is mapped to the target.resource.attribute.labels.value UDM field. Otherwise, the target.resource.attribute.labels.key UDM field is set to new_value and the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[new_value]}, %{events.parameters.multiValue}, where %{target.resource.attribute.labels[new_value]} and %{events.parameters.multiValue} are replaced with the values of the target.resource.attribute.labels[new_value] and events.parameters.multiValue log fields.
change_document_visibility old_value target.resource.attribute.labels[old_value] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to old_value, then
Iterate through log field events.parameters.multiValue:
if the index2 log field value is equal to 0, then the target.resource.attribute.labels.key UDM field is set to old_value and the events.parameters.multiValue log field is mapped to the target.resource.attribute.labels.value UDM field. Otherwise, the target.resource.attribute.labels.key UDM field is set to old_value and the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[old_value]}, %{events.parameters.multiValue}, where %{target.resource.attribute.labels[old_value]} and %{events.parameters.multiValue} are replaced with the values of the target.resource.attribute.labels[old_value] and events.parameters.multiValue log fields.
change_document_visibility old_visibility target.resource.attribute.labels[old_visibility]
change_document_visibility originating_app_id additional.fields[originating_app_id]
change_document_visibility owner about.user.email_addresses
change_document_visibility owner target.resource.attribute.labels[owner]
change_document_visibility owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
change_document_visibility owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
change_document_visibility primary_event additional.fields[primary_event]
change_document_visibility target_domain target.domain.name
change_document_visibility shared_drive_id target.resource_ancestors.product_object_id
change_document_visibility visibility target.resource.attribute.labels[visibility]
change_document_visibility visibility_change target.resource.attribute.labels[visibility_change]
change_document_visibility target.application The target.application UDM field is set to Google Drive.
change_document_visibility_hierarchy_reconciled actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
change_document_visibility_hierarchy_reconciled actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
change_document_visibility_hierarchy_reconciled billable additional.fields[billable]
change_document_visibility_hierarchy_reconciled doc_id target.resource.product_object_id
change_document_visibility_hierarchy_reconciled doc_title target.resource.name
change_document_visibility_hierarchy_reconciled doc_type target.resource.attribute.labels[doc_type]
change_document_visibility_hierarchy_reconciled is_encrypted additional.fields[is_encrypted]
change_document_visibility_hierarchy_reconciled new_value target.resource.attribute.labels[new_value] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to new_value, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the target.resource.attribute.labels.key UDM field is set to new_value and the events.parameters.multiValue log field is mapped to the target.resource.attribute.labels.value UDM field. Otherwise, the target.resource.attribute.labels.key UDM field is set to new_value and the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[new_value]}, %{events.parameters.multiValue}, where %{target.resource.attribute.labels[new_value]} and %{events.parameters.multiValue} are replaced with the values of the target.resource.attribute.labels[new_value] and events.parameters.multiValue log fields.
change_document_visibility_hierarchy_reconciled old_value target.resource.attribute.labels[old_value] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to old_value, then
Iterate through log field events.parameters.multiValue:
if the index2 log field value is equal to 0, then the target.resource.attribute.labels.key UDM field is set to old_value and the events.parameters.multiValue log field is mapped to the target.resource.attribute.labels.value UDM field. Otherwise, the target.resource.attribute.labels.key UDM field is set to old_value and the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[old_value]}, %{events.parameters.multiValue}, where %{target.resource.attribute.labels[old_value]} and %{events.parameters.multiValue} are replaced with the values of the target.resource.attribute.labels[old_value] and events.parameters.multiValue log fields.
change_document_visibility_hierarchy_reconciled old_visibility target.resource.attribute.labels[old_visibility]
change_document_visibility_hierarchy_reconciled originating_app_id additional.fields[originating_app_id]
change_document_visibility_hierarchy_reconciled owner about.user.email_addresses
change_document_visibility_hierarchy_reconciled owner target.resource.attribute.labels[owner]
change_document_visibility_hierarchy_reconciled owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
change_document_visibility_hierarchy_reconciled owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
change_document_visibility_hierarchy_reconciled primary_event additional.fields[primary_event]
change_document_visibility_hierarchy_reconciled target_domain target.domain.name
change_document_visibility_hierarchy_reconciled shared_drive_id target.resource_ancestors.product_object_id
change_document_visibility_hierarchy_reconciled visibility target.resource.attribute.labels[visibility]
change_document_visibility_hierarchy_reconciled visibility_change target.resource.attribute.labels[visibility_change]
change_document_visibility_hierarchy_reconciled target.application The target.application UDM field is set to Google Drive.
publish_new_version actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
publish_new_version actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
publish_new_version billable additional.fields[billable]
publish_new_version doc_id target.resource.product_object_id
publish_new_version doc_title target.resource.name
publish_new_version doc_type target.resource.attribute.labels[doc_type]
publish_new_version is_encrypted additional.fields[is_encrypted]
publish_new_version originating_app_id additional.fields[originating_app_id]
publish_new_version owner about.user.email_addresses
publish_new_version owner target.resource.attribute.labels[owner]
publish_new_version owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
publish_new_version owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
publish_new_version primary_event additional.fields[primary_event]
publish_new_version shared_drive_id target.resource_ancestors.product_object_id
publish_new_version visibility target.resource.attribute.labels[visibility]
publish_new_version target.application The target.application UDM field is set to Google Drive.
remove_security_update actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
remove_security_update actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
remove_security_update billable additional.fields[billable]
remove_security_update doc_id target.resource.product_object_id
remove_security_update doc_title target.resource.name
remove_security_update doc_type target.resource.attribute.labels[doc_type]
remove_security_update is_encrypted additional.fields[is_encrypted]
remove_security_update originating_app_id additional.fields[originating_app_id]
remove_security_update owner about.user.email_addresses
remove_security_update owner target.resource.attribute.labels[owner]
remove_security_update owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
remove_security_update owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
remove_security_update primary_event additional.fields[primary_event]
remove_security_update shared_drive_id target.resource_ancestors.product_object_id
remove_security_update visibility target.resource.attribute.labels[visibility]
remove_security_update target.application The target.application UDM field is set to Google Drive.
shared_drive_membership_change actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
shared_drive_membership_change actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
shared_drive_membership_change added_role additional.fields[target_user] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to added_role, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the events.parameters.multiValue log field is mapped to the target.user.attribute.roles.name UDM field. Otherwise, the target.user.attribute.roles.name UDM field is set to a value generated from the template %{target.user.attribute.roles.name}, %{events.parameters.multiValue}, where %{target.user.attribute.roles.name} and %{events.parameters.multiValue} are replaced with the values of the target.user.attribute.roles.name and events.parameters.multiValue log fields.
shared_drive_membership_change billable additional.fields[billable]
shared_drive_membership_change doc_id target.resource.product_object_id
shared_drive_membership_change doc_title target.resource.name
shared_drive_membership_change doc_type target.resource.attribute.labels[doc_type]
shared_drive_membership_change is_encrypted additional.fields[is_encrypted]
shared_drive_membership_change membership_change_type additional.fields[membership_change_type]
shared_drive_membership_change originating_app_id additional.fields[originating_app_id]
shared_drive_membership_change owner about.user.email_addresses
shared_drive_membership_change owner target.resource.attribute.labels[owner]
shared_drive_membership_change owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
shared_drive_membership_change owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
shared_drive_membership_change primary_event additional.fields[primary_event]
shared_drive_membership_change removed_role target.user.attribute.roles.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to removed_role, then
Iterate through log field events.parameters.multiValue:
if the index2 log field value is equal to 0, then the events.parameters.multiValue log field is mapped to the target.user.attribute.roles.name UDM field. Otherwise, the target.user.attribute.roles.name UDM field is set to a value generated from the template %{target.user.attribute.roles.name}, %{events.parameters.multiValue}, where %{target.user.attribute.roles.name} and %{events.parameters.multiValue} are replaced with the values of the target.user.attribute.roles.name and events.parameters.multiValue log fields.
shared_drive_membership_change target.user.attribute.roles.description Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to removed_role, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then if the events.parameters.multiValue log field value is equal to commenter, then the target.user.attribute.roles.description UDM field is set to Team Drive role Commenter.. Else if the events.parameters.multiValue log field value is equal to content_manager, then the target.user.attribute.roles.description UDM field is set to Team Drive role Content manager.. Else if the events.parameters.multiValue log field value is equal to editor, then the target.user.attribute.roles.description UDM field is set to Team Drive role Contributor.. Else if the events.parameters.multiValue log field value is equal to none, then The target.user.attribute.roles.description UDM field is set to No role in Team Drive.. Else if the events.parameters.multiValue log field value is equal to organizer, then the target.user.attribute.roles.description UDM field is set to Team Drive role Manager.. Else if the events.parameters.multiValue log field value is equal to viewer, then the target.user.attribute.roles.description UDM field is set to Team Drive role Viewer..
shared_drive_membership_change target.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to target, then if the events.parameters.value log field value matches the regular expression pattern: ^.+@.+$, then the events.parameters.value log field is mapped to the target.user.email_addresses UDM field. Otherwise, the target.user.attribute.labels.key UDM field is set to target and the events.parameters.value log field is mapped to the target.user.attribute.labels.value UDM field.
shared_drive_membership_change target_user target.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to target, then target log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to target_user, then target_user log field value is set to the events.parameters.value log field value.
If the target_user log field value is not empty and the target log field value is not equal to the target_user log field value, then if the target_user log field value matches the regular expression pattern: ^.+@.+$, then the target_user log field is mapped to the target.user.email_addresses UDM field. Otherwise, the target.user.attribute.labels.key UDM field is set to target_user and The target_user log field is mapped to the target.user.attribute.labels.value UDM field.
shared_drive_membership_change target_user additional.fields[target_user]
shared_drive_membership_change shared_drive_id target.resource_ancestors.product_object_id
shared_drive_membership_change visibility target.resource.attribute.labels[visibility]
shared_drive_membership_change target.application The target.application UDM field is set to Google Drive.
shared_drive_settings_change actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
shared_drive_settings_change actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
shared_drive_settings_change billable additional.fields[billable]
shared_drive_settings_change doc_id target.resource.product_object_id
shared_drive_settings_change doc_title target.resource.name
shared_drive_settings_change doc_type target.resource.attribute.labels[doc_type]
shared_drive_settings_change is_encrypted additional.fields[is_encrypted]
shared_drive_settings_change new_settings_state additional.fields[new_settings_state]
shared_drive_settings_change old_settings_state additional.fields[old_settings_state]
shared_drive_settings_change originating_app_id additional.fields[originating_app_id]
shared_drive_settings_change owner about.user.email_addresses
shared_drive_settings_change owner target.resource.attribute.labels[owner]
shared_drive_settings_change owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
shared_drive_settings_change owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
shared_drive_settings_change primary_event additional.fields[primary_event]
shared_drive_settings_change target.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to target, then if the events.parameters.value log field value matches the regular expression pattern: ^.+@.+$, then the events.parameters.value log field is mapped to the target.user.email_addresses UDM field. Otherwise, the target.user.attribute.labels.key UDM field is set to target and the events.parameters.value log field is mapped to the target.user.attribute.labels.value UDM field.
shared_drive_settings_change shared_drive_id target.resource_ancestors.product_object_id
shared_drive_settings_change shared_drive_settings_change_type additional.fields[shared_drive_settings_change_type]
shared_drive_settings_change visibility target.resource.attribute.labels[visibility]
shared_drive_settings_change target.application The target.application UDM field is set to Google Drive.
sheets_import_range_access_change doc_id target.resource.product_object_id
sheets_import_range_access_change doc_title target.resource.name
sheets_import_range_access_change doc_type target.resource.attribute.labels[doc_type]
sheets_import_range_access_change is_encrypted additional.fields[is_encrypted]
sheets_import_range_access_change originating_app_id additional.fields[originating_app_id]
sheets_import_range_access_change owner about.user.email_addresses
sheets_import_range_access_change owner target.resource.attribute.labels[owner]
sheets_import_range_access_change owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
sheets_import_range_access_change owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
sheets_import_range_access_change primary_event additional.fields[primary_event]
sheets_import_range_access_change sheets_import_range_enabled target.resource.attribute.labels[sheets_import_range_enabled]
sheets_import_range_access_change sheets_import_range_recipient_doc target.resource.attribute.labels[sheets_import_range_recipient_doc]
sheets_import_range_access_change shared_drive_id target.resource_ancestors.product_object_id
sheets_import_range_access_change visibility target.resource.attribute.labels[visibility]
sheets_import_range_access_change target.application The target.application UDM field is set to Google Drive.
change_user_access actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
change_user_access actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
change_user_access billable additional.fields[billable]
change_user_access doc_id target.resource.product_object_id
change_user_access doc_title target.resource.name
change_user_access doc_type target.resource.attribute.labels[doc_type]
change_user_access is_encrypted additional.fields[is_encrypted]
change_user_access new_value target.resource.attribute.labels[new_value] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to new_value, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the target.resource.attribute.labels.key UDM field is set to new_value and the events.parameters.multiValue log field is mapped to the target.resource.attribute.labels.value UDM field. Otherwise, the target.resource.attribute.labels.key UDM field is set to new_value and the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[new_value]}, %{events.parameters.multiValue}, where %{target.resource.attribute.labels[new_value]} and %{events.parameters.multiValue} are replaced with the values of the target.resource.attribute.labels[new_value] and events.parameters.multiValue log fields.
change_user_access old_value target.resource.attribute.labels[old_value] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to old_value, then
Iterate through log field events.parameters.multiValue:
if the index2 log field value is equal to 0, then the target.resource.attribute.labels.key UDM field is set to old_value and the events.parameters.multiValue log field is mapped to the target.resource.attribute.labels.value UDM field. Otherwise, the target.resource.attribute.labels.key UDM field is set to old_value and the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[old_value]}, %{events.parameters.multiValue}, where %{target.resource.attribute.labels[old_value]} and %{events.parameters.multiValue} are replaced with the values of the target.resource.attribute.labels[old_value] and events.parameters.multiValue log fields.
change_user_access old_visibility target.resource.attribute.labels[old_visibility]
change_user_access originating_app_id additional.fields[originating_app_id]
change_user_access owner about.user.email_addresses
change_user_access owner target.resource.attribute.labels[owner]
change_user_access owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
change_user_access owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
change_user_access primary_event additional.fields[primary_event]
change_user_access target_user target.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to target, then target log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to target_user, then target_user log field value is set to the events.parameters.value log field value.
If the target_user log field value is not empty and the target log field value is not equal to the target_user log field value, then if the target_user log field value matches the regular expression pattern: ^.+@.+$, then the target_user log field is mapped to the target.user.email_addresses UDM field. Otherwise, the target.user.attribute.labels.key UDM field is set to target_user and The target_user log field is mapped to the target.user.attribute.labels.value UDM field.
change_user_access target_user additional.fields[target_user]
change_user_access shared_drive_id target.resource_ancestors.product_object_id
change_user_access visibility target.resource.attribute.labels[visibility]
change_user_access visibility_change target.resource.attribute.labels[visibility_change]
change_user_access target.application The target.application UDM field is set to Google Drive.
change_user_access_hierarchy_reconciled actor_is_collaborator_account principal.user.attribute.labels[actor_is_collaborator_account]
change_user_access_hierarchy_reconciled actor_is_collaborator_account additional.fields[actor_is_collaborator_account]
change_user_access_hierarchy_reconciled billable additional.fields[billable]
change_user_access_hierarchy_reconciled doc_id target.resource.product_object_id
change_user_access_hierarchy_reconciled doc_title target.resource.name
change_user_access_hierarchy_reconciled doc_type target.resource.attribute.labels[doc_type]
change_user_access_hierarchy_reconciled is_encrypted additional.fields[is_encrypted]
change_user_access_hierarchy_reconciled new_value target.resource.attribute.labels[new_value] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to new_value, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the target.resource.attribute.labels.key UDM field is set to new_value and the events.parameters.multiValue log field is mapped to the target.resource.attribute.labels.value UDM field. Otherwise, the target.resource.attribute.labels.key UDM field is set to new_value and the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[new_value]}, %{events.parameters.multiValue}, where %{target.resource.attribute.labels[new_value]} and %{events.parameters.multiValue} are replaced with the values of the target.resource.attribute.labels[new_value] and events.parameters.multiValue log fields.
change_user_access_hierarchy_reconciled old_value target.resource.attribute.labels[old_value] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to old_value, then
Iterate through log field events.parameters.multiValue:
if the index2 log field value is equal to 0, then the target.resource.attribute.labels.key UDM field is set to old_value and the events.parameters.multiValue log field is mapped to the target.resource.attribute.labels.value UDM field. Otherwise, the target.resource.attribute.labels.key UDM field is set to old_value and the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[old_value]}, %{events.parameters.multiValue}, where %{target.resource.attribute.labels[old_value]} and %{events.parameters.multiValue} are replaced with the values of the target.resource.attribute.labels[old_value] and events.parameters.multiValue log fields.
change_user_access_hierarchy_reconciled old_visibility target.resource.attribute.labels[old_visibility]
change_user_access_hierarchy_reconciled originating_app_id additional.fields[originating_app_id]
change_user_access_hierarchy_reconciled owner about.user.email_addresses
change_user_access_hierarchy_reconciled owner target.resource.attribute.labels[owner]
change_user_access_hierarchy_reconciled owner_is_shared_drive target.resource.attribute.labels[owner_is_shared_drive]
change_user_access_hierarchy_reconciled owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
change_user_access_hierarchy_reconciled primary_event additional.fields[primary_event]
change_user_access_hierarchy_reconciled target_user target.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to target, then target log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to target_user, then target_user log field value is set to the events.parameters.value log field value.
If the target_user log field value is not empty and the target log field value is not equal to the target_user log field value, then if the target_user log field value matches the regular expression pattern: ^.+@.+$, then the target_user log field is mapped to the target.user.email_addresses UDM field. Otherwise, the target.user.attribute.labels.key UDM field is set to target_user and The target_user log field is mapped to the target.user.attribute.labels.value UDM field.
change_user_access_hierarchy_reconciled target_user additional.fields[target_user]
change_user_access_hierarchy_reconciled shared_drive_id target.resource_ancestors.product_object_id
change_user_access_hierarchy_reconciled visibility target.resource.attribute.labels[visibility]
change_user_access_hierarchy_reconciled visibility_change target.resource.attribute.labels[visibility_change]
change_user_access_hierarchy_reconciled target.application The target.application UDM field is set to Google Drive.
storage_usage_update storage_usage_in_bytes additional.fields[storage_usage_in_bytes]
storage_usage_update target.application The target.application UDM field is set to Google Drive.

Field mapping reference: workspace activity groups application

The following table provides the log fields to UDM field mapping corresponding to events for the groups application.

Event Name Log field UDM mapping Logic
change_acl_permission acl_permission target.group.attribute.roles.name
change_acl_permission group_email target.group.email_addresses
change_acl_permission new_value_repeated target.group.attribute.labels[new_value_repeated] new_value_repeated log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to new_value_repeated, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then new_value_repeated log field value is set to the events.parameters.multiValue log field value. Otherwise, new_value_repeated log field value is set to a value generated from the template %{new_value_repeated}, %{events.parameters.multiValue}, where %{new_value_repeated} and %{events.parameters.multiValue} are replaced with the values of the new_value_repeated and events.parameters.multiValue log fields.
The target.group.attribute.labels.key UDM field is set to new_value_repeated and the new_value_repeated log field is mapped to the target.group.attribute.labels.value UDM field.
change_acl_permission old_value_repeated target.group.attribute.labels[old_value_repeated] old_value_repeated log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to old_value_repeated, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then old_value_repeated log field value is set to the events.parameters.multiValue log field value. Otherwise, old_value_repeated log field value is set to a value generated from the template %{old_value_repeated}, %{events.parameters.multiValue}, where %{old_value_repeated} and %{events.parameters.multiValue} are replaced with the values of the old_value_repeated and events.parameters.multiValue log fields.
The target.group.attribute.labels.key UDM field is set to old_value_repeated and the old_value_repeated log field is mapped to the target.group.attribute.labels.value UDM field.
change_acl_permission target.application The target.application UDM field is set to Google Groups.
accept_invitation group_email target.group.email_addresses
accept_invitation target.application The target.application UDM field is set to Google Groups.
approve_join_request group_email target.group.email_addresses
approve_join_request user_email target.user.email_addresses
approve_join_request target.application The target.application UDM field is set to Google Groups.
join group_email target.group.email_addresses
join target.application The target.application UDM field is set to Google Groups.
join_via_mail group_email target.group.email_addresses
join_via_mail target.application The target.application UDM field is set to Google Groups.
request_to_join group_email target.group.email_addresses
request_to_join target.application The target.application UDM field is set to Google Groups.
request_to_join_via_mail group_email target.group.email_addresses
request_to_join_via_mail target.application The target.application UDM field is set to Google Groups.
change_basic_setting basic_setting target.resource.name
change_basic_setting group_email target.group.email_addresses
change_basic_setting new_value target.group.attribute.labels[new_value]
change_basic_setting target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
change_basic_setting old_value target.group.attribute.labels[old_value]
change_basic_setting target.application The target.application UDM field is set to Google Groups.
create_group target.application The target.application UDM field is set to Google Groups.
create_group group_email target.group.email_addresses
delete_group target.application The target.application UDM field is set to Google Groups.
delete_group group_email target.group.email_addresses
change_email_subscription_type group_email target.group.email_addresses
change_email_subscription_type new_value target.group.attribute.labels[new_value]
change_email_subscription_type old_value target.group.attribute.labels[old_value]
change_email_subscription_type user_email target.user.email_addresses
change_email_subscription_type target.application The target.application UDM field is set to Google Groups.
change_identity_setting group_email target.group.email_addresses
change_identity_setting identity_setting target.resource.name
change_identity_setting new_value target.group.attribute.labels[new_value]
change_identity_setting target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
change_identity_setting old_value target.group.attribute.labels[old_value]
change_identity_setting target.application The target.application UDM field is set to Google Groups.
add_info_setting group_email target.group.email_addresses
add_info_setting info_setting target.resource.name
add_info_setting target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
add_info_setting value target.group.attribute.labels[value]
add_info_setting target.application The target.application UDM field is set to Google Groups.
change_info_setting group_email target.group.email_addresses
change_info_setting info_setting target.resource.name
change_info_setting new_value target.group.attribute.labels[new_value]
change_info_setting old_value target.group.attribute.labels[old_value]
change_info_setting target.application The target.application UDM field is set to Google Groups.
change_info_setting target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
remove_info_setting group_email target.group.email_addresses
remove_info_setting info_setting target.resource.name
remove_info_setting target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
remove_info_setting value target.group.attribute.labels[value]
remove_info_setting target.application The target.application UDM field is set to Google Groups.
change_new_members_restrictions_setting group_email target.group.email_addresses
change_new_members_restrictions_setting new_members_restrictions_setting target.resource.name
change_new_members_restrictions_setting new_value target.group.attribute.labels[new_value]
change_new_members_restrictions_setting old_value target.group.attribute.labels[old_value]
change_new_members_restrictions_setting target.application The target.application UDM field is set to Google Groups.
change_new_members_restrictions_setting target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
change_post_replies_setting group_email target.group.email_addresses
change_post_replies_setting new_value target.group.attribute.labels[new_value]
change_post_replies_setting old_value target.group.attribute.labels[old_value]
change_post_replies_setting post_replies_setting target.resource.name
change_post_replies_setting target.application The target.application UDM field is set to Google Groups.
change_post_replies_setting target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
change_spam_moderation_setting group_email target.group.email_addresses
change_spam_moderation_setting new_value target.group.attribute.labels[new_value]
change_spam_moderation_setting old_value target.group.attribute.labels[old_value]
change_spam_moderation_setting spam_moderation_setting target.resource.name
change_spam_moderation_setting target.application The target.application UDM field is set to Google Groups.
change_spam_moderation_setting target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
change_topic_setting group_email target.group.email_addresses
change_topic_setting new_value target.group.attribute.labels[new_value]
change_topic_setting old_value target.group.attribute.labels[old_value]
change_topic_setting topic_setting target.resource.name
change_topic_setting target.application The target.application UDM field is set to Google Groups.
change_topic_setting target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
moderate_message group_email target.group.email_addresses
moderate_message message_id network.email.mail_id
moderate_message message_moderation_action security_result.action_details
moderate_message status security_result.action Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to status, then if the events.parameters.value log field value is equal to succeeded, then the security_result.action UDM field is set to ALLOW. Otherwise, the security_result.action UDM field is set to BLOCK.
moderate_message target.application The target.application UDM field is set to Google Groups.
always_post_from_user group_email target.group.email_addresses
always_post_from_user status security_result.action Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to status, then if the events.parameters.value log field value is equal to succeeded, then the security_result.action UDM field is set to ALLOW. Otherwise, the security_result.action UDM field is set to BLOCK.
always_post_from_user user_email target.user.email_addresses
always_post_from_user target.application The target.application UDM field is set to Google Groups.
add_user group_email target.group.email_addresses
add_user member_role target.user.attribute.roles.name
add_user user_email target.user.email_addresses
add_user target.application The target.application UDM field is set to Google Groups.
ban_user_with_moderation group_email target.group.email_addresses
ban_user_with_moderation status security_result.action Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to status, then if the events.parameters.value log field value is equal to succeeded, then the security_result.action UDM field is set to ALLOW. Otherwise, the security_result.action UDM field is set to BLOCK.
ban_user_with_moderation user_email target.user.email_addresses
ban_user_with_moderation target.application The target.application UDM field is set to Google Groups.
revoke_invitation group_email target.group.email_addresses
revoke_invitation user_email target.user.email_addresses
revoke_invitation target.application The target.application UDM field is set to Google Groups.
invite_user group_email target.group.email_addresses
invite_user user_email target.user.email_addresses
invite_user target.application The target.application UDM field is set to Google Groups.
reject_join_request group_email target.group.email_addresses
reject_join_request user_email target.user.email_addresses
reject_join_request target.application The target.application UDM field is set to Google Groups.
reinvite_user group_email target.group.email_addresses
reinvite_user user_email target.user.email_addresses
reinvite_user target.application The target.application UDM field is set to Google Groups.
remove_user group_email target.group.email_addresses
remove_user user_email target.user.email_addresses
remove_user target.application The target.application UDM field is set to Google Groups.
unsubscribe_via_mail group_email target.group.email_addresses
unsubscribe_via_mail target.application The target.application UDM field is set to Google Groups.

Field mapping reference: workspace activity keep application

The following table provides the log fields to UDM field mapping corresponding to events for the keep application.

Event Name Log field UDM mapping Logic
deleted_attachment attachment_name target.file.names
deleted_attachment note_name target.url
deleted_attachment note_name target.resource.name
deleted_attachment owner_email about.user.email_addresses
deleted_attachment target.application The target.application UDM field is set to Google Keep.
uploaded_attachment attachment_name target.file.names
uploaded_attachment note_name target.url
uploaded_attachment note_name target.resource.name
uploaded_attachment owner_email about.user.email_addresses
uploaded_attachment target.application The target.application UDM field is set to Google Keep.
edited_note_content note_name target.url
edited_note_content note_name target.resource.name
edited_note_content owner_email about.user.email_addresses
edited_note_content target.application The target.application UDM field is set to Google Keep.
created_note note_name target.url
created_note note_name target.resource.name
created_note owner_email about.user.email_addresses
created_note target.application The target.application UDM field is set to Google Keep.
deleted_note note_name target.url
deleted_note note_name target.resource.name
deleted_note owner_email about.user.email_addresses
deleted_note target.application The target.application UDM field is set to Google Keep.
modified_acl note_name target.url
modified_acl note_name target.resource.name
modified_acl owner_email about.user.email_addresses
modified_acl target.application The target.application UDM field is set to Google Keep.

Field mapping reference: workspace activity user_accounts application

The following table provides the log fields to UDM field mapping corresponding to events for the user_accounts application. fields.

Event Name Log field UDM mapping Logic
2sv_disable target.application The target.application UDM field is set to User Accounts.
2sv_enroll target.application The target.application UDM field is set to User Accounts.
password_edit target.application The target.application UDM field is set to User Accounts.
recovery_email_edit target.application The target.application UDM field is set to User Accounts.
recovery_phone_edit target.application The target.application UDM field is set to User Accounts.
recovery_secret_qa_edit target.application The target.application UDM field is set to User Accounts.
titanium_enroll target.application The target.application UDM field is set to User Accounts.
titanium_unenroll target.application The target.application UDM field is set to User Accounts.
email_forwarding_out_of_domain target.user.email_addresses
email_forwarding_out_of_domain target.application The target.application UDM field is set to User Accounts.

Field mapping reference: workspace activity google_meet application

The following table provides the log fields to UDM field mapping corresponding to events for the google_meet application. fields.

Event Name Log field UDM mapping Logic
abuse_report_submitted action_description security_result.action_details
abuse_report_submitted action_reason security_result.summary
abuse_report_submitted calendar_event_id target.resource.attribute.labels[calendar_event_id]
abuse_report_submitted calendar_event_id additional.fields[calendar_event_id]
abuse_report_submitted conference_id target.resource.product_object_id
abuse_report_submitted device_type principal.asset.attribute.labels[device_type]
abuse_report_submitted display_name principal.user.user_display_name
abuse_report_submitted endpoint_id additional.fields[endpoint_id]
abuse_report_submitted identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
abuse_report_submitted principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
abuse_report_submitted ip_address principal.asset.ip
abuse_report_submitted ip_address principal.ip
abuse_report_submitted is_external principal.user.attribute.labels[is_external]
abuse_report_submitted is_external additional.fields[is_external]
abuse_report_submitted meeting_code target.resource.attribute.labels[meeting_code]
abuse_report_submitted organizer_email about.user.email_addresses
abuse_report_submitted product_type target.resource.resource_subtype
abuse_report_submitted target_display_names target.user.user_display_name
abuse_report_submitted target_email target.user.email_addresses
abuse_report_submitted target_phone_number target.user.phone_numbers
abuse_report_submitted target.application The target.application UDM field is set to Google Meet.
broadcast_activity broadcast_state target.resource.attribute.labels[broadcast_state]
broadcast_activity conference_id target.resource.product_object_id
broadcast_activity is_external principal.user.attribute.labels[is_external]
broadcast_activity is_external additional.fields[is_external]
broadcast_activity meeting_code target.resource.attribute.labels[meeting_code]
broadcast_activity target.application The target.application UDM field is set to Google Meet.
call_ended audio_recv_packet_loss_max additional.fields[audio_recv_packet_loss_max]
call_ended audio_recv_packet_loss_mean additional.fields[audio_recv_packet_loss_mean]
call_ended audio_recv_seconds additional.fields[audio_recv_seconds]
call_ended audio_send_bitrate_kbps_mean additional.fields[audio_send_bitrate_kbps_mean]
call_ended audio_send_packet_loss_max additional.fields[audio_send_packet_loss_max]
call_ended audio_send_packet_loss_mean additional.fields[audio_send_packet_loss_mean]
call_ended audio_send_seconds additional.fields[audio_send_seconds]
call_ended calendar_event_id target.resource.attribute.labels[calendar_event_id]
call_ended calendar_event_id additional.fields[calendar_event_id]
call_ended conference_id target.resource.product_object_id
call_ended device_type principal.asset.attribute.labels[device_type]
call_ended display_name principal.user.user_display_name
call_ended duration_seconds network.session_duration
call_ended encryption_type target.resource.attribute.labels[encryption_type]
call_ended end_of_call_rating additional.fields[end_of_call_rating]
call_ended endpoint_id additional.fields[endpoint_id]
call_ended identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
call_ended principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
call_ended ip_address principal.asset.ip
call_ended ip_address principal.ip
call_ended is_companion additional.fields[is_companion]
call_ended is_external principal.user.attribute.labels[is_external]
call_ended is_external additional.fields[is_external]
call_ended join_permission_acceptor_email about.user.email_addresses
call_ended join_permission_type about.user.attribute.labels[join_permission_type]
call_ended location_country principal.location.country_or_region
call_ended location_region principal.location.name
call_ended meeting_code target.resource.attribute.labels[meeting_code]
call_ended network_congestion additional.fields[network_congestion]
call_ended network_estimated_download_kbps_mean additional.fields[network_estimated_download_kbps_mean]
call_ended network_estimated_upload_kbps_mean additional.fields[network_estimated_upload_kbps_mean]
call_ended network_recv_jitter_msec_max additional.fields[network_recv_jitter_msec_max]
call_ended network_recv_jitter_msec_mean additional.fields[network_recv_jitter_msec_mean]
call_ended network_rtt_msec_mean additional.fields[network_rtt_msec_mean]
call_ended network_send_jitter_msec_mean additional.fields[network_send_jitter_msec_mean]
call_ended network_transport_protocol additional.fields[network_transport_protocol]
call_ended organizer_email about.user.email_addresses
call_ended product_type target.resource.resource_subtype
call_ended screencast_recv_bitrate_kbps_mean additional.fields[screencast_recv_bitrate_kbps_mean]
call_ended screencast_recv_fps_mean additional.fields[screencast_recv_fps_mean]
call_ended screencast_recv_long_side_median_pixels additional.fields[screencast_recv_long_side_median_pixels]
call_ended screencast_recv_packet_loss_max additional.fields[screencast_recv_packet_loss_max]
call_ended screencast_recv_packet_loss_mean additional.fields[screencast_recv_packet_loss_mean]
call_ended screencast_recv_seconds additional.fields[screencast_recv_seconds]
call_ended screencast_recv_short_side_median_pixels additional.fields[screencast_recv_short_side_median_pixels]
call_ended screencast_send_bitrate_kbps_mean additional.fields[screencast_send_bitrate_kbps_mean]
call_ended screencast_send_fps_mean additional.fields[screencast_send_fps_mean]
call_ended screencast_send_long_side_median_pixels additional.fields[screencast_send_long_side_median_pixels]
call_ended screencast_send_packet_loss_max additional.fields[screencast_send_packet_loss_max]
call_ended screencast_send_packet_loss_mean additional.fields[screencast_send_packet_loss_mean]
call_ended screencast_send_seconds additional.fields[screencast_send_seconds]
call_ended screencast_send_short_side_median_pixels additional.fields[screencast_send_short_side_median_pixels]
call_ended video_recv_fps_mean additional.fields[video_recv_fps_mean]
call_ended video_recv_long_side_median_pixels additional.fields[video_recv_long_side_median_pixels]
call_ended video_recv_packet_loss_max additional.fields[video_recv_packet_loss_max]
call_ended video_recv_packet_loss_mean additional.fields[video_recv_packet_loss_mean]
call_ended video_recv_seconds additional.fields[video_recv_seconds]
call_ended video_recv_short_side_median_pixels additional.fields[video_recv_short_side_median_pixels]
call_ended video_send_bitrate_kbps_mean additional.fields[video_send_bitrate_kbps_mean]
call_ended video_send_fps_mean additional.fields[video_send_fps_mean]
call_ended video_send_long_side_median_pixels additional.fields[video_send_long_side_median_pixels]
call_ended video_send_packet_loss_max additional.fields[video_send_packet_loss_max]
call_ended video_send_packet_loss_mean additional.fields[video_send_packet_loss_mean]
call_ended video_send_seconds additional.fields[video_send_seconds]
call_ended video_send_short_side_median_pixels additional.fields[video_send_short_side_median_pixels]
call_ended target.application The target.application UDM field is set to Google Meet.
livestream_watched audio_recv_packet_loss_max additional.fields[audio_recv_packet_loss_max]
livestream_watched audio_recv_packet_loss_mean additional.fields[audio_recv_packet_loss_mean]
livestream_watched audio_recv_seconds additional.fields[audio_recv_seconds]
livestream_watched audio_send_bitrate_kbps_mean additional.fields[audio_send_bitrate_kbps_mean]
livestream_watched audio_send_packet_loss_max additional.fields[audio_send_packet_loss_max]
livestream_watched audio_send_packet_loss_mean additional.fields[audio_send_packet_loss_mean]
livestream_watched audio_send_seconds additional.fields[audio_send_seconds]
livestream_watched calendar_event_id target.resource.attribute.labels[calendar_event_id]
livestream_watched calendar_event_id additional.fields[calendar_event_id]
livestream_watched conference_id target.resource.product_object_id
livestream_watched device_type principal.asset.attribute.labels[device_type]
livestream_watched display_name principal.user.user_display_name
livestream_watched end_of_call_rating additional.fields[end_of_call_rating]
livestream_watched endpoint_id additional.fields[endpoint_id]
livestream_watched identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
livestream_watched principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
livestream_watched ip_address principal.asset.ip
livestream_watched ip_address principal.ip
livestream_watched is_external principal.user.attribute.labels[is_external]
livestream_watched is_external additional.fields[is_external]
livestream_watched livestream_ecdn_location intermediary.location.name
livestream_watched livestream_ecdn_network additional.fields[livestream_ecdn_network]
livestream_watched livestream_private_ip_address principal.ip
livestream_watched livestream_private_ip_address principal.asset.ip
livestream_watched livestream_view_page_id target.resource.attribute.labels[livestream_view_page_id]
livestream_watched location_country principal.location.country_or_region
livestream_watched location_region principal.location.name
livestream_watched meeting_code target.resource.attribute.labels[meeting_code]
livestream_watched network_congestion additional.fields[network_congestion]
livestream_watched network_estimated_download_kbps_mean additional.fields[network_estimated_download_kbps_mean]
livestream_watched network_estimated_upload_kbps_mean additional.fields[network_estimated_upload_kbps_mean]
livestream_watched network_recv_jitter_msec_max additional.fields[network_recv_jitter_msec_max]
livestream_watched network_recv_jitter_msec_mean additional.fields[network_recv_jitter_msec_mean]
livestream_watched network_rtt_msec_mean additional.fields[network_rtt_msec_mean]
livestream_watched network_send_jitter_msec_mean additional.fields[network_send_jitter_msec_mean]
livestream_watched network_transport_protocol additional.fields[network_transport_protocol]
livestream_watched organizer_email about.user.email_addresses
livestream_watched product_type target.resource.resource_subtype
livestream_watched screencast_recv_bitrate_kbps_mean additional.fields[screencast_recv_bitrate_kbps_mean]
livestream_watched screencast_recv_fps_mean additional.fields[screencast_recv_fps_mean]
livestream_watched screencast_recv_long_side_median_pixels additional.fields[screencast_recv_long_side_median_pixels]
livestream_watched screencast_recv_packet_loss_max additional.fields[screencast_recv_packet_loss_max]
livestream_watched screencast_recv_packet_loss_mean additional.fields[screencast_recv_packet_loss_mean]
livestream_watched screencast_recv_seconds additional.fields[screencast_recv_seconds]
livestream_watched screencast_recv_short_side_median_pixels additional.fields[screencast_recv_short_side_median_pixels]
livestream_watched screencast_send_bitrate_kbps_mean additional.fields[screencast_send_bitrate_kbps_mean]
livestream_watched screencast_send_fps_mean additional.fields[screencast_send_fps_mean]
livestream_watched screencast_send_long_side_median_pixels additional.fields[screencast_send_long_side_median_pixels]
livestream_watched screencast_send_packet_loss_max additional.fields[screencast_send_packet_loss_max]
livestream_watched screencast_send_packet_loss_mean additional.fields[screencast_send_packet_loss_mean]
livestream_watched screencast_send_seconds additional.fields[screencast_send_seconds]
livestream_watched screencast_send_short_side_median_pixels additional.fields[screencast_send_short_side_median_pixels]
livestream_watched start_timestamp_seconds additional.fields[start_timestamp_seconds]
livestream_watched video_recv_fps_mean additional.fields[video_recv_fps_mean]
livestream_watched video_recv_long_side_median_pixels additional.fields[video_recv_long_side_median_pixels]
livestream_watched video_recv_packet_loss_max additional.fields[video_recv_packet_loss_max]
livestream_watched video_recv_packet_loss_mean additional.fields[video_recv_packet_loss_mean]
livestream_watched video_recv_seconds additional.fields[video_recv_seconds]
livestream_watched video_recv_short_side_median_pixels additional.fields[video_recv_short_side_median_pixels]
livestream_watched video_send_bitrate_kbps_mean additional.fields[video_send_bitrate_kbps_mean]
livestream_watched video_send_fps_mean additional.fields[video_send_fps_mean]
livestream_watched video_send_long_side_median_pixels additional.fields[video_send_long_side_median_pixels]
livestream_watched video_send_packet_loss_max additional.fields[video_send_packet_loss_max]
livestream_watched video_send_packet_loss_mean additional.fields[video_send_packet_loss_mean]
livestream_watched video_send_seconds additional.fields[video_send_seconds]
livestream_watched video_send_short_side_median_pixels additional.fields[video_send_short_side_median_pixels]
livestream_watched target.application The target.application UDM field is set to Google Meet.
consented_to_third_party_media_app action_time additional.fields[action_time]
consented_to_third_party_media_app conference_id target.resource.product_object_id
consented_to_third_party_media_app display_name principal.user.user_display_name
consented_to_third_party_media_app identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
consented_to_third_party_media_app principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
consented_to_third_party_media_app is_companion additional.fields[is_companion]
consented_to_third_party_media_app is_external principal.user.attribute.labels[is_external]
consented_to_third_party_media_app is_external additional.fields[is_external]
consented_to_third_party_media_app meeting_code target.resource.attribute.labels[meeting_code]
consented_to_third_party_media_app third_party_media_app_initiator_email about.user.userid
consented_to_third_party_media_app target.application The target.application UDM field is set to Google Meet.
dialed_out action_time additional.fields[action_time]
dialed_out conference_id target.resource.product_object_id
dialed_out identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
dialed_out principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
dialed_out is_companion additional.fields[is_companion]
dialed_out is_external principal.user.attribute.labels[is_external]
dialed_out is_external additional.fields[is_external]
dialed_out meeting_code target.resource.attribute.labels[meeting_code]
dialed_out target_user_count target.user.attribute.labels[target_user_count]
dialed_out target.application The target.application UDM field is set to Google Meet.
send_chat_everyone action_time additional.fields[action_time]
send_chat_everyone conference_id target.resource.product_object_id
send_chat_everyone identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
send_chat_everyone principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
send_chat_everyone is_companion additional.fields[is_companion]
send_chat_everyone is_external principal.user.attribute.labels[is_external]
send_chat_everyone is_external additional.fields[is_external]
send_chat_everyone meeting_code target.resource.attribute.labels[meeting_code]
send_chat_everyone target.application The target.application UDM field is set to Google Meet.
hand_raised action_time additional.fields[action_time]
hand_raised conference_id target.resource.product_object_id
hand_raised identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
hand_raised principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
hand_raised is_companion additional.fields[is_companion]
hand_raised is_external principal.user.attribute.labels[is_external]
hand_raised is_external additional.fields[is_external]
hand_raised meeting_code target.resource.attribute.labels[meeting_code]
hand_raised target.application The target.application UDM field is set to Google Meet.
in_meet_broadcast_activity broadcast_state target.resource.attribute.labels[broadcast_state]
in_meet_broadcast_activity conference_id target.resource.product_object_id
in_meet_broadcast_activity is_external principal.user.attribute.labels[is_external]
in_meet_broadcast_activity target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
in_meet_broadcast_activity is_external additional.fields[is_external]
in_meet_broadcast_activity target.application The target.application UDM field is set to Google Meet.
see_chat_everyone action_time additional.fields[action_time]
see_chat_everyone conference_id target.resource.product_object_id
see_chat_everyone identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
see_chat_everyone principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
see_chat_everyone is_companion additional.fields[is_companion]
see_chat_everyone is_external principal.user.attribute.labels[is_external]
see_chat_everyone is_external additional.fields[is_external]
see_chat_everyone meeting_code target.resource.attribute.labels[meeting_code]
see_chat_everyone target.application The target.application UDM field is set to Google Meet.
see_chat_participants action_time additional.fields[action_time]
see_chat_participants conference_id target.resource.product_object_id
see_chat_participants identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
see_chat_participants principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
see_chat_participants is_companion additional.fields[is_companion]
see_chat_participants is_external principal.user.attribute.labels[is_external]
see_chat_participants is_external additional.fields[is_external]
see_chat_participants meeting_code target.resource.attribute.labels[meeting_code]
see_chat_participants target.application The target.application UDM field is set to Google Meet.
invitation_sent action_time additional.fields[action_time]
invitation_sent conference_id target.resource.product_object_id
invitation_sent identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
invitation_sent principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
invitation_sent is_companion additional.fields[is_companion]
invitation_sent is_external principal.user.attribute.labels[is_external]
invitation_sent is_external additional.fields[is_external]
invitation_sent meeting_code target.resource.attribute.labels[meeting_code]
invitation_sent target_user_count target.user.attribute.labels[target_user_count]
invitation_sent target.application The target.application UDM field is set to Google Meet.
knocking_accepted action_time additional.fields[action_time]
knocking_accepted conference_id target.resource.product_object_id
knocking_accepted identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
knocking_accepted principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
knocking_accepted is_companion additional.fields[is_companion]
knocking_accepted is_external principal.user.attribute.labels[is_external]
knocking_accepted is_external additional.fields[is_external]
knocking_accepted meeting_code target.resource.attribute.labels[meeting_code]
knocking_accepted target_user_count target.user.attribute.labels[target_user_count]
knocking_accepted target.application The target.application UDM field is set to Google Meet.
knocking_denied action_time additional.fields[action_time]
knocking_denied conference_id target.resource.product_object_id
knocking_denied identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
knocking_denied principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
knocking_denied is_companion additional.fields[is_companion]
knocking_denied is_external principal.user.attribute.labels[is_external]
knocking_denied is_external additional.fields[is_external]
knocking_denied meeting_code target.resource.attribute.labels[meeting_code]
knocking_denied target_user_count target.user.attribute.labels[target_user_count]
knocking_denied target.application The target.application UDM field is set to Google Meet.
send_chat_contributors action_time additional.fields[action_time]
send_chat_contributors conference_id target.resource.product_object_id
send_chat_contributors identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
send_chat_contributors principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
send_chat_contributors is_companion additional.fields[is_companion]
send_chat_contributors is_external principal.user.attribute.labels[is_external]
send_chat_contributors is_external additional.fields[is_external]
send_chat_contributors meeting_code target.resource.attribute.labels[meeting_code]
send_chat_contributors target.application The target.application UDM field is set to Google Meet.
send_chat_hosts action_time additional.fields[action_time]
send_chat_hosts conference_id target.resource.product_object_id
send_chat_hosts identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
send_chat_hosts principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
send_chat_hosts is_companion additional.fields[is_companion]
send_chat_hosts is_external principal.user.attribute.labels[is_external]
send_chat_hosts is_external additional.fields[is_external]
send_chat_hosts meeting_code target.resource.attribute.labels[meeting_code]
send_chat_hosts target.application The target.application UDM field is set to Google Meet.
poll_answered action_time additional.fields[action_time]
poll_answered conference_id target.resource.product_object_id
poll_answered identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
poll_answered principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
poll_answered is_companion additional.fields[is_companion]
poll_answered is_external principal.user.attribute.labels[is_external]
poll_answered is_external additional.fields[is_external]
poll_answered meeting_code target.resource.attribute.labels[meeting_code]
poll_answered target.application The target.application UDM field is set to Google Meet.
poll_created action_time additional.fields[action_time]
poll_created conference_id target.resource.product_object_id
poll_created identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
poll_created principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
poll_created is_companion additional.fields[is_companion]
poll_created is_external principal.user.attribute.labels[is_external]
poll_created is_external additional.fields[is_external]
poll_created meeting_code target.resource.attribute.labels[meeting_code]
poll_created target.application The target.application UDM field is set to Google Meet.
presentation_started action_time additional.fields[action_time]
presentation_started conference_id target.resource.product_object_id
presentation_started identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
presentation_started principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
presentation_started is_companion additional.fields[is_companion]
presentation_started is_external principal.user.attribute.labels[is_external]
presentation_started is_external additional.fields[is_external]
presentation_started meeting_code target.resource.attribute.labels[meeting_code]
presentation_started target.application The target.application UDM field is set to Google Meet.
presentation_stopped action_time additional.fields[action_time]
presentation_stopped conference_id target.resource.product_object_id
presentation_stopped identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
presentation_stopped principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
presentation_stopped is_companion additional.fields[is_companion]
presentation_stopped is_external principal.user.attribute.labels[is_external]
presentation_stopped is_external additional.fields[is_external]
presentation_stopped meeting_code target.resource.attribute.labels[meeting_code]
presentation_stopped target.application The target.application UDM field is set to Google Meet.
question_created action_time additional.fields[action_time]
question_created conference_id target.resource.product_object_id
question_created identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
question_created principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
question_created is_companion additional.fields[is_companion]
question_created is_external principal.user.attribute.labels[is_external]
question_created is_external additional.fields[is_external]
question_created meeting_code target.resource.attribute.labels[meeting_code]
question_created target.application The target.application UDM field is set to Google Meet.
question_responded action_time additional.fields[action_time]
question_responded conference_id target.resource.product_object_id
question_responded identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
question_responded principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
question_responded is_companion additional.fields[is_companion]
question_responded is_external principal.user.attribute.labels[is_external]
question_responded is_external additional.fields[is_external]
question_responded meeting_code target.resource.attribute.labels[meeting_code]
question_responded target.application The target.application UDM field is set to Google Meet.
recording_activity conference_id target.resource.product_object_id
recording_activity is_external principal.user.attribute.labels[is_external]
recording_activity is_external additional.fields[is_external]
recording_activity streaming_session_state target.resource.attribute.labels[streaming_session_state]
recording_activity target.application The target.application UDM field is set to Google Meet.
ring_answered action_time additional.fields[action_time]
ring_answered conference_id target.resource.product_object_id
ring_answered identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
ring_answered principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
ring_answered is_companion additional.fields[is_companion]
ring_answered is_external principal.user.attribute.labels[is_external]
ring_answered is_external additional.fields[is_external]
ring_answered meeting_code target.resource.attribute.labels[meeting_code]
ring_answered target_user_count target.user.attribute.labels[target_user_count]
ring_answered target.application The target.application UDM field is set to Google Meet.
ring_missed action_time additional.fields[action_time]
ring_missed conference_id target.resource.product_object_id
ring_missed identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
ring_missed principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
ring_missed is_companion additional.fields[is_companion]
ring_missed is_external principal.user.attribute.labels[is_external]
ring_missed is_external additional.fields[is_external]
ring_missed meeting_code target.resource.attribute.labels[meeting_code]
ring_missed target_user_count target.user.attribute.labels[target_user_count]
ring_missed target.application The target.application UDM field is set to Google Meet.
ring_sent action_time additional.fields[action_time]
ring_sent conference_id target.resource.product_object_id
ring_sent identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
ring_sent principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
ring_sent is_companion additional.fields[is_companion]
ring_sent is_external principal.user.attribute.labels[is_external]
ring_sent is_external additional.fields[is_external]
ring_sent meeting_code target.resource.attribute.labels[meeting_code]
ring_sent target_user_count target.user.attribute.labels[target_user_count]
ring_sent target.application The target.application UDM field is set to Google Meet.
room_check_in action_time additional.fields[action_time]
room_check_in conference_id target.resource.product_object_id
room_check_in identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
room_check_in principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
room_check_in is_companion additional.fields[is_companion]
room_check_in is_external principal.user.attribute.labels[is_external]
room_check_in is_external additional.fields[is_external]
room_check_in meeting_code target.resource.attribute.labels[meeting_code]
room_check_in target.application The target.application UDM field is set to Google Meet.
room_check_out action_time additional.fields[action_time]
room_check_out conference_id target.resource.product_object_id
room_check_out identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
room_check_out principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
room_check_out is_companion additional.fields[is_companion]
room_check_out is_external principal.user.attribute.labels[is_external]
room_check_out is_external additional.fields[is_external]
room_check_out meeting_code target.resource.attribute.labels[meeting_code]
room_check_out target.application The target.application UDM field is set to Google Meet.
speech_translation_disallowed action_reason security_result.summary
speech_translation_disallowed action_time additional.fields[action_time]
speech_translation_disallowed conference_id target.resource.product_object_id
speech_translation_disallowed identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
speech_translation_disallowed principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
speech_translation_disallowed is_companion additional.fields[is_companion]
speech_translation_disallowed is_external principal.user.attribute.labels[is_external]
speech_translation_disallowed is_external additional.fields[is_external]
speech_translation_disallowed meeting_code target.resource.attribute.labels[meeting_code]
speech_translation_disallowed target.application The target.application UDM field is set to Google Meet.
speech_translation_allowed action_time additional.fields[action_time]
speech_translation_allowed conference_id target.resource.product_object_id
speech_translation_allowed identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
speech_translation_allowed principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
speech_translation_allowed is_companion additional.fields[is_companion]
speech_translation_allowed is_external principal.user.attribute.labels[is_external]
speech_translation_allowed is_external additional.fields[is_external]
speech_translation_allowed meeting_code target.resource.attribute.labels[meeting_code]
speech_translation_allowed target.application The target.application UDM field is set to Google Meet.
smart_notes_session_started action_time additional.fields[action_time]
smart_notes_session_started conference_id target.resource.product_object_id
smart_notes_session_started identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
smart_notes_session_started principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
smart_notes_session_started is_companion additional.fields[is_companion]
smart_notes_session_started is_external principal.user.attribute.labels[is_external]
smart_notes_session_started is_external additional.fields[is_external]
smart_notes_session_started meeting_code target.resource.attribute.labels[meeting_code]
smart_notes_session_started streaming_session_start_reason additional.fields[streaming_session_start_reason]
smart_notes_session_started target.application The target.application UDM field is set to Google Meet.
smart_notes_session_stopped action_time additional.fields[action_time]
smart_notes_session_stopped conference_id target.resource.product_object_id
smart_notes_session_stopped identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
smart_notes_session_stopped principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
smart_notes_session_stopped is_companion additional.fields[is_companion]
smart_notes_session_stopped is_external principal.user.attribute.labels[is_external]
smart_notes_session_stopped is_external additional.fields[is_external]
smart_notes_session_stopped meeting_code target.resource.attribute.labels[meeting_code]
smart_notes_session_stopped target.application The target.application UDM field is set to Google Meet.
transcription_activity conference_id target.resource.product_object_id
transcription_activity identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
transcription_activity principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
transcription_activity is_external principal.user.attribute.labels[is_external]
transcription_activity is_external additional.fields[is_external]
transcription_activity streaming_session_start_reason additional.fields[streaming_session_start_reason]
transcription_activity streaming_session_state target.resource.attribute.labels[streaming_session_state]
transcription_activity target.application The target.application UDM field is set to Google Meet.
watermarking_active action_time additional.fields[action_time]
watermarking_active conference_id target.resource.product_object_id
watermarking_active identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
watermarking_active principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
watermarking_active is_companion additional.fields[is_companion]
watermarking_active is_external principal.user.attribute.labels[is_external]
watermarking_active is_external additional.fields[is_external]
watermarking_active meeting_code target.resource.attribute.labels[meeting_code]
watermarking_active target.application The target.application UDM field is set to Google Meet.
watermarking_starting action_time additional.fields[action_time]
watermarking_starting conference_id target.resource.product_object_id
watermarking_starting identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
watermarking_starting principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
watermarking_starting is_companion additional.fields[is_companion]
watermarking_starting is_external principal.user.attribute.labels[is_external]
watermarking_starting is_external additional.fields[is_external]
watermarking_starting meeting_code target.resource.attribute.labels[meeting_code]
watermarking_starting target.application The target.application UDM field is set to Google Meet.
watermarking_stopped action_time additional.fields[action_time]
watermarking_stopped conference_id target.resource.product_object_id
watermarking_stopped identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
watermarking_stopped principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
watermarking_stopped is_companion additional.fields[is_companion]
watermarking_stopped is_external principal.user.attribute.labels[is_external]
watermarking_stopped is_external additional.fields[is_external]
watermarking_stopped meeting_code target.resource.attribute.labels[meeting_code]
watermarking_stopped target.application The target.application UDM field is set to Google Meet.
whiteboard_started action_time additional.fields[action_time]
whiteboard_started conference_id target.resource.product_object_id
whiteboard_started identifier principal.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then identifier_type log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to identifier, then identifier log field value is set to the events.parameters.value log field value and the events.parameters.value log field is mapped to the principal.user.userid UDM field.
If the identifier_type log field value is equal to device_id, then the principal.asset_id UDM field is set to a value generated from the template AssetId:%{identifier}, where %{identifier} is replaced with the value of the identifier log field.
Else if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else if the identifier_type log field value is equal to email_address, then if the identifier log field value is not equal to the actor.email log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
whiteboard_started principal.asset.attribute.labels[identifier_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to identifier_type, then if the events.parameters.value log field value is equal to device_id, then the principal.asset.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.asset.attribute.labels.value UDM field. Otherwise, the principal.user.attribute.labels.key UDM field is set to identifier_type and the events.parameters.value log field is mapped to the principal.user.attribute.labels.value UDM field.
whiteboard_started is_companion additional.fields[is_companion]
whiteboard_started is_external principal.user.attribute.labels[is_external]
whiteboard_started is_external additional.fields[is_external]
whiteboard_started meeting_code target.resource.attribute.labels[meeting_code]
whiteboard_started target.application The target.application UDM field is set to Google Meet.

Field mapping reference: workspace activity token application

The following table provides the log fields to UDM field mapping corresponding to events for the token application.

Event Name Log field UDM mapping Logic
activity api_name target.resource.attribute.labels[api_name]
activity app_name target.application The target.application UDM field is set to OAuth Token.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to app_name, then the events.parameters.value log field is mapped to the target.application UDM field.
activity app_name target.resource.name
activity client_id target.resource.product_object_id
activity client_type target.resource.attribute.labels[client_type]
activity method_name target.resource.attribute.labels[method_name]
activity num_response_bytes network.received_bytes
activity product_bucket target.resource.attribute.labels[product_bucket]
authorize app_name target.application The target.application UDM field is set to OAuth Token.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to app_name, then the events.parameters.value log field is mapped to the target.application UDM field.
authorize app_name target.resource.name
authorize client_id target.resource.product_object_id
authorize client_type target.resource.attribute.labels[client_type]
authorize scope target.resource.attribute.labels[scope] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to scope, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the target.resource.attribute.labels.key UDM field is set to scope and the events.parameters.multiValue log field is mapped to the target.resource.attribute.labels.value UDM field. Otherwise, the target.resource.attribute.labels.key UDM field is set to scope and The target.resource.attribute.labels.value UDM field is set to a value generated from the template target.resource.attribute.labels[scope], %{events.parameters.multiValue}, where %{events.parameters.multiValue} is replaced with the value of the events.parameters.multiValue log field.
authorize scope_data target.resource.attribute.labels[scope_data] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to scope_data, then
Iterate through log field events.parameters.multiMsgValue:
iterate through log field events.parameters.multiMsgValue.parameter:
if the index1 log field value is equal to 0 and the index2 log field value is equal to 0, then the target.resource.attribute.labels.key UDM field is set to scope_data. If the events.parameters.multiMsgValue.parameter.name log field value is equal to scope_name, then the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{events.parameters.multiMsgValue.parameter.name} : %{events.parameters.multiMsgValue.parameter.value}, where %{events.parameters.multiMsgValue.parameter.name} and %{events.parameters.multiMsgValue.parameter.value} are replaced with the values of the events.parameters.multiMsgValue.parameter.name and events.parameters.multiMsgValue.parameter.value log fields. Else if the events.parameters.multiMsgValue.parameter.name log field value is equal to product_bucket, then the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{events.parameters.multiMsgValue.parameter.name} : %{events.parameters.multiMsgValue.parameter.multiValue}, where %{events.parameters.multiMsgValue.parameter.name} and %{events.parameters.multiMsgValue.parameter.multiValue} are replaced with the values of the events.parameters.multiMsgValue.parameter.name and events.parameters.multiMsgValue.parameter.multiValue log fields. Otherwise, the target.resource.attribute.labels.key UDM field is set to scope_data. If the events.parameters.multiMsgValue.parameter.name log field value is equal to scope_name, then the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[scope_data]}, %{events.parameters.multiMsgValue.parameter.name} : %{events.parameters.multiMsgValue.parameter.value}, where %{target.resource.attribute.labels[scope_data]}, %{events.parameters.multiMsgValue.parameter.name}, and %{events.parameters.multiMsgValue.parameter.value} are replaced with the values of the target.resource.attribute.labels[scope_data], events.parameters.multiMsgValue.parameter.name, and events.parameters.multiMsgValue.parameter.value log fields. Else if the events.parameters.multiMsgValue.parameter.name log field value is equal to product_bucket, then the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[scope_data]}, %{events.parameters.multiMsgValue.parameter.name} : %{events.parameters.multiMsgValue.parameter.multiValue}, where %{target.resource.attribute.labels[scope_data]}, %{events.parameters.multiMsgValue.parameter.name}, and %{events.parameters.multiMsgValue.parameter.multiValue} are replaced with the values of the target.resource.attribute.labels[scope_data], events.parameters.multiMsgValue.parameter.name, and events.parameters.multiMsgValue.parameter.multiValue log fields.
deny app_name target.application The target.application UDM field is set to OAuth Token.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to app_name, then the events.parameters.value log field is mapped to the target.application UDM field.
deny app_name target.resource.name
deny client_id target.resource.product_object_id
deny client_type target.resource.attribute.labels[client_type]
deny rejection_type target.resource.attribute.labels[rejection_type]
deny scope target.resource.attribute.labels[scope] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to scope, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the target.resource.attribute.labels.key UDM field is set to scope and the events.parameters.multiValue log field is mapped to the target.resource.attribute.labels.value UDM field. Otherwise, the target.resource.attribute.labels.key UDM field is set to scope and The target.resource.attribute.labels.value UDM field is set to a value generated from the template target.resource.attribute.labels[scope], %{events.parameters.multiValue}, where %{events.parameters.multiValue} is replaced with the value of the events.parameters.multiValue log field.
deny scope_data target.resource.attribute.labels[scope_data] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to scope_data, then
Iterate through log field events.parameters.multiMsgValue:
iterate through log field events.parameters.multiMsgValue.parameter:
if the index1 log field value is equal to 0 and the index2 log field value is equal to 0, then the target.resource.attribute.labels.key UDM field is set to scope_data. If the events.parameters.multiMsgValue.parameter.name log field value is equal to scope_name, then the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{events.parameters.multiMsgValue.parameter.name} : %{events.parameters.multiMsgValue.parameter.value}, where %{events.parameters.multiMsgValue.parameter.name} and %{events.parameters.multiMsgValue.parameter.value} are replaced with the values of the events.parameters.multiMsgValue.parameter.name and events.parameters.multiMsgValue.parameter.value log fields. Else if the events.parameters.multiMsgValue.parameter.name log field value is equal to product_bucket, then the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{events.parameters.multiMsgValue.parameter.name} : %{events.parameters.multiMsgValue.parameter.multiValue}, where %{events.parameters.multiMsgValue.parameter.name} and %{events.parameters.multiMsgValue.parameter.multiValue} are replaced with the values of the events.parameters.multiMsgValue.parameter.name and events.parameters.multiMsgValue.parameter.multiValue log fields. Otherwise, the target.resource.attribute.labels.key UDM field is set to scope_data. If the events.parameters.multiMsgValue.parameter.name log field value is equal to scope_name, then the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[scope_data]}, %{events.parameters.multiMsgValue.parameter.name} : %{events.parameters.multiMsgValue.parameter.value}, where %{target.resource.attribute.labels[scope_data]}, %{events.parameters.multiMsgValue.parameter.name}, and %{events.parameters.multiMsgValue.parameter.value} are replaced with the values of the target.resource.attribute.labels[scope_data], events.parameters.multiMsgValue.parameter.name, and events.parameters.multiMsgValue.parameter.value log fields. Else if the events.parameters.multiMsgValue.parameter.name log field value is equal to product_bucket, then the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[scope_data]}, %{events.parameters.multiMsgValue.parameter.name} : %{events.parameters.multiMsgValue.parameter.multiValue}, where %{target.resource.attribute.labels[scope_data]}, %{events.parameters.multiMsgValue.parameter.name}, and %{events.parameters.multiMsgValue.parameter.multiValue} are replaced with the values of the target.resource.attribute.labels[scope_data], events.parameters.multiMsgValue.parameter.name, and events.parameters.multiMsgValue.parameter.multiValue log fields.
request app_name target.application The target.application UDM field is set to OAuth Token.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to app_name, then the events.parameters.value log field is mapped to the target.application UDM field.
request app_name target.resource.name
request app_request_info additional.fields[app_request_info]
request client_id target.resource.product_object_id
request client_type target.resource.attribute.labels[client_type]
request requester_email principal.user.email_addresses
request scope target.resource.attribute.labels[scope] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to scope, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the target.resource.attribute.labels.key UDM field is set to scope and the events.parameters.multiValue log field is mapped to the target.resource.attribute.labels.value UDM field. Otherwise, the target.resource.attribute.labels.key UDM field is set to scope and The target.resource.attribute.labels.value UDM field is set to a value generated from the template target.resource.attribute.labels[scope], %{events.parameters.multiValue}, where %{events.parameters.multiValue} is replaced with the value of the events.parameters.multiValue log field.
request extensions.auth.type The extensions.auth.type UDM field is set to SSO.
request extensions.auth.mechanism The extensions.auth.mechanism UDM field is set to USERNAME_PASSWORD.
request scope_data target.resource.attribute.labels[scope_data] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to scope_data, then
Iterate through log field events.parameters.multiMsgValue:
iterate through log field events.parameters.multiMsgValue.parameter:
if the index1 log field value is equal to 0 and the index2 log field value is equal to 0, then the target.resource.attribute.labels.key UDM field is set to scope_data. If the events.parameters.multiMsgValue.parameter.name log field value is equal to scope_name, then the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{events.parameters.multiMsgValue.parameter.name} : %{events.parameters.multiMsgValue.parameter.value}, where %{events.parameters.multiMsgValue.parameter.name} and %{events.parameters.multiMsgValue.parameter.value} are replaced with the values of the events.parameters.multiMsgValue.parameter.name and events.parameters.multiMsgValue.parameter.value log fields. Else if the events.parameters.multiMsgValue.parameter.name log field value is equal to product_bucket, then the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{events.parameters.multiMsgValue.parameter.name} : %{events.parameters.multiMsgValue.parameter.multiValue}, where %{events.parameters.multiMsgValue.parameter.name} and %{events.parameters.multiMsgValue.parameter.multiValue} are replaced with the values of the events.parameters.multiMsgValue.parameter.name and events.parameters.multiMsgValue.parameter.multiValue log fields. Otherwise, the target.resource.attribute.labels.key UDM field is set to scope_data. If the events.parameters.multiMsgValue.parameter.name log field value is equal to scope_name, then the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[scope_data]}, %{events.parameters.multiMsgValue.parameter.name} : %{events.parameters.multiMsgValue.parameter.value}, where %{target.resource.attribute.labels[scope_data]}, %{events.parameters.multiMsgValue.parameter.name}, and %{events.parameters.multiMsgValue.parameter.value} are replaced with the values of the target.resource.attribute.labels[scope_data], events.parameters.multiMsgValue.parameter.name, and events.parameters.multiMsgValue.parameter.value log fields. Else if the events.parameters.multiMsgValue.parameter.name log field value is equal to product_bucket, then the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[scope_data]}, %{events.parameters.multiMsgValue.parameter.name} : %{events.parameters.multiMsgValue.parameter.multiValue}, where %{target.resource.attribute.labels[scope_data]}, %{events.parameters.multiMsgValue.parameter.name}, and %{events.parameters.multiMsgValue.parameter.multiValue} are replaced with the values of the target.resource.attribute.labels[scope_data], events.parameters.multiMsgValue.parameter.name, and events.parameters.multiMsgValue.parameter.multiValue log fields.
revoke app_name target.application The target.application UDM field is set to OAuth Token.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to app_name, then the events.parameters.value log field is mapped to the target.application UDM field.
revoke app_name target.resource.name
revoke client_id target.resource.product_object_id
revoke client_type target.resource.attribute.labels[client_type]
revoke scope target.resource.attribute.labels[scope] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to scope, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the target.resource.attribute.labels.key UDM field is set to scope and the events.parameters.multiValue log field is mapped to the target.resource.attribute.labels.value UDM field. Otherwise, the target.resource.attribute.labels.key UDM field is set to scope and The target.resource.attribute.labels.value UDM field is set to a value generated from the template target.resource.attribute.labels[scope], %{events.parameters.multiValue}, where %{events.parameters.multiValue} is replaced with the value of the events.parameters.multiValue log field.
revoke scope_data target.resource.attribute.labels[scope_data] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to scope_data, then
Iterate through log field events.parameters.multiMsgValue:
iterate through log field events.parameters.multiMsgValue.parameter:
if the index1 log field value is equal to 0 and the index2 log field value is equal to 0, then the target.resource.attribute.labels.key UDM field is set to scope_data. If the events.parameters.multiMsgValue.parameter.name log field value is equal to scope_name, then the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{events.parameters.multiMsgValue.parameter.name} : %{events.parameters.multiMsgValue.parameter.value}, where %{events.parameters.multiMsgValue.parameter.name} and %{events.parameters.multiMsgValue.parameter.value} are replaced with the values of the events.parameters.multiMsgValue.parameter.name and events.parameters.multiMsgValue.parameter.value log fields. Else if the events.parameters.multiMsgValue.parameter.name log field value is equal to product_bucket, then the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{events.parameters.multiMsgValue.parameter.name} : %{events.parameters.multiMsgValue.parameter.multiValue}, where %{events.parameters.multiMsgValue.parameter.name} and %{events.parameters.multiMsgValue.parameter.multiValue} are replaced with the values of the events.parameters.multiMsgValue.parameter.name and events.parameters.multiMsgValue.parameter.multiValue log fields. Otherwise, the target.resource.attribute.labels.key UDM field is set to scope_data. If the events.parameters.multiMsgValue.parameter.name log field value is equal to scope_name, then the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[scope_data]}, %{events.parameters.multiMsgValue.parameter.name} : %{events.parameters.multiMsgValue.parameter.value}, where %{target.resource.attribute.labels[scope_data]}, %{events.parameters.multiMsgValue.parameter.name}, and %{events.parameters.multiMsgValue.parameter.value} are replaced with the values of the target.resource.attribute.labels[scope_data], events.parameters.multiMsgValue.parameter.name, and events.parameters.multiMsgValue.parameter.value log fields. Else if the events.parameters.multiMsgValue.parameter.name log field value is equal to product_bucket, then the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[scope_data]}, %{events.parameters.multiMsgValue.parameter.name} : %{events.parameters.multiMsgValue.parameter.multiValue}, where %{target.resource.attribute.labels[scope_data]}, %{events.parameters.multiMsgValue.parameter.name}, and %{events.parameters.multiMsgValue.parameter.multiValue} are replaced with the values of the target.resource.attribute.labels[scope_data], events.parameters.multiMsgValue.parameter.name, and events.parameters.multiMsgValue.parameter.multiValue log fields.

Field mapping reference: workspace activity rules application

The following table provides the log fields to UDM field mapping corresponding to events for the rules application.

Event Name Log field UDM mapping Logic
action_complete access_level security_result.detection_fields[access_level]
action_complete actor_ip_address principal.ip
action_complete actor_ip_address principal.asset.ip
action_complete conference_id target.resource.attribute.labels[conference_id]
action_complete data_source target.application The target.application UDM field is set to Rules.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to data_source, then the events.parameters.value log field is mapped to the target.application UDM field.
action_complete device_id target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to device_id, then The target.asset_id UDM field is set to a value generated from the template Asset ID: %{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
action_complete device_type target.asset.attribute.labels[device_type]
action_complete evaluation_context additional.fields[evaluation_context]
action_complete has_alert additional.fields[has_alert]
action_complete matched_detectors security_result.detection_fields[matched_detectors] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to matched_detectors, then
Iterate through log field events.parameters.multiMessageValue:
iterate through log field events.parameters.multiMessageValue.parameter:
if the index2 log field value is equal to 0, then the security_result.detection_fields.key UDM field is set to matched_detectors and the security_result.detection_fields.value UDM field is set to a value generated from the template %{events.parameters.multiMessageValue.parameter.name} : %{events.parameters.multiMessageValue.parameter.value}, where %{events.parameters.multiMessageValue.parameter.name} and %{events.parameters.multiMessageValue.parameter.value} are replaced with the values of the events.parameters.multiMessageValue.parameter.name and events.parameters.multiMessageValue.parameter.value log fields. Otherwise, the security_result.detection_fields.key UDM field is set to matched_detectors and the security_result.detection_fields.value UDM field is set to a value generated from the template %{security_result.detection_fields[matched_detectors]}, %{events.parameters.multiMessageValue.parameter.name} : %{events.parameters.multiMessageValue.parameter.value}, where %{security_result.detection_fields[matched_detectors]}, %{events.parameters.multiMessageValue.parameter.name}, and %{events.parameters.multiMessageValue.parameter.value} are replaced with the values of the security_result.detection_fields[matched_detectors], events.parameters.multiMessageValue.parameter.name, and events.parameters.multiMessageValue.parameter.value log fields.
action_complete matched_threshold security_result.detection_fields[matched_threshold]
action_complete matched_trigger security_result.detection_fields[matched_trigger]
action_complete resource_id target.resource.product_object_id
action_complete resource_owner_email about.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to resource_owner_email, then if the events.parameters.value log field value matches the regular expression pattern: ^.+@.+$, then the events.parameters.value log field is mapped to the about.user.email_addresses UDM field.
action_complete resource_recipients target.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to resource_recipients, then
Iterate through log field events.parameters.multiValue:
if the events.parameters.multiValue log field value matches the regular expression pattern: ^.+@.+$, then the events.parameters.multiValue log field is mapped to the target.user.email_addresses UDM field. Otherwise, the target.user.attribute.labels.key UDM field is set to resource_recipients and the events.parameters.multiValue log field is mapped to the target.user.attribute.labels.value UDM field.
action_complete resource_recipients_omitted_count additional.fields[resource_recipients_omitted_count]
action_complete resource_title target.resource.name
action_complete resource_type target.resource.resource_subtype
action_complete rule_name security_result.rule_name
action_complete rule_resource_name security_result.rule_labels[rule_resource_name]
action_complete rule_type security_result.rule_type
action_complete scan_type additional.fields[scan_type]
action_complete severity security_result.severity
action_complete snippets target.resource.attribute.labels[snippets] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to snippets, then
Iterate through log field events.parameters.multiMsgValue:
iterate through log field events.parameters.multiMsgValue.parameter:
if the index2 log field value is equal to 0, then the target.resource.attribute.labels.key UDM field is set to snippets and the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{events.parameters.multiMsgValue.parameter.name} : %{events.parameters.multiMsgValue.parameter.value}, where %{events.parameters.multiMsgValue.parameter.name} and %{events.parameters.multiMsgValue.parameter.value} are replaced with the values of the events.parameters.multiMsgValue.parameter.name and events.parameters.multiMsgValue.parameter.value log fields and the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{events.parameters.multiMsgValue.parameter.name} : %{events.parameters.multiMsgValue.parameter.intValue}, where %{events.parameters.multiMsgValue.parameter.name} and %{events.parameters.multiMsgValue.parameter.intValue} are replaced with the values of the events.parameters.multiMsgValue.parameter.name and events.parameters.multiMsgValue.parameter.intValue log fields. Otherwise, the target.resource.attribute.labels.key UDM field is set to snippets and the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[snippets]}, %{events.parameters.multiMsgValue.parameter.name} : %{events.parameters.multiMsgValue.parameter.value}, where %{target.resource.attribute.labels[snippets]}, %{events.parameters.multiMsgValue.parameter.name}, and %{events.parameters.multiMsgValue.parameter.value} are replaced with the values of the target.resource.attribute.labels[snippets], events.parameters.multiMsgValue.parameter.name, and events.parameters.multiMsgValue.parameter.value log fields and the target.resource.attribute.labels.value UDM field is set to a value generated from the template %{target.resource.attribute.labels[snippets]}, %{events.parameters.multiMsgValue.parameter.name} : %{events.parameters.multiMsgValue.parameter.intValue}, where %{target.resource.attribute.labels[snippets]}, %{events.parameters.multiMsgValue.parameter.name}, and %{events.parameters.multiMsgValue.parameter.intValue} are replaced with the values of the target.resource.attribute.labels[snippets], events.parameters.multiMsgValue.parameter.name, and events.parameters.multiMsgValue.parameter.intValue log fields.
action_complete space_id target.resource.attribute.labels[space_id]
action_complete space_type target.resource.attribute.labels[space_type]
action_complete suppressed_actions security_result.action_details
action_complete triggered_actions security_result.action_details Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to triggered_actions, then
Iterate through log field events.parameters.multiMessageValue:
iterate through log field events.parameters.multiMessageValue.parameter:
if the events.parameters.multiMessageValue.parameter.name log field value is equal to action_type, then the security_result.action_details UDM field is set to a value generated from the template %{events.parameters.multiMessageValue.parameter.name} : %{events.parameters.multiMessageValue.parameter.value}, where %{events.parameters.multiMessageValue.parameter.name} and %{events.parameters.multiMessageValue.parameter.value} are replaced with the values of the events.parameters.multiMessageValue.parameter.name and events.parameters.multiMessageValue.parameter.value log fields.
label_applied actor_ip_address principal.ip
label_applied actor_ip_address principal.asset.ip
label_applied conference_id target.resource.attribute.labels[conference_id]
label_applied data_source target.application The target.application UDM field is set to Rules.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to data_source, then the events.parameters.value log field is mapped to the target.application UDM field.
label_applied device_id target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to device_id, then The target.asset_id UDM field is set to a value generated from the template Asset ID: %{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
label_applied device_type target.asset.attribute.labels[device_type]
label_applied evaluation_context additional.fields[evaluation_context]
label_applied has_alert additional.fields[has_alert]
label_applied label_title additional.fields[label_title]
label_applied matched_detectors security_result.detection_fields[matched_detectors] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to matched_detectors, then
Iterate through log field events.parameters.multiMessageValue:
iterate through log field events.parameters.multiMessageValue.parameter:
if the index2 log field value is equal to 0, then the security_result.detection_fields.key UDM field is set to matched_detectors and the security_result.detection_fields.value UDM field is set to a value generated from the template %{events.parameters.multiMessageValue.parameter.name} : %{events.parameters.multiMessageValue.parameter.value}, where %{events.parameters.multiMessageValue.parameter.name} and %{events.parameters.multiMessageValue.parameter.value} are replaced with the values of the events.parameters.multiMessageValue.parameter.name and events.parameters.multiMessageValue.parameter.value log fields. Otherwise, the security_result.detection_fields.key UDM field is set to matched_detectors and the security_result.detection_fields.value UDM field is set to a value generated from the template %{security_result.detection_fields[matched_detectors]}, %{events.parameters.multiMessageValue.parameter.name} : %{events.parameters.multiMessageValue.parameter.value}, where %{security_result.detection_fields[matched_detectors]}, %{events.parameters.multiMessageValue.parameter.name}, and %{events.parameters.multiMessageValue.parameter.value} are replaced with the values of the security_result.detection_fields[matched_detectors], events.parameters.multiMessageValue.parameter.name, and events.parameters.multiMessageValue.parameter.value log fields.
label_applied matched_threshold security_result.detection_fields[matched_threshold]
label_applied matched_trigger security_result.detection_fields[matched_trigger]
label_applied resource_id target.resource.product_object_id
label_applied resource_owner_email about.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to resource_owner_email, then if the events.parameters.value log field value matches the regular expression pattern: ^.+@.+$, then the events.parameters.value log field is mapped to the about.user.email_addresses UDM field.
label_applied resource_recipients target.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to resource_recipients, then
Iterate through log field events.parameters.multiValue:
if the events.parameters.multiValue log field value matches the regular expression pattern: ^.+@.+$, then the events.parameters.multiValue log field is mapped to the target.user.email_addresses UDM field. Otherwise, the target.user.attribute.labels.key UDM field is set to resource_recipients and the events.parameters.multiValue log field is mapped to the target.user.attribute.labels.value UDM field.
label_applied resource_recipients_omitted_count additional.fields[resource_recipients_omitted_count]
label_applied resource_title target.resource.name
label_applied resource_type target.resource.resource_subtype
label_applied rule_name security_result.rule_name
label_applied rule_resource_name security_result.rule_labels[rule_resource_name]
label_applied rule_type security_result.rule_type
label_applied scan_type additional.fields[scan_type]
label_applied severity security_result.severity
label_applied space_id target.resource.attribute.labels[space_id]
label_applied space_type target.resource.attribute.labels[space_type]
label_applied suppressed_actions security_result.action_details
label_applied triggered_actions security_result.action_details Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to triggered_actions, then
Iterate through log field events.parameters.multiMessageValue:
iterate through log field events.parameters.multiMessageValue.parameter:
if the events.parameters.multiMessageValue.parameter.name log field value is equal to action_type, then the security_result.action_details UDM field is set to a value generated from the template %{events.parameters.multiMessageValue.parameter.name} : %{events.parameters.multiMessageValue.parameter.value}, where %{events.parameters.multiMessageValue.parameter.name} and %{events.parameters.multiMessageValue.parameter.value} are replaced with the values of the events.parameters.multiMessageValue.parameter.name and events.parameters.multiMessageValue.parameter.value log fields.
label_field_value_changed actor_ip_address principal.ip
label_field_value_changed actor_ip_address principal.asset.ip
label_field_value_changed conference_id target.resource.attribute.labels[conference_id]
label_field_value_changed data_source target.application The target.application UDM field is set to Rules.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to data_source, then the events.parameters.value log field is mapped to the target.application UDM field.
label_field_value_changed device_id target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to device_id, then The target.asset_id UDM field is set to a value generated from the template Asset ID: %{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
label_field_value_changed device_type target.asset.attribute.labels[device_type]
label_field_value_changed evaluation_context additional.fields[evaluation_context]
label_field_value_changed has_alert additional.fields[has_alert]
label_field_value_changed label_field additional.fields[label_field]
label_field_value_changed label_title additional.fields[label_title]
label_field_value_changed matched_detectors security_result.detection_fields[matched_detectors] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to matched_detectors, then
Iterate through log field events.parameters.multiMessageValue:
iterate through log field events.parameters.multiMessageValue.parameter:
if the index2 log field value is equal to 0, then the security_result.detection_fields.key UDM field is set to matched_detectors and the security_result.detection_fields.value UDM field is set to a value generated from the template %{events.parameters.multiMessageValue.parameter.name} : %{events.parameters.multiMessageValue.parameter.value}, where %{events.parameters.multiMessageValue.parameter.name} and %{events.parameters.multiMessageValue.parameter.value} are replaced with the values of the events.parameters.multiMessageValue.parameter.name and events.parameters.multiMessageValue.parameter.value log fields. Otherwise, the security_result.detection_fields.key UDM field is set to matched_detectors and the security_result.detection_fields.value UDM field is set to a value generated from the template %{security_result.detection_fields[matched_detectors]}, %{events.parameters.multiMessageValue.parameter.name} : %{events.parameters.multiMessageValue.parameter.value}, where %{security_result.detection_fields[matched_detectors]}, %{events.parameters.multiMessageValue.parameter.name}, and %{events.parameters.multiMessageValue.parameter.value} are replaced with the values of the security_result.detection_fields[matched_detectors], events.parameters.multiMessageValue.parameter.name, and events.parameters.multiMessageValue.parameter.value log fields.
label_field_value_changed matched_threshold security_result.detection_fields[matched_threshold]
label_field_value_changed matched_trigger security_result.detection_fields[matched_trigger]
label_field_value_changed new_value additional.fields[new_value]
label_field_value_changed old_value additional.fields[old_value]
label_field_value_changed resource_id target.resource.product_object_id
label_field_value_changed resource_owner_email about.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to resource_owner_email, then if the events.parameters.value log field value matches the regular expression pattern: ^.+@.+$, then the events.parameters.value log field is mapped to the about.user.email_addresses UDM field.
label_field_value_changed resource_recipients target.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to resource_recipients, then
Iterate through log field events.parameters.multiValue:
if the events.parameters.multiValue log field value matches the regular expression pattern: ^.+@.+$, then the events.parameters.multiValue log field is mapped to the target.user.email_addresses UDM field. Otherwise, the target.user.attribute.labels.key UDM field is set to resource_recipients and the events.parameters.multiValue log field is mapped to the target.user.attribute.labels.value UDM field.
label_field_value_changed resource_recipients_omitted_count additional.fields[resource_recipients_omitted_count]
label_field_value_changed resource_title target.resource.name
label_field_value_changed resource_type target.resource.resource_subtype
label_field_value_changed rule_name security_result.rule_name
label_field_value_changed rule_resource_name security_result.rule_labels[rule_resource_name]
label_field_value_changed rule_type security_result.rule_type
label_field_value_changed scan_type additional.fields[scan_type]
label_field_value_changed severity security_result.severity
label_field_value_changed space_id target.resource.attribute.labels[space_id]
label_field_value_changed space_type target.resource.attribute.labels[space_type]
label_field_value_changed suppressed_actions security_result.action_details
label_field_value_changed triggered_actions security_result.action_details Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to triggered_actions, then
Iterate through log field events.parameters.multiMessageValue:
iterate through log field events.parameters.multiMessageValue.parameter:
if the events.parameters.multiMessageValue.parameter.name log field value is equal to action_type, then the security_result.action_details UDM field is set to a value generated from the template %{events.parameters.multiMessageValue.parameter.name} : %{events.parameters.multiMessageValue.parameter.value}, where %{events.parameters.multiMessageValue.parameter.name} and %{events.parameters.multiMessageValue.parameter.value} are replaced with the values of the events.parameters.multiMessageValue.parameter.name and events.parameters.multiMessageValue.parameter.value log fields.
label_removed actor_ip_address principal.ip
label_removed actor_ip_address principal.asset.ip
label_removed conference_id target.resource.attribute.labels[conference_id]
label_removed data_source target.application The target.application UDM field is set to Rules.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to data_source, then the events.parameters.value log field is mapped to the target.application UDM field.
label_removed device_id target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to device_id, then The target.asset_id UDM field is set to a value generated from the template Asset ID: %{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
label_removed device_type target.asset.attribute.labels[device_type]
label_removed evaluation_context additional.fields[evaluation_context]
label_removed has_alert additional.fields[has_alert]
label_removed label_title additional.fields[label_title]
label_removed matched_detectors security_result.detection_fields[matched_detectors] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to matched_detectors, then
Iterate through log field events.parameters.multiMessageValue:
iterate through log field events.parameters.multiMessageValue.parameter:
if the index2 log field value is equal to 0, then the security_result.detection_fields.key UDM field is set to matched_detectors and the security_result.detection_fields.value UDM field is set to a value generated from the template %{events.parameters.multiMessageValue.parameter.name} : %{events.parameters.multiMessageValue.parameter.value}, where %{events.parameters.multiMessageValue.parameter.name} and %{events.parameters.multiMessageValue.parameter.value} are replaced with the values of the events.parameters.multiMessageValue.parameter.name and events.parameters.multiMessageValue.parameter.value log fields. Otherwise, the security_result.detection_fields.key UDM field is set to matched_detectors and the security_result.detection_fields.value UDM field is set to a value generated from the template %{security_result.detection_fields[matched_detectors]}, %{events.parameters.multiMessageValue.parameter.name} : %{events.parameters.multiMessageValue.parameter.value}, where %{security_result.detection_fields[matched_detectors]}, %{events.parameters.multiMessageValue.parameter.name}, and %{events.parameters.multiMessageValue.parameter.value} are replaced with the values of the security_result.detection_fields[matched_detectors], events.parameters.multiMessageValue.parameter.name, and events.parameters.multiMessageValue.parameter.value log fields.
label_removed matched_threshold security_result.detection_fields[matched_threshold]
label_removed matched_trigger security_result.detection_fields[matched_trigger]
label_removed resource_id target.resource.product_object_id
label_removed resource_owner_email about.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to resource_owner_email, then if the events.parameters.value log field value matches the regular expression pattern: ^.+@.+$, then the events.parameters.value log field is mapped to the about.user.email_addresses UDM field.
label_removed resource_recipients target.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to resource_recipients, then
Iterate through log field events.parameters.multiValue:
if the events.parameters.multiValue log field value matches the regular expression pattern: ^.+@.+$, then the events.parameters.multiValue log field is mapped to the target.user.email_addresses UDM field. Otherwise, the target.user.attribute.labels.key UDM field is set to resource_recipients and the events.parameters.multiValue log field is mapped to the target.user.attribute.labels.value UDM field.
label_removed resource_recipients_omitted_count additional.fields[resource_recipients_omitted_count]
label_removed resource_title target.resource.name
label_removed resource_type target.resource.resource_subtype
label_removed rule_name security_result.rule_name
label_removed rule_resource_name security_result.rule_labels[rule_resource_name]
label_removed rule_type security_result.rule_type
label_removed scan_type additional.fields[scan_type]
label_removed severity security_result.severity
label_removed space_id target.resource.attribute.labels[space_id]
label_removed space_type target.resource.attribute.labels[space_type]
label_removed suppressed_actions security_result.action_details
label_removed triggered_actions security_result.action_details Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to triggered_actions, then
Iterate through log field events.parameters.multiMessageValue:
iterate through log field events.parameters.multiMessageValue.parameter:
if the events.parameters.multiMessageValue.parameter.name log field value is equal to action_type, then the security_result.action_details UDM field is set to a value generated from the template %{events.parameters.multiMessageValue.parameter.name} : %{events.parameters.multiMessageValue.parameter.value}, where %{events.parameters.multiMessageValue.parameter.name} and %{events.parameters.multiMessageValue.parameter.value} are replaced with the values of the events.parameters.multiMessageValue.parameter.name and events.parameters.multiMessageValue.parameter.value log fields.
rule_match actions security_result.action_details
rule_match application target.application The target.application UDM field is set to Rules.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to application, then the events.parameters.value log field is mapped to the target.application UDM field.
rule_match drive_shared_drive_id target.resource.attribute.labels[drive_shared_drive_id]
rule_match has_content_match additional.fields[has_content_match]
rule_match matched_templates security_result.detection_fields[matched_templates]
rule_match mobile_device_type target.asset.attribute.labels[mobile_device_type]
rule_match mobile_ios_vendor_id target.asset.attribute.labels[mobile_ios_vendor_id]
rule_match resource_id target.resource.product_object_id
rule_match resource_name target.resource.name
rule_match resource_owner_email about.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to resource_owner_email, then if the events.parameters.value log field value matches the regular expression pattern: ^.+@.+$, then the events.parameters.value log field is mapped to the about.user.email_addresses UDM field.
rule_match rule_id security_result.rule_id
rule_match rule_name security_result.rule_name
rule_match rule_update_time_usec security_result.rule_labels[rule_update_time_usec]
rule_trigger data_source target.application The target.application UDM field is set to Rules.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to data_source, then the events.parameters.value log field is mapped to the target.application UDM field.
rule_trigger matched_threshold security_result.detection_fields[matched_threshold]
rule_trigger matched_trigger security_result.detection_fields[matched_trigger]
rule_trigger rule_name security_result.rule_name
rule_trigger rule_resource_name security_result.rule_labels[rule_resource_name]
rule_trigger rule_type security_result.rule_type
rule_trigger severity security_result.severity
rule_trigger triggered_actions security_result.action_details Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to triggered_actions, then
Iterate through log field events.parameters.multiMessageValue:
iterate through log field events.parameters.multiMessageValue.parameter:
if the events.parameters.multiMessageValue.parameter.name log field value is equal to action_type, then the security_result.action_details UDM field is set to a value generated from the template %{events.parameters.multiMessageValue.parameter.name} : %{events.parameters.multiMessageValue.parameter.value}, where %{events.parameters.multiMessageValue.parameter.name} and %{events.parameters.multiMessageValue.parameter.value} are replaced with the values of the events.parameters.multiMessageValue.parameter.name and events.parameters.multiMessageValue.parameter.value log fields.

Field mapping reference: workspace activity saml application

The following table provides the log fields to UDM field mapping corresponding to events for the saml application.

Event Name Log field UDM mapping Logic
login_failure application_name target.application The target.application UDM field is set to SAML.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to application_name, then the events.parameters.value log field is mapped to the target.application UDM field.
login_failure device_id principal.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to device_id, then The principal.asset_id UDM field is set to a value generated from the template AssetId:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
login_failure failure_type security_result.summary
login_failure initiated_by security_result.detection_fields[initiated_by]
login_failure orgunit_path target.user.attribute.labels[orgunit_path]
login_failure saml_second_level_status_code additional.fields[saml_second_level_status_code]
login_failure security_result.action The security_result.action UDM field is set to FAIL.
login_failure extensions.auth.mechanism The extensions.auth.mechanism UDM field is set to REMOTE.
login_failure saml_status_code additional.fields[saml_status_code]
login_success application_name target.application The target.application UDM field is set to SAML.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to application_name, then the events.parameters.value log field is mapped to the target.application UDM field.
login_success device_id principal.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to device_id, then The principal.asset_id UDM field is set to a value generated from the template AssetId:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
login_success initiated_by security_result.detection_fields[initiated_by]
login_success orgunit_path target.user.attribute.labels[orgunit_path]
login_success security_result.action The security_result.action UDM field is set to ALLOW.
login_success extensions.auth.mechanism The extensions.auth.mechanism UDM field is set to REMOTE.
login_success saml_status_code additional.fields[saml_status_code]

Field mapping reference: workspace activity login application

The following table provides the log fields to UDM field mapping corresponding to events for the login application.

Event Name Log field UDM mapping Logic
account_disabled_password_leak affected_email_address target.user.email_addresses
account_disabled_password_leak security_result.action The security_result.action UDM field is set to ALLOW.
account_disabled_password_leak target.application The target.application UDM field is set to Login.
account_disabled_password_leak extensions.auth.type The extensions.auth.type UDM field is set to SSO.
suspicious_login affected_email_address target.user.email_addresses
suspicious_login security_result.action The security_result.action UDM field is set to ALLOW.
suspicious_login security_result.detection_fields[login_timestamp] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to login_timestamp, then if the id.time log field value is empty, then the events.parameters.intValue log field is mapped to the metadata.event_timestamp UDM field. Otherwise, the security_result.detection_fields.key UDM field is set to login_timestamp and the events.parameters.intValue log field is mapped to the security_result.detection_fields.value UDM field.
suspicious_login target.application The target.application UDM field is set to Login.
suspicious_login extensions.auth.type The extensions.auth.type UDM field is set to SSO.
suspicious_login_less_secure_app affected_email_address target.user.email_addresses
suspicious_login_less_secure_app security_result.action The security_result.action UDM field is set to ALLOW.
suspicious_login_less_secure_app login_timestamp security_result.detection_fields[login_timestamp] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to login_timestamp, then if the id.time log field value is empty, then the events.parameters.intValue log field is mapped to the metadata.event_timestamp UDM field. Otherwise, the security_result.detection_fields.key UDM field is set to login_timestamp and the events.parameters.intValue log field is mapped to the security_result.detection_fields.value UDM field.
suspicious_login_less_secure_app target.application The target.application UDM field is set to Login.
suspicious_login_less_secure_app extensions.auth.type The extensions.auth.type UDM field is set to SSO.
suspicious_programmatic_login affected_email_address target.user.email_addresses
suspicious_programmatic_login security_result.action The security_result.action UDM field is set to ALLOW.
suspicious_programmatic_login login_timestamp security_result.detection_fields[login_timestamp] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to login_timestamp, then if the id.time log field value is empty, then the events.parameters.intValue log field is mapped to the metadata.event_timestamp UDM field. Otherwise, the security_result.detection_fields.key UDM field is set to login_timestamp and the events.parameters.intValue log field is mapped to the security_result.detection_fields.value UDM field.
suspicious_programmatic_login target.application The target.application UDM field is set to Login.
suspicious_programmatic_login extensions.auth.type The extensions.auth.type UDM field is set to SSO.
user_signed_out_due_to_suspicious_session_cookie security_result.action The security_result.action UDM field is set to ALLOW.
user_signed_out_due_to_suspicious_session_cookie affected_email_address target.user.email_addresses
user_signed_out_due_to_suspicious_session_cookie target.application The target.application UDM field is set to Login.
user_signed_out_due_to_suspicious_session_cookie extensions.auth.type The extensions.auth.type UDM field is set to SSO.
account_disabled_generic affected_email_address target.user.email_addresses
account_disabled_generic security_result.action The security_result.action UDM field is set to ALLOW.
account_disabled_generic target.application The target.application UDM field is set to Login.
account_disabled_generic extensions.auth.type The extensions.auth.type UDM field is set to SSO.
account_disabled_spamming_through_relay security_result.action The security_result.action UDM field is set to ALLOW.
account_disabled_spamming_through_relay affected_email_address target.user.email_addresses
account_disabled_spamming_through_relay target.application The target.application UDM field is set to Login.
account_disabled_spamming_through_relay extensions.auth.type The extensions.auth.type UDM field is set to SSO.
account_disabled_spamming security_result.action The security_result.action UDM field is set to ALLOW.
account_disabled_spamming affected_email_address target.user.email_addresses
account_disabled_spamming target.application The target.application UDM field is set to Login.
account_disabled_spamming extensions.auth.type The extensions.auth.type UDM field is set to SSO.
account_disabled_hijacked affected_email_address target.user.email_addresses
account_disabled_hijacked security_result.action The security_result.action UDM field is set to ALLOW.
account_disabled_hijacked login_timestamp security_result.detection_fields[login_timestamp] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to login_timestamp, then if the id.time log field value is empty, then the events.parameters.intValue log field is mapped to the metadata.event_timestamp UDM field. Otherwise, the security_result.detection_fields.key UDM field is set to login_timestamp and the events.parameters.intValue log field is mapped to the security_result.detection_fields.value UDM field.
account_disabled_hijacked target.application The target.application UDM field is set to Login.
account_disabled_hijacked extensions.auth.type The extensions.auth.type UDM field is set to SSO.
login_failure login_challenge_method security_result.detection_fields[login_challenge_method_attempts_count] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to login_challenge_method, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the security_result.detection_fields.key UDM field is set to login_challenge_method and the events.parameters.multiValue log field is mapped to the security_result.detection_fields.value UDM field. Otherwise, The security_result.detection_fields.key UDM field is set to login_challenge_method and the security_result.detection_fields.value UDM field is set to a value generated from the template %{security_result.detection_fields[login_challenge_method]}, %{events.parameters.multiValue}, where %{security_result.detection_fields[login_challenge_method]} and %{events.parameters.multiValue} are replaced with the values of the security_result.detection_fields[login_challenge_method] and events.parameters.multiValue log fields.
login_failure extensions.auth.mechanism Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to login_challenge_method, then
Iterate through log field events.parameters.multiValue:
if the events.parameters.multiValue log field value is equal to password, then the extensions.auth.mechanism UDM field is set to USERNAME_PASSWORD. Else if the events.parameters.multiValue log field value is equal to security_key_otp, then the extensions.auth.mechanism UDM field is set to OTP.
login_failure login_failure_type security_result.summary
login_failure security_result.action The security_result.action UDM field is set to FAIL.
login_failure login_type security_result.detection_fields[login_type]
login_failure target.application The target.application UDM field is set to Login.
login_failure extensions.auth.type The extensions.auth.type UDM field is set to SSO.
login_challenge login_challenge_method security_result.detection_fields[login_challenge_method_attempts_count] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to login_challenge_method, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the security_result.detection_fields.key UDM field is set to login_challenge_method and the events.parameters.multiValue log field is mapped to the security_result.detection_fields.value UDM field. Otherwise, The security_result.detection_fields.key UDM field is set to login_challenge_method and the security_result.detection_fields.value UDM field is set to a value generated from the template %{security_result.detection_fields[login_challenge_method]}, %{events.parameters.multiValue}, where %{security_result.detection_fields[login_challenge_method]} and %{events.parameters.multiValue} are replaced with the values of the security_result.detection_fields[login_challenge_method] and events.parameters.multiValue log fields.
login_challenge extensions.auth.mechanism Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to login_challenge_method, then
Iterate through log field events.parameters.multiValue:
if the events.parameters.multiValue log field value is equal to password, then the extensions.auth.mechanism UDM field is set to USERNAME_PASSWORD. Else if the events.parameters.multiValue log field value is equal to security_key_otp, then the extensions.auth.mechanism UDM field is set to OTP.
login_challenge login_challenge_status additional.fields[login_challenge_status]
login_challenge security_result.action The security_result.action UDM field is set to ALLOW.
login_challenge login_type security_result.detection_fields[login_type]
login_challenge target.application The target.application UDM field is set to Login.
login_challenge extensions.auth.type The extensions.auth.type UDM field is set to SSO.
login_verification is_second_factor additional.fields[is_second_factor]
login_verification login_challenge_method security_result.detection_fields[login_challenge_method_attempts_count] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to login_challenge_method, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the security_result.detection_fields.key UDM field is set to login_challenge_method and the events.parameters.multiValue log field is mapped to the security_result.detection_fields.value UDM field. Otherwise, The security_result.detection_fields.key UDM field is set to login_challenge_method and the security_result.detection_fields.value UDM field is set to a value generated from the template %{security_result.detection_fields[login_challenge_method]}, %{events.parameters.multiValue}, where %{security_result.detection_fields[login_challenge_method]} and %{events.parameters.multiValue} are replaced with the values of the security_result.detection_fields[login_challenge_method] and events.parameters.multiValue log fields.
login_verification extensions.auth.mechanism Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to login_challenge_method, then
Iterate through log field events.parameters.multiValue:
if the events.parameters.multiValue log field value is equal to password, then the extensions.auth.mechanism UDM field is set to USERNAME_PASSWORD. Else if the events.parameters.multiValue log field value is equal to security_key_otp, then the extensions.auth.mechanism UDM field is set to OTP.
login_verification login_challenge_status additional.fields[login_challenge_status]
login_verification security_result.action The security_result.action UDM field is set to ALLOW.
login_verification login_type security_result.detection_fields[login_type]
login_verification target.application The target.application UDM field is set to Login.
login_verification extensions.auth.type The extensions.auth.type UDM field is set to SSO.
logout security_result.action The security_result.action UDM field is set to ALLOW.
logout login_type security_result.detection_fields[login_type]
logout target.application The target.application UDM field is set to Login.
logout extensions.auth.type The extensions.auth.type UDM field is set to SSO.
risky_sensitive_action_allowed is_suspicious additional.fields[is_suspicious]
risky_sensitive_action_allowed login_challenge_method security_result.detection_fields[login_challenge_method_attempts_count] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to login_challenge_method, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the security_result.detection_fields.key UDM field is set to login_challenge_method and the events.parameters.multiValue log field is mapped to the security_result.detection_fields.value UDM field. Otherwise, The security_result.detection_fields.key UDM field is set to login_challenge_method and the security_result.detection_fields.value UDM field is set to a value generated from the template %{security_result.detection_fields[login_challenge_method]}, %{events.parameters.multiValue}, where %{security_result.detection_fields[login_challenge_method]} and %{events.parameters.multiValue} are replaced with the values of the security_result.detection_fields[login_challenge_method] and events.parameters.multiValue log fields.
risky_sensitive_action_allowed extensions.auth.mechanism Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to login_challenge_method, then
Iterate through log field events.parameters.multiValue:
if the events.parameters.multiValue log field value is equal to password, then the extensions.auth.mechanism UDM field is set to USERNAME_PASSWORD. Else if the events.parameters.multiValue log field value is equal to security_key_otp, then the extensions.auth.mechanism UDM field is set to OTP.
risky_sensitive_action_allowed login_challenge_status additional.fields[login_challenge_status]
risky_sensitive_action_allowed login_type security_result.detection_fields[login_type]
risky_sensitive_action_allowed security_result.action The security_result.action UDM field is set to ALLOW.
risky_sensitive_action_allowed sensitive_action_name security_result.action_details
risky_sensitive_action_allowed target.application The target.application UDM field is set to Login.
risky_sensitive_action_allowed extensions.auth.type The extensions.auth.type UDM field is set to SSO.
risky_sensitive_action_blocked is_suspicious additional.fields[is_suspicious]
risky_sensitive_action_blocked login_challenge_method security_result.detection_fields[login_challenge_method_attempts_count] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to login_challenge_method, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the security_result.detection_fields.key UDM field is set to login_challenge_method and the events.parameters.multiValue log field is mapped to the security_result.detection_fields.value UDM field. Otherwise, The security_result.detection_fields.key UDM field is set to login_challenge_method and the security_result.detection_fields.value UDM field is set to a value generated from the template %{security_result.detection_fields[login_challenge_method]}, %{events.parameters.multiValue}, where %{security_result.detection_fields[login_challenge_method]} and %{events.parameters.multiValue} are replaced with the values of the security_result.detection_fields[login_challenge_method] and events.parameters.multiValue log fields.
risky_sensitive_action_blocked extensions.auth.mechanism Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to login_challenge_method, then
Iterate through log field events.parameters.multiValue:
if the events.parameters.multiValue log field value is equal to password, then the extensions.auth.mechanism UDM field is set to USERNAME_PASSWORD. Else if the events.parameters.multiValue log field value is equal to security_key_otp, then the extensions.auth.mechanism UDM field is set to OTP.
risky_sensitive_action_blocked login_challenge_status additional.fields[login_challenge_status]
risky_sensitive_action_blocked login_type security_result.detection_fields[login_type]
risky_sensitive_action_blocked security_result.action The security_result.action UDM field is set to BLOCK.
risky_sensitive_action_blocked sensitive_action_name security_result.action_details
risky_sensitive_action_blocked target.application The target.application UDM field is set to Login.
risky_sensitive_action_blocked extensions.auth.type The extensions.auth.type UDM field is set to SSO.
login_success is_suspicious additional.fields[is_suspicious]
login_success login_challenge_method security_result.detection_fields[login_challenge_method_attempts_count] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to login_challenge_method, then
Iterate through log field events.parameters.multiValue:
if the index1 log field value is equal to 0, then the security_result.detection_fields.key UDM field is set to login_challenge_method and the events.parameters.multiValue log field is mapped to the security_result.detection_fields.value UDM field. Otherwise, The security_result.detection_fields.key UDM field is set to login_challenge_method and the security_result.detection_fields.value UDM field is set to a value generated from the template %{security_result.detection_fields[login_challenge_method]}, %{events.parameters.multiValue}, where %{security_result.detection_fields[login_challenge_method]} and %{events.parameters.multiValue} are replaced with the values of the security_result.detection_fields[login_challenge_method] and events.parameters.multiValue log fields.
login_success extensions.auth.mechanism Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to login_challenge_method, then
Iterate through log field events.parameters.multiValue:
if the events.parameters.multiValue log field value is equal to password, then the extensions.auth.mechanism UDM field is set to USERNAME_PASSWORD. Else if the events.parameters.multiValue log field value is equal to security_key_otp, then the extensions.auth.mechanism UDM field is set to OTP.
login_success security_result.action The security_result.action UDM field is set to ALLOW.
login_success login_type security_result.detection_fields[login_type]
login_success target.application The target.application UDM field is set to Login.
login_success extensions.auth.type The extensions.auth.type UDM field is set to SSO.
gov_attack_warning target.application The target.application UDM field is set to Login.
gov_attack_warning extensions.auth.type The extensions.auth.type UDM field is set to SSO.
gov_attack_warning security_result.action The security_result.action UDM field is set to ALLOW.
2sv_disable target.application The target.application UDM field is set to Login.
2sv_disable extensions.auth.type The extensions.auth.type UDM field is set to SSO.
2sv_disable security_result.action The security_result.action UDM field is set to ALLOW.
2sv_enroll target.application The target.application UDM field is set to Login.
2sv_enroll extensions.auth.type The extensions.auth.type UDM field is set to SSO.
2sv_enroll security_result.action The security_result.action UDM field is set to ALLOW.
password_edit target.application The target.application UDM field is set to Login.
password_edit extensions.auth.type The extensions.auth.type UDM field is set to SSO.
password_edit security_result.action The security_result.action UDM field is set to ALLOW.
recovery_email_edit target.application The target.application UDM field is set to Login.
recovery_email_edit extensions.auth.type The extensions.auth.type UDM field is set to SSO.
recovery_email_edit security_result.action The security_result.action UDM field is set to ALLOW.
recovery_phone_edit target.application The target.application UDM field is set to Login.
recovery_phone_edit extensions.auth.type The extensions.auth.type UDM field is set to SSO.
recovery_phone_edit security_result.action The security_result.action UDM field is set to ALLOW.
recovery_secret_qa_edit target.application The target.application UDM field is set to Login.
recovery_secret_qa_edit extensions.auth.type The extensions.auth.type UDM field is set to SSO.
recovery_secret_qa_edit security_result.action The security_result.action UDM field is set to ALLOW.
passkey_enrolled target.application The target.application UDM field is set to Login.
passkey_enrolled extensions.auth.type The extensions.auth.type UDM field is set to SSO.
passkey_enrolled target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
passkey_enrolled security_result.action The security_result.action UDM field is set to ALLOW.
passkey_removed target.application The target.application UDM field is set to Login.
passkey_removed extensions.auth.type The extensions.auth.type UDM field is set to SSO.
passkey_removed target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
passkey_removed security_result.action The security_result.action UDM field is set to ALLOW.
titanium_enroll target.application The target.application UDM field is set to Login.
titanium_enroll extensions.auth.type The extensions.auth.type UDM field is set to SSO.
titanium_enroll security_result.action The security_result.action UDM field is set to ALLOW.
titanium_unenroll target.application The target.application UDM field is set to Login.
titanium_unenroll extensions.auth.type The extensions.auth.type UDM field is set to SSO.
titanium_unenroll security_result.action The security_result.action UDM field is set to ALLOW.
blocked_sender target.application The target.application UDM field is set to Login.
blocked_sender extensions.auth.type The extensions.auth.type UDM field is set to SSO.
blocked_sender security_result.action The security_result.action UDM field is set to ALLOW.
email_forwarding_out_of_domain target.application The target.application UDM field is set to Login.
email_forwarding_out_of_domain extensions.auth.type The extensions.auth.type UDM field is set to SSO.
email_forwarding_out_of_domain security_result.action The security_result.action UDM field is set to ALLOW.

Field mapping reference: workspace activity admin application

The following table provides the log fields to UDM field mapping corresponding to events for the admin application.

Event Name Log field UDM mapping Logic
CHANGE_APPLICATION_SETTING APPLICATION_EDITION additional.fields[application_edition]
CHANGE_APPLICATION_SETTING APPLICATION_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to APPLICATION_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
CHANGE_APPLICATION_SETTING GROUP_EMAIL target.group.email_addresses
CHANGE_APPLICATION_SETTING NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_APPLICATION_SETTING OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_APPLICATION_SETTING ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_APPLICATION_SETTING SETTING_NAME target.resource.name
CHANGE_APPLICATION_SETTING target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CREATE_APPLICATION_SETTING APPLICATION_EDITION additional.fields[application_edition]
CREATE_APPLICATION_SETTING APPLICATION_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to APPLICATION_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
CREATE_APPLICATION_SETTING GROUP_EMAIL target.group.email_addresses
CREATE_APPLICATION_SETTING NEW_VALUE target.resource.attribute.labels[new_value]
CREATE_APPLICATION_SETTING ORG_UNIT_NAME additional.fields[org_unit_name]
CREATE_APPLICATION_SETTING SETTING_NAME target.resource.name
CREATE_APPLICATION_SETTING target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
DELETE_APPLICATION_SETTING APPLICATION_EDITION additional.fields[application_edition]
DELETE_APPLICATION_SETTING APPLICATION_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to APPLICATION_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
DELETE_APPLICATION_SETTING GROUP_EMAIL target.group.email_addresses
DELETE_APPLICATION_SETTING OLD_VALUE target.user.attribute.labels[old_value]
DELETE_APPLICATION_SETTING ORG_UNIT_NAME additional.fields[org_unit_name]
DELETE_APPLICATION_SETTING SETTING_NAME target.resource.name
DELETE_APPLICATION_SETTING target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
REORDER_GROUP_BASED_POLICIES_EVENT APPLICATION_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to APPLICATION_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
REORDER_GROUP_BASED_POLICIES_EVENT GROUP_PRIORITIES target.resource.attribute.labels[GROUP_PRIORITIES]
REORDER_GROUP_BASED_POLICIES_EVENT SETTING_NAME target.resource.name
REORDER_GROUP_BASED_POLICIES_EVENT target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
GPLUS_PREMIUM_FEATURES DOMAIN_NAME target.domain.name
GPLUS_PREMIUM_FEATURES NEW_VALUE target.resource.name
GPLUS_PREMIUM_FEATURES target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CREATE_MANAGED_CONFIGURATION DEVICE_TYPE target.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_TYPE, then If the events.parameters.value log field value matches the regular expression pattern: (?i)windows, then the target.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)mac, then the target.platform UDM field is set to MAC. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)linux, then the target.platform UDM field is set to LINUX. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)ios, then the target.platform UDM field is set to IOS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)android, then the target.platform UDM field is set to ANDROID. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)chrome, then the target.platform UDM field is set to CHROME_OS.
CREATE_MANAGED_CONFIGURATION MANAGED_CONFIGURATION_NAME target.resource.name
CREATE_MANAGED_CONFIGURATION MOBILE_APP_PACKAGE_ID target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to MOBILE_APP_PACKAGE_ID, then the events.parameters.value log field is mapped to the target.application UDM field.
CREATE_MANAGED_CONFIGURATION target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
DELETE_MANAGED_CONFIGURATION DEVICE_TYPE target.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_TYPE, then If the events.parameters.value log field value matches the regular expression pattern: (?i)windows, then the target.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)mac, then the target.platform UDM field is set to MAC. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)linux, then the target.platform UDM field is set to LINUX. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)ios, then the target.platform UDM field is set to IOS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)android, then the target.platform UDM field is set to ANDROID. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)chrome, then the target.platform UDM field is set to CHROME_OS.
DELETE_MANAGED_CONFIGURATION MANAGED_CONFIGURATION_NAME target.resource.name
DELETE_MANAGED_CONFIGURATION MOBILE_APP_PACKAGE_ID target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to MOBILE_APP_PACKAGE_ID, then the events.parameters.value log field is mapped to the target.application UDM field.
DELETE_MANAGED_CONFIGURATION target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
UPDATE_MANAGED_CONFIGURATION DEVICE_TYPE target.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_TYPE, then If the events.parameters.value log field value matches the regular expression pattern: (?i)windows, then the target.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)mac, then the target.platform UDM field is set to MAC. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)linux, then the target.platform UDM field is set to LINUX. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)ios, then the target.platform UDM field is set to IOS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)android, then the target.platform UDM field is set to ANDROID. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)chrome, then the target.platform UDM field is set to CHROME_OS.
UPDATE_MANAGED_CONFIGURATION MANAGED_CONFIGURATION_NAME target.resource.name
UPDATE_MANAGED_CONFIGURATION MOBILE_APP_PACKAGE_ID target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to MOBILE_APP_PACKAGE_ID, then the events.parameters.value log field is mapped to the target.application UDM field.
UPDATE_MANAGED_CONFIGURATION target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
FLASHLIGHT_EDU_NON_FEATURED_SERVICES_SELECTED FLASHLIGHT_EDU_NON_FEATURED_SERVICES_SELECTION target.resource.attribute.labels[FLASHLIGHT_EDU_NON_FEATURED_SERVICES_SELECTION]
FLASHLIGHT_EDU_NON_FEATURED_SERVICES_SELECTED target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
UPDATE_SMART_FEATURES NEW_VALUE target.resource.name
UPDATE_SMART_FEATURES target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CREATE_BUILDING DOMAIN_NAME target.domain.name
CREATE_BUILDING NEW_VALUE target.resource.name
DELETE_BUILDING DOMAIN_NAME target.domain.name
DELETE_BUILDING OLD_VALUE target.resource.name
UPDATE_BUILDING DOMAIN_NAME target.domain.name
UPDATE_BUILDING FIELD_NAME additional.fields[FIELD_NAME]
UPDATE_BUILDING NEW_VALUE target.resource.attribute.labels[new_value]
UPDATE_BUILDING OLD_VALUE target.resource.attribute.labels[old_value]
UPDATE_BUILDING RESOURCE_IDENTIFIER target.resource.name
EWS_IN_NEW_CREDENTIALS_GENERATED EXCHANGE_ROLE_ACCOUNT target.user.userid
EWS_OUT_ENDPOINT_CONFIGURATION_CHANGED EXCHANGE_ROLE_ACCOUNT target.user.userid
EWS_OUT_ENDPOINT_CONFIGURATION_CHANGED EXCHANGE_WEB_SERVICES_URL target.url
EWS_OUT_ENDPOINT_CONFIGURATION_CHANGED NUMBER_OF_ADDITIONAL_EXCHANGE_ENDPOINTS target.resource.attribute.labels[NUMBER_OF_ADDITIONAL_EXCHANGE_ENDPOINTS]
EWS_OUT_ENDPOINT_CONFIGURATION_CHANGED target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CREATE_CALENDAR_RESOURCE DOMAIN_NAME target.domain.name
CREATE_CALENDAR_RESOURCE NEW_VALUE target.resource.name
DELETE_CALENDAR_RESOURCE DOMAIN_NAME target.domain.name
DELETE_CALENDAR_RESOURCE OLD_VALUE target.resource.name
CREATE_CALENDAR_RESOURCE_FEATURE DOMAIN_NAME target.domain.name
CREATE_CALENDAR_RESOURCE_FEATURE NEW_VALUE target.resource.name
DELETE_CALENDAR_RESOURCE_FEATURE DOMAIN_NAME target.domain.name
DELETE_CALENDAR_RESOURCE_FEATURE OLD_VALUE target.resource.name
UPDATE_CALENDAR_RESOURCE_FEATURE DOMAIN_NAME target.domain.name
UPDATE_CALENDAR_RESOURCE_FEATURE FIELD_NAME additional.fields[FIELD_NAME]
UPDATE_CALENDAR_RESOURCE_FEATURE NEW_VALUE target.resource.attribute.labels[new_value]
UPDATE_CALENDAR_RESOURCE_FEATURE OLD_VALUE target.resource.attribute.labels[old_value]
UPDATE_CALENDAR_RESOURCE_FEATURE RESOURCE_IDENTIFIER target.resource.name
RENAME_CALENDAR_RESOURCE DOMAIN_NAME target.domain.name
RENAME_CALENDAR_RESOURCE NEW_VALUE target.resource.name
RENAME_CALENDAR_RESOURCE OLD_VALUE target.resource.attribute.labels[old_value]
UPDATE_CALENDAR_RESOURCE DOMAIN_NAME target.domain.name
UPDATE_CALENDAR_RESOURCE FIELD_NAME additional.fields[FIELD_NAME]
UPDATE_CALENDAR_RESOURCE NEW_VALUE target.resource.attribute.labels[new_value]
UPDATE_CALENDAR_RESOURCE OLD_VALUE target.resource.attribute.labels[old_value]
UPDATE_CALENDAR_RESOURCE RESOURCE_IDENTIFIER target.resource.name
CHANGE_CALENDAR_SETTING DOMAIN_NAME target.domain.name
CHANGE_CALENDAR_SETTING GROUP_EMAIL target.group.email_addresses
CHANGE_CALENDAR_SETTING NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_CALENDAR_SETTING OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_CALENDAR_SETTING ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_CALENDAR_SETTING target.application The target.application UDM field is set to Admin.
CHANGE_CALENDAR_SETTING SETTING_NAME target.resource.name
CHANGE_CALENDAR_SETTING target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CANCEL_CALENDAR_EVENTS USER_EMAIL target.user.email_addresses
RELEASE_CALENDAR_RESOURCES USER_EMAIL target.user.email_addresses
MEET_INTEROP_CREATE_GATEWAY GATEWAY_NAME target.resource.name
MEET_INTEROP_DELETE_GATEWAY GATEWAY_NAME target.resource.name
MEET_INTEROP_MODIFY_GATEWAY GATEWAY_NAME target.resource.name
CHANGE_CHAT_SETTING DOMAIN_NAME target.domain.name
CHANGE_CHAT_SETTING GROUP_EMAIL target.group.email_addresses
CHANGE_CHAT_SETTING NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_CHAT_SETTING OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_CHAT_SETTING ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_CHAT_SETTING SETTING_NAME target.resource.name
CHANGE_CHAT_SETTING target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_CHROME_OS_ANDROID_APPLICATION_SETTING APP_ID target.resource.product_object_id
CHANGE_CHROME_OS_ANDROID_APPLICATION_SETTING CHROME_OS_SESSION_TYPE additional.fields[CHROME_OS_SESSION_TYPE]
CHANGE_CHROME_OS_ANDROID_APPLICATION_SETTING GROUP_EMAIL target.group.email_addresses
CHANGE_CHROME_OS_ANDROID_APPLICATION_SETTING NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_CHROME_OS_ANDROID_APPLICATION_SETTING OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_CHROME_OS_ANDROID_APPLICATION_SETTING ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_CHROME_OS_ANDROID_APPLICATION_SETTING SETTING_NAME target.resource.name
CHANGE_CHROME_OS_ANDROID_APPLICATION_SETTING target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_DEVICE_STATE DEVICE_NEW_STATE target.asset.attribute.labels[device_new_state]
CHANGE_DEVICE_STATE DEVICE_PREVIOUS_STATE target.asset.attribute.labels[device_previous_state]
CHANGE_DEVICE_STATE DEVICE_SERIAL_NUMBER target.asset.hardware.serial_number
CHANGE_DEVICE_STATE DEVICE_TYPE target.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_TYPE, then If the events.parameters.value log field value matches the regular expression pattern: (?i)windows, then the target.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)mac, then the target.platform UDM field is set to MAC. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)linux, then the target.platform UDM field is set to LINUX. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)ios, then the target.platform UDM field is set to IOS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)android, then the target.platform UDM field is set to ANDROID. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)chrome, then the target.platform UDM field is set to CHROME_OS.
CHANGE_DEVICE_STATE target.application The target.application UDM field is set to Admin.
CHANGE_DEVICE_UPGRADE DEVICE_SERIAL_NUMBER target.asset.hardware.serial_number
CHANGE_DEVICE_UPGRADE NEW_VALUE target.asset.attribute.labels[new_value]
CHANGE_DEVICE_UPGRADE OLD_VALUE target.asset.attribute.labels[old_value]
CHANGE_CHROME_OS_APPLICATION_SETTING APP_ID target.resource.product_object_id
CHANGE_CHROME_OS_APPLICATION_SETTING CHROME_OS_SESSION_TYPE additional.fields[CHROME_OS_SESSION_TYPE]
CHANGE_CHROME_OS_APPLICATION_SETTING GROUP_EMAIL target.group.email_addresses
CHANGE_CHROME_OS_APPLICATION_SETTING NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_CHROME_OS_APPLICATION_SETTING OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_CHROME_OS_APPLICATION_SETTING ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_CHROME_OS_APPLICATION_SETTING SETTING_NAME target.resource.name
CHANGE_CHROME_OS_APPLICATION_SETTING target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
SEND_CHROME_OS_DEVICE_COMMAND DEVICE_SERIAL_NUMBER target.asset.hardware.serial_number
SEND_CHROME_OS_DEVICE_COMMAND NEW_VALUE additional.fields[new_value]
CHANGE_CHROME_OS_DEVICE_ANNOTATION DEVICE_SERIAL_NUMBER target.asset.hardware.serial_number
CHANGE_CHROME_OS_DEVICE_ANNOTATION target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_CHROME_OS_DEVICE_SETTING NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_CHROME_OS_DEVICE_SETTING OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_CHROME_OS_DEVICE_SETTING ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_CHROME_OS_DEVICE_SETTING SETTING_NAME target.resource.name
CHANGE_CHROME_OS_DEVICE_SETTING target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_CHROME_OS_DEVICE_STATE DEVICE_SERIAL_NUMBER target.asset.hardware.serial_number
CHANGE_CHROME_OS_DEVICE_STATE NEW_VALUE target.asset.attribute.labels[new_value]
CHANGE_CHROME_OS_DEVICE_STATE OLD_VALUE target.asset.attribute.labels[old_value]
CHANGE_CHROME_OS_PUBLIC_SESSION_SETTING NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_CHROME_OS_PUBLIC_SESSION_SETTING OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_CHROME_OS_PUBLIC_SESSION_SETTING ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_CHROME_OS_PUBLIC_SESSION_SETTING SETTING_NAME target.resource.name
CHANGE_CHROME_OS_PUBLIC_SESSION_SETTING target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
INSERT_CHROME_OS_PRINT_SERVER PRINT_SERVER_NAME target.resource.name
DELETE_CHROME_OS_PRINT_SERVER PRINT_SERVER_NAME target.resource.name
UPDATE_CHROME_OS_PRINT_SERVER NEW_VALUE target.resource.attribute.labels[new_value]
UPDATE_CHROME_OS_PRINT_SERVER OLD_VALUE target.resource.attribute.labels[old_value]
UPDATE_CHROME_OS_PRINT_SERVER PRINT_SERVER_NAME target.resource.name
INSERT_CHROME_OS_PRINTER PRINTER_NAME target.resource.name
DELETE_CHROME_OS_PRINTER PRINTER_NAME target.resource.name
UPDATE_CHROME_OS_PRINTER NEW_VALUE target.resource.attribute.labels[new_value]
UPDATE_CHROME_OS_PRINTER OLD_VALUE target.resource.attribute.labels[old_value]
UPDATE_CHROME_OS_PRINTER PRINTER_NAME target.resource.name
CHANGE_CHROME_OS_SETTING DOMAIN_NAME target.domain.name
CHANGE_CHROME_OS_SETTING NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_CHROME_OS_SETTING OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_CHROME_OS_SETTING SETTING_NAME target.resource.name
CHANGE_CHROME_OS_SETTING target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_CHROME_OS_USER_SETTING NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_CHROME_OS_USER_SETTING OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_CHROME_OS_USER_SETTING ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_CHROME_OS_USER_SETTING SETTING_NAME target.resource.name
CHANGE_CHROME_OS_USER_SETTING target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CREATE_CHROME_OS_ENROLLMENT_TOKEN FULL_ORG_UNIT_PATH additional.fields[FULL_ORG_UNIT_PATH]
CHANGE_CHROME_OS_CUSTOM_CONFIGURATIONS_JSON_SETTING NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_CHROME_OS_CUSTOM_CONFIGURATIONS_JSON_SETTING OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_CHROME_OS_CUSTOM_CONFIGURATIONS_JSON_SETTING ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_CHROME_OS_CUSTOM_CONFIGURATIONS_JSON_SETTING target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
DELETE_CHROME_OS_DEVICE DEVICE_SERIAL_NUMBER target.asset.hardware.serial_number
DELETE_DUPLICATE_CHROME_OS_DEVICE DEVICE_SERIAL_NUMBER target.asset.hardware.serial_number
DELETE_DUPLICATE_CHROME_OS_DEVICE DIRECTORY_API_ID additional.fields[DIRECTORY_API_ID]
CHANGE_CHROME_OS_ISOLATED_WEB_APPLICATION_SETTING APP_ID target.resource.product_object_id
CHANGE_CHROME_OS_ISOLATED_WEB_APPLICATION_SETTING CHROME_OS_SESSION_TYPE additional.fields[CHROME_OS_SESSION_TYPE]
CHANGE_CHROME_OS_ISOLATED_WEB_APPLICATION_SETTING GROUP_EMAIL target.group.email_addresses
CHANGE_CHROME_OS_ISOLATED_WEB_APPLICATION_SETTING NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_CHROME_OS_ISOLATED_WEB_APPLICATION_SETTING OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_CHROME_OS_ISOLATED_WEB_APPLICATION_SETTING ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_CHROME_OS_ISOLATED_WEB_APPLICATION_SETTING SETTING_NAME target.resource.name
CHANGE_CHROME_OS_ISOLATED_WEB_APPLICATION_SETTING target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
ISSUE_DEVICE_COMMAND DEVICE_COMMAND_DETAILS additional.fields[DEVICE_COMMAND_DETAILS]
ISSUE_DEVICE_COMMAND DEVICE_SERIAL_NUMBER target.asset.hardware.serial_number
ISSUE_DEVICE_COMMAND DEVICE_TYPE target.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_TYPE, then If the events.parameters.value log field value matches the regular expression pattern: (?i)windows, then the target.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)mac, then the target.platform UDM field is set to MAC. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)linux, then the target.platform UDM field is set to LINUX. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)ios, then the target.platform UDM field is set to IOS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)android, then the target.platform UDM field is set to ANDROID. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)chrome, then the target.platform UDM field is set to CHROME_OS.
MOVE_DEVICE_TO_ORG_UNIT_DETAILED DEVICE_NEW_ORG_UNIT target.asset.attribute.labels[DEVICE_NEW_ORG_UNIT]
MOVE_DEVICE_TO_ORG_UNIT_DETAILED DEVICE_PREVIOUS_ORG_UNIT target.asset.attribute.labels[DEVICE_PREVIOUS_ORG_UNIT]
MOVE_DEVICE_TO_ORG_UNIT_DETAILED DEVICE_SERIAL_NUMBER target.asset.hardware.serial_number
MOVE_DEVICE_TO_ORG_UNIT_DETAILED DEVICE_TYPE target.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_TYPE, then If the events.parameters.value log field value matches the regular expression pattern: (?i)windows, then the target.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)mac, then the target.platform UDM field is set to MAC. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)linux, then the target.platform UDM field is set to LINUX. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)ios, then the target.platform UDM field is set to IOS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)android, then the target.platform UDM field is set to ANDROID. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)chrome, then the target.platform UDM field is set to CHROME_OS.
PRE_PROVISION_CHROME_OS_DEVICE DEVICE_SERIAL_NUMBER target.asset.hardware.serial_number
REMOVE_CHROME_OS_APPLICATION_SETTING APP_ID target.resource.product_object_id
REMOVE_CHROME_OS_APPLICATION_SETTING APP_TYPE target.resource.resource_subtype
REMOVE_CHROME_OS_APPLICATION_SETTING CHROME_OS_SESSION_TYPE additional.fields[CHROME_OS_SESSION_TYPE]
REMOVE_CHROME_OS_APPLICATION_SETTING ORG_UNIT_NAME additional.fields[org_unit_name]
REMOVE_CHROME_OS_APPLICATION_SETTING target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
REMOVE_CHROME_OS_APPLICATION_SETTINGS APP_ID target.resource.product_object_id
REMOVE_CHROME_OS_APPLICATION_SETTINGS target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
REMOVE_CHROME_OS_WEB_ORIGIN_SETTINGS CHROME_OS_SESSION_TYPE additional.fields[CHROME_OS_SESSION_TYPE]
REMOVE_CHROME_OS_WEB_ORIGIN_SETTINGS GROUP_EMAIL target.group.email_addresses
REMOVE_CHROME_OS_WEB_ORIGIN_SETTINGS ORG_UNIT_NAME additional.fields[org_unit_name]
REMOVE_CHROME_OS_WEB_ORIGIN_SETTINGS WEB_ORIGIN target.url
REMOVE_CHROME_OS_WEB_ORIGIN_SETTINGS target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
REPAIR_CENTER_DEPROVISION DEVICE_PREVIOUS_STATE target.asset.attribute.labels[device_previous_state]
REPAIR_CENTER_DEPROVISION DEVICE_SERIAL_NUMBER target.asset.hardware.serial_number
REPAIR_CENTER_DEPROVISION DEVICE_TYPE target.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_TYPE, then If the events.parameters.value log field value matches the regular expression pattern: (?i)windows, then the target.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)mac, then the target.platform UDM field is set to MAC. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)linux, then the target.platform UDM field is set to LINUX. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)ios, then the target.platform UDM field is set to IOS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)android, then the target.platform UDM field is set to ANDROID. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)chrome, then the target.platform UDM field is set to CHROME_OS.
REVOKE_CHROME_OS_ENROLLMENT_TOKEN FULL_ORG_UNIT_PATH additional.fields[FULL_ORG_UNIT_PATH]
UPDATE_DEVICE DEVICE_SERIAL_NUMBER target.asset.hardware.serial_number
UPDATE_DEVICE DEVICE_TYPE target.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_TYPE, then If the events.parameters.value log field value matches the regular expression pattern: (?i)windows, then the target.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)mac, then the target.platform UDM field is set to MAC. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)linux, then the target.platform UDM field is set to LINUX. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)ios, then the target.platform UDM field is set to IOS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)android, then the target.platform UDM field is set to ANDROID. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)chrome, then the target.platform UDM field is set to CHROME_OS.
CHANGE_CHROME_OS_WEB_APPLICATION_SETTING APP_ID target.resource.product_object_id
CHANGE_CHROME_OS_WEB_APPLICATION_SETTING CHROME_OS_SESSION_TYPE additional.fields[CHROME_OS_SESSION_TYPE]
CHANGE_CHROME_OS_WEB_APPLICATION_SETTING GROUP_EMAIL target.group.email_addresses
CHANGE_CHROME_OS_WEB_APPLICATION_SETTING NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_CHROME_OS_WEB_APPLICATION_SETTING OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_CHROME_OS_WEB_APPLICATION_SETTING ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_CHROME_OS_WEB_APPLICATION_SETTING SETTING_NAME target.resource.name
CHANGE_CHROME_OS_WEB_APPLICATION_SETTING target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_CHROME_OS_WEB_PERMISSION_SETTING CHROME_OS_SESSION_TYPE additional.fields[CHROME_OS_SESSION_TYPE]
CHANGE_CHROME_OS_WEB_PERMISSION_SETTING GROUP_EMAIL target.group.email_addresses
CHANGE_CHROME_OS_WEB_PERMISSION_SETTING NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_CHROME_OS_WEB_PERMISSION_SETTING OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_CHROME_OS_WEB_PERMISSION_SETTING ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_CHROME_OS_WEB_PERMISSION_SETTING SETTING_NAME target.resource.name
CHANGE_CHROME_OS_WEB_PERMISSION_SETTING WEB_ORIGIN target.url
CHANGE_CHROME_OS_WEB_PERMISSION_SETTING target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_CONTACTS_SETTING DOMAIN_NAME target.domain.name
CHANGE_CONTACTS_SETTING NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_CONTACTS_SETTING OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_CONTACTS_SETTING ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_CONTACTS_SETTING SETTING_NAME target.resource.name
CHANGE_CONTACTS_SETTING target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
ASSIGN_ROLE ORG_UNIT_NAME additional.fields[org_unit_name]
ASSIGN_ROLE ROLE_NAME target.resource.attribute.roles.name
ASSIGN_ROLE USER_EMAIL target.user.email_addresses
ASSIGN_ROLE target.application The target.application UDM field is set to Admin.
ASSIGN_ROLE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CREATE_ROLE ROLE_ID target.resource.attribute.labels[role_id]
CREATE_ROLE ROLE_NAME target.resource.attribute.roles.name
CREATE_ROLE target.application The target.application UDM field is set to Admin.
CREATE_ROLE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
DELETE_ROLE ROLE_ID target.group.product_object_id
DELETE_ROLE ROLE_NAME target.resource.name
DELETE_ROLE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
ADD_PRIVILEGE PRIVILEGE_NAME target.resource.attribute.labels[PRIVILEGE_NAME]
ADD_PRIVILEGE ROLE_ID target.resource.product_object_id
ADD_PRIVILEGE ROLE_NAME target.resource.name
ADD_PRIVILEGE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
REMOVE_PRIVILEGE PRIVILEGE_NAME target.resource.attribute.labels[PRIVILEGE_NAME]
REMOVE_PRIVILEGE ROLE_ID target.resource.product_object_id
REMOVE_PRIVILEGE ROLE_NAME target.resource.name
REMOVE_PRIVILEGE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
RENAME_ROLE NEW_VALUE target.resource.attribute.labels[new_value]
RENAME_ROLE ROLE_NAME target.resource.name
RENAME_ROLE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
UPDATE_ROLE ROLE_ID target.resource.product_object_id
UPDATE_ROLE ROLE_NAME target.resource.name
UPDATE_ROLE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
UNASSIGN_ROLE ORG_UNIT_NAME additional.fields[org_unit_name]
UNASSIGN_ROLE ROLE_NAME target.resource.attribute.roles.name
UNASSIGN_ROLE USER_EMAIL target.user.email_addresses
UNASSIGN_ROLE target.application The target.application UDM field is set to Admin.
UNASSIGN_ROLE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
TRANSFER_DOCUMENT_OWNERSHIP DOMAIN_NAME target.domain.name
TRANSFER_DOCUMENT_OWNERSHIP NEW_VALUE target.user.email_addresses
TRANSFER_DOCUMENT_OWNERSHIP USER_EMAIL src.user.email_addresses
DOCS_ORG_BRANDING_PROVISIONING ORG_BRANDING_PROVISIONING_STATUS security_result.action_details
DOCS_ORG_BRANDING_PROVISIONING SERVICE_ACCOUNT_EMAIL target.user.email_addresses
DOCS_ORG_BRANDING_PROVISIONING SHARED_DRIVE_NAME target.resource.name
DOCS_ORG_BRANDING_UPLOAD DOCUMENT_ID target.resource.product_object_id
DOCS_ORG_BRANDING_UPLOAD ORG_BRANDING_EDITOR_TYPE target.resource.resource_subtype
DOCS_ORG_BRANDING_UPLOAD ORG_BRANDING_UPLOAD_STATUS security_result.action_details
DRIVE_DATA_RESTORE BEGIN_DATE_TIME additional.fields[begin_date_time]
DRIVE_DATA_RESTORE END_DATE_TIME additional.fields[end_date_time]
DRIVE_DATA_RESTORE USER_EMAIL target.user.email_addresses
CHANGE_DOCS_SETTING DOMAIN_NAME target.domain.name
CHANGE_DOCS_SETTING GROUP_EMAIL target.group.email_addresses
CHANGE_DOCS_SETTING NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_DOCS_SETTING OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_DOCS_SETTING ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_DOCS_SETTING SETTING_NAME target.resource.name
CHANGE_DOCS_SETTING target.application The target.application UDM field is set to Admin.
CHANGE_DOCS_SETTING target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
MOVE_SHARED_DRIVE_TO_ORG_UNIT NEW_VALUE target.resource.attribute.labels[new_value]
MOVE_SHARED_DRIVE_TO_ORG_UNIT ORG_UNIT_NAME additional.fields[org_unit_name]
MOVE_SHARED_DRIVE_TO_ORG_UNIT SHARED_DRIVE_ID target.resource.product_object_id
CHANGE_ACCOUNT_AUTO_RENEWAL DOMAIN_NAME target.domain.name
CHANGE_ACCOUNT_AUTO_RENEWAL NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_ACCOUNT_AUTO_RENEWAL target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
ADD_APPLICATION APP_ID target.resource.product_object_id
ADD_APPLICATION APPLICATION_ENABLED additional.fields[application_enabled]
ADD_APPLICATION APPLICATION_NAME target.resource.name
ADD_APPLICATION target.application The target.application UDM field is set to Admin.
ADD_APPLICATION target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
ADD_APPLICATION_TO_WHITELIST APP_ID target.resource.product_object_id
ADD_APPLICATION_TO_WHITELIST APPLICATION_NAME target.resource.name
CHANGE_ADVERTISEMENT_OPTION DOMAIN_NAME target.domain.name
CHANGE_ADVERTISEMENT_OPTION NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_ADVERTISEMENT_OPTION OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_ADVERTISEMENT_OPTION target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CREATE_ALERT ALERT_NAME security_result.rule_name
CREATE_ALERT target.application The target.application UDM field is set to Admin.
CREATE_ALERT target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_ALERT_CRITERIA ALERT_NAME target.resource.name
DELETE_ALERT ALERT_NAME target.resource.name
ALERT_RECEIVERS_CHANGED ALERT_NAME target.resource.name
ALERT_RECEIVERS_CHANGED NEW_VALUE target.resource.attribute.labels[new_value]
ALERT_RECEIVERS_CHANGED OLD_VALUE target.resource.attribute.labels[old_value]
RENAME_ALERT NEW_VALUE target.resource.attribute.labels[new_value]
RENAME_ALERT OLD_VALUE target.resource.attribute.labels[old_value]
ALERT_STATUS_CHANGED ALERT_NAME target.resource.name
ALERT_STATUS_CHANGED NEW_VALUE target.resource.attribute.labels[new_value]
ALERT_STATUS_CHANGED OLD_VALUE target.resource.attribute.labels[old_value]
ALERT_STATUS_CHANGED target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
ADD_DOMAIN_ALIAS DOMAIN_ALIAS additional.fields[DOMAIN_ALIAS]
ADD_DOMAIN_ALIAS DOMAIN_NAME target.domain.name
REMOVE_DOMAIN_ALIAS DOMAIN_ALIAS additional.fields[DOMAIN_ALIAS]
REMOVE_DOMAIN_ALIAS DOMAIN_NAME target.domain.name
SKIP_DOMAIN_ALIAS_MX DOMAIN_ALIAS additional.fields[DOMAIN_ALIAS]
SKIP_DOMAIN_ALIAS_MX DOMAIN_NAME target.domain.name
VERIFY_DOMAIN_ALIAS_MX DOMAIN_ALIAS additional.fields[DOMAIN_ALIAS]
VERIFY_DOMAIN_ALIAS_MX DOMAIN_NAME target.domain.name
VERIFY_DOMAIN_ALIAS DOMAIN_ALIAS additional.fields[DOMAIN_ALIAS]
VERIFY_DOMAIN_ALIAS DOMAIN_NAME target.domain.name
VERIFY_DOMAIN_ALIAS DOMAIN_VERIFICATION_METHOD additional.fields[domain_verification_method]
TOGGLE_OAUTH_ACCESS_TO_ALL_APIS DOMAIN_NAME target.domain.name
TOGGLE_OAUTH_ACCESS_TO_ALL_APIS NEW_VALUE target.resource.attribute.labels[new_value]
TOGGLE_OAUTH_ACCESS_TO_ALL_APIS target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
TOGGLE_ALLOW_ADMIN_PASSWORD_RESET DOMAIN_NAME target.domain.name
TOGGLE_ALLOW_ADMIN_PASSWORD_RESET NEW_VALUE target.resource.attribute.labels[new_value]
TOGGLE_ALLOW_ADMIN_PASSWORD_RESET target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
ENABLE_API_ACCESS DOMAIN_NAME target.domain.name
ENABLE_API_ACCESS NEW_VALUE target.resource.attribute.labels[new_value]
ENABLE_API_ACCESS OLD_VALUE target.resource.attribute.labels[old_value]
ENABLE_API_ACCESS target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
AUTHORIZE_API_CLIENT_ACCESS API_CLIENT_NAME target.application
AUTHORIZE_API_CLIENT_ACCESS API_SCOPES additional.fields[api_scopes]
AUTHORIZE_API_CLIENT_ACCESS DOMAIN_NAME target.domain.name
AUTHORIZE_API_CLIENT_ACCESS target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
REMOVE_API_CLIENT_ACCESS API_CLIENT_NAME target.application
REMOVE_API_CLIENT_ACCESS DOMAIN_NAME target.domain.name
REMOVE_API_CLIENT_ACCESS target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHROME_LICENSES_REDEEMED APP_LICENSES_ORDER_NUMBER additional.fields[APP_LICENSES_ORDER_NUMBER]
CHROME_LICENSES_REDEEMED APPLICATION_NAME target.resource.name
CHROME_LICENSES_REDEEMED CHROME_NUM_LICENSES_PURCHASED additional.fields[CHROME_NUM_LICENSES_PURCHASED]
CHROME_LICENSES_REDEEMED target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
TOGGLE_AUTO_ADD_NEW_SERVICE DOMAIN_NAME target.domain.name
TOGGLE_AUTO_ADD_NEW_SERVICE NEW_VALUE target.resource.attribute.labels[new_value]
TOGGLE_AUTO_ADD_NEW_SERVICE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_PRIMARY_DOMAIN DOMAIN_NAME target.domain.name
CHANGE_PRIMARY_DOMAIN NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_PRIMARY_DOMAIN target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_WHITELIST_SETTING NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_WHITELIST_SETTING OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_WHITELIST_SETTING SETTING_NAME target.resource.name
CHANGE_WHITELIST_SETTING target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
COMMUNICATION_PREFERENCES_SETTING_CHANGE DOMAIN_NAME target.domain.name
COMMUNICATION_PREFERENCES_SETTING_CHANGE NEW_VALUE target.resource.attribute.labels[new_value]
COMMUNICATION_PREFERENCES_SETTING_CHANGE OLD_VALUE target.resource.attribute.labels[old_value]
COMMUNICATION_PREFERENCES_SETTING_CHANGE SETTING_NAME target.resource.name
COMMUNICATION_PREFERENCES_SETTING_CHANGE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_CONFLICT_ACCOUNT_ACTION DOMAIN_NAME target.domain.name
CHANGE_CONFLICT_ACCOUNT_ACTION NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_CONFLICT_ACCOUNT_ACTION OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_CONFLICT_ACCOUNT_ACTION target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_CONFLICT_ACCOUNTS_MANAGEMENT_SETTINGS CONFLICT_ACCOUNTS_MANAGEMENT_SETTINGS target.resource.name
CHANGE_CONFLICT_ACCOUNTS_MANAGEMENT_SETTINGS target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
ENABLE_FEEDBACK_SOLICITATION DOMAIN_NAME target.domain.name
ENABLE_FEEDBACK_SOLICITATION NEW_VALUE target.resource.attribute.labels[new_value]
ENABLE_FEEDBACK_SOLICITATION OLD_VALUE target.resource.attribute.labels[old_value]
ENABLE_FEEDBACK_SOLICITATION target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
TOGGLE_CONTACT_SHARING DOMAIN_NAME target.domain.name
TOGGLE_CONTACT_SHARING NEW_VALUE target.resource.attribute.labels[new_value]
TOGGLE_CONTACT_SHARING target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CREATE_PLAY_FOR_WORK_TOKEN PLAY_FOR_WORK_TOKEN_ID target.resource.name
TOGGLE_USE_CUSTOM_LOGO DOMAIN_NAME target.domain.name
TOGGLE_USE_CUSTOM_LOGO NEW_VALUE target.resource.attribute.labels[new_value]
TOGGLE_USE_CUSTOM_LOGO target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_CUSTOM_LOGO DOMAIN_NAME target.domain.name
CHANGE_DATA_LOCALIZATION_FOR_RUSSIA NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_DATA_LOCALIZATION_FOR_RUSSIA OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_DATA_LOCALIZATION_FOR_RUSSIA ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_DATA_LOCALIZATION_FOR_RUSSIA target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_DATA_LOCALIZATION_SETTING NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_DATA_LOCALIZATION_SETTING OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_DATA_LOCALIZATION_SETTING ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_DATA_LOCALIZATION_SETTING target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_DATA_PROTECTION_OFFICER_CONTACT_INFO INFO_TYPE target.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to INFO_TYPE, then If the events.parameters.value log field value matches the regular expression pattern: ^.+@.+$, then the events.parameters.value log field is mapped to the target.user.email_addresses UDM field. Otherwise, the target.user.attribute.labels.key UDM field is set to INFO_TYPE and The events.parameters.value log field is mapped to the target.user.attribute.labels.value UDM field.
CHANGE_DATA_PROTECTION_OFFICER_CONTACT_INFO NEW_VALUE target.user.attribute.labels[new_value]
CHANGE_DATA_PROTECTION_OFFICER_CONTACT_INFO OLD_VALUE target.user.attribute.labels[old_value]
DELETE_PLAY_FOR_WORK_TOKEN PLAY_FOR_WORK_TOKEN_ID target.resource.name
VIEW_DNS_LOGIN_DETAILS DOMAIN_NAME target.domain.name
CHANGE_DOMAIN_DEFAULT_LOCALE DOMAIN_NAME target.domain.name
CHANGE_DOMAIN_DEFAULT_LOCALE NEW_VALUE additional.fields[new_value]
CHANGE_DOMAIN_DEFAULT_LOCALE OLD_VALUE additional.fields[old_value]
CHANGE_DOMAIN_DEFAULT_LOCALE target.application The target.application UDM field is set to Admin.
CHANGE_DOMAIN_DEFAULT_LOCALE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_DOMAIN_DEFAULT_TIMEZONE DOMAIN_NAME target.domain.name
CHANGE_DOMAIN_DEFAULT_TIMEZONE NEW_VALUE additional.fields[new_value]
CHANGE_DOMAIN_DEFAULT_TIMEZONE OLD_VALUE additional.fields[old_value]
CHANGE_DOMAIN_DEFAULT_TIMEZONE target.application The target.application UDM field is set to Admin.
CHANGE_DOMAIN_DEFAULT_TIMEZONE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_DOMAIN_NAME DOMAIN_NAME target.domain.name
CHANGE_DOMAIN_NAME NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_DOMAIN_NAME target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
TOGGLE_ENABLE_PRE_RELEASE_FEATURES DOMAIN_NAME target.domain.name
TOGGLE_ENABLE_PRE_RELEASE_FEATURES NEW_VALUE target.resource.attribute.labels[new_value]
TOGGLE_ENABLE_PRE_RELEASE_FEATURES target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_DOMAIN_SUPPORT_MESSAGE DOMAIN_NAME target.domain.name
CHANGE_DOMAIN_SUPPORT_MESSAGE NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_DOMAIN_SUPPORT_MESSAGE OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_DOMAIN_SUPPORT_MESSAGE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
ADD_TRUSTED_DOMAINS DOMAIN_NAME target.domain.name
ADD_TRUSTED_DOMAINS target.application The target.application UDM field is set to Admin.
ADD_TRUSTED_DOMAINS target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
REMOVE_TRUSTED_DOMAINS DOMAIN_NAME target.domain.name
CHANGE_EDU_TYPE DOMAIN_NAME target.domain.name
CHANGE_EDU_TYPE NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_EDU_TYPE OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_EDU_TYPE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
TOGGLE_ENABLE_OAUTH_CONSUMER_KEY DOMAIN_NAME target.domain.name
TOGGLE_ENABLE_OAUTH_CONSUMER_KEY NEW_VALUE target.resource.attribute.labels[new_value]
TOGGLE_ENABLE_OAUTH_CONSUMER_KEY target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
TOGGLE_SSO_ENABLED DOMAIN_NAME target.domain.name
TOGGLE_SSO_ENABLED NEW_VALUE target.resource.attribute.labels[new_value]
TOGGLE_SSO_ENABLED target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
TOGGLE_SSL DOMAIN_NAME target.domain.name
TOGGLE_SSL NEW_VALUE target.resource.attribute.labels[new_value]
TOGGLE_SSL target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_EU_REPRESENTATIVE_CONTACT_INFO INFO_TYPE target.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to INFO_TYPE, then If the events.parameters.value log field value matches the regular expression pattern: ^.+@.+$, then the events.parameters.value log field is mapped to the target.user.email_addresses UDM field. Otherwise, the target.user.attribute.labels.key UDM field is set to INFO_TYPE and The events.parameters.value log field is mapped to the target.user.attribute.labels.value UDM field.
CHANGE_EU_REPRESENTATIVE_CONTACT_INFO NEW_VALUE target.user.attribute.labels[new_value]
CHANGE_EU_REPRESENTATIVE_CONTACT_INFO OLD_VALUE target.user.attribute.labels[old_value]
CHANGE_LOGIN_BACKGROUND_COLOR DOMAIN_NAME target.domain.name
CHANGE_LOGIN_BACKGROUND_COLOR NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_LOGIN_BACKGROUND_COLOR OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_LOGIN_BACKGROUND_COLOR target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_LOGIN_BORDER_COLOR DOMAIN_NAME target.domain.name
CHANGE_LOGIN_BORDER_COLOR NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_LOGIN_BORDER_COLOR OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_LOGIN_BORDER_COLOR target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_LOGIN_ACTIVITY_TRACE DOMAIN_NAME target.domain.name
CHANGE_LOGIN_ACTIVITY_TRACE NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_LOGIN_ACTIVITY_TRACE OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_LOGIN_ACTIVITY_TRACE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
PLAY_FOR_WORK_ENROLL PLAY_FOR_WORK_MDM_VENDOR_NAME target.resource.attribute.labels[PLAY_FOR_WORK_MDM_VENDOR_NAME]
PLAY_FOR_WORK_ENROLL PLAY_FOR_WORK_TOKEN_ID target.resource.name
PLAY_FOR_WORK_ENROLL target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
PLAY_FOR_WORK_UNENROLL PLAY_FOR_WORK_MDM_VENDOR_NAME target.resource.attribute.labels[PLAY_FOR_WORK_MDM_VENDOR_NAME]
PLAY_FOR_WORK_UNENROLL target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
MX_RECORD_VERIFICATION_CLAIM DOMAIN_NAME target.domain.name
MX_RECORD_VERIFICATION_CLAIM USER_EMAIL target.user.email_addresses
TOGGLE_NEW_APP_FEATURES DOMAIN_NAME target.domain.name
TOGGLE_NEW_APP_FEATURES NEW_VALUE target.resource.attribute.labels[new_value]
TOGGLE_NEW_APP_FEATURES target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
TOGGLE_USE_NEXT_GEN_CONTROL_PANEL DOMAIN_NAME target.domain.name
TOGGLE_USE_NEXT_GEN_CONTROL_PANEL NEW_VALUE target.resource.attribute.labels[new_value]
TOGGLE_USE_NEXT_GEN_CONTROL_PANEL target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
UPLOAD_OAUTH_CERTIFICATE DOMAIN_NAME target.domain.name
REGENERATE_OAUTH_CONSUMER_SECRET DOMAIN_NAME target.domain.name
TOGGLE_OPEN_ID_ENABLED DOMAIN_NAME target.domain.name
TOGGLE_OPEN_ID_ENABLED NEW_VALUE target.resource.attribute.labels[new_value]
TOGGLE_OPEN_ID_ENABLED target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_ORGANIZATION_NAME DOMAIN_NAME target.domain.name
CHANGE_ORGANIZATION_NAME NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_ORGANIZATION_NAME OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_ORGANIZATION_NAME target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
TOGGLE_OUTBOUND_RELAY DOMAIN_NAME target.domain.name
TOGGLE_OUTBOUND_RELAY NEW_VALUE target.resource.attribute.labels[new_value]
TOGGLE_OUTBOUND_RELAY OLD_VALUE target.resource.attribute.labels[old_value]
TOGGLE_OUTBOUND_RELAY ORG_UNIT_NAME additional.fields[org_unit_name]
TOGGLE_OUTBOUND_RELAY target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_PASSWORD_MAX_LENGTH DOMAIN_NAME target.domain.name
CHANGE_PASSWORD_MAX_LENGTH NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_PASSWORD_MAX_LENGTH OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_PASSWORD_MAX_LENGTH target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_PASSWORD_MIN_LENGTH DOMAIN_NAME target.domain.name
CHANGE_PASSWORD_MIN_LENGTH NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_PASSWORD_MIN_LENGTH OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_PASSWORD_MIN_LENGTH target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
UPDATE_DOMAIN_PRIMARY_ADMIN_EMAIL DOMAIN_NAME target.domain.name
UPDATE_DOMAIN_PRIMARY_ADMIN_EMAIL NEW_VALUE target.resource.attribute.labels[new_value]
UPDATE_DOMAIN_PRIMARY_ADMIN_EMAIL OLD_VALUE target.resource.attribute.labels[old_value]
UPDATE_DOMAIN_PRIMARY_ADMIN_EMAIL target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
ENABLE_SERVICE_OR_FEATURE_NOTIFICATIONS DOMAIN_NAME target.domain.name
ENABLE_SERVICE_OR_FEATURE_NOTIFICATIONS NEW_VALUE target.resource.attribute.labels[new_value]
ENABLE_SERVICE_OR_FEATURE_NOTIFICATIONS OLD_VALUE target.resource.attribute.labels[old_value]
ENABLE_SERVICE_OR_FEATURE_NOTIFICATIONS target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
REMOVE_APPLICATION APP_ID target.resource.product_object_id
REMOVE_APPLICATION APPLICATION_NAME target.resource.name
REMOVE_APPLICATION target.application The target.application UDM field is set to Admin.
REMOVE_APPLICATION target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
REMOVE_APPLICATION_FROM_WHITELIST APP_ID target.resource.product_object_id
REMOVE_APPLICATION_FROM_WHITELIST APPLICATION_NAME target.resource.name
CHANGE_RENEW_DOMAIN_REGISTRATION DOMAIN_NAME target.domain.name
CHANGE_RENEW_DOMAIN_REGISTRATION NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_RENEW_DOMAIN_REGISTRATION OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_RENEW_DOMAIN_REGISTRATION target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_RESELLER_ACCESS NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_RESELLER_ACCESS OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_RESELLER_ACCESS target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_RESELLER_ACCESS_FOR_SKU NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_RESELLER_ACCESS_FOR_SKU OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_RESELLER_ACCESS_FOR_SKU SKU_NAME target.resource.name
CHANGE_RESELLER_ACCESS_FOR_SKU target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
RULE_ACTIONS_CHANGED RULE_NAME target.resource.name
CREATE_RULE RULE_NAME target.resource.name
CHANGE_RULE_CRITERIA RULE_NAME target.resource.name
DELETE_RULE RULE_NAME target.resource.name
RENAME_RULE NEW_VALUE target.resource.attribute.labels[new_value]
RENAME_RULE OLD_VALUE target.resource.attribute.labels[old_value]
RULE_STATUS_CHANGED NEW_VALUE target.resource.attribute.labels[new_value]
RULE_STATUS_CHANGED OLD_VALUE target.resource.attribute.labels[old_value]
RULE_STATUS_CHANGED RULE_NAME target.resource.name
RULE_STATUS_CHANGED target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
ADD_SECONDARY_DOMAIN DOMAIN_NAME target.domain.name
ADD_SECONDARY_DOMAIN SECONDARY_DOMAIN_NAME additional.fields[SECONDARY_DOMAIN_NAME]
REMOVE_SECONDARY_DOMAIN DOMAIN_NAME target.domain.name
REMOVE_SECONDARY_DOMAIN SECONDARY_DOMAIN_NAME additional.fields[SECONDARY_DOMAIN_NAME]
SKIP_SECONDARY_DOMAIN_MX DOMAIN_NAME target.domain.name
SKIP_SECONDARY_DOMAIN_MX SECONDARY_DOMAIN_NAME additional.fields[SECONDARY_DOMAIN_NAME]
VERIFY_SECONDARY_DOMAIN_MX DOMAIN_NAME target.domain.name
VERIFY_SECONDARY_DOMAIN_MX SECONDARY_DOMAIN_NAME additional.fields[SECONDARY_DOMAIN_NAME]
VERIFY_SECONDARY_DOMAIN DOMAIN_NAME target.domain.name
VERIFY_SECONDARY_DOMAIN SECONDARY_DOMAIN_NAME additional.fields[SECONDARY_DOMAIN_NAME]
UPDATE_DOMAIN_SECONDARY_EMAIL DOMAIN_NAME target.domain.name
UPDATE_DOMAIN_SECONDARY_EMAIL NEW_VALUE target.resource.attribute.labels[new_value]
UPDATE_DOMAIN_SECONDARY_EMAIL OLD_VALUE target.resource.attribute.labels[old_value]
UPDATE_DOMAIN_SECONDARY_EMAIL target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_SSO_SETTINGS DOMAIN_NAME target.domain.name
CHANGE_SSO_SETTINGS target.application The target.application UDM field is set to Admin.
CHANGE_SSO_SETTINGS target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
UPDATE_RULE RULE_NAME target.resource.name
DROP_FROM_QUARANTINE EMAIL_LOG_SEARCH_MSG_ID additional.fields[email_log_search_msg_id]
DROP_FROM_QUARANTINE QUARANTINE_NAME additional.fields[quarantine_name]
EMAIL_LIFE_OF_A_MESSAGE EMAIL_LIFE_OF_A_MESSAGE_FETCH_EMAIL_DETAILS additional.fields[email_life_of_a_message_fetch_email_details]
EMAIL_LIFE_OF_A_MESSAGE EMAIL_LOG_SEARCH_MSG_ID additional.fields[email_log_search_msg_id]
EMAIL_LIFE_OF_A_MESSAGE EMAIL_LOG_SEARCH_RECIPIENT additional.fields[email_log_search_recipient]
EMAIL_LOG_SEARCH EMAIL_LOG_SEARCH_END_DATE additional.fields[email_log_search_end_date]
EMAIL_LOG_SEARCH EMAIL_LOG_SEARCH_MSG_ID additional.fields[email_log_search_msg_id]
EMAIL_LOG_SEARCH EMAIL_LOG_SEARCH_RECIPIENT additional.fields[email_log_search_recipient]
EMAIL_LOG_SEARCH EMAIL_LOG_SEARCH_SENDER additional.fields[email_log_search_sender]
EMAIL_LOG_SEARCH EMAIL_LOG_SEARCH_SMTP_RECIPIENT_IP additional.fields[email_log_search_smtp_recipient_ip]
EMAIL_LOG_SEARCH EMAIL_LOG_SEARCH_SMTP_SENDER_IP additional.fields[email_log_search_smtp_sender_ip]
EMAIL_LOG_SEARCH EMAIL_LOG_SEARCH_START_DATE additional.fields[email_log_search_start_date]
EMAIL_LOG_SEARCH target.application The target.application UDM field is set to Admin.
EMAIL_UNDELETE END_DATE additional.fields[end_date]
EMAIL_UNDELETE START_DATE additional.fields[start_date]
EMAIL_UNDELETE USER_EMAIL target.user.email_addresses
CHANGE_EMAIL_SETTING DOMAIN_NAME target.domain.name
CHANGE_EMAIL_SETTING GROUP_EMAIL target.group.email_addresses
CHANGE_EMAIL_SETTING NEW_VALUE target.user.attribute.labels[new_value]
CHANGE_EMAIL_SETTING OLD_VALUE target.user.attribute.labels[old_value]
CHANGE_EMAIL_SETTING ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_EMAIL_SETTING SETTING_NAME target.resource.name
CHANGE_EMAIL_SETTING target.application The target.application UDM field is set to Admin.
CHANGE_EMAIL_SETTING target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_GMAIL_SETTING ENABLED_SETTING target.resource.attribute.labels[ENABLED_SETTING]
CHANGE_GMAIL_SETTING ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_GMAIL_SETTING SETTING_DESCRIPTION target.resource.attribute.labels[setting_description]
CHANGE_GMAIL_SETTING SETTING_ENABLED target.resource.attribute.labels[SETTING_ENABLED]
CHANGE_GMAIL_SETTING SETTING_NAME target.resource.name
CHANGE_GMAIL_SETTING USER_DEFINED_SETTING_NAME target.resource.attribute.labels[user_defined_setting_name]
CHANGE_GMAIL_SETTING target.application The target.application UDM field is set to Admin.
CHANGE_GMAIL_SETTING target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CREATE_GMAIL_SETTING ORG_UNIT_NAME additional.fields[org_unit_name]
CREATE_GMAIL_SETTING SETTING_DESCRIPTION target.resource.attribute.labels[setting_description]
CREATE_GMAIL_SETTING SETTING_NAME target.resource.name
CREATE_GMAIL_SETTING USER_DEFINED_SETTING_NAME target.resource.attribute.labels[user_defined_setting_name]
CREATE_GMAIL_SETTING target.application The target.application UDM field is set to Admin.
CREATE_GMAIL_SETTING target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
DELETE_GMAIL_SETTING ORG_UNIT_NAME additional.fields[org_unit_name]
DELETE_GMAIL_SETTING SETTING_DESCRIPTION target.resource.attribute.labels[setting_description]
DELETE_GMAIL_SETTING SETTING_NAME target.resource.name
DELETE_GMAIL_SETTING USER_DEFINED_SETTING_NAME target.resource.attribute.labels[user_defined_setting_name]
DELETE_GMAIL_SETTING target.application The target.application UDM field is set to Admin.
DELETE_GMAIL_SETTING target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
REJECT_FROM_QUARANTINE EMAIL_LOG_SEARCH_MSG_ID additional.fields[email_log_search_msg_id]
REJECT_FROM_QUARANTINE QUARANTINE_NAME additional.fields[quarantine_name]
RELEASE_FROM_QUARANTINE EMAIL_LOG_SEARCH_MSG_ID additional.fields[email_log_search_msg_id]
RELEASE_FROM_QUARANTINE QUARANTINE_NAME additional.fields[quarantine_name]
RELEASE_FROM_QUARANTINE target.application The target.application UDM field is set to Admin.
WHITELISTED_GROUPS_UPDATED WHITELISTED_GROUPS target.group.group_display_name
CREATE_GROUP GROUP_EMAIL target.group.email_addresses
CREATE_GROUP target.application The target.application UDM field is set to Admin.
CREATE_GROUP target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
DELETE_GROUP GROUP_EMAIL target.group.email_addresses
DELETE_GROUP target.application The target.application UDM field is set to Admin.
CHANGE_GROUP_DESCRIPTION GROUP_EMAIL target.group.email_addresses
CHANGE_GROUP_EMAIL GROUP_EMAIL target.group.email_addresses
CHANGE_GROUP_EMAIL NEW_VALUE target.group.attribute.labels[new_value]
ADD_GROUP_MEMBER GROUP_EMAIL target.group.email_addresses
ADD_GROUP_MEMBER USER_EMAIL target.user.email_addresses
ADD_GROUP_MEMBER target.application The target.application UDM field is set to Admin.
ADD_GROUP_MEMBER target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
REMOVE_GROUP_MEMBER GROUP_EMAIL target.group.email_addresses
REMOVE_GROUP_MEMBER USER_EMAIL target.user.email_addresses
REMOVE_GROUP_MEMBER target.application The target.application UDM field is set to Admin.
REMOVE_GROUP_MEMBER target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
UPDATE_GROUP_MEMBER GROUP_EMAIL target.group.email_addresses
UPDATE_GROUP_MEMBER NEW_VALUE target.user.attribute.labels[new_value]
UPDATE_GROUP_MEMBER OLD_VALUE target.user.attribute.labels[old_value]
UPDATE_GROUP_MEMBER USER_EMAIL target.user.email_addresses
UPDATE_GROUP_MEMBER target.application The target.application UDM field is set to Admin.
UPDATE_GROUP_MEMBER target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
UPDATE_GROUP_MEMBER_DELIVERY_SETTINGS GROUP_EMAIL target.group.email_addresses
UPDATE_GROUP_MEMBER_DELIVERY_SETTINGS NEW_VALUE target.user.attribute.labels[new_value]
UPDATE_GROUP_MEMBER_DELIVERY_SETTINGS OLD_VALUE target.user.attribute.labels[old_value]
UPDATE_GROUP_MEMBER_DELIVERY_SETTINGS USER_EMAIL target.user.email_addresses
UPDATE_GROUP_MEMBER_DELIVERY_SETTINGS target.application The target.application UDM field is set to Admin.
UPDATE_GROUP_MEMBER_DELIVERY_SETTINGS target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
UPDATE_GROUP_MEMBER_DELIVERY_SETTINGS_CAN_EMAIL_OVERRIDE GROUP_EMAIL target.group.email_addresses
UPDATE_GROUP_MEMBER_DELIVERY_SETTINGS_CAN_EMAIL_OVERRIDE NEW_VALUE target.group.attribute.labels[new_value]
UPDATE_GROUP_MEMBER_DELIVERY_SETTINGS_CAN_EMAIL_OVERRIDE OLD_VALUE target.group.attribute.labels[old_value]
UPDATE_GROUP_MEMBER_DELIVERY_SETTINGS_CAN_EMAIL_OVERRIDE USER_EMAIL target.user.email_addresses
GROUP_MEMBER_BULK_UPLOAD GROUP_MEMBER_BULK_UPLOAD_FAILED_NUMBER additional.fields[group_member_bulk_upload_failed_number]
GROUP_MEMBER_BULK_UPLOAD GROUP_MEMBER_BULK_UPLOAD_TOTAL_NUMBER additional.fields[group_member_bulk_upload_total_number]
CHANGE_GROUP_NAME GROUP_EMAIL target.group.email_addresses
CHANGE_GROUP_NAME NEW_VALUE target.group.attribute.labels[new_value]
CHANGE_GROUP_SETTING GROUP_EMAIL target.group.email_addresses
CHANGE_GROUP_SETTING NEW_VALUE target.user.attribute.labels[new_value]
CHANGE_GROUP_SETTING OLD_VALUE target.user.attribute.labels[old_value]
CHANGE_GROUP_SETTING SETTING_NAME target.resource.name
CHANGE_GROUP_SETTING target.application The target.application UDM field is set to Admin.
CHANGE_GROUP_SETTING target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHROME_APP_LICENSES_ENABLED APPLICATION_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to APPLICATION_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
CHROME_APP_LICENSES_ENABLED CHROME_LICENSES_ENABLED additional.fields[CHROME_LICENSES_ENABLED]
CHROME_APP_LICENSES_ENABLED DISTRIBUTION_ENTITY_NAME target.group.group_display_name DISTRIBUTION_ENTITY_NAME log field value is set to empty and DISTRIBUTION_ENTITY_TYPE log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DISTRIBUTION_ENTITY_NAME, then DISTRIBUTION_ENTITY_NAME log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to DISTRIBUTION_ENTITY_TYPE, then DISTRIBUTION_ENTITY_TYPE log field value is set to the events.parameters.value log field value.
If the DISTRIBUTION_ENTITY_TYPE log field value is equal to GROUP, then the DISTRIBUTION_ENTITY_NAME log field is mapped to the target.group.group_display_name UDM field.
Else if the DISTRIBUTION_ENTITY_TYPE log field value is equal to ORG_UNIT, then The additional.fields.key UDM field is set to distribution_entity_name and the DISTRIBUTION_ENTITY_NAME log field is mapped to the additional.fields.value UDM field.
Else if the DISTRIBUTION_ENTITY_TYPE log field value is equal to USER, then the DISTRIBUTION_ENTITY_NAME log field is mapped to the target.user.user_display_name UDM field.
CHROME_APP_LICENSES_ENABLED DISTRIBUTION_ENTITY_TYPE additional.fields[distribution_entity_type]
CHROME_APP_LICENSES_ENABLED target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
ORG_USERS_LICENSE_ASSIGNMENT NEW_VALUE target.resource.name
ORG_USERS_LICENSE_ASSIGNMENT ORG_UNIT_NAME additional.fields[org_unit_name]
ORG_USERS_LICENSE_ASSIGNMENT PRODUCT_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to PRODUCT_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
ORG_USERS_LICENSE_ASSIGNMENT target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
ORG_ALL_USERS_LICENSE_ASSIGNMENT NEW_VALUE target.resource.name
ORG_ALL_USERS_LICENSE_ASSIGNMENT ORG_UNIT_NAME additional.fields[org_unit_name]
ORG_ALL_USERS_LICENSE_ASSIGNMENT PRODUCT_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to PRODUCT_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
ORG_ALL_USERS_LICENSE_ASSIGNMENT target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
SUPPRESSED_LICENSE_ASSIGNMENT NEW_VALUE target.resource.name
SUPPRESSED_LICENSE_ASSIGNMENT PRODUCT_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to PRODUCT_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
SUPPRESSED_LICENSE_ASSIGNMENT USER_EMAIL target.user.email_addresses
SUPPRESSED_LICENSE_ASSIGNMENT target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
TEMPORARY_LICENSE_ASSIGNMENT NEW_VALUE target.resource.name
TEMPORARY_LICENSE_ASSIGNMENT PRODUCT_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to PRODUCT_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
TEMPORARY_LICENSE_ASSIGNMENT USER_EMAIL target.user.email_addresses
TEMPORARY_LICENSE_ASSIGNMENT target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
USER_LICENSE_ASSIGNMENT NEW_VALUE target.user.attribute.labels[new_value]
USER_LICENSE_ASSIGNMENT PRODUCT_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to PRODUCT_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
USER_LICENSE_ASSIGNMENT USER_EMAIL target.user.email_addresses
USER_LICENSE_ASSIGNMENT target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_LICENSE_AUTO_ASSIGN NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_LICENSE_AUTO_ASSIGN PRODUCT_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to PRODUCT_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
CHANGE_LICENSE_AUTO_ASSIGN SKU_NAME target.resource.name
CHANGE_LICENSE_AUTO_ASSIGN target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
SUPPRESSED_TO_ASSIGNED_LICENSE_CONVERSION NEW_VALUE target.resource.name
SUPPRESSED_TO_ASSIGNED_LICENSE_CONVERSION PRODUCT_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to PRODUCT_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
SUPPRESSED_TO_ASSIGNED_LICENSE_CONVERSION USER_EMAIL target.user.email_addresses
SUPPRESSED_TO_ASSIGNED_LICENSE_CONVERSION target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
TEMPORARY_TO_ASSIGNED_LICENSE_CONVERSION NEW_VALUE target.resource.name
TEMPORARY_TO_ASSIGNED_LICENSE_CONVERSION PRODUCT_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to PRODUCT_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
TEMPORARY_TO_ASSIGNED_LICENSE_CONVERSION USER_EMAIL target.user.email_addresses
TEMPORARY_TO_ASSIGNED_LICENSE_CONVERSION target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
TEMPORARY_TO_SUPPRESSED_LICENSE_CONVERSION NEW_VALUE target.resource.name
TEMPORARY_TO_SUPPRESSED_LICENSE_CONVERSION PRODUCT_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to PRODUCT_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
TEMPORARY_TO_SUPPRESSED_LICENSE_CONVERSION USER_EMAIL target.user.email_addresses
TEMPORARY_TO_SUPPRESSED_LICENSE_CONVERSION target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
FIRST_TEMPORARY_OR_SUPPRESSED_LICENSE_NOTIFICATION SKU_NAME target.resource.name
RESELLER_FIRST_TEMPORARY_OR_SUPPRESSED_LICENSE_NOTIFICATION DOMAIN_NAME target.domain.name
RESELLER_FIRST_TEMPORARY_OR_SUPPRESSED_LICENSE_NOTIFICATION SKU_NAME target.resource.name
USER_LICENSE_REASSIGNMENT NEW_VALUE target.resource.attribute.labels[new_value]
USER_LICENSE_REASSIGNMENT OLD_VALUE target.resource.attribute.labels[old_value]
USER_LICENSE_REASSIGNMENT PRODUCT_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to PRODUCT_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
USER_LICENSE_REASSIGNMENT USER_EMAIL target.user.email_addresses
USER_LICENSE_REASSIGNMENT target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
ORG_LICENSE_REVOKE OLD_VALUE target.resource.name
ORG_LICENSE_REVOKE ORG_UNIT_NAME additional.fields[org_unit_name]
ORG_LICENSE_REVOKE PRODUCT_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to PRODUCT_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
ORG_LICENSE_REVOKE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
SUPPRESSED_LICENSE_REVOKE OLD_VALUE target.resource.name
SUPPRESSED_LICENSE_REVOKE PRODUCT_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to PRODUCT_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
SUPPRESSED_LICENSE_REVOKE USER_EMAIL target.user.email_addresses
SUPPRESSED_LICENSE_REVOKE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
TEMPORARY_LICENSE_REVOKE OLD_VALUE target.resource.name
TEMPORARY_LICENSE_REVOKE PRODUCT_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to PRODUCT_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
TEMPORARY_LICENSE_REVOKE USER_EMAIL target.user.email_addresses
TEMPORARY_LICENSE_REVOKE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
USER_LICENSE_REVOKE OLD_VALUE target.user.attribute.labels[old_value]
USER_LICENSE_REVOKE PRODUCT_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to PRODUCT_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
USER_LICENSE_REVOKE USER_EMAIL target.user.email_addresses
USER_LICENSE_REVOKE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
TEMPORARY_LICENSES_EXPIRED_NOTIFICATION SKU_NAME target.resource.name
RESELLER_TEMPORARY_LICENSES_EXPIRED_NOTIFICATION DOMAIN_NAME target.domain.name
RESELLER_TEMPORARY_LICENSES_EXPIRED_NOTIFICATION SKU_NAME target.resource.name
UPDATE_DYNAMIC_LICENSE NEW_VALUE target.resource.attribute.labels[new_value]
UPDATE_DYNAMIC_LICENSE OLD_VALUE target.resource.attribute.labels[old_value]
UPDATE_DYNAMIC_LICENSE ORG_UNIT_NAME additional.fields[org_unit_name]
UPDATE_DYNAMIC_LICENSE PRODUCT_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to PRODUCT_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
UPDATE_DYNAMIC_LICENSE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHROME_APP_USER_LICENSE_ASSIGNED APP_LICENSE target.resource.name
CHROME_APP_USER_LICENSE_ASSIGNED USER_EMAIL target.user.email_addresses
CHROME_APP_USER_LICENSE_ASSIGNED target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHROME_APP_USER_LICENSE_REVOKED APP_LICENSE target.resource.name
CHROME_APP_USER_LICENSE_REVOKED USER_EMAIL target.user.email_addresses
CHROME_APP_USER_LICENSE_REVOKED target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
ACTION_CANCELLED ACTION_ID security_result.detection_fields[action_id]
ACTION_CANCELLED ACTION_TYPE security_result.action_details
ACTION_CANCELLED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template Asset ID:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
ACTION_CANCELLED DEVICE_TYPE target.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_TYPE, then If the events.parameters.value log field value matches the regular expression pattern: (?i)windows, then the target.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)mac, then the target.platform UDM field is set to MAC. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)linux, then the target.platform UDM field is set to LINUX. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)ios, then the target.platform UDM field is set to IOS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)android, then the target.platform UDM field is set to ANDROID. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)chrome, then the target.platform UDM field is set to CHROME_OS.
ACTION_CANCELLED USER_EMAIL target.user.email_addresses
ACTION_REQUESTED ACTION_ID security_result.detection_fields[action_id]
ACTION_REQUESTED ACTION_TYPE security_result.action_details
ACTION_REQUESTED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template Asset ID:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
ACTION_REQUESTED DEVICE_TYPE target.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_TYPE, then If the events.parameters.value log field value matches the regular expression pattern: (?i)windows, then the target.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)mac, then the target.platform UDM field is set to MAC. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)linux, then the target.platform UDM field is set to LINUX. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)ios, then the target.platform UDM field is set to IOS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)android, then the target.platform UDM field is set to ANDROID. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)chrome, then the target.platform UDM field is set to CHROME_OS.
ACTION_REQUESTED USER_EMAIL target.user.email_addresses
ACTION_REQUESTED target.application The target.application UDM field is set to Admin.
ACTION_REQUESTED target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
ADD_MOBILE_CERTIFICATE DOMAIN_NAME target.domain.name
ADD_MOBILE_CERTIFICATE MOBILE_CERTIFICATE_COMMON_NAME target.resource.name
ADD_MOBILE_CERTIFICATE ORG_UNIT_NAME additional.fields[org_unit_name]
ADD_MOBILE_CERTIFICATE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
APPLE_DEP_SYNC_TRIGGERED USER_EMAIL target.user.email_addresses
APPLE_DEP_TOKEN_SETUP_COMPLETE USER_EMAIL target.user.email_addresses
APPLE_VPP_TOKEN_OPERATION TOKEN_OPERATION_NAME additional.fields[TOKEN_OPERATION_NAME]
APPLE_VPP_TOKEN_OPERATION TOKEN_OPERATION_STATUS additional.fields[TOKEN_OPERATION_STATUS]
COMPANY_DEVICES_BULK_CREATION NUMBER_OF_COMPANY_OWNED_DEVICES additional.fields[NUMBER_OF_COMPANY_OWNED_DEVICES]
COMPANY_OWNED_DEVICE_BLOCKED COMPANY_DEVICE_ID target.asset_id
COMPANY_OWNED_DEVICE_BLOCKED DEVICE_TYPE target.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_TYPE, then If the events.parameters.value log field value matches the regular expression pattern: (?i)windows, then the target.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)mac, then the target.platform UDM field is set to MAC. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)linux, then the target.platform UDM field is set to LINUX. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)ios, then the target.platform UDM field is set to IOS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)android, then the target.platform UDM field is set to ANDROID. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)chrome, then the target.platform UDM field is set to CHROME_OS.
COMPANY_OWNED_DEVICE_BLOCKED target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
COMPANY_DEVICE_DELETION COMPANY_DEVICE_ID target.asset_id
COMPANY_DEVICE_DELETION DEVICE_TYPE target.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_TYPE, then If the events.parameters.value log field value matches the regular expression pattern: (?i)windows, then the target.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)mac, then the target.platform UDM field is set to MAC. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)linux, then the target.platform UDM field is set to LINUX. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)ios, then the target.platform UDM field is set to IOS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)android, then the target.platform UDM field is set to ANDROID. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)chrome, then the target.platform UDM field is set to CHROME_OS.
COMPANY_DEVICE_DELETION target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
COMPANY_OWNED_DEVICE_UNBLOCKED COMPANY_DEVICE_ID target.asset_id
COMPANY_OWNED_DEVICE_UNBLOCKED DEVICE_TYPE target.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_TYPE, then If the events.parameters.value log field value matches the regular expression pattern: (?i)windows, then the target.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)mac, then the target.platform UDM field is set to MAC. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)linux, then the target.platform UDM field is set to LINUX. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)ios, then the target.platform UDM field is set to IOS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)android, then the target.platform UDM field is set to ANDROID. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)chrome, then the target.platform UDM field is set to CHROME_OS.
COMPANY_OWNED_DEVICE_UNBLOCKED target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
COMPANY_OWNED_DEVICE_WIPED COMPANY_DEVICE_ID target.asset_id
COMPANY_OWNED_DEVICE_WIPED DEVICE_TYPE target.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_TYPE, then If the events.parameters.value log field value matches the regular expression pattern: (?i)windows, then the target.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)mac, then the target.platform UDM field is set to MAC. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)linux, then the target.platform UDM field is set to LINUX. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)ios, then the target.platform UDM field is set to IOS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)android, then the target.platform UDM field is set to ANDROID. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)chrome, then the target.platform UDM field is set to CHROME_OS.
COMPANY_OWNED_DEVICE_WIPED target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CUSTOMER_USER_DEVICE_DELETION_EVENT COMPANY_DEVICE_ID target.asset_id
CUSTOMER_USER_DEVICE_DELETION_EVENT DEVICE_TYPE target.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_TYPE, then If the events.parameters.value log field value matches the regular expression pattern: (?i)windows, then the target.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)mac, then the target.platform UDM field is set to MAC. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)linux, then the target.platform UDM field is set to LINUX. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)ios, then the target.platform UDM field is set to IOS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)android, then the target.platform UDM field is set to ANDROID. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)chrome, then the target.platform UDM field is set to CHROME_OS.
CUSTOMER_USER_DEVICE_DELETION_EVENT target.application The target.application UDM field is set to Admin.
CUSTOMER_USER_DEVICE_DELETION_EVENT target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_MOBILE_APPLICATION_PERMISSION_GRANT DEVICE_TYPE target.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_TYPE, then If the events.parameters.value log field value matches the regular expression pattern: (?i)windows, then the target.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)mac, then the target.platform UDM field is set to MAC. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)linux, then the target.platform UDM field is set to LINUX. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)ios, then the target.platform UDM field is set to IOS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)android, then the target.platform UDM field is set to ANDROID. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)chrome, then the target.platform UDM field is set to CHROME_OS.
CHANGE_MOBILE_APPLICATION_PERMISSION_GRANT DISTRIBUTION_ENTITY_NAME target.group.group_display_name DISTRIBUTION_ENTITY_NAME log field value is set to empty and DISTRIBUTION_ENTITY_TYPE log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DISTRIBUTION_ENTITY_NAME, then DISTRIBUTION_ENTITY_NAME log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to DISTRIBUTION_ENTITY_TYPE, then DISTRIBUTION_ENTITY_TYPE log field value is set to the events.parameters.value log field value.
If the DISTRIBUTION_ENTITY_TYPE log field value is equal to GROUP, then the DISTRIBUTION_ENTITY_NAME log field is mapped to the target.group.group_display_name UDM field.
Else if the DISTRIBUTION_ENTITY_TYPE log field value is equal to ORG_UNIT, then The additional.fields.key UDM field is set to distribution_entity_name and the DISTRIBUTION_ENTITY_NAME log field is mapped to the additional.fields.value UDM field.
Else if the DISTRIBUTION_ENTITY_TYPE log field value is equal to USER, then the DISTRIBUTION_ENTITY_NAME log field is mapped to the target.user.user_display_name UDM field.
CHANGE_MOBILE_APPLICATION_PERMISSION_GRANT DISTRIBUTION_ENTITY_TYPE additional.fields[distribution_entity_type]
CHANGE_MOBILE_APPLICATION_PERMISSION_GRANT MOBILE_APP_PACKAGE_ID target.resource.name
CHANGE_MOBILE_APPLICATION_PERMISSION_GRANT NEW_PERMISSION_GRANT_STATE target.resource.attribute.labels[NEW_PERMISSION_GRANT_STATE]
CHANGE_MOBILE_APPLICATION_PERMISSION_GRANT OLD_PERMISSION_GRANT_STATE target.resource.attribute.labels[OLD_PERMISSION_GRANT_STATE]
CHANGE_MOBILE_APPLICATION_PERMISSION_GRANT PERMISSION_GROUP_NAME additional.fields[PERMISSION_GROUP_NAME]
CHANGE_MOBILE_APPLICATION_PERMISSION_GRANT target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_MOBILE_APPLICATION_PRIORITY_ORDER DEVICE_TYPE target.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_TYPE, then If the events.parameters.value log field value matches the regular expression pattern: (?i)windows, then the target.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)mac, then the target.platform UDM field is set to MAC. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)linux, then the target.platform UDM field is set to LINUX. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)ios, then the target.platform UDM field is set to IOS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)android, then the target.platform UDM field is set to ANDROID. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)chrome, then the target.platform UDM field is set to CHROME_OS.
CHANGE_MOBILE_APPLICATION_PRIORITY_ORDER MOBILE_APP_PACKAGE_ID target.resource.name
CHANGE_MOBILE_APPLICATION_PRIORITY_ORDER target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
REMOVE_MOBILE_APPLICATION_FROM_WHITELIST DEVICE_TYPE target.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_TYPE, then If the events.parameters.value log field value matches the regular expression pattern: (?i)windows, then the target.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)mac, then the target.platform UDM field is set to MAC. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)linux, then the target.platform UDM field is set to LINUX. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)ios, then the target.platform UDM field is set to IOS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)android, then the target.platform UDM field is set to ANDROID. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)chrome, then the target.platform UDM field is set to CHROME_OS.
REMOVE_MOBILE_APPLICATION_FROM_WHITELIST DISTRIBUTION_ENTITY_NAME additional.fields[distribution_entity_name]
REMOVE_MOBILE_APPLICATION_FROM_WHITELIST DISTRIBUTION_ENTITY_TYPE additional.fields[distribution_entity_type]
REMOVE_MOBILE_APPLICATION_FROM_WHITELIST MOBILE_APP_PACKAGE_ID target.resource.name
REMOVE_MOBILE_APPLICATION_FROM_WHITELIST target.application The target.application UDM field is set to Admin.
REMOVE_MOBILE_APPLICATION_FROM_WHITELIST target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_MOBILE_APPLICATION_SETTINGS DEVICE_TYPE target.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_TYPE, then If the events.parameters.value log field value matches the regular expression pattern: (?i)windows, then the target.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)mac, then the target.platform UDM field is set to MAC. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)linux, then the target.platform UDM field is set to LINUX. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)ios, then the target.platform UDM field is set to IOS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)android, then the target.platform UDM field is set to ANDROID. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)chrome, then the target.platform UDM field is set to CHROME_OS.
CHANGE_MOBILE_APPLICATION_SETTINGS DISTRIBUTION_ENTITY_NAME additional.fields[distribution_entity_name]
CHANGE_MOBILE_APPLICATION_SETTINGS DISTRIBUTION_ENTITY_TYPE additional.fields[distribution_entity_type]
CHANGE_MOBILE_APPLICATION_SETTINGS MOBILE_APP_PACKAGE_ID additional.fields[mobile_app_package_id]
CHANGE_MOBILE_APPLICATION_SETTINGS NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_MOBILE_APPLICATION_SETTINGS OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_MOBILE_APPLICATION_SETTINGS SETTING_NAME target.resource.name
CHANGE_MOBILE_APPLICATION_SETTINGS target.application The target.application UDM field is set to Admin.
CHANGE_MOBILE_APPLICATION_SETTINGS target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
ADD_MOBILE_APPLICATION_TO_WHITELIST DEVICE_TYPE target.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_TYPE, then If the events.parameters.value log field value matches the regular expression pattern: (?i)windows, then the target.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)mac, then the target.platform UDM field is set to MAC. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)linux, then the target.platform UDM field is set to LINUX. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)ios, then the target.platform UDM field is set to IOS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)android, then the target.platform UDM field is set to ANDROID. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)chrome, then the target.platform UDM field is set to CHROME_OS.
ADD_MOBILE_APPLICATION_TO_WHITELIST DISTRIBUTION_ENTITY_NAME additional.fields[distribution_entity_name]
ADD_MOBILE_APPLICATION_TO_WHITELIST DISTRIBUTION_ENTITY_TYPE additional.fields[distribution_entity_type]
ADD_MOBILE_APPLICATION_TO_WHITELIST MOBILE_APP_PACKAGE_ID target.resource.name
ADD_MOBILE_APPLICATION_TO_WHITELIST target.application The target.application UDM field is set to Admin.
ADD_MOBILE_APPLICATION_TO_WHITELIST target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
MOBILE_DEVICE_APPROVE DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template Asset ID:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
MOBILE_DEVICE_APPROVE DEVICE_TYPE target.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_TYPE, then If the events.parameters.value log field value matches the regular expression pattern: (?i)windows, then the target.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)mac, then the target.platform UDM field is set to MAC. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)linux, then the target.platform UDM field is set to LINUX. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)ios, then the target.platform UDM field is set to IOS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)android, then the target.platform UDM field is set to ANDROID. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)chrome, then the target.platform UDM field is set to CHROME_OS.
MOBILE_DEVICE_APPROVE USER_EMAIL target.user.email_addresses
MOBILE_DEVICE_APPROVE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
MOBILE_DEVICE_BLOCK DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template Asset ID:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
MOBILE_DEVICE_BLOCK DEVICE_TYPE target.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_TYPE, then If the events.parameters.value log field value matches the regular expression pattern: (?i)windows, then the target.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)mac, then the target.platform UDM field is set to MAC. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)linux, then the target.platform UDM field is set to LINUX. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)ios, then the target.platform UDM field is set to IOS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)android, then the target.platform UDM field is set to ANDROID. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)chrome, then the target.platform UDM field is set to CHROME_OS.
MOBILE_DEVICE_BLOCK USER_EMAIL target.user.email_addresses
MOBILE_DEVICE_BLOCK target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
MOBILE_DEVICE_DELETE DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template Asset ID:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
MOBILE_DEVICE_DELETE DEVICE_TYPE target.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_TYPE, then If the events.parameters.value log field value matches the regular expression pattern: (?i)windows, then the target.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)mac, then the target.platform UDM field is set to MAC. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)linux, then the target.platform UDM field is set to LINUX. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)ios, then the target.platform UDM field is set to IOS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)android, then the target.platform UDM field is set to ANDROID. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)chrome, then the target.platform UDM field is set to CHROME_OS.
MOBILE_DEVICE_DELETE USER_EMAIL target.user.email_addresses
MOBILE_DEVICE_DELETE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
MOBILE_DEVICE_WIPE DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template Asset ID:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
MOBILE_DEVICE_WIPE DEVICE_TYPE target.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_TYPE, then If the events.parameters.value log field value matches the regular expression pattern: (?i)windows, then the target.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)mac, then the target.platform UDM field is set to MAC. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)linux, then the target.platform UDM field is set to LINUX. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)ios, then the target.platform UDM field is set to IOS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)android, then the target.platform UDM field is set to ANDROID. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)chrome, then the target.platform UDM field is set to CHROME_OS.
MOBILE_DEVICE_WIPE USER_EMAIL target.user.email_addresses
MOBILE_DEVICE_WIPE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_MOBILE_SETTING DOMAIN_NAME target.domain.name
CHANGE_MOBILE_SETTING NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_MOBILE_SETTING OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_MOBILE_SETTING ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_MOBILE_SETTING SETTING_NAME target.resource.name
CHANGE_MOBILE_SETTING target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_ADMIN_RESTRICTIONS_PIN DOMAIN_NAME target.domain.name
CHANGE_ADMIN_RESTRICTIONS_PIN ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_ADMIN_RESTRICTIONS_PIN target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_MOBILE_WIRELESS_NETWORK DOMAIN_NAME target.domain.name
CHANGE_MOBILE_WIRELESS_NETWORK MOBILE_WIRELESS_NETWORK_NAME target.resource.name
CHANGE_MOBILE_WIRELESS_NETWORK ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_MOBILE_WIRELESS_NETWORK target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
ADD_MOBILE_WIRELESS_NETWORK DOMAIN_NAME target.domain.name
ADD_MOBILE_WIRELESS_NETWORK MOBILE_WIRELESS_NETWORK_NAME target.resource.name
ADD_MOBILE_WIRELESS_NETWORK ORG_UNIT_NAME additional.fields[org_unit_name]
ADD_MOBILE_WIRELESS_NETWORK target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
REMOVE_MOBILE_WIRELESS_NETWORK DOMAIN_NAME target.domain.name
REMOVE_MOBILE_WIRELESS_NETWORK MOBILE_WIRELESS_NETWORK_NAME target.resource.name
REMOVE_MOBILE_WIRELESS_NETWORK ORG_UNIT_NAME additional.fields[org_unit_name]
REMOVE_MOBILE_WIRELESS_NETWORK target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_MOBILE_WIRELESS_NETWORK_PASSWORD DOMAIN_NAME target.domain.name
CHANGE_MOBILE_WIRELESS_NETWORK_PASSWORD MOBILE_WIRELESS_NETWORK_NAME target.resource.name
CHANGE_MOBILE_WIRELESS_NETWORK_PASSWORD ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_MOBILE_WIRELESS_NETWORK_PASSWORD target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
REMOVE_MOBILE_CERTIFICATE DOMAIN_NAME target.domain.name
REMOVE_MOBILE_CERTIFICATE MOBILE_CERTIFICATE_COMMON_NAME target.resource.name
REMOVE_MOBILE_CERTIFICATE ORG_UNIT_NAME additional.fields[org_unit_name]
REMOVE_MOBILE_CERTIFICATE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
MOBILE_ACCOUNT_WIPE DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template Asset ID:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
MOBILE_ACCOUNT_WIPE DEVICE_TYPE target.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_TYPE, then If the events.parameters.value log field value matches the regular expression pattern: (?i)windows, then the target.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)mac, then the target.platform UDM field is set to MAC. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)linux, then the target.platform UDM field is set to LINUX. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)ios, then the target.platform UDM field is set to IOS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)android, then the target.platform UDM field is set to ANDROID. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)chrome, then the target.platform UDM field is set to CHROME_OS.
MOBILE_ACCOUNT_WIPE USER_EMAIL target.user.email_addresses
MOBILE_ACCOUNT_WIPE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
MOBILE_DEVICE_CANCEL_WIPE_THEN_APPROVE DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template Asset ID:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
MOBILE_DEVICE_CANCEL_WIPE_THEN_APPROVE DEVICE_TYPE target.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_TYPE, then If the events.parameters.value log field value matches the regular expression pattern: (?i)windows, then the target.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)mac, then the target.platform UDM field is set to MAC. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)linux, then the target.platform UDM field is set to LINUX. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)ios, then the target.platform UDM field is set to IOS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)android, then the target.platform UDM field is set to ANDROID. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)chrome, then the target.platform UDM field is set to CHROME_OS.
MOBILE_DEVICE_CANCEL_WIPE_THEN_APPROVE USER_EMAIL target.user.email_addresses
MOBILE_DEVICE_CANCEL_WIPE_THEN_APPROVE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
MOBILE_DEVICE_CANCEL_WIPE_THEN_BLOCK DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template Asset ID:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
MOBILE_DEVICE_CANCEL_WIPE_THEN_BLOCK DEVICE_TYPE target.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_TYPE, then If the events.parameters.value log field value matches the regular expression pattern: (?i)windows, then the target.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)mac, then the target.platform UDM field is set to MAC. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)linux, then the target.platform UDM field is set to LINUX. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)ios, then the target.platform UDM field is set to IOS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)android, then the target.platform UDM field is set to ANDROID. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)chrome, then the target.platform UDM field is set to CHROME_OS.
MOBILE_DEVICE_CANCEL_WIPE_THEN_BLOCK USER_EMAIL target.user.email_addresses
MOBILE_DEVICE_CANCEL_WIPE_THEN_BLOCK target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHROME_LICENSES_ENABLED APPLICATION_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to APPLICATION_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
CHROME_LICENSES_ENABLED CHROME_LICENSES_ENABLED additional.fields[CHROME_LICENSES_ENABLED]
CHROME_LICENSES_ENABLED ORG_UNIT_NAME target.resource.name
CHROME_LICENSES_ENABLED target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHROME_APPLICATION_LICENSE_RESERVATION_CREATED APPLICATION_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to APPLICATION_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
CHROME_APPLICATION_LICENSE_RESERVATION_CREATED NEW_VALUE target.resource.attribute.labels[new_value]
CHROME_APPLICATION_LICENSE_RESERVATION_CREATED ORG_UNIT_NAME target.resource.name
CHROME_APPLICATION_LICENSE_RESERVATION_CREATED SKU_NAME additional.fields[SKU_NAME]
CHROME_APPLICATION_LICENSE_RESERVATION_CREATED target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHROME_APPLICATION_LICENSE_RESERVATION_DELETED APPLICATION_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to APPLICATION_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
CHROME_APPLICATION_LICENSE_RESERVATION_DELETED ORG_UNIT_NAME target.resource.name
CHROME_APPLICATION_LICENSE_RESERVATION_DELETED SKU_NAME additional.fields[SKU_NAME]
CHROME_APPLICATION_LICENSE_RESERVATION_DELETED target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHROME_APPLICATION_LICENSE_RESERVATION_UPDATED APPLICATION_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to APPLICATION_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
CHROME_APPLICATION_LICENSE_RESERVATION_UPDATED NEW_VALUE target.resource.attribute.labels[new_value]
CHROME_APPLICATION_LICENSE_RESERVATION_UPDATED OLD_VALUE target.resource.attribute.labels[old_value]
CHROME_APPLICATION_LICENSE_RESERVATION_UPDATED ORG_UNIT_NAME target.resource.name
CHROME_APPLICATION_LICENSE_RESERVATION_UPDATED SKU_NAME additional.fields[SKU_NAME]
CHROME_APPLICATION_LICENSE_RESERVATION_UPDATED target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CREATE_DEVICE_ENROLLMENT_TOKEN FULL_ORG_UNIT_PATH target.resource.name
ASSIGN_CUSTOM_LOGO ORG_UNIT_NAME target.resource.name
ASSIGN_CUSTOM_LOGO target.application The target.application UDM field is set to Admin.
ASSIGN_CUSTOM_LOGO target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
UNASSIGN_CUSTOM_LOGO ORG_UNIT_NAME target.resource.name
UNASSIGN_CUSTOM_LOGO target.application The target.application UDM field is set to Admin.
UNASSIGN_CUSTOM_LOGO target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CREATE_ENROLLMENT_TOKEN ORG_UNIT_NAME target.resource.name
REVOKE_ENROLLMENT_TOKEN ORG_UNIT_NAME target.resource.name
CHROME_LICENSES_ALLOWED APPLICATION_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to APPLICATION_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
CHROME_LICENSES_ALLOWED CHROME_LICENSES_ALLOWED additional.fields[CHROME_LICENSES_ALLOWED]
CHROME_LICENSES_ALLOWED ORG_UNIT_NAME target.resource.name
CREATE_ORG_UNIT ORG_UNIT_NAME target.resource.name
CREATE_ORG_UNIT target.application The target.application UDM field is set to Admin.
CREATE_ORG_UNIT target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
REMOVE_ORG_UNIT ORG_UNIT_NAME target.resource.name
REMOVE_ORG_UNIT target.application The target.application UDM field is set to Admin.
REMOVE_ORG_UNIT target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
EDIT_ORG_UNIT_DESCRIPTION ORG_UNIT_NAME target.resource.name
EDIT_ORG_UNIT_DESCRIPTION target.application The target.application UDM field is set to Admin.
EDIT_ORG_UNIT_DESCRIPTION target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
MOVE_ORG_UNIT NEW_VALUE additional.fields[new_value]
MOVE_ORG_UNIT ORG_UNIT_NAME target.resource.name
MOVE_ORG_UNIT target.application The target.application UDM field is set to Admin.
MOVE_ORG_UNIT target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
EDIT_ORG_UNIT_NAME NEW_VALUE additional.fields[new_value]
EDIT_ORG_UNIT_NAME ORG_UNIT_NAME target.resource.name
EDIT_ORG_UNIT_NAME target.application The target.application UDM field is set to Admin.
EDIT_ORG_UNIT_NAME target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
REVOKE_DEVICE_ENROLLMENT_TOKEN FULL_ORG_UNIT_PATH target.resource.name
TOGGLE_SERVICE_ENABLED DOMAIN_NAME target.domain.name
TOGGLE_SERVICE_ENABLED GROUP_EMAIL target.group.email_addresses
TOGGLE_SERVICE_ENABLED NEW_VALUE additional.fields[new_value]
TOGGLE_SERVICE_ENABLED ORG_UNIT_NAME additional.fields[org_unit_name]
TOGGLE_SERVICE_ENABLED SERVICE_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to SERVICE_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
TOGGLE_SERVICE_ENABLED target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_CAA_APP_ASSIGNMENTS APPLICATION_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to APPLICATION_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
CHANGE_CAA_APP_ASSIGNMENTS CAA_ACCESS_ASSIGNMENTS_NEW target.resource.attribute.labels[CAA_ACCESS_ASSIGNMENTS_NEW]
CHANGE_CAA_APP_ASSIGNMENTS CAA_ACCESS_ASSIGNMENTS_OLD target.resource.attribute.labels[CAA_ACCESS_ASSIGNMENTS_OLD]
CHANGE_CAA_APP_ASSIGNMENTS CAA_ACCESS_LEVELS_NEW target.resource.attribute.labels[CAA_ACCESS_LEVELS_NEW]
CHANGE_CAA_APP_ASSIGNMENTS CAA_ACCESS_LEVELS_OLD target.resource.attribute.labels[CAA_ACCESS_LEVELS_OLD]
CHANGE_CAA_APP_ASSIGNMENTS CAA_ASSIGNMENTS_NEW target.resource.attribute.labels[CAA_ASSIGNMENTS_NEW]
CHANGE_CAA_APP_ASSIGNMENTS CAA_ASSIGNMENTS_OLD target.resource.attribute.labels[CAA_ASSIGNMENTS_OLD]
CHANGE_CAA_APP_ASSIGNMENTS CAA_ENFORCEMENT_ENDPOINTS_NEW target.resource.attribute.labels[CAA_ENFORCEMENT_ENDPOINTS_NEW]
CHANGE_CAA_APP_ASSIGNMENTS CAA_ENFORCEMENT_ENDPOINTS_OLD target.resource.attribute.labels[CAA_ENFORCEMENT_ENDPOINTS_OLD]
CHANGE_CAA_APP_ASSIGNMENTS GROUP_NAME about.group.group_display_name
CHANGE_CAA_APP_ASSIGNMENTS MODE target.resource.attribute.labels[MODE]
CHANGE_CAA_APP_ASSIGNMENTS ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_CAA_APP_ASSIGNMENTS TARGET_ENTITY_NAME target.resource.name
CHANGE_CAA_APP_ASSIGNMENTS TARGET_ENTITY_TYPE target.resource.resource_subtype
CHANGE_CAA_APP_ASSIGNMENTS target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
UNDERAGE_BLOCK_ALL_THIRD_PARTY_API_ACCESS ORG_UNIT_NAME additional.fields[org_unit_name]
BLOCK_ALL_THIRD_PARTY_API_ACCESS ORG_UNIT_NAME additional.fields[org_unit_name]
UNBLOCK_ALL_THIRD_PARTY_API_ACCESS ORG_UNIT_NAME additional.fields[org_unit_name]
ALLOW_STRONG_AUTHENTICATION DOMAIN_NAME target.domain.name
ALLOW_STRONG_AUTHENTICATION NEW_VALUE additional.fields[new_value]
ALLOW_STRONG_AUTHENTICATION OLD_VALUE additional.fields[old_value]
ALLOW_STRONG_AUTHENTICATION target.application The target.application UDM field is set to Admin.
ALLOW_STRONG_AUTHENTICATION target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
UNDERAGE_SIGN_IN_ONLY_THIRD_PARTY_API_ACCESS ORG_UNIT_NAME additional.fields[org_unit_name]
SIGN_IN_ONLY_THIRD_PARTY_API_ACCESS ORG_UNIT_NAME additional.fields[org_unit_name]
ALLOW_SERVICE_FOR_OAUTH2_ACCESS OAUTH2_SERVICE_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to OAUTH2_SERVICE_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
ALLOW_SERVICE_FOR_OAUTH2_ACCESS ORG_UNIT_NAME additional.fields[org_unit_name]
ALLOW_SERVICE_FOR_OAUTH2_ACCESS target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
DISALLOW_SERVICE_FOR_OAUTH2_ACCESS OAUTH2_SERVICE_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to OAUTH2_SERVICE_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
DISALLOW_SERVICE_FOR_OAUTH2_ACCESS ORG_UNIT_NAME additional.fields[org_unit_name]
DISALLOW_SERVICE_FOR_OAUTH2_ACCESS target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_APP_ACCESS_SETTINGS_COLLECTION_ID DOMAIN_NAME target.domain.name
CHANGE_APP_ACCESS_SETTINGS_COLLECTION_ID NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_APP_ACCESS_SETTINGS_COLLECTION_ID OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_APP_ACCESS_SETTINGS_COLLECTION_ID ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_APP_ACCESS_SETTINGS_COLLECTION_ID SETTING_NAME target.resource.name
CHANGE_APP_ACCESS_SETTINGS_COLLECTION_ID target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
ADD_TO_BLOCKED_OAUTH2_APPS OAUTH2_APP_ID additional.fields[oauth2_app_id]
ADD_TO_BLOCKED_OAUTH2_APPS OAUTH2_APP_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to OAUTH2_APP_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
ADD_TO_BLOCKED_OAUTH2_APPS OAUTH2_APP_TYPE additional.fields[oauth2_app_type]
ADD_TO_BLOCKED_OAUTH2_APPS ORG_UNIT_NAME additional.fields[org_unit_name]
ADD_TO_LIMITED_OAUTH2_APPS OAUTH2_APP_ID additional.fields[oauth2_app_id]
ADD_TO_LIMITED_OAUTH2_APPS OAUTH2_APP_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to OAUTH2_APP_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
ADD_TO_LIMITED_OAUTH2_APPS OAUTH2_APP_TYPE additional.fields[oauth2_app_type]
ADD_TO_LIMITED_OAUTH2_APPS ORG_UNIT_NAME additional.fields[org_unit_name]
ADD_TO_TRUSTED_BY_OAUTH_SCOPE_OAUTH2_APPS OAUTH2_APP_ID additional.fields[oauth2_app_id]
ADD_TO_TRUSTED_BY_OAUTH_SCOPE_OAUTH2_APPS OAUTH2_APP_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to OAUTH2_APP_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
ADD_TO_TRUSTED_BY_OAUTH_SCOPE_OAUTH2_APPS OAUTH2_APP_TYPE additional.fields[oauth2_app_type]
ADD_TO_TRUSTED_BY_OAUTH_SCOPE_OAUTH2_APPS ORG_UNIT_NAME additional.fields[org_unit_name]
ADD_TO_CAA_EXEMPT_OAUTH2_APPS OAUTH2_APP_ID additional.fields[oauth2_app_id]
ADD_TO_CAA_EXEMPT_OAUTH2_APPS OAUTH2_APP_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to OAUTH2_APP_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
ADD_TO_CAA_EXEMPT_OAUTH2_APPS OAUTH2_APP_TYPE additional.fields[oauth2_app_type]
ADD_TO_CAA_EXEMPT_OAUTH2_APPS ORG_UNIT_NAME additional.fields[org_unit_name]
REMOVE_FROM_CAA_EXEMPT_OAUTH2_APPS OAUTH2_APP_ID additional.fields[oauth2_app_id]
REMOVE_FROM_CAA_EXEMPT_OAUTH2_APPS OAUTH2_APP_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to OAUTH2_APP_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
REMOVE_FROM_CAA_EXEMPT_OAUTH2_APPS OAUTH2_APP_TYPE additional.fields[oauth2_app_type]
REMOVE_FROM_CAA_EXEMPT_OAUTH2_APPS ORG_UNIT_NAME additional.fields[org_unit_name]
REMOVE_FROM_TRUSTED_OAUTH2_APPS OAUTH2_APP_ID additional.fields[oauth2_app_id]
REMOVE_FROM_TRUSTED_OAUTH2_APPS OAUTH2_APP_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to OAUTH2_APP_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
REMOVE_FROM_TRUSTED_OAUTH2_APPS OAUTH2_APP_TYPE additional.fields[oauth2_app_type]
REMOVE_FROM_TRUSTED_OAUTH2_APPS ORG_UNIT_NAME additional.fields[org_unit_name]
REMOVE_FROM_BLOCKED_OAUTH2_APPS OAUTH2_APP_ID additional.fields[oauth2_app_id]
REMOVE_FROM_BLOCKED_OAUTH2_APPS OAUTH2_APP_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to OAUTH2_APP_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
REMOVE_FROM_BLOCKED_OAUTH2_APPS OAUTH2_APP_TYPE additional.fields[oauth2_app_type]
REMOVE_FROM_BLOCKED_OAUTH2_APPS ORG_UNIT_NAME additional.fields[org_unit_name]
REMOVE_FROM_LIMITED_OAUTH2_APPS OAUTH2_APP_ID additional.fields[oauth2_app_id]
REMOVE_FROM_LIMITED_OAUTH2_APPS OAUTH2_APP_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to OAUTH2_APP_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
REMOVE_FROM_LIMITED_OAUTH2_APPS OAUTH2_APP_TYPE additional.fields[oauth2_app_type]
REMOVE_FROM_LIMITED_OAUTH2_APPS ORG_UNIT_NAME additional.fields[org_unit_name]
REMOVE_FROM_TRUSTED_BY_OAUTH_SCOPE_OAUTH2_APPS OAUTH2_APP_ID additional.fields[oauth2_app_id]
REMOVE_FROM_TRUSTED_BY_OAUTH_SCOPE_OAUTH2_APPS OAUTH2_APP_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to OAUTH2_APP_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
REMOVE_FROM_TRUSTED_BY_OAUTH_SCOPE_OAUTH2_APPS OAUTH2_APP_TYPE additional.fields[oauth2_app_type]
REMOVE_FROM_TRUSTED_BY_OAUTH_SCOPE_OAUTH2_APPS ORG_UNIT_NAME additional.fields[org_unit_name]
ADD_TO_TRUSTED_OAUTH2_APPS OAUTH2_APP_ID additional.fields[oauth2_app_id]
ADD_TO_TRUSTED_OAUTH2_APPS OAUTH2_APP_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to OAUTH2_APP_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
ADD_TO_TRUSTED_OAUTH2_APPS OAUTH2_APP_TYPE additional.fields[oauth2_app_type]
ADD_TO_TRUSTED_OAUTH2_APPS ORG_UNIT_NAME additional.fields[org_unit_name]
MULTIPLE_ADD_TO_BLOCKED_OAUTH2_APPS OAUTH2_NUM_APPS additional.fields[OAUTH2_NUM_APPS]
MULTIPLE_ADD_TO_BLOCKED_OAUTH2_APPS ORG_UNIT_NAME additional.fields[org_unit_name]
MULTIPLE_ADD_TO_LIMITED_OAUTH2_APPS OAUTH2_NUM_APPS additional.fields[OAUTH2_NUM_APPS]
MULTIPLE_ADD_TO_LIMITED_OAUTH2_APPS ORG_UNIT_NAME additional.fields[org_unit_name]
MULTIPLE_ADD_TO_TRUSTED_BY_OAUTH_SCOPE_OAUTH2_APPS OAUTH2_NUM_APPS additional.fields[OAUTH2_NUM_APPS]
MULTIPLE_ADD_TO_TRUSTED_BY_OAUTH_SCOPE_OAUTH2_APPS ORG_UNIT_NAME additional.fields[org_unit_name]
MULTIPLE_ADD_TO_TRUSTED_OAUTH2_APPS OAUTH2_NUM_APPS additional.fields[OAUTH2_NUM_APPS]
MULTIPLE_ADD_TO_TRUSTED_OAUTH2_APPS ORG_UNIT_NAME additional.fields[org_unit_name]
OAUTH_APPS_BULK_UPLOAD BULK_UPLOAD_SUCCESS_OAUTH_APPS_NUMBER additional.fields[BULK_UPLOAD_SUCCESS_OAUTH_APPS_NUMBER]
OAUTH_APPS_BULK_UPLOAD BULK_UPLOAD_TOTAL_OAUTH_APPS_NUMBER additional.fields[BULK_UPLOAD_TOTAL_OAUTH_APPS_NUMBER]
OAUTH_APPS_BULK_UPLOAD_NOTIFICATION_SENT USER_EMAIL target.user.email_addresses
BLOCK_ON_DEVICE_ACCESS OAUTH2_SERVICE_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to OAUTH2_SERVICE_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
BLOCK_ON_DEVICE_ACCESS ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION GROUP_EMAIL target.group.email_addresses
CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION NEW_VALUE additional.fields[new_value]
CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION OLD_VALUE additional.fields[old_value]
CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION target.application The target.application UDM field is set to Admin.
CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_TWO_STEP_VERIFICATION_FREQUENCY GROUP_EMAIL target.group.email_addresses
CHANGE_TWO_STEP_VERIFICATION_FREQUENCY NEW_VALUE additional.fields[new_value]
CHANGE_TWO_STEP_VERIFICATION_FREQUENCY OLD_VALUE additional.fields[old_value]
CHANGE_TWO_STEP_VERIFICATION_FREQUENCY ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_TWO_STEP_VERIFICATION_FREQUENCY target.application The target.application UDM field is set to Admin.
CHANGE_TWO_STEP_VERIFICATION_FREQUENCY target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION GROUP_EMAIL target.group.email_addresses
CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION NEW_VALUE additional.fields[new_value]
CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION OLD_VALUE additional.fields[old_value]
CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION target.application The target.application UDM field is set to Admin.
CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_TWO_STEP_VERIFICATION_START_DATE GROUP_EMAIL target.group.email_addresses
CHANGE_TWO_STEP_VERIFICATION_START_DATE NEW_VALUE additional.fields[new_value]
CHANGE_TWO_STEP_VERIFICATION_START_DATE OLD_VALUE additional.fields[old_value]
CHANGE_TWO_STEP_VERIFICATION_START_DATE ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_TWO_STEP_VERIFICATION_START_DATE target.application The target.application UDM field is set to Admin.
CHANGE_TWO_STEP_VERIFICATION_START_DATE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS ALLOWED_TWO_STEP_VERIFICATION_METHOD additional.fields[allowedsv_method]
CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS GROUP_EMAIL target.group.email_addresses
CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS target.application The target.application UDM field is set to Admin.
CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
TOGGLE_CAA_ENABLEMENT NEW_VALUE target.resource.name
TOGGLE_CAA_ENABLEMENT target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_CAA_ERROR_MESSAGE NEW_VALUE target.resource.name
CHANGE_CAA_ERROR_MESSAGE ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_CAA_ERROR_MESSAGE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
TOGGLE_CAA_REMEDIATION_ENABLEMENT NEW_VALUE target.resource.name
TOGGLE_CAA_REMEDIATION_ENABLEMENT ORG_UNIT_NAME additional.fields[org_unit_name]
TOGGLE_CAA_REMEDIATION_ENABLEMENT target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
EDU_OVER_18_APPROVAL_WORKFLOW_DISABLED ORG_UNIT_NAME additional.fields[org_unit_name]
EDU_DELEGATED_USER_APPROVAL_WORKFLOW_DISABLED ORG_UNIT_NAME additional.fields[org_unit_name]
UNDERAGE_USER_APPROVAL_WORKFLOW_DISABLED ORG_UNIT_NAME additional.fields[org_unit_name]
USER_APPROVAL_WORKFLOW_DISABLED ORG_UNIT_NAME additional.fields[org_unit_name]
UNTRUST_DOMAIN_OWNED_OAUTH2_APPS ORG_UNIT_NAME additional.fields[org_unit_name]
TRUST_DOMAIN_OWNED_OAUTH2_APPS ORG_UNIT_NAME additional.fields[org_unit_name]
ENABLE_NON_ADMIN_USER_PASSWORD_RECOVERY GROUP_EMAIL target.group.email_addresses
ENABLE_NON_ADMIN_USER_PASSWORD_RECOVERY NEW_VALUE target.resource.attribute.labels[new_value]
ENABLE_NON_ADMIN_USER_PASSWORD_RECOVERY OLD_VALUE target.resource.attribute.labels[old_value]
ENABLE_NON_ADMIN_USER_PASSWORD_RECOVERY ORG_UNIT_NAME additional.fields[org_unit_name]
ENABLE_NON_ADMIN_USER_PASSWORD_RECOVERY target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
EDU_OVER_18_APPROVAL_WORKFLOW_ENABLED ORG_UNIT_NAME additional.fields[org_unit_name]
EDU_DELEGATED_USER_APPROVAL_WORKFLOW_ENABLED ORG_UNIT_NAME additional.fields[org_unit_name]
UNDERAGE_USER_APPROVAL_WORKFLOW_ENABLED ORG_UNIT_NAME additional.fields[org_unit_name]
USER_APPROVAL_WORKFLOW_ENABLED ORG_UNIT_NAME additional.fields[org_unit_name]
ENFORCE_STRONG_AUTHENTICATION DOMAIN_NAME target.domain.name
ENFORCE_STRONG_AUTHENTICATION GROUP_EMAIL target.group.email_addresses
ENFORCE_STRONG_AUTHENTICATION NEW_VALUE additional.fields[new_value]
ENFORCE_STRONG_AUTHENTICATION OLD_VALUE additional.fields[old_value]
ENFORCE_STRONG_AUTHENTICATION ORG_UNIT_NAME additional.fields[org_unit_name]
ENFORCE_STRONG_AUTHENTICATION SETTING_NAME target.resource.name
ENFORCE_STRONG_AUTHENTICATION target.application The target.application UDM field is set to Admin.
ENFORCE_STRONG_AUTHENTICATION target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
UPDATE_ERROR_MSG_FOR_RESTRICTED_OAUTH2_APPS NEW_VALUE target.resource.attribute.labels[new_value]
UPDATE_ERROR_MSG_FOR_RESTRICTED_OAUTH2_APPS OLD_VALUE target.resource.attribute.labels[old_value]
UPDATE_ERROR_MSG_FOR_RESTRICTED_OAUTH2_APPS ORG_UNIT_NAME additional.fields[org_unit_name]
UPDATE_ERROR_MSG_FOR_RESTRICTED_OAUTH2_APPS target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED GROUP_EMAIL target.group.email_addresses
WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED NEW_VALUE additional.fields[new_value]
WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED OLD_VALUE additional.fields[old_value]
WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED ORG_UNIT_NAME additional.fields[org_unit_name]
WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED target.application The target.application UDM field is set to Admin.
WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
SESSION_CONTROL_SETTINGS_CHANGE ORG_UNIT_NAME additional.fields[org_unit_name]
SESSION_CONTROL_SETTINGS_CHANGE REAUTH_APPLICATION target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to REAUTH_APPLICATION, then the events.parameters.value log field is mapped to the target.application UDM field.
SESSION_CONTROL_SETTINGS_CHANGE REAUTH_SETTING_NEW additional.fields[reauth_setting_new]
SESSION_CONTROL_SETTINGS_CHANGE REAUTH_SETTING_OLD additional.fields[reauth_setting_old]
SESSION_CONTROL_SETTINGS_CHANGE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_SESSION_LENGTH NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_SESSION_LENGTH OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_SESSION_LENGTH target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
UNBLOCK_ON_DEVICE_ACCESS OAUTH2_SERVICE_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to OAUTH2_SERVICE_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
UNBLOCK_ON_DEVICE_ACCESS ORG_UNIT_NAME additional.fields[org_unit_name]
DOWNLOAD_PENDING_APP_USER_REQUESTS OAUTH2_APP_ID additional.fields[oauth2_app_id]
DOWNLOAD_PENDING_APP_USER_REQUESTS OAUTH2_APP_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to OAUTH2_APP_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
ADD_WEB_ADDRESS SITE_LOCATION target.resource.attribute.labels[SITE_LOCATION]
ADD_WEB_ADDRESS WEB_ADDRESS target.resource.name
ADD_WEB_ADDRESS target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
DELETE_WEB_ADDRESS SITE_LOCATION target.resource.attribute.labels[SITE_LOCATION]
DELETE_WEB_ADDRESS WEB_ADDRESS target.resource.name
DELETE_WEB_ADDRESS target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_SITES_SETTING DOMAIN_NAME target.domain.name
CHANGE_SITES_SETTING NEW_VALUE target.resource.attribute.labels[new_value]
CHANGE_SITES_SETTING OLD_VALUE target.resource.attribute.labels[old_value]
CHANGE_SITES_SETTING ORG_UNIT_NAME additional.fields[org_unit_name]
CHANGE_SITES_SETTING SETTING_NAME target.resource.name
CHANGE_SITES_SETTING target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_SITES_WEB_ADDRESS_MAPPING_UPDATES SERVICE_NAME target.resource.name
CHANGE_SITES_WEB_ADDRESS_MAPPING_UPDATES SITE_LOCATION target.resource.attribute.labels[SITE_LOCATION]
CHANGE_SITES_WEB_ADDRESS_MAPPING_UPDATES WEB_ADDRESS target.url
CHANGE_SITES_WEB_ADDRESS_MAPPING_UPDATES target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
VIEW_SITE_DETAILS SITE_NAME target.resource.name
VIEW_SITE_DETAILS target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
DELETE_2SV_SCRATCH_CODES target.application The target.application UDM field is set to Admin.
DELETE_2SV_SCRATCH_CODES USER_EMAIL target.user.email_addresses
DELETE_2SV_SCRATCH_CODES target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
GENERATE_2SV_SCRATCH_CODES target.application The target.application UDM field is set to Admin.
GENERATE_2SV_SCRATCH_CODES USER_EMAIL target.user.email_addresses
GENERATE_2SV_SCRATCH_CODES target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
REVOKE_3LO_DEVICE_TOKENS DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template Asset ID:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
REVOKE_3LO_DEVICE_TOKENS DEVICE_TYPE target.platform Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_TYPE, then If the events.parameters.value log field value matches the regular expression pattern: (?i)windows, then the target.platform UDM field is set to WINDOWS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)mac, then the target.platform UDM field is set to MAC. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)linux, then the target.platform UDM field is set to LINUX. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)ios, then the target.platform UDM field is set to IOS. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)android, then the target.platform UDM field is set to ANDROID. Else if the events.parameters.value log field value matches the regular expression pattern: (?i)chrome, then the target.platform UDM field is set to CHROME_OS.
REVOKE_3LO_DEVICE_TOKENS USER_EMAIL target.user.email_addresses
REVOKE_3LO_DEVICE_TOKENS target.application The target.application UDM field is set to Admin.
REVOKE_3LO_DEVICE_TOKENS target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
REVOKE_3LO_TOKEN APP_ID target.resource.product_object_id
REVOKE_3LO_TOKEN USER_EMAIL target.user.email_addresses
REVOKE_3LO_TOKEN target.application The target.application UDM field is set to Admin.
REVOKE_3LO_TOKEN target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
ACCEPT_USER_INVITATION USER_EMAIL target.user.email_addresses
ADD_RECOVERY_EMAIL USER_EMAIL target.user.email_addresses
ADD_RECOVERY_EMAIL target.application The target.application UDM field is set to Admin.
ADD_RECOVERY_EMAIL target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
ADD_RECOVERY_PHONE USER_EMAIL target.user.email_addresses
ADD_RECOVERY_PHONE target.application The target.application UDM field is set to Admin.
ADD_RECOVERY_PHONE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
GRANT_ADMIN_PRIVILEGE USER_EMAIL target.user.email_addresses
GRANT_ADMIN_PRIVILEGE target.application The target.application UDM field is set to Admin.
GRANT_ADMIN_PRIVILEGE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
REVOKE_ADMIN_PRIVILEGE USER_EMAIL target.user.email_addresses
REVOKE_ADMIN_PRIVILEGE target.application The target.application UDM field is set to Admin.
REVOKE_ADMIN_PRIVILEGE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
REVOKE_ASP ASP_ID additional.fields[asp_id]
REVOKE_ASP USER_EMAIL target.user.email_addresses
REVOKE_ASP target.application The target.application UDM field is set to Admin.
REVOKE_ASP target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
TOGGLE_AUTOMATIC_CONTACT_SHARING NEW_VALUE target.user.attribute.labels[new_value]
TOGGLE_AUTOMATIC_CONTACT_SHARING USER_EMAIL target.user.email_addresses
TOGGLE_AUTOMATIC_CONTACT_SHARING target.application The target.application UDM field is set to Admin.
TOGGLE_AUTOMATIC_CONTACT_SHARING target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
BULK_UPLOAD BULK_UPLOAD_FAIL_USERS_NUMBER additional.fields[bulk_upload_fail_users_number]
BULK_UPLOAD BULK_UPLOAD_TOTAL_USERS_NUMBER additional.fields[bulk_upload_total_users_number]
BULK_UPLOAD DOMAIN_NAME target.domain.name
BULK_UPLOAD target.application The target.application UDM field is set to Admin.
BULK_UPLOAD target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
BULK_UPLOAD_NOTIFICATION_SENT DOMAIN_NAME target.domain.name
BULK_UPLOAD_NOTIFICATION_SENT USER_EMAIL target.user.email_addresses
BULK_UPLOAD_NOTIFICATION_SENT target.application The target.application UDM field is set to Admin.
BULK_UPLOAD_NOTIFICATION_SENT target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CANCEL_USER_INVITE DOMAIN_NAME target.domain.name
CANCEL_USER_INVITE USER_EMAIL target.user.email_addresses
CANCEL_USER_INVITE target.application The target.application UDM field is set to Admin.
CANCEL_USER_INVITE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_USER_CUSTOM_FIELD NEW_VALUE target.user.attribute.labels[new_value]
CHANGE_USER_CUSTOM_FIELD OLD_VALUE target.user.attribute.labels[old_value]
CHANGE_USER_CUSTOM_FIELD USER_CUSTOM_FIELD target.user.attribute.labels[user_custom_field]
CHANGE_USER_CUSTOM_FIELD USER_EMAIL target.user.email_addresses
CHANGE_USER_CUSTOM_FIELD target.application The target.application UDM field is set to Admin.
CHANGE_USER_CUSTOM_FIELD target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_USER_EXTERNAL_ID NEW_VALUE target.user.attribute.labels[new_value]
CHANGE_USER_EXTERNAL_ID OLD_VALUE target.user.attribute.labels[old_value]
CHANGE_USER_EXTERNAL_ID USER_EMAIL target.user.email_addresses
CHANGE_USER_EXTERNAL_ID target.application The target.application UDM field is set to Admin.
CHANGE_USER_EXTERNAL_ID target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_USER_GENDER NEW_VALUE target.user.attribute.labels[new_value]
CHANGE_USER_GENDER OLD_VALUE target.user.attribute.labels[old_value]
CHANGE_USER_GENDER USER_EMAIL target.user.email_addresses
CHANGE_USER_GENDER target.application The target.application UDM field is set to Admin.
CHANGE_USER_GENDER target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_USER_IM NEW_VALUE target.user.attribute.labels[new_value]
CHANGE_USER_IM OLD_VALUE target.user.attribute.labels[old_value]
CHANGE_USER_IM USER_EMAIL target.user.email_addresses
CHANGE_USER_IM target.application The target.application UDM field is set to Admin.
CHANGE_USER_IM target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
ENABLE_USER_IP_WHITELIST NEW_VALUE target.user.attribute.labels[new_value]
ENABLE_USER_IP_WHITELIST OLD_VALUE target.user.attribute.labels[old_value]
ENABLE_USER_IP_WHITELIST USER_EMAIL target.user.email_addresses
ENABLE_USER_IP_WHITELIST target.application The target.application UDM field is set to Admin.
ENABLE_USER_IP_WHITELIST target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_USER_KEYWORD NEW_VALUE target.user.attribute.labels[new_value]
CHANGE_USER_KEYWORD OLD_VALUE target.user.attribute.labels[old_value]
CHANGE_USER_KEYWORD USER_EMAIL target.user.email_addresses
CHANGE_USER_KEYWORD target.application The target.application UDM field is set to Admin.
CHANGE_USER_KEYWORD target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_USER_LANGUAGE NEW_VALUE target.user.attribute.labels[new_value]
CHANGE_USER_LANGUAGE OLD_VALUE target.user.attribute.labels[old_value]
CHANGE_USER_LANGUAGE USER_EMAIL target.user.email_addresses
CHANGE_USER_LANGUAGE target.application The target.application UDM field is set to Admin.
CHANGE_USER_LANGUAGE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_USER_LOCATION NEW_VALUE target.user.attribute.labels[new_value]
CHANGE_USER_LOCATION OLD_VALUE target.user.attribute.labels[old_value]
CHANGE_USER_LOCATION USER_EMAIL target.user.email_addresses
CHANGE_USER_LOCATION target.application The target.application UDM field is set to Admin.
CHANGE_USER_LOCATION target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_USER_ORGANIZATION NEW_VALUE target.user.attribute.labels[new_value]
CHANGE_USER_ORGANIZATION OLD_VALUE target.user.attribute.labels[old_value]
CHANGE_USER_ORGANIZATION USER_EMAIL target.user.email_addresses
CHANGE_USER_ORGANIZATION target.application The target.application UDM field is set to Admin.
CHANGE_USER_ORGANIZATION target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_USER_PHONE_NUMBER NEW_VALUE target.user.attribute.labels[new_value]
CHANGE_USER_PHONE_NUMBER OLD_VALUE target.user.attribute.labels[old_value]
CHANGE_USER_PHONE_NUMBER USER_EMAIL target.user.email_addresses
CHANGE_USER_PHONE_NUMBER target.application The target.application UDM field is set to Admin.
CHANGE_USER_PHONE_NUMBER target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_RECOVERY_EMAIL USER_EMAIL target.user.email_addresses
CHANGE_RECOVERY_EMAIL target.application The target.application UDM field is set to Admin.
CHANGE_RECOVERY_EMAIL target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_RECOVERY_PHONE USER_EMAIL target.user.email_addresses
CHANGE_RECOVERY_PHONE target.application The target.application UDM field is set to Admin.
CHANGE_RECOVERY_PHONE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_USER_RELATION NEW_VALUE target.user.attribute.labels[new_value]
CHANGE_USER_RELATION OLD_VALUE target.user.attribute.labels[old_value]
CHANGE_USER_RELATION USER_EMAIL target.user.email_addresses
CHANGE_USER_RELATION target.application The target.application UDM field is set to Admin.
CHANGE_USER_RELATION target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_USER_ADDRESS NEW_VALUE target.user.attribute.labels[new_value]
CHANGE_USER_ADDRESS OLD_VALUE target.user.attribute.labels[old_value]
CHANGE_USER_ADDRESS USER_EMAIL target.user.email_addresses
CHANGE_USER_ADDRESS target.application The target.application UDM field is set to Admin.
CHANGE_USER_ADDRESS target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CREATE_EMAIL_MONITOR BEGIN_DATE_TIME additional.fields[begin_date_time]
CREATE_EMAIL_MONITOR EMAIL_MONITOR_DEST_EMAIL additional.fields[email_monitor_dest_email]
CREATE_EMAIL_MONITOR EMAIL_MONITOR_LEVEL_CHAT additional.fields[email_monitor_level_chat]
CREATE_EMAIL_MONITOR EMAIL_MONITOR_LEVEL_DRAFT_EMAIL additional.fields[email_monitor_level_draft_email]
CREATE_EMAIL_MONITOR EMAIL_MONITOR_LEVEL_INCOMING_EMAIL additional.fields[email_monitor_level_incoming_email]
CREATE_EMAIL_MONITOR EMAIL_MONITOR_LEVEL_OUTGOING_EMAIL additional.fields[email_monitor_level_outgoing_email]
CREATE_EMAIL_MONITOR END_DATE_TIME additional.fields[end_date_time]
CREATE_EMAIL_MONITOR USER_EMAIL target.user.email_addresses
CREATE_EMAIL_MONITOR target.application The target.application UDM field is set to Admin.
CREATE_EMAIL_MONITOR target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CREATE_DATA_TRANSFER_REQUEST APPLICATION_NAME target.application The target.application UDM field is set to Admin.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to APPLICATION_NAME, then the events.parameters.value log field is mapped to the target.application UDM field.
CREATE_DATA_TRANSFER_REQUEST DESTINATION_USER_EMAIL target.user.email_addresses
CREATE_DATA_TRANSFER_REQUEST USER_EMAIL src.user.email_addresses
CREATE_DATA_TRANSFER_REQUEST target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
GRANT_DELEGATED_ADMIN_PRIVILEGES NEW_VALUE target.user.attribute.labels[new_value]
GRANT_DELEGATED_ADMIN_PRIVILEGES USER_EMAIL target.user.email_addresses
GRANT_DELEGATED_ADMIN_PRIVILEGES target.application The target.application UDM field is set to Admin.
GRANT_DELEGATED_ADMIN_PRIVILEGES target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
DELETE_ACCOUNT_INFO_DUMP REQUEST_ID additional.fields[request_id]
DELETE_ACCOUNT_INFO_DUMP USER_EMAIL target.user.email_addresses
DELETE_ACCOUNT_INFO_DUMP target.application The target.application UDM field is set to Admin.
DELETE_ACCOUNT_INFO_DUMP target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
DELETE_EMAIL_MONITOR EMAIL_MONITOR_DEST_EMAIL additional.fields[email_monitor_dest_email]
DELETE_EMAIL_MONITOR USER_EMAIL target.user.email_addresses
DELETE_EMAIL_MONITOR target.application The target.application UDM field is set to Admin.
DELETE_EMAIL_MONITOR target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
DELETE_MAILBOX_DUMP REQUEST_ID additional.fields[request_id]
DELETE_MAILBOX_DUMP USER_EMAIL target.user.email_addresses
DELETE_MAILBOX_DUMP target.application The target.application UDM field is set to Admin.
DELETE_MAILBOX_DUMP target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
DELETE_PROFILE_PHOTO USER_EMAIL target.user.email_addresses
DELETE_PROFILE_PHOTO target.application The target.application UDM field is set to Admin.
DELETE_PROFILE_PHOTO target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
ADD_DISPLAY_NAME USER_DISPLAY_NAME target.user.user_display_name
ADD_DISPLAY_NAME USER_EMAIL target.user.email_addresses
CHANGE_DISPLAY_NAME NEW_VALUE target.user.user_display_name
CHANGE_DISPLAY_NAME OLD_VALUE target.user.attribute.labels[old_value]
CHANGE_DISPLAY_NAME USER_EMAIL target.user.email_addresses
CHANGE_DISPLAY_NAME target.application The target.application UDM field is set to Admin.
CHANGE_DISPLAY_NAME target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
REMOVE_DISPLAY_NAME USER_DISPLAY_NAME target.user.user_display_name
REMOVE_DISPLAY_NAME USER_EMAIL target.user.email_addresses
CHANGE_FIRST_NAME NEW_VALUE target.user.first_name
CHANGE_FIRST_NAME OLD_VALUE target.user.attribute.labels[old_value]
CHANGE_FIRST_NAME USER_EMAIL target.user.email_addresses
CHANGE_FIRST_NAME target.application The target.application UDM field is set to Admin.
CHANGE_FIRST_NAME target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
GMAIL_RESET_USER GMAIL_RESET_REASON security_result.summary
GMAIL_RESET_USER USER_EMAIL target.user.email_addresses
GMAIL_RESET_USER target.application The target.application UDM field is set to Admin.
GMAIL_RESET_USER target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_LAST_NAME NEW_VALUE target.user.last_name
CHANGE_LAST_NAME OLD_VALUE target.user.attribute.labels[old_value]
CHANGE_LAST_NAME USER_EMAIL target.user.email_addresses
CHANGE_LAST_NAME target.application The target.application UDM field is set to Admin.
CHANGE_LAST_NAME target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
MAIL_ROUTING_DESTINATION_ADDED NEW_VALUE target.resource.attribute.labels[new_value]
MAIL_ROUTING_DESTINATION_ADDED USER_EMAIL target.user.email_addresses
MAIL_ROUTING_DESTINATION_ADDED target.application The target.application UDM field is set to Admin.
MAIL_ROUTING_DESTINATION_ADDED target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
MAIL_ROUTING_DESTINATION_REMOVED OLD_VALUE target.user.attribute.labels[old_value]
MAIL_ROUTING_DESTINATION_REMOVED USER_EMAIL target.user.email_addresses
MAIL_ROUTING_DESTINATION_REMOVED target.application The target.application UDM field is set to Admin.
MAIL_ROUTING_DESTINATION_REMOVED target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
ADD_NICKNAME USER_EMAIL target.user.email_addresses
ADD_NICKNAME USER_NICKNAME target.user.attribute.labels[nickname]
ADD_NICKNAME target.application The target.application UDM field is set to Admin.
ADD_NICKNAME target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
REMOVE_NICKNAME USER_EMAIL target.user.email_addresses
REMOVE_NICKNAME USER_NICKNAME target.user.attribute.labels[nickname]
REMOVE_NICKNAME target.application The target.application UDM field is set to Admin.
REMOVE_NICKNAME target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
PASSKEY_REVOKED enrollment_type additional.fields[enrollment_type]
PASSKEY_REVOKED passkey_added_from additional.fields[passkey_added_from]
PASSKEY_REVOKED passkey_added_on_timestamp additional.fields[passkey_added_on_timestamp]
PASSKEY_REVOKED passkey_last_used_from additional.fields[passkey_last_used_from]
PASSKEY_REVOKED passkey_last_used_timestamp additional.fields[passkey_last_used_timestamp]
PASSKEY_REVOKED platform_or_device additional.fields[platform_or_device]
PASSKEY_REVOKED supports_passwordless additional.fields[supports_passwordless]
PASSKEY_REVOKED USER_EMAIL target.user.email_addresses
CHANGE_PASSWORD USER_EMAIL target.user.email_addresses
CHANGE_PASSWORD target.application The target.application UDM field is set to Admin.
CHANGE_PASSWORD target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
CHANGE_PASSWORD_ON_NEXT_LOGIN NEW_VALUE target.user.attribute.labels[new_value]
CHANGE_PASSWORD_ON_NEXT_LOGIN OLD_VALUE target.user.attribute.labels[old_value]
CHANGE_PASSWORD_ON_NEXT_LOGIN USER_EMAIL target.user.email_addresses
CHANGE_PASSWORD_ON_NEXT_LOGIN target.application The target.application UDM field is set to Admin.
CHANGE_PASSWORD_ON_NEXT_LOGIN target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
UPDATE_PUBLIC_KEY_CERTIFICATE_STATUS PUBLIC_KEY_CERTIFICATE_STATUS additional.fields[PUBLIC_KEY_CERTIFICATE_STATUS]
UPDATE_PUBLIC_KEY_CERTIFICATE_STATUS USER_EMAIL target.user.email_addresses
UPDATE_PUBLIC_KEY_CERTIFICATE_STATUS USER_IMPACTED_EMAIL target.user.email_addresses
UPDATE_PUBLIC_KEY_CERTIFICATE USER_EMAIL target.user.email_addresses
UPDATE_PUBLIC_KEY_CERTIFICATE USER_IMPACTED_EMAIL target.user.email_addresses
REMOVE_RECOVERY_EMAIL USER_EMAIL target.user.email_addresses
REMOVE_RECOVERY_EMAIL target.application The target.application UDM field is set to Admin.
REMOVE_RECOVERY_EMAIL target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
REMOVE_RECOVERY_PHONE USER_EMAIL target.user.email_addresses
REMOVE_RECOVERY_PHONE target.application The target.application UDM field is set to Admin.
REMOVE_RECOVERY_PHONE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
REQUEST_ACCOUNT_INFO USER_EMAIL target.user.email_addresses
REQUEST_ACCOUNT_INFO target.application The target.application UDM field is set to Admin.
REQUEST_ACCOUNT_INFO target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
REQUEST_MAILBOX_DUMP BEGIN_DATE_TIME additional.fields[begin_date_time]
REQUEST_MAILBOX_DUMP EMAIL_EXPORT_INCLUDE_DELETED additional.fields[email_export_include_deleted]
REQUEST_MAILBOX_DUMP EMAIL_EXPORT_PACKAGE_CONTENT additional.fields[email_export_package_content]
REQUEST_MAILBOX_DUMP END_DATE_TIME additional.fields[end_date_time]
REQUEST_MAILBOX_DUMP SEARCH_QUERY_FOR_DUMP additional.fields[search_query_for_dump]
REQUEST_MAILBOX_DUMP USER_EMAIL target.user.email_addresses
REQUEST_MAILBOX_DUMP target.application The target.application UDM field is set to Admin.
REQUEST_MAILBOX_DUMP target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
RESEND_USER_INVITE DOMAIN_NAME target.domain.name
RESEND_USER_INVITE USER_EMAIL target.user.email_addresses
RESEND_USER_INVITE target.application The target.application UDM field is set to Admin.
RESEND_USER_INVITE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
RESET_SIGNIN_COOKIES USER_EMAIL target.user.email_addresses
RESET_SIGNIN_COOKIES target.application The target.application UDM field is set to Admin.
RESET_SIGNIN_COOKIES target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
SECURITY_KEY_REGISTERED_FOR_USER USER_EMAIL target.user.email_addresses
SECURITY_KEY_REGISTERED_FOR_USER target.resource.resource_type The target.resource.resource_type UDM field is set to CREDENTIAL.
SECURITY_KEY_REGISTERED_FOR_USER target.application The target.application UDM field is set to Admin.
REVOKE_SECURITY_KEY enrollment_type additional.fields[enrollment_type]
REVOKE_SECURITY_KEY passkey_added_from additional.fields[passkey_added_from]
REVOKE_SECURITY_KEY passkey_added_on_timestamp additional.fields[passkey_added_on_timestamp]
REVOKE_SECURITY_KEY passkey_last_used_from additional.fields[passkey_last_used_from]
REVOKE_SECURITY_KEY passkey_last_used_timestamp additional.fields[passkey_last_used_timestamp]
REVOKE_SECURITY_KEY platform_or_device additional.fields[platform_or_device]
REVOKE_SECURITY_KEY supports_passwordless additional.fields[supports_passwordless]
REVOKE_SECURITY_KEY USER_EMAIL target.user.email_addresses
REVOKE_SECURITY_KEY target.application The target.application UDM field is set to Admin.
REVOKE_SECURITY_KEY target.resource.resource_type The target.resource.resource_type UDM field is set to CREDENTIAL.
USER_INVITE DOMAIN_NAME target.domain.name
USER_INVITE USER_EMAIL target.user.email_addresses
USER_INVITE target.application The target.application UDM field is set to Admin.
USER_INVITE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
VIEW_TEMP_PASSWORD DOMAIN_NAME target.domain.name
VIEW_TEMP_PASSWORD USER_EMAIL target.user.email_addresses
VIEW_TEMP_PASSWORD target.application The target.application UDM field is set to Admin.
VIEW_TEMP_PASSWORD target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
TURN_OFF_2_STEP_VERIFICATION USER_EMAIL target.user.email_addresses
TURN_OFF_2_STEP_VERIFICATION target.application The target.application UDM field is set to Admin.
TURN_OFF_2_STEP_VERIFICATION target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
UNBLOCK_USER_SESSION USER_EMAIL target.user.email_addresses
UNBLOCK_USER_SESSION target.application The target.application UDM field is set to Admin.
UNBLOCK_USER_SESSION target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
UNMANAGED_USERS_BULK_UPLOAD BULK_UPLOAD_FAIL_USERS_NUMBER additional.fields[bulk_upload_fail_users_number]
UNMANAGED_USERS_BULK_UPLOAD BULK_UPLOAD_TOTAL_USERS_NUMBER additional.fields[bulk_upload_total_users_number]
UNMANAGED_USERS_BULK_UPLOAD target.application The target.application UDM field is set to Admin.
UNMANAGED_USERS_BULK_UPLOAD target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
UPDATE_PROFILE_PHOTO USER_EMAIL target.user.email_addresses
UPDATE_PROFILE_PHOTO target.application The target.application UDM field is set to Admin.
UPDATE_PROFILE_PHOTO target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
UNENROLL_USER_FROM_TITANIUM USER_EMAIL target.user.email_addresses
UNENROLL_USER_FROM_TITANIUM target.application The target.application UDM field is set to Admin.
UNENROLL_USER_FROM_TITANIUM target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
ARCHIVE_USER USER_EMAIL target.user.email_addresses
ARCHIVE_USER target.application The target.application UDM field is set to Admin.
ARCHIVE_USER target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
UPDATE_BIRTHDATE BIRTHDATE target.user.attribute.labels[birthdate]
UPDATE_BIRTHDATE USER_EMAIL target.user.email_addresses
UPDATE_BIRTHDATE target.application The target.application UDM field is set to Admin.
UPDATE_BIRTHDATE target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
USER_CREATED_PASSKEY_REVOKE USER_EMAIL target.user.email_addresses
CREATE_USER USER_EMAIL target.user.email_addresses
CREATE_USER target.application The target.application UDM field is set to Admin.
CREATE_USER target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
DELETE_USER USER_EMAIL target.user.email_addresses
DELETE_USER target.application The target.application UDM field is set to Admin.
DELETE_USER target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
DOWNGRADE_USER_FROM_GPLUS USER_EMAIL target.user.email_addresses
DOWNGRADE_USER_FROM_GPLUS target.application The target.application UDM field is set to Admin.
DOWNGRADE_USER_FROM_GPLUS target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
USER_ENROLLED_IN_TWO_STEP_VERIFICATION USER_EMAIL target.user.email_addresses
USER_ENROLLED_IN_TWO_STEP_VERIFICATION target.application The target.application UDM field is set to Admin.
USER_ENROLLED_IN_TWO_STEP_VERIFICATION target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
DOWNLOAD_USERLIST FORMAT target.file.file_type Iterate through log field events:
iterate through log field events.parameters:
if the events.parameters.name log field value is equal to CONTENT_NAME, then file_type log field value is set to a value generated from the template FILE_TYPE_%{file_type}, where %{file_type} is replaced with the value of the file_type log field. If the file_type log field value contain one of the following values:
  • FILE_TYPE_ACE
  • FILE_TYPE_ANDROID
  • FILE_TYPE_APPLE
  • FILE_TYPE_APPLE_PLIST
  • FILE_TYPE_APPLEDOUBLE
  • FILE_TYPE_APPLESCRIPT
  • FILE_TYPE_APPLESCRIPT_COMPILED
  • FILE_TYPE_APPLESINGLE
  • FILE_TYPE_ARC
  • FILE_TYPE_ARJ
  • FILE_TYPE_ASD
  • FILE_TYPE_ASF
  • FILE_TYPE_AVI
  • FILE_TYPE_AWK
  • FILE_TYPE_BLACKHOLE
  • FILE_TYPE_BMP
  • FILE_TYPE_BZIP
  • FILE_TYPE_C
  • FILE_TYPE_CAB
  • FILE_TYPE_CAP
  • FILE_TYPE_CHM
  • FILE_TYPE_COFF
  • FILE_TYPE_COOKIE
  • FILE_TYPE_CPP
  • FILE_TYPE_CRX
  • FILE_TYPE_DEB
  • FILE_TYPE_DIB
  • FILE_TYPE_DIVX
  • FILE_TYPE_DMG
  • FILE_TYPE_DOC
  • FILE_TYPE_DOCX
  • FILE_TYPE_DOS_COM
  • FILE_TYPE_DOS_EXE
  • FILE_TYPE_DYALOG
  • FILE_TYPE_DZIP
  • FILE_TYPE_EBOOK
  • FILE_TYPE_ELF
  • FILE_TYPE_EMAIL_TYPE
  • FILE_TYPE_EMF
  • FILE_TYPE_EOT
  • FILE_TYPE_EPS
  • FILE_TYPE_FLA
  • FILE_TYPE_FLAC
  • FILE_TYPE_FLC
  • FILE_TYPE_FLI
  • FILE_TYPE_FLV
  • FILE_TYPE_FORTRAN
  • FILE_TYPE_FPX
  • FILE_TYPE_GIF
  • FILE_TYPE_GIMP
  • FILE_TYPE_GUL
  • FILE_TYPE_GZIP
  • FILE_TYPE_HTML
  • FILE_TYPE_HWP
  • FILE_TYPE_ICO
  • FILE_TYPE_IN_DESIGN
  • FILE_TYPE_IPHONE
  • FILE_TYPE_ISOIMAGE
  • FILE_TYPE_JAR
  • FILE_TYPE_JAVA
  • FILE_TYPE_JAVA_BYTECODE
  • FILE_TYPE_JAVASCRIPT
  • FILE_TYPE_JNG
  • FILE_TYPE_JPEG
  • FILE_TYPE_KGB
  • FILE_TYPE_LATEX
  • FILE_TYPE_LINUX
  • FILE_TYPE_LINUX_KERNEL
  • FILE_TYPE_LNK
  • FILE_TYPE_MACH_O
  • FILE_TYPE_MACINTOSH
  • FILE_TYPE_MACINTOSH_HFS
  • FILE_TYPE_MACINTOSH_LIB
  • FILE_TYPE_MIDI
  • FILE_TYPE_MOV
  • FILE_TYPE_MP3
  • FILE_TYPE_MP4
  • FILE_TYPE_MPEG
  • FILE_TYPE_MSCOMPRESS
  • FILE_TYPE_MSI
  • FILE_TYPE_NE_DLL
  • FILE_TYPE_NE_EXE
  • FILE_TYPE_ODF
  • FILE_TYPE_ODG
  • FILE_TYPE_ODP
  • FILE_TYPE_ODS
  • FILE_TYPE_ODT
  • FILE_TYPE_OGG
  • FILE_TYPE_OUTLOOK
  • FILE_TYPE_PALMOS
  • FILE_TYPE_PASCAL
  • FILE_TYPE_PDF
  • FILE_TYPE_PE_DLL
  • FILE_TYPE_PE_EXE
  • FILE_TYPE_PERL
  • FILE_TYPE_PHP
  • FILE_TYPE_PKG
  • FILE_TYPE_PNG
  • FILE_TYPE_POWERSHELL
  • FILE_TYPE_PPSX
  • FILE_TYPE_PPT
  • FILE_TYPE_PPTX
  • FILE_TYPE_PS
  • FILE_TYPE_PSD
  • FILE_TYPE_PYTHON
  • FILE_TYPE_QUICKTIME
  • FILE_TYPE_RAR
  • FILE_TYPE_RM
  • FILE_TYPE_ROM
  • FILE_TYPE_RPM
  • FILE_TYPE_RTF
  • FILE_TYPE_RUBY
  • FILE_TYPE_RZIP
  • FILE_TYPE_SCRIPT
  • FILE_TYPE_SEVENZIP
  • FILE_TYPE_SHELLSCRIPT
  • FILE_TYPE_SVG
  • FILE_TYPE_SWF
  • FILE_TYPE_SYMBIAN
  • FILE_TYPE_T3GP
  • FILE_TYPE_TAR
  • FILE_TYPE_TARGA
  • FILE_TYPE_TEXT
  • FILE_TYPE_TIFF
  • FILE_TYPE_TORRENT
  • FILE_TYPE_TTF
  • FILE_TYPE_UNSPECIFIED
  • FILE_TYPE_VBA
  • FILE_TYPE_WAV
  • FILE_TYPE_WEBP
  • FILE_TYPE_WINCE
  • FILE_TYPE_WMA
  • FILE_TYPE_WMV
  • FILE_TYPE_WOFF
  • FILE_TYPE_XLS
  • FILE_TYPE_XLSX
  • FILE_TYPE_XML
  • FILE_TYPE_XPI
  • FILE_TYPE_XWD
  • FILE_TYPE_ZIP
  • FILE_TYPE_ZLIB
, then the file_type log field is mapped to the target.file.file_type UDM field.
MOVE_USER_TO_ORG_UNIT NEW_VALUE target.user.attribute.labels[new_value]
MOVE_USER_TO_ORG_UNIT ORG_UNIT_NAME additional.fields[org_unit_name]
MOVE_USER_TO_ORG_UNIT USER_EMAIL target.user.email_addresses
MOVE_USER_TO_ORG_UNIT target.application The target.application UDM field is set to Admin.
MOVE_USER_TO_ORG_UNIT target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
USER_PUT_IN_TWO_STEP_VERIFICATION_GRACE_PERIOD NEW_VALUE target.user.attribute.labels[new_value]
USER_PUT_IN_TWO_STEP_VERIFICATION_GRACE_PERIOD USER_EMAIL target.user.email_addresses
USER_PUT_IN_TWO_STEP_VERIFICATION_GRACE_PERIOD target.application The target.application UDM field is set to Admin.
USER_PUT_IN_TWO_STEP_VERIFICATION_GRACE_PERIOD target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
RENAME_USER NEW_VALUE target.user.user_display_name
RENAME_USER USER_EMAIL target.user.email_addresses
RENAME_USER target.application The target.application UDM field is set to Admin.
RENAME_USER target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
UNENROLL_USER_FROM_STRONG_AUTH USER_EMAIL target.user.email_addresses
UNENROLL_USER_FROM_STRONG_AUTH target.application The target.application UDM field is set to Admin.
UNENROLL_USER_FROM_STRONG_AUTH target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
SUSPEND_USER USER_EMAIL target.user.email_addresses
SUSPEND_USER target.application The target.application UDM field is set to Admin.
SUSPEND_USER target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
UNARCHIVE_USER USER_EMAIL target.user.email_addresses
UNARCHIVE_USER target.application The target.application UDM field is set to Admin.
UNARCHIVE_USER target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
UNDELETE_USER USER_EMAIL target.user.email_addresses
UNDELETE_USER target.application The target.application UDM field is set to Admin.
UNDELETE_USER target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
UNSUSPEND_USER USER_EMAIL target.user.email_addresses
UNSUSPEND_USER target.application The target.application UDM field is set to Admin.
UNSUSPEND_USER target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
UPGRADE_USER_TO_GPLUS USER_EMAIL target.user.email_addresses
UPGRADE_USER_TO_GPLUS target.application The target.application UDM field is set to Admin.
UPGRADE_USER_TO_GPLUS target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
USERS_BULK_UPLOAD BULK_UPLOAD_FAIL_USERS_NUMBER additional.fields[bulk_upload_fail_users_number]
USERS_BULK_UPLOAD BULK_UPLOAD_TOTAL_USERS_NUMBER additional.fields[bulk_upload_total_users_number]
USERS_BULK_UPLOAD target.application The target.application UDM field is set to Admin.
USERS_BULK_UPLOAD target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
USERS_BULK_UPLOAD_NOTIFICATION_SENT USER_EMAIL target.user.email_addresses
USERS_BULK_UPLOAD_NOTIFICATION_SENT target.application The target.application UDM field is set to Admin.
USERS_BULK_UPLOAD_NOTIFICATION_SENT target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
DOWNLOAD_PENDING_INVITES_LIST target.application The target.application UDM field is set to Admin.
DOWNLOAD_PENDING_INVITES_LIST target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
DOWNLOAD_UNMANAGED_USERS_LIST target.application The target.application UDM field is set to Admin.
DOWNLOAD_UNMANAGED_USERS_LIST target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
DOWNLOAD_USERLIST_CSV target.application The target.application UDM field is set to Admin.
DOWNLOAD_USERLIST_CSV target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.

Field mapping reference: workspace activity gmail application

The following table provides the log fields to UDM field mapping corresponding to events for the gmail application.

Event Name Log field UDM mapping Logic
delivery events.parameters[delivery].msgValue[message_info].parameter.value[description] metadata.description
delivery metadata.event_timestamp Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to event_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to timestamp_usec, then the unix_time field is extracted from events.parameters.msgValue.parameter.intValue log field using the Grok pattern. If the unix_time log field value is not empty, then the unix_time extracted field is mapped to the metadata.event_timestamp UDM field.
delivery events.parameters[delivery].msgValue[event_info].parameter.intValue[mail_event_type] metadata.product_event_type
delivery events.parameters[delivery].msgValue[message_info].parameter.value[rfc2822_message_id] network.email.mail_id
delivery events.parameters[delivery].msgValue[message_info].parameter.value[subject] network.email.subject
delivery events.parameters[delivery].msgValue[message_info].parameter.intValue[payload_size] network.sent_bytes
delivery events.parameters[delivery].msgValue[event_info].parameter.intValue[elapsed_time_usec] network.session_duration
delivery network.smtp.is_tls If the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_tls_state] field value is equal to 1, then the network.smtp.is_tls UDM field is set to true.
delivery events.parameters.msgValue.parameter.multiMessageValue.parameter.value network.smtp.rcpt_to Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to destination, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to address, then the events.parameters.msgValue.parameter.multiMessageValue.parameter.value log field is mapped to the network.smtp.rcpt_to UDM field.
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] network.smtp.server_response If the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_response_reason] log field value is equal to 1, then the network.smtp.server_response UDM field is set to a value generated from the template %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} - Default reason messages are rejected or accepted, where %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} is replaced with the value of the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] log field.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_response_reason] log field value is equal to 3, then the network.smtp.server_response UDM field is set to a value generated from the template %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} - Malware, where %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} is replaced with the value of the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] log field.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_response_reason] log field value is equal to 4, then the network.smtp.server_response UDM field is set to a value generated from the template %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} - DMARC policy, where %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} is replaced with the value of the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] log field.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_response_reason] log field value is equal to 5, then the network.smtp.server_response UDM field is set to a value generated from the template %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} - Unsupported attachment (by Gmail), where %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} is replaced with the value of the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] log field.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_response_reason] log field value is equal to 6, then the network.smtp.server_response UDM field is set to a value generated from the template %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} - Receive limit exceeded, where %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} is replaced with the value of the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] log field.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_response_reason] log field value is equal to 7, then the network.smtp.server_response UDM field is set to a value generated from the template %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} - Account over quota, where %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} is replaced with the value of the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] log field.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_response_reason] log field value is equal to 8, then the network.smtp.server_response UDM field is set to a value generated from the template %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} - Bad PTR record, where %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} is replaced with the value of the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] log field.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_response_reason] log field value is equal to 9, then the network.smtp.server_response UDM field is set to a value generated from the template %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} - Recipient does not exist, where %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} is replaced with the value of the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] log field.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_response_reason] log field value is equal to 10, then the network.smtp.server_response UDM field is set to a value generated from the template %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} - Customer policy, where %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} is replaced with the value of the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] log field.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_response_reason] log field value is equal to 12, then the network.smtp.server_response UDM field is set to a value generated from the template %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} - RFC violation, where %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} is replaced with the value of the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] log field.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_response_reason] log field value is equal to 13, then the network.smtp.server_response UDM field is set to a value generated from the template %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} - Blatant spam, where %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} is replaced with the value of the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] log field.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_response_reason] log field value is equal to 14, then the network.smtp.server_response UDM field is set to a value generated from the template %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} - Denial of service, where %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} is replaced with the value of the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] log field.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_response_reason] log field value is equal to 15, then the network.smtp.server_response UDM field is set to a value generated from the template %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} - Malicious or spammy links, where %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} is replaced with the value of the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] log field.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_response_reason] log field value is equal to 16, then the network.smtp.server_response UDM field is set to a value generated from the template %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} - Low IP reputation, where %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} is replaced with the value of the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] log field.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_response_reason] log field value is equal to 17, then the network.smtp.server_response UDM field is set to a value generated from the template %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} - Low domain reputation, where %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} is replaced with the value of the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] log field.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_response_reason] log field value is equal to 18, then the network.smtp.server_response UDM field is set to a value generated from the template %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} - IP listed in public Real-time Blackhole List (RBL), where %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} is replaced with the value of the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] log field.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_response_reason] log field value is equal to 19, then the network.smtp.server_response UDM field is set to a value generated from the template %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} - Temporarily rejected due to DoS limits, where %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} is replaced with the value of the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] log field.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_response_reason] log field value is equal to 20, then the network.smtp.server_response UDM field is set to a value generated from the template %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} - Permanently rejected due to DoS limits, where %{events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]} is replaced with the value of the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] log field.
Otherwise, the events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] log field is mapped to the network.smtp.server_response UDM field.
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[smtp_tls_cipher] network.tls.cipher
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[smtp_tls_version] network.tls.version
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[client_host_zone] principal.administrative_domain
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[source].parameter.value[service] principal.application
delivery events.parameters[delivery].msgValue[message_owner].parameter.value[customer_domain] principal.domain.name
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[client_ip], events.parameters[delivery].msgValue[message_connection_info].parameter.value[smtp_user_agent_ip] principal.ip
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[client_ip], events.parameters[delivery].msgValue[message_connection_info].parameter.value[smtp_user_agent_ip] principal.asset.ip
delivery actor.gaiaId additional.fields[actor_gaiaid]
delivery actor.orgunitPath additional.fields[actor_orgunitpath] Iterate through log field actor.orgunitPath:
The additional.fields.key UDM field is set to a value generated from the template actor_orgunitpath_%{index}, where %{index} is replaced with the value of the index log field and the actor.orgunitPath log field is mapped to the additional.fields.value UDM field.
delivery events.parameters.msgValue.parameter.multiIntValue additional.fields[message_owner_gaia_id] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_owner, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to gaia_ids, then
Iterate through log field events.parameters.msgValue.parameter.multiIntValue:
The additional.fields.key UDM field is set to a value generated from the template message_owner_gaia_id_%{index2}, where %{index2} is replaced with the value of the index2 log field and the events.parameters.msgValue.parameter.multiIntValue log field is mapped to the additional.fields.value UDM field.
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[source].parameter.value[selector] additional.fields[source_selector]
delivery events.parameters.msgValue.parameter.multiValue principal.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_owner, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to addresses, then
Iterate through log field events.parameters.msgValue.parameter.multiValue:
if the events.parameters.msgValue.parameter.multiValue log field value is not equal to the actor.email log field value, then the events.parameters.msgValue.parameter.multiValue log field is mapped to the principal.user.email_addresses UDM field.
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[source].parameter.value[from_header_address] network.email.from
delivery events.parameters.msgValue.parameter.msgValue.parameter.value network.smtp.mail_from Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to source, then
Iterate through log field events.parameters.msgValue.parameter.msgValue.parameter:
if the events.parameters.msgValue.parameter.msgValue.parameter.name log field value is equal to address and the events.parameters.msgValue.parameter.msgValue.parameter.value log field value is not equal to the actor.email log field value, then the events.parameters.msgValue.parameter.msgValue.parameter.value log field is mapped to the network.smtp.mail_from UDM field.
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[source].parameter.value[from_header_displayname] principal.user.user_display_name
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[source].parameter.intValue[user_id] principal.user.userid
delivery events.parameters[delivery].msgValue[message_info].parameter.value[flattened_destinations] additional.fields[flattened_destinations]
delivery events.parameters.msgValue.parameter.multiMessageValue.parameter.value target.application Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to destination, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to service, then if the index2 log field value is equal to 0, then the events.parameters.msgValue.parameter.multiMessageValue.parameter.value log field is mapped to the target.application UDM field. Otherwise, the events.parameters.msgValue.parameter.multiMessageValue.parameter.value log field is mapped to the about.application UDM field.
delivery events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue additional.fields[destination_rcpt_response] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to destination, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to rcpt_response, then the additional.fields.key UDM field is set to a value generated from the template destination_rcpt_response_%{index2}, where %{index2} is replaced with the value of the index2 log field and the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field is mapped to the additional.fields.value UDM field.
delivery events.parameters.msgValue.parameter.multiMessageValue.parameter.value additional.fields[destination_selector] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to destination, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to selector, then the additional.fields.key UDM field is set to a value generated from the template destination_selector_%{index2}, where %{index2} is replaced with the value of the index2 log field and the events.parameters.msgValue.parameter.multiMessageValue.parameter.value log field is mapped to the additional.fields.value UDM field.
delivery events.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[destination].parameter.boolValue[smime_decryption_success] additional.fields[destination_smime_decryption_success] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to destination, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to smime_decryption_success, then the additional.fields.key UDM field is set to a value generated from the template destination_smime_decryption_success_%{index2}, where %{index2} is replaced with the value of the index2 log field and the events.parameters.msgValue.parameter.multiMessageValue.parameter.boolValue log field is mapped to the additional.fields.value UDM field.
delivery events.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[destination].parameter.boolValue[smime_extraction_success] additional.fields[destination_smime_extraction_success] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to destination, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to smime_extraction_success, then the additional.fields.key UDM field is set to a value generated from the template destination_smime_extraction_success_%{index2}, where %{index2} is replaced with the value of the index2 log field and the events.parameters.msgValue.parameter.multiMessageValue.parameter.boolValue log field is mapped to the additional.fields.value UDM field.
delivery events.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[destination].parameter.boolValue[smime_parsing_success] additional.fields[destination_smime_parsing_success] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to destination, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to smime_parsing_success, then the additional.fields.key UDM field is set to a value generated from the template destination_smime_parsing_success_%{index2}, where %{index2} is replaced with the value of the index2 log field and the events.parameters.msgValue.parameter.multiMessageValue.parameter.boolValue log field is mapped to the additional.fields.value UDM field.
delivery events.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[destination].parameter.boolValue[smime_signature_verification_success] additional.fields[destination_smime_signature_verification_success] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to destination, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to smime_signature_verification_success, then the additional.fields.key UDM field is set to a value generated from the template destination_smime_signature_verification_success_%{index2}, where %{index2} is replaced with the value of the index2 log field and the events.parameters.msgValue.parameter.multiMessageValue.parameter.boolValue log field is mapped to the additional.fields.value UDM field.
delivery events.parameters.msgValue.parameter.multiMessageValue.parameter.value target.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to destination, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to address, then if the index2 log field value is equal to 0, then the events.parameters.msgValue.parameter.multiMessageValue.parameter.value log field is mapped to the target.user.email_addresses UDM field. Otherwise, the events.parameters.msgValue.parameter.multiMessageValue.parameter.value log field is mapped to the about.user.email_addresses UDM field.
delivery events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue target.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to destination, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to user_id, then if the index2 log field value is equal to 0, then the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field is mapped to the target.user.userid UDM field. Otherwise, the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field is mapped to the about.user.userid UDM field.
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[smtp_out_remote_host],events.parameters[delivery].msgValue[server_info].parameter.value[host_name] intermediary.hostname
delivery events.parameters.msgValue.parameter.msgValue.parameter.multiValue,events.parameters.msgValue.parameter.msgValue.parameter.value intermediary.ip Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to connection_info, then
Iterate through log field events.parameters.msgValue.parameter.msgValue.parameter:
if the events.parameters.msgValue.parameter.msgValue.parameter.name log field value is equal to failed_smtp_out_connect_ip, then
Iterate through log field events.parameters.msgValue.parameter.msgValue.parameter.multiValue:
The events.parameters.msgValue.parameter.msgValue.parameter.multiValue log field is mapped to the intermediary.ip UDM field. Else if the events.parameters.msgValue.parameter.msgValue.parameter.name log field value contain one of the following values:
  • smtp_in_connect_ip
  • smtp_out_connect_ip
  • smtp_user_agent_ip
, then the events.parameters.msgValue.parameter.msgValue.parameter.value log field is mapped to the intermediary.ip UDM field.
delivery events.parameters[delivery].msgValue[server_info].parameter.value[job_name] additional.fields[job_name]
delivery events.parameters[delivery].msgValue[server_info].parameter.intValue[server_type] additional.fields[server_type]
delivery events.parameters[delivery].msgValue[server_info].parameter.intValue[task_number] additional.fields[task_number]
delivery security_result.about.user.email_addresses Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to triggered_rule_info, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to policy_holder_address, then if the events log field value the parameters log field value the msgValue log field value the parameter log field value the multiMessageValue log field value the parameter log field value the value log field value matches the regular expression pattern: ^.+@.+$, then the events.parameters.msgValue.parameter.multiMessageValue.parameter.value log field is mapped to the security_result.about.user.email_addresses UDM field. Otherwise, the events.parameters.msgValue.parameter.multiMessageValue.parameter.value log field is mapped to the security_result.about.administrative_domain UDM field. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to consequence, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.name log field value is equal to policy_holder_email, then if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.value log field value matches the regular expression pattern: ^.+@.+$, then the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.value log field is mapped to the security_result.about.user.email_addresses UDM field.
delivery events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue security_result.about.user.userid Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to triggered_rule_info, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to consequence, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.name log field value is equal to policy_holder_user_id, then the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field is mapped to the security_result.about.user.userid UDM field.
delivery security_result.action If the events.parametersthe delivery log field value .msgvalue the event_info log field value .parameter.boolvalue the success log field value log field value is equal to true, then the security_result.action UDM field is set to ALLOW.
Otherwise, The security_result.action UDM field is set to BLOCK.
delivery events.parameters[delivery].msgValue[event_info].parameter.boolValue[success] security_result.action_details If the events.parameters[delivery].msgValue[message_info].parameter.intValue[action_type] log field value is equal to 1, then the security_result.action_details UDM field is set to 1 - Message received by inbound SMTP server..
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[action_type] log field value is equal to 2, then the security_result.action_details UDM field is set to 2 - Message accepted by Gmail and Prepared for delivery..
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[action_type] log field value is equal to 3, then the security_result.action_details UDM field is set to 3 - Message was handled by Gmail..
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[action_type] log field value is equal to 10, then the security_result.action_details UDM field is set to 10 - Message sent out by outbound SMTP server..
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[action_type] log field value is equal to 14, then the security_result.action_details UDM field is set to 14 - A temporary error occurred when Gmail tried to deliver the message, and the message has been scheduled for retry..
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[action_type] log field value is equal to 18, then the security_result.action_details UDM field is set to 18 - Message could not be delivered and Bounced..
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[action_type] log field value is equal to 19, then the security_result.action_details UDM field is set to 19 - Message was dropped by Gmail..
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[action_type] log field value is equal to 45, then the security_result.action_details UDM field is set to 45 - Message was accepted for delivery by the Google Groups subsystem..
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[action_type] log field value is equal to 46, then the security_result.action_details UDM field is set to 46 - Message's recipient address was a Google Group, and the recipient was expanded to each member of the Google Group that has message delivery enabled..
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[action_type] log field value is equal to 48, then the security_result.action_details UDM field is set to 48 - Message received by inbound SMTP server for relay..
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[action_type] log field value is equal to 49, then the security_result.action_details UDM field is set to 49 - Message sent through relay by outbound SMTP server..
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[action_type] log field value is equal to 51, then the security_result.action_details UDM field is set to 51 - Message was written to Google Groups storage..
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[action_type] log field value is equal to 54, then the security_result.action_details UDM field is set to 54 - Message was rejected by the Google Groups storage system..
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[action_type] log field value is equal to 55, then the security_result.action_details UDM field is set to 55 - Message was re-inserted into Gmail by policies that modify the primary delivery route or envelope recipient..
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[action_type] log field value is equal to 68, then the security_result.action_details UDM field is set to 68 - Message accepted by Gmail and Prepared for delivery..
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[action_type] log field value is equal to 69, then the security_result.action_details UDM field is set to 69 - A user changed the message is spam classification in Gmail..
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[action_type] log field value is equal to 70, then the security_result.action_details UDM field is set to 70 - The message was reclassified as spam or phishing after it was delivered to Gmail..
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[action_type] log field value is equal to 71, then the security_result.action_details UDM field is set to 71 - A user took an action in the inbox after receiving the message. Post-delivery actions include opening a message, clicking a link in a message, and Downloading an attachment. BigQuery export doesn't provide details about the action..
delivery security_result.category If the events.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[attachment].parameter.intValue[malware_family] log field value log field value is not empty, then the security_result.category UDM field is set to SOFTWARE_MALICIOUS.
If the events.parameters[delivery].msgValue[message_info].parameter.boolValue[is_spam] log field value is equal to true, then the security_result.category UDM field is set to MAIL_SPAM.
delivery security_result.category_details If the events.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[attachment].parameter.intValue[malware_family] log field value is equal to 1, then the security_result.category_details UDM field is set to 1 - A known malicious program type of malware.
Else if the events.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[attachment].parameter.intValue[malware_family] log field value is equal to 2, then the security_result.category_details UDM field is set to 2 - A virus or worm type of malware.
Else if the events.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[attachment].parameter.intValue[malware_family] log field value is equal to 3, then the security_result.category_details UDM field is set to 3 - Possible harmful email content.
Else if the events.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[attachment].parameter.intValue[malware_family] log field value is equal to 4, then the security_result.category_details UDM field is set to 4 - Possible unwanted email content.
Else if the events.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[attachment].parameter.intValue[malware_family] log field value is equal to 5, then the security_result.category_details UDM field is set to 5 - Other type of malware.
delivery events.parameters[delivery].msgValue[message_info].parameter.value[flattened_triggered_rule_info] security_result.detection_fields[flattened_triggered_rule_info]
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[is_internal] security_result.detection_fields[is_internal]
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[is_intra_domain] security_result.detection_fields[is_intra_domain]
delivery events.parameters[delivery].msgValue[message_info].parameter.boolValue[is_policy_check_for_sender] security_result.detection_fields[is_policy_check_for_sender]
delivery events.parameters[delivery].msgValue[message_info].parameter.boolValue[is_spam] security_result.detection_fields[is_spam]
delivery events.parameters[delivery].msgValue[message_info].parameter.intValue[smtp_replay_error] security_result.detection_fields[smtp_replay_error] If the events.parameters[delivery].msgValue[message_info].parameter.intValue[smtp_replay_error] log field value is equal to 1, then the security_result.detection_fields.key UDM field is set to smtp_replay_error and the security_result.detection_fields.value UDM field is set to 1 - Authentication error.
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[smtp_replay_error] log field value is equal to 2, then the security_result.detection_fields.key UDM field is set to smtp_replay_error and the security_result.detection_fields.value UDM field is set to 2 - Daily rate limit was exceeded..
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[smtp_replay_error] log field value is equal to 3, then the security_result.detection_fields.key UDM field is set to smtp_replay_error and the security_result.detection_fields.value UDM field is set to 3 - Peak rate limit was exceeded..
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[smtp_replay_error] log field value is equal to 4, then the security_result.detection_fields.key UDM field is set to smtp_replay_error and the security_result.detection_fields.value UDM field is set to 4 - SMTP relay was abused..
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[smtp_replay_error] log field value is equal to 5, then the security_result.detection_fields.key UDM field is set to smtp_replay_error and the security_result.detection_fields.value UDM field is set to 5 - Per-user rate limit was exceeded..
delivery security_result.detection_fields[spam_info_classification_reason] If the events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.intValue[classification_reason] log field value is equal to 1, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 1 - Default spam classification reason.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.intValue[classification_reason] log field value is equal to 2, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 2 - Message classified because of sender's past actions.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.intValue[classification_reason] log field value is equal to 3, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 3 - Suspicious content.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.intValue[classification_reason] log field value is equal to 4, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 4 - Suspicious link.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.intValue[classification_reason] log field value is equal to 5, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 5 - Suspicious attachment.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.intValue[classification_reason] log field value is equal to 6, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 6 - Custom policy defined in Google Workspace Admin Console > Gmail settings.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.intValue[classification_reason] log field value is equal to 7, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 7 - DMARC.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.intValue[classification_reason] log field value is equal to 8, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 8 - Domain in public RBLs.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.intValue[classification_reason] log field value is equal to 9, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 9 - RFC standards violation.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.intValue[classification_reason] log field value is equal to 10, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 10 - Gmail policy violation.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.intValue[classification_reason] log field value is equal to 11, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 11 - Machine learning verdict.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.intValue[classification_reason] log field value is equal to 12, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 12 - Sender reputation.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.intValue[classification_reason] log field value is equal to 13, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 13 - Blatant spam.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.intValue[classification_reason] log field value is equal to 14, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 14 - Advanced phishing and Malware protection.
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.intValue[classification_timestamp_usec] security_result.detection_fields[spam_info_classification_timestamp_usec]
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.boolValue[delayed_for_deepscan] security_result.detection_fields[spam_info_delayed_for_deepscan]
delivery security_result.detection_fields[spam_info_disposition] If the events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.intValue[disposition] log field value is equal to 1, then the security_result.detection_fields.key UDM field is set to spam_info_disposition and the security_result.detection_fields.value UDM field is set to 1 - Message considered clean (not spam or malware).
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.intValue[disposition] log field value is equal to 2, then the security_result.detection_fields.key UDM field is set to spam_info_disposition and the security_result.detection_fields.value UDM field is set to 2 - Spam.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.intValue[disposition] log field value is equal to 3, then the security_result.detection_fields.key UDM field is set to spam_info_disposition and the security_result.detection_fields.value UDM field is set to 3 - Phishing.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.intValue[disposition] log field value is equal to 4, then the security_result.detection_fields.key UDM field is set to spam_info_disposition and the security_result.detection_fields.value UDM field is set to 4 - Suspicious.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.intValue[disposition] log field value is equal to 5, then the security_result.detection_fields.key UDM field is set to spam_info_disposition and the security_result.detection_fields.value UDM field is set to 5 - Malware.
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.value[ip_whitelist_entry] security_result.detection_fields[spam_info_ip_whitelist_entry]
delivery events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.intValue security_result.detection_fields[spam_info_safety_settings_condition] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to spam_info, then
Iterate through log field events.parameters.msgValue.parameter.msgValue.parameter:
if the events.parameters.msgValue.parameter.msgValue.parameter.name log field value is equal to safety_settings_condition, then
Iterate through log field events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to safety_settings_action, then the security_result.detection_fields.key UDM field is set to spam_info_safety_settings_condition and the events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.intValue log field is mapped to the security_result.detection_fields.value UDM field.
delivery events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.intValue security_result.detection_fields[spam_info_safety_settings_action] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to spam_info, then
Iterate through log field events.parameters.msgValue.parameter.msgValue.parameter:
if the events.parameters.msgValue.parameter.msgValue.parameter.name log field value is equal to safety_settings_info, then
Iterate through log field events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to safety_settings_action, then the security_result.detection_fields.key UDM field is set to spam_info_safety_settings_action and the events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.intValue log field is mapped to the security_result.detection_fields.value UDM field.
delivery events.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.multiMessageValue[string_match].parameter.value[attachment_name] security_result.detection_fields[triggered_rule_info_string_match_attachment_name]
delivery events.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.multiMessageValue[string_match].parameter.value[matched_string] security_result.detection_fields[triggered_rule_info_string_match_matched_string]
delivery security_result.detection_fields[triggered_rule_info_string_match_source] If the events.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.multiMessageValue[string_match].parameter.intValue[source] log field value is equal to 0, then the security_result.detection_fields.key UDM field is set to triggered_rule_info_string_match_source and the security_result.detection_fields.value UDM field is set to 0 - Unknown.
Else if the events.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.multiMessageValue[string_match].parameter.intValue[source] log field value is equal to 1, then The security_result.detection_fields.key UDM field is set to triggered_rule_info_string_match_source and the security_result.detection_fields.value UDM field is set to 1 - Message body, including text format attachments.
Else if the events.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.multiMessageValue[string_match].parameter.intValue[source] log field value is equal to 2, then the security_result.detection_fields.key UDM field is set to triggered_rule_info_string_match_source and the security_result.detection_fields.value UDM field is set to 2 - Binary format attachments.
Else if the events.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.multiMessageValue[string_match].parameter.intValue[source] log field value is equal to 3, then the security_result.detection_fields.key UDM field is set to triggered_rule_info_string_match_source and the security_result.detection_fields.value UDM field is set to 3 - Message headers.
Else if the events.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.multiMessageValue[string_match].parameter.intValue[source] log field value is equal to 4, then the security_result.detection_fields.key UDM field is set to triggered_rule_info_string_match_source and the security_result.detection_fields.value UDM field is set to 4 - Subject.
Else if the events.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.multiMessageValue[string_match].parameter.intValue[source] log field value is equal to 5, then The security_result.detection_fields.key UDM field is set to triggered_rule_info_string_match_source and the security_result.detection_fields.value UDM field is set to 5 - Sender header.
Else if the events.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.multiMessageValue[string_match].parameter.intValue[source] log field value is equal to 6, then the security_result.detection_fields.key UDM field is set to triggered_rule_info_string_match_source and the security_result.detection_fields.value UDM field is set to 6 - Recipient header.
Else if the events.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.multiMessageValue[string_match].parameter.intValue[source] log field value is equal to 7, then the security_result.detection_fields.key UDM field is set to triggered_rule_info_string_match_source and the security_result.detection_fields.value UDM field is set to 7 - Raw message.
delivery security_result.detection_fields[upload_error_category] If the events.parameters[delivery].msgValue[message_info].parameter.intValue[upload_error_category] log field value is equal to 0, then the security_result.detection_fields.key UDM field is set to upload_error_category and the security_result.detection_fields.value UDM field is set to 0 - Uncategorized transient error.
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[upload_error_category] log field value is equal to 1, then the security_result.detection_fields.key UDM field is set to upload_error_category and the security_result.detection_fields.value UDM field is set to 1 - Recipient account is too busy.
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[upload_error_category] log field value is equal to 2, then the security_result.detection_fields.key UDM field is set to upload_error_category and the security_result.detection_fields.value UDM field is set to 2 - DNS error resolving recipient domain.
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[upload_error_category] log field value is equal to 3, then the security_result.detection_fields.key UDM field is set to upload_error_category and the security_result.detection_fields.value UDM field is set to 3 - Recipient's server refused connection.
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[upload_error_category] log field value is equal to 4, then the security_result.detection_fields.key UDM field is set to upload_error_category and the security_result.detection_fields.value UDM field is set to 4 - Recipient is out of storage.
delivery events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue security_result.rule_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to triggered_rule_info, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to rule_id, then the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field is mapped to the security_result.rule_id UDM field.
delivery security_result.rule_labels[triggered_rule_info_consequence_action] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to triggered_rule_info, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to consequence, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.name log field value is equal to action, then if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 0, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 0 - Consequence is a no-op. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 3, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 3 - Put message in Admin Quarantine. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 4, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 4 - Modify the primary delivery target. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 5, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 5 - Add a delivery target. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 6, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 6 - Added a message header. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 7, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 7 - Overwrite the envelope recipient. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 9, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 9 - Add message to specified message set. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 10, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 10 - Modify the message labels. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 11, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 11 - Prefix text to message subject. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 12, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 12 - Add a footer to the message. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 13, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 13 - Strip the message body. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 14, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 14 - Store a copy of the message in the user's mailbox, according to comprehensive mail storage setting.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 15, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 15 - Replace attachment with canned text. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 16, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 16 - Require secure message delivery. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 17, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 17 - Message can't be delivered and Bounced. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 18, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 18 - Archive to Google Vault for recipients. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 20, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 20 - Encrypt outbound message using S/MIME. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 21, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 21 - Change the recipient user when message is received at SMTP..
delivery events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.value security_result.rule_labels[triggered_rule_info_consequence_reason] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to triggered_rule_info, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to consequence, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.name log field value is equal to reason, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_reason and the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.value log field is mapped to the security_result.rule_labels.value UDM field.
delivery security_result.rule_labels[triggered_rule_info_consequence_subconsequence_action] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to triggered_rule_info, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to consequence, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.name log field value is equal to subconsequence, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.name log field value is equal to action, then if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 0, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 0 - Consequence is a no-op. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 3, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 3 - Put message in Admin Quarantine. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 4, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 4 - Modify the primary delivery target. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 5, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 5 - Add a delivery target. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 6, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 6 - Added a message header. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 7, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 7 - Overwrite the envelope recipient. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 9, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 9 - Add message to specified message set. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 10, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 10 - Modify the message labels. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 11, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 11 - Prefix text to message subject. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 12, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 12 - Add a footer to the message. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 13, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 13 - Strip the message body. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 14, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 14 - Store a copy of the message in the user is mailbox, according to comprehensive mail storage setting.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 15, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 15 - Replace attachment with canned text. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 16, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 16 - Require secure message delivery. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 17, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 17 - Message can't be delivered and Bounced. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 18, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 18 - Archive to Google Vault for recipients. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 20, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 20 - Encrypt outbound message using S/MIME. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 21, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 21 - Change the recipient user when message is received at SMTP..
delivery events.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.multiMessageValue[consequence].parameter.multiMessageValue[subconsequence].parameter.value[reason] security_result.rule_labels[triggered_rule_info_consequence_subconsequence_reason]
delivery events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue security_result.rule_labels[triggered_rule_info_policy_id] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to triggered_rule_info, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to policy_id, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_policy_id and the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field is mapped to the security_result.rule_labels.value UDM field.
delivery additional.fields[triggered_rule_info_spam_label_modifier] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to triggered_rule_info, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to spam_label_modifier, then if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 0, then the additional.fields.key UDM field is set to a value generated from the template triggered_rule_info_spam_label_modifier_%{index3}%{index4}, where %{index3} and %{index4} are replaced with the values of the index3 and index4 log fields and the additional.fields.value UDM field is set to 0 - No action—the rule honored the Gmail spam classification verdict.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 1, then the additional.fields.key UDM field is set to a value generated from the template triggered_rule_info_spam_label_modifier_%{index3}%{index4}, where %{index3} and %{index4} are replaced with the values of the index3 and index4 log fields and the additional.fields.value UDM field is set to 1 - Spam—the rule classified the message as spam.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 2, then the additional.fields.key UDM field is set to a value generated from the template triggered_rule_info_spam_label_modifier_%{index3}%{index4}, where %{index3} and %{index4} are replaced with the values of the index3 and index4 log fields and the additional.fields.value UDM field is set to 2 - Not spam—the rule classified the message as not spam..
delivery security_result.rule_labels[triggered_rule_info_spam_label_modifier] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to triggered_rule_info, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to spam_label_modifier, then if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 0, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_spam_label_modifier and the security_result.rule_labels.value UDM field is set to 0 - No action—the rule honored the Gmail spam classification verdict.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 1, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_spam_label_modifier and the security_result.rule_labels.value UDM field is set to 1 - Spam—the rule classified the message as spam.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 2, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_spam_label_modifier and the security_result.rule_labels.value UDM field is set to 2 - Not spam—the rule classified the message as not spam..
delivery events.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.multiMessageValue[string_match].parameter.value[match_expression] security_result.rule_labels[triggered_rule_info_string_match_match_expression]
delivery events.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.multiMessageValue[string_match].parameter.value[predefined_detector_name] security_result.rule_labels[triggered_rule_info_string_match_predefined_detector_name]
delivery security_result.rule_labels[triggered_rule_info_string_match_type] If the events.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.multiMessageValue[string_match].parameter.intValue[type] log field value is equal to 0, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_string_match_type and the securtiy_result.rule_labels.value UDM field is set to 0 - Undefined.
Else if the events.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.multiMessageValue[string_match].parameter.intValue[type] log field value is equal to 1, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_string_match_type and the securtiy_result.rule_labels.value UDM field is set to 1 - Regular expression match.
Else if the events.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.multiMessageValue[string_match].parameter.intValue[type] log field value is equal to 2, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_string_match_type and the securtiy_result.rule_labels.value UDM field is set to 2 - Predefined detector match.
Else if the events.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.multiMessageValue[string_match].parameter.intValue[type] log field value is equal to 3, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_string_match_type and the securtiy_result.rule_labels.value UDM field is set to 3 - Simple content match.
Else if the events.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.multiMessageValue[string_match].parameter.intValue[type] log field value is equal to 4, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_string_match_type and the securtiy_result.rule_labels.value UDM field is set to 4 - Non-ASCII match.
delivery events.parameters.msgValue.parameter.multiMessageValue.parameter.value security_result.rule_name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to triggered_rule_info, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to rule_name, then the events.parameters.msgValue.parameter.multiMessageValue.parameter.value log field is mapped to the security_result.rule_name UDM field.
delivery security_result.rule_type Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to triggered_rule_info, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to rule_type, then if the eevents.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.intValue[rule_type] log field value is equal to 0, then the security_result.rule_type UDM field is set to 0 - Walled garden. Else if the eevents.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.intValue[rule_type] log field value is equal to 7, then the security_result.rule_type UDM field is set to 7 - Objectionable content. Else if the eevents.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.intValue[rule_type] log field value is equal to 8, then the security_result.rule_type UDM field is set to 8 - Content compliance. Else if the eevents.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.intValue[rule_type] log field value is equal to 10, then the security_result.rule_type UDM field is set to 10 - Received mail routing. Else if the eevents.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.intValue[rule_type] log field value is equal to 11, then the security_result.rule_type UDM field is set to 11 - Sent mail routing. Else if the eevents.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.intValue[rule_type] log field value is equal to 12, then the security_result.rule_type UDM field is set to 12 - Spam override. Else if the eevents.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.intValue[rule_type] log field value is equal to 14, then the security_result.rule_type UDM field is set to 14 - Blocked senders. Else if the eevents.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.intValue[rule_type] log field value is equal to 15, then the security_result.rule_type UDM field is set to 15 - Append footer. Else if the eevents.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.intValue[rule_type] log field value is equal to 16, then the security_result.rule_type UDM field is set to 16 - Attachment compliance. Else if the eevents.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.intValue[rule_type] log field value is equal to 17, then the security_result.rule_type UDM field is set to 17 - TLS compliance. Else if the eevents.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.intValue[rule_type] log field value is equal to 18, then the security_result.rule_type UDM field is set to 18 - Domain default routing. Else if the eevents.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.intValue[rule_type] log field value is equal to 19, then the security_result.rule_type UDM field is set to 19 - Inbound email journal acceptance in Vault. Else if the eevents.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.intValue[rule_type] log field value is equal to 20, then the security_result.rule_type UDM field is set to 20 - Outbound relay. Else if the eevents.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.intValue[rule_type] log field value is equal to 21, then the security_result.rule_type UDM field is set to 21 - Quarantine summary. Else if the eevents.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.intValue[rule_type] log field value is equal to 22, then the security_result.rule_type UDM field is set to 22 - Alternate secure route. Else if the eevents.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.intValue[rule_type] log field value is equal to 23, then the security_result.rule_type UDM field is set to 23 - Alias table. Else if the eevents.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.intValue[rule_type] log field value is equal to 24, then the security_result.rule_type UDM field is set to 24 - Comprehensive mail storage. Else if the eevents.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.intValue[rule_type] log field value is equal to 25, then the security_result.rule_type UDM field is set to 25 - Routing rule. Else if the eevents.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.intValue[rule_type] log field value is equal to 26, then the security_result.rule_type UDM field is set to 26 - Inbound gateway. Else if the eevents.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.intValue[rule_type] log field value is equal to 27, then the security_result.rule_type UDM field is set to 27 - S/MIME. Else if the eevents.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.intValue[rule_type] log field value is equal to 28, then the security_result.rule_type UDM field is set to 28 - Third-party email archiving. Else if the eevents.parameters[delivery].msgValue[message_info].parameter.multiMessageValue[triggered_rule_info].parameter.intValue[rule_type] log field value is equal to 31, then the security_result.rule_type UDM field is set to 31 - S/MIME restrict delivery. Otherwise, the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field is mapped to the security_result.rule_type UDM field.
delivery about.domain.name Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to connection_info, then
Iterate through log field events.parameters.msgValue.parameter.msgValue.parameter:
if the events.parameters.msgValue.parameter.msgValue.parameter.name log field value is equal to authenticated_domain, then
Iterate through log field events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to name, then the events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.value log field is mapped to the about.domain.name UDM field.
delivery about.file.file_type Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to attachment, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to file_extension_type, then file_type log field value is set to a value generated from the template FILE_TYPE_%{events.parameters.msgValue.parameter.multiMessageValue.parameter.value}, where %{events.parameters.msgValue.parameter.multiMessageValue.parameter.value} is replaced with the value of the events.parameters.msgValue.parameter.multiMessageValue.parameter.value log field. If the file_type log field value contain one of the following values:
  • FILE_TYPE_ACE
  • FILE_TYPE_ANDROID
  • FILE_TYPE_APPLE
  • FILE_TYPE_APPLE_PLIST
  • FILE_TYPE_APPLEDOUBLE
  • FILE_TYPE_APPLESCRIPT
  • FILE_TYPE_APPLESCRIPT_COMPILED
  • FILE_TYPE_APPLESINGLE
  • FILE_TYPE_ARC
  • FILE_TYPE_ARJ
  • FILE_TYPE_ASD
  • FILE_TYPE_ASF
  • FILE_TYPE_AVI
  • FILE_TYPE_AWK
  • FILE_TYPE_BLACKHOLE
  • FILE_TYPE_BMP
  • FILE_TYPE_BZIP
  • FILE_TYPE_C
  • FILE_TYPE_CAB
  • FILE_TYPE_CAP
  • FILE_TYPE_CHM
  • FILE_TYPE_COFF
  • FILE_TYPE_COOKIE
  • FILE_TYPE_CPP
  • FILE_TYPE_CRX
  • FILE_TYPE_DEB
  • FILE_TYPE_DIB
  • FILE_TYPE_DIVX
  • FILE_TYPE_DMG
  • FILE_TYPE_DOC
  • FILE_TYPE_DOCX
  • FILE_TYPE_DOS_COM
  • FILE_TYPE_DOS_EXE
  • FILE_TYPE_DYALOG
  • FILE_TYPE_DZIP
  • FILE_TYPE_EBOOK
  • FILE_TYPE_ELF
  • FILE_TYPE_EMAIL_TYPE
  • FILE_TYPE_EMF
  • FILE_TYPE_EOT
  • FILE_TYPE_EPS
  • FILE_TYPE_FLA
  • FILE_TYPE_FLAC
  • FILE_TYPE_FLC
  • FILE_TYPE_FLI
  • FILE_TYPE_FLV
  • FILE_TYPE_FORTRAN
  • FILE_TYPE_FPX
  • FILE_TYPE_GIF
  • FILE_TYPE_GIMP
  • FILE_TYPE_GUL
  • FILE_TYPE_GZIP
  • FILE_TYPE_HTML
  • FILE_TYPE_HWP
  • FILE_TYPE_ICO
  • FILE_TYPE_IN_DESIGN
  • FILE_TYPE_IPHONE
  • FILE_TYPE_ISOIMAGE
  • FILE_TYPE_JAR
  • FILE_TYPE_JAVA
  • FILE_TYPE_JAVA_BYTECODE
  • FILE_TYPE_JAVASCRIPT
  • FILE_TYPE_JNG
  • FILE_TYPE_JPEG
  • FILE_TYPE_KGB
  • FILE_TYPE_LATEX
  • FILE_TYPE_LINUX
  • FILE_TYPE_LINUX_KERNEL
  • FILE_TYPE_LNK
  • FILE_TYPE_MACH_O
  • FILE_TYPE_MACINTOSH
  • FILE_TYPE_MACINTOSH_HFS
  • FILE_TYPE_MACINTOSH_LIB
  • FILE_TYPE_MIDI
  • FILE_TYPE_MOV
  • FILE_TYPE_MP3
  • FILE_TYPE_MP4
  • FILE_TYPE_MPEG
  • FILE_TYPE_MSCOMPRESS
  • FILE_TYPE_MSI
  • FILE_TYPE_NE_DLL
  • FILE_TYPE_NE_EXE
  • FILE_TYPE_ODF
  • FILE_TYPE_ODG
  • FILE_TYPE_ODP
  • FILE_TYPE_ODS
  • FILE_TYPE_ODT
  • FILE_TYPE_OGG
  • FILE_TYPE_OUTLOOK
  • FILE_TYPE_PALMOS
  • FILE_TYPE_PASCAL
  • FILE_TYPE_PDF
  • FILE_TYPE_PE_DLL
  • FILE_TYPE_PE_EXE
  • FILE_TYPE_PERL
  • FILE_TYPE_PHP
  • FILE_TYPE_PKG
  • FILE_TYPE_PNG
  • FILE_TYPE_POWERSHELL
  • FILE_TYPE_PPSX
  • FILE_TYPE_PPT
  • FILE_TYPE_PPTX
  • FILE_TYPE_PS
  • FILE_TYPE_PSD
  • FILE_TYPE_PYTHON
  • FILE_TYPE_QUICKTIME
  • FILE_TYPE_RAR
  • FILE_TYPE_RM
  • FILE_TYPE_ROM
  • FILE_TYPE_RPM
  • FILE_TYPE_RTF
  • FILE_TYPE_RUBY
  • FILE_TYPE_RZIP
  • FILE_TYPE_SCRIPT
  • FILE_TYPE_SEVENZIP
  • FILE_TYPE_SHELLSCRIPT
  • FILE_TYPE_SVG
  • FILE_TYPE_SWF
  • FILE_TYPE_SYMBIAN
  • FILE_TYPE_T3GP
  • FILE_TYPE_TAR
  • FILE_TYPE_TARGA
  • FILE_TYPE_TEXT
  • FILE_TYPE_TIFF
  • FILE_TYPE_TORRENT
  • FILE_TYPE_TTF
  • FILE_TYPE_UNSPECIFIED
  • FILE_TYPE_VBA
  • FILE_TYPE_WAV
  • FILE_TYPE_WEBP
  • FILE_TYPE_WINCE
  • FILE_TYPE_WMA
  • FILE_TYPE_WMV
  • FILE_TYPE_WOFF
  • FILE_TYPE_XLS
  • FILE_TYPE_XLSX
  • FILE_TYPE_XML
  • FILE_TYPE_XPI
  • FILE_TYPE_XWD
  • FILE_TYPE_ZIP
  • FILE_TYPE_ZLIB
, then the file_type log field is mapped to the about.file.file_type UDM field. Else if the events.parameters.msgValue.parameter.name log field value is equal to post_delivery_info, then
Iterate through log field events.parameters.msgValue.parameter.msgValue.parameter:
if the events.parameters.msgValue.parameter.msgValue.parameter.name log field value is equal to interaction, then
Iterate through log field events.parameters.msgValue.parameter.msgValue.parameter.msgValue.parameter:
if the events.parameters.msgValue.parameter.msgValue.parameter.msgValue.parameter.name log field value is equal to attachment, then
Iterate through log field events.parameters.msgValue.parameter.msgValue.parameter.msgValue.parameter.msgValue.parameter:
if the events.parameters.msgValue.parameter.msgValue.parameter.msgValue.parameter.msgValue.parameter.name log field value is equal to file_extension_type, then file_type log field value is set to a value generated from the template FILE_TYPE_%{events.parameters.msgValue.parameter.msgValue.parameter.msgValue.parameter.msgValue.parameter.value}, where %{events.parameters.msgValue.parameter.msgValue.parameter.msgValue.parameter.msgValue.parameter.value} is replaced with the value of the events.parameters.msgValue.parameter.msgValue.parameter.msgValue.parameter.msgValue.parameter.value log field. If the file_type log field value contain one of the following values:
  • FILE_TYPE_ACE
  • FILE_TYPE_ANDROID
  • FILE_TYPE_APPLE
  • FILE_TYPE_APPLE_PLIST
  • FILE_TYPE_APPLEDOUBLE
  • FILE_TYPE_APPLESCRIPT
  • FILE_TYPE_APPLESCRIPT_COMPILED
  • FILE_TYPE_APPLESINGLE
  • FILE_TYPE_ARC
  • FILE_TYPE_ARJ
  • FILE_TYPE_ASD
  • FILE_TYPE_ASF
  • FILE_TYPE_AVI
  • FILE_TYPE_AWK
  • FILE_TYPE_BLACKHOLE
  • FILE_TYPE_BMP
  • FILE_TYPE_BZIP
  • FILE_TYPE_C
  • FILE_TYPE_CAB
  • FILE_TYPE_CAP
  • FILE_TYPE_CHM
  • FILE_TYPE_COFF
  • FILE_TYPE_COOKIE
  • FILE_TYPE_CPP
  • FILE_TYPE_CRX
  • FILE_TYPE_DEB
  • FILE_TYPE_DIB
  • FILE_TYPE_DIVX
  • FILE_TYPE_DMG
  • FILE_TYPE_DOC
  • FILE_TYPE_DOCX
  • FILE_TYPE_DOS_COM
  • FILE_TYPE_DOS_EXE
  • FILE_TYPE_DYALOG
  • FILE_TYPE_DZIP
  • FILE_TYPE_EBOOK
  • FILE_TYPE_ELF
  • FILE_TYPE_EMAIL_TYPE
  • FILE_TYPE_EMF
  • FILE_TYPE_EOT
  • FILE_TYPE_EPS
  • FILE_TYPE_FLA
  • FILE_TYPE_FLAC
  • FILE_TYPE_FLC
  • FILE_TYPE_FLI
  • FILE_TYPE_FLV
  • FILE_TYPE_FORTRAN
  • FILE_TYPE_FPX
  • FILE_TYPE_GIF
  • FILE_TYPE_GIMP
  • FILE_TYPE_GUL
  • FILE_TYPE_GZIP
  • FILE_TYPE_HTML
  • FILE_TYPE_HWP
  • FILE_TYPE_ICO
  • FILE_TYPE_IN_DESIGN
  • FILE_TYPE_IPHONE
  • FILE_TYPE_ISOIMAGE
  • FILE_TYPE_JAR
  • FILE_TYPE_JAVA
  • FILE_TYPE_JAVA_BYTECODE
  • FILE_TYPE_JAVASCRIPT
  • FILE_TYPE_JNG
  • FILE_TYPE_JPEG
  • FILE_TYPE_KGB
  • FILE_TYPE_LATEX
  • FILE_TYPE_LINUX
  • FILE_TYPE_LINUX_KERNEL
  • FILE_TYPE_LNK
  • FILE_TYPE_MACH_O
  • FILE_TYPE_MACINTOSH
  • FILE_TYPE_MACINTOSH_HFS
  • FILE_TYPE_MACINTOSH_LIB
  • FILE_TYPE_MIDI
  • FILE_TYPE_MOV
  • FILE_TYPE_MP3
  • FILE_TYPE_MP4
  • FILE_TYPE_MPEG
  • FILE_TYPE_MSCOMPRESS
  • FILE_TYPE_MSI
  • FILE_TYPE_NE_DLL
  • FILE_TYPE_NE_EXE
  • FILE_TYPE_ODF
  • FILE_TYPE_ODG
  • FILE_TYPE_ODP
  • FILE_TYPE_ODS
  • FILE_TYPE_ODT
  • FILE_TYPE_OGG
  • FILE_TYPE_OUTLOOK
  • FILE_TYPE_PALMOS
  • FILE_TYPE_PASCAL
  • FILE_TYPE_PDF
  • FILE_TYPE_PE_DLL
  • FILE_TYPE_PE_EXE
  • FILE_TYPE_PERL
  • FILE_TYPE_PHP
  • FILE_TYPE_PKG
  • FILE_TYPE_PNG
  • FILE_TYPE_POWERSHELL
  • FILE_TYPE_PPSX
  • FILE_TYPE_PPT
  • FILE_TYPE_PPTX
  • FILE_TYPE_PS
  • FILE_TYPE_PSD
  • FILE_TYPE_PYTHON
  • FILE_TYPE_QUICKTIME
  • FILE_TYPE_RAR
  • FILE_TYPE_RM
  • FILE_TYPE_ROM
  • FILE_TYPE_RPM
  • FILE_TYPE_RTF
  • FILE_TYPE_RUBY
  • FILE_TYPE_RZIP
  • FILE_TYPE_SCRIPT
  • FILE_TYPE_SEVENZIP
  • FILE_TYPE_SHELLSCRIPT
  • FILE_TYPE_SVG
  • FILE_TYPE_SWF
  • FILE_TYPE_SYMBIAN
  • FILE_TYPE_T3GP
  • FILE_TYPE_TAR
  • FILE_TYPE_TARGA
  • FILE_TYPE_TEXT
  • FILE_TYPE_TIFF
  • FILE_TYPE_TORRENT
  • FILE_TYPE_TTF
  • FILE_TYPE_UNSPECIFIED
  • FILE_TYPE_VBA
  • FILE_TYPE_WAV
  • FILE_TYPE_WEBP
  • FILE_TYPE_WINCE
  • FILE_TYPE_WMA
  • FILE_TYPE_WMV
  • FILE_TYPE_WOFF
  • FILE_TYPE_XLS
  • FILE_TYPE_XLSX
  • FILE_TYPE_XML
  • FILE_TYPE_XPI
  • FILE_TYPE_XWD
  • FILE_TYPE_ZIP
  • FILE_TYPE_ZLIB
, then the file_type log field is mapped to the about.file.file_type UDM field.
delivery events.parameters.msgValue.parameter.multiMessageValue.parameter.value, events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.value about.file.sha256 Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to attachment, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to sha256, then the events.parameters.msgValue.parameter.multiMessageValue.parameter.value log field is mapped to the about.file.sha256 UDM field.
delivery events.parameters.msgValue.parameter.multiMessageValue.parameter.value about.file.names Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to attachment, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to file_name, then the events.parameters.msgValue.parameter.multiMessageValue.parameter.value log field is mapped to the about.file.names UDM field.
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[ip_geo_city] about.ip_geo_artifact.location.city
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[ip_geo_country] about.ip_geo_artifact.location.country_or_region
delivery security_result.action_details If the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.intValue[action_type] log field value is equal to 1, then the security_result.action_details UDM field is set to 1 - Message opened for the first time..
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.intValue[action_type] log field value is equal to 2, then the security_result.action_details UDM field is set to 2 - Message marked as unread..
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.intValue[action_type] log field value is equal to 3, then the security_result.action_details UDM field is set to 3 - Message replied..
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.intValue[action_type] log field value is equal to 4, then the security_result.action_details UDM field is set to 4 - Message forwarded..
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.intValue[action_type] log field value is equal to 4, then the security_result.action_details UDM field is set to 4 - Message forwarded..
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.intValue[action_type] log field value is equal to 5, then the security_result.action_details UDM field is set to 5 - Message auto-forwarded by a Gmail setting..
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.intValue[action_type] log field value is equal to 6, then the security_result.action_details UDM field is set to 6 - Message moved to inbox..
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.intValue[action_type] log field value is equal to 7, then the security_result.action_details UDM field is set to 7 - Message moved to trash..
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.intValue[action_type] log field value is equal to 8, then the security_result.action_details UDM field is set to 8 - Message moved out of trash..
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.intValue[action_type] log field value is equal to 9, then the security_result.action_details UDM field is set to 9 - A link in the message body was clicked..
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.intValue[action_type] log field value is equal to 10, then the security_result.action_details UDM field is set to 10 - One or more message attachments were downloaded..
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.intValue[action_type] log field value is equal to 11, then the security_result.action_details UDM field is set to 11 - A link in an attachment was clicked when the attachment was previewed..
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.intValue[action_type] log field value is equal to 12, then the security_result.action_details UDM field is set to 12 - One or more message attachments were saved to Google Drive..
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.intValue[action_type] log field value is equal to 13, then the security_result.action_details UDM field is set to 13 - A link in the add-on was clicked..
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.intValue[action_type] log field value is equal to 14, then the security_result.action_details UDM field is set to 14 - One or more Google Drive items in the message were downloaded..
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.intValue[action_type] log field value is equal to 15, then the security_result.action_details UDM field is set to 15 - One or more Google Drive items in the message were saved to the recipient's Google Drive..
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.intValue[action_type] log field value is equal to 16, then the security_result.action_details UDM field is set to 16 - A classification label was applied to or changed for the message..
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.intValue[action_type] log field value is equal to 17, then the security_result.action_details UDM field is set to 17 - A classification label was applied to or changed for message attachments..
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.intValue[action_type] log field value is equal to 18, then the security_result.action_details UDM field is set to 18 - Message archived..
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.intValue[action_type] log field value is equal to 19, then the security_result.action_details UDM field is set to 19 - Message permanently deleted..
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.intValue[action_type] log field value is equal to 20, then the security_result.action_details UDM field is set to 20 - One or more message attachments were previewed..
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.intValue[action_type] log field value is equal to 21, then the security_result.action_details UDM field is set to 21 - Recipient blocked the message sender..
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.intValue[action_type] log field value is equal to 22, then the security_result.action_details UDM field is set to 22 - Message saved as draft..
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.intValue[action_type] log field value is equal to 23, then the security_result.action_details UDM field is set to 23 - Message viewed, including first and Following readings..
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.intValue[action_type] log field value is equal to 24, then the security_result.action_details UDM field is set to 24 - Message downloaded..
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.intValue[action_type] log field value is equal to 25, then the security_result.action_details UDM field is set to 25 - An application accessed a message on behalf of a user..
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.intValue[action_type] log field value is equal to 26, then the security_result.action_details UDM field is set to 26 - Delegate Granted..
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.msgValue[interaction].parameter.value[link_url] about.url
delivery additional.fields[authenticated_domain_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to connection_info, then
Iterate through log field events.parameters.msgValue.parameter.msgValue.parameter:
if the events.parameters.msgValue.parameter.msgValue.parameter.name log field value is equal to authenticated_domain, then
Iterate through log field events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to type, then if the events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 1, then the additional.fields.key UDM field is set to a value generated from the template authenticated_domain_type_%{index3}%{index4}, where %{index3} and %{index4} are replaced with the values of the index3 and index4 log fields and the additional.fields.value UDM field is set to 1 - SPF. Else if the events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 2, then the additional.fields.key UDM field is set to a value generated from the template authenticated_domain_type_%{index3}%{index4}, where %{index3} and %{index4} are replaced with the values of the index3 and index4 log fields and the additional.fields.value UDM field is set to 2 - DKIM. Else if the events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 3, then the additional.fields.key UDM field is set to a value generated from the template authenticated_domain_type_%{index3}%{index4}, where %{index3} and %{index4} are replaced with the values of the index3 and index4 log fields and the additional.fields.value UDM field is set to 3 - DKIM_PROXY. Else if the events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 4, then the additional.fields.key UDM field is set to a value generated from the template authenticated_domain_type_%{index3}%{index4}, where %{index3} and %{index4} are replaced with the values of the index3 and index4 log fields and the additional.fields.value UDM field is set to 4 - XOAR_SPF. Else if the events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 5, then the additional.fields.key UDM field is set to a value generated from the template authenticated_domain_type_%{index3}%{index4}, where %{index3} and %{index4} are replaced with the values of the index3 and index4 log fields and the additional.fields.value UDM field is set to 5 - XOAR_DKIM. Else if the events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 6, then the additional.fields.key UDM field is set to a value generated from the template authenticated_domain_type_%{index3}%{index4}, where %{index3} and %{index4} are replaced with the values of the index3 and index4 log fields and the additional.fields.value UDM field is set to 6 - ARC_SPF. Else if the events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 7, then the additional.fields.key UDM field is set to a value generated from the template authenticated_domain_type_%{index3}%{index4}, where %{index3} and %{index4} are replaced with the values of the index3 and index4 log fields and the additional.fields.value UDM field is set to 7 - ARC_DKIM.
delivery events.parameters[delivery].msgValue[message_info].parameter.intValue[delivery_timestamp_usec] additional.fields[delivery_timestamp_usec]
delivery additional.fields[detected_file_types_category] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to structured_policy_log_info, then
Iterate through log field events.parameters.msgValue.parameter.msgValue.parameter:
if the events.parameters.msgValue.parameter.msgValue.parameter.name log field value is equal to detected_file_types, then
Iterate through log field events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to category, then if the events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 1, then the additional.fields.key UDM field is set to a value generated from the template detected_file_types_category_%{index3}%{index4}, where %{index3} and %{index4} are replaced with the values of the index3 and index4 log fields and the additional.fields.value UDM field is set to 1 - Unrecognized file type. Else if the events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 2, then the additional.fields.key UDM field is set to a value generated from the template detected_file_types_category_%{index3}%{index4}, where %{index3} and %{index4} are replaced with the values of the index3 and index4 log fields and the additional.fields.value UDM field is set to 2 - Microsoft Office documents, including word processing, spreadsheet, presentation, and Database documents. Includes PDF files. The file might or might not be encrypted.. Else if the events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 3, then the additional.fields.key UDM field is set to a value generated from the template detected_file_types_category_%{index3}%{index4}, where %{index3} and %{index4} are replaced with the values of the index3 and index4 log fields and the additional.fields.value UDM field is set to 3 - Video and Multimedia, for example, MPEG, Quicktime, WMV. Else if the events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 4, then the additional.fields.key UDM field is set to a value generated from the template detected_file_types_category_%{index3}%{index4}, where %{index3} and %{index4} are replaced with the values of the index3 and index4 log fields and the additional.fields.value UDM field is set to 4 - Music and Audio, for example, MP3, AAC, WAV. Else if the events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 5, then the additional.fields.key UDM field is set to a value generated from the template detected_file_types_category_%{index3}%{index4}, where %{index3} and %{index4} are replaced with the values of the index3 and index4 log fields and the additional.fields.value UDM field is set to 5 - Images, for example, JPEG, BMP, GIF. Else if the events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 6, then the additional.fields.key UDM field is set to a value generated from the template detected_file_types_category_%{index3}%{index4}, where %{index3} and %{index4} are replaced with the values of the index3 and index4 log fields and the additional.fields.value UDM field is set to 6 - Archives, for example, ZIP, TAR, TGZ. Else if the events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 7, then the additional.fields.key UDM field is set to a value generated from the template detected_file_types_category_%{index3}%{index4}, where %{index3} and %{index4} are replaced with the values of the index3 and index4 log fields and the additional.fields.value UDM field is set to 7 - Executables, for example EXE, COM, JS. Else if the events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 8, then the additional.fields.key UDM field is set to a value generated from the template detected_file_types_category_%{index3}%{index4}, where %{index3} and %{index4} are replaced with the values of the index3 and index4 log fields and the additional.fields.value UDM field is set to 8 - Office documents that are encrypted.. Else if the events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 9, then the additional.fields.key UDM field is set to a value generated from the template detected_file_types_category_%{index3}%{index4}, where %{index3} and %{index4} are replaced with the values of the index3 and index4 log fields and the additional.fields.value UDM field is set to 9 - Office documents that are not encrypted.. Otherwise, the additional.fields.key UDM field is set to a value generated from the template detected_file_types_category_%{index3}%{index4}, where %{index3} and %{index4} are replaced with the values of the index3 and index4 log fields and the events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.intValue log field is mapped to the additional.fields.value UDM field.
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[dkim_pass] security_result.detection_fields[dkim_pass]
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[dmarc_pass] security_result.detection_fields[dmarc_pass]
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[dmarc_published_domain] security_result.detection_fields[dmarc_published_domain]
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.msgValue[exchange_journal_info].parameter.multiValue[recipients] additional.fields[exchange_journal_info_recipients]
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.msgValue[exchange_journal_info].parameter.value[rfc822_message_id] additional.fields[exchange_journal_info_rfc822_message_id]
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.msgValue[exchange_journal_info].parameter.intValue[timestamp] additional.fields[exchange_journal_info_timestamp]
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.msgValue[exchange_journal_info].parameter.multiValue[unknown_recipients] additional.fields[exchange_journal_info_unknown_recipients]
delivery events.parameters[delivery].msgValue[message_info].parameter.intValue[internal_message_id] additional.fields[internal_message_id]
delivery events.parameters.msgValue.parameter.multiValue additional.fields[link_domain] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to link_domain, then
Iterate through log field events.parameters.msgValue.parameter.multiValue:
The additional.fields.key UDM field is set to a value generated from the template link_domain_%{index2}, where %{index2} is replaced with the value of the index2 log field and the events.parameters.msgValue.parameter.multiValue log field is mapped to the additional.fields.value UDM field.
delivery additional.fields[message_set_type] Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to message_set, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to type, then if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 1, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 1 - Message is inbound (received from outside your domains). This message set doesn't appear with message set 10.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 2, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 2 - Message is outbound (sent to a recipient outside your domains). This message set doesn't appear with message set 10.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 4, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 4 - Message contains objectionable content, as defined by one of your policies.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 6, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 6 - Message triggered the walled garden rule you configured that restricts messages to authorized addresses or domains.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 7, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 7 - Gmail classified the message as spam.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 8, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 8 - Message being sent (outgoing message). Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 9, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 9 - Message being received (incoming message). Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 10, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 10 - Message that is internal to your domains. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 11, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 11 - Message has a sender or recipients outside your domains.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 12, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 12 - Message has some recipients inside your domain and Some recipients outside your domain. This message set might appear when:. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 13, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 13 - The type of the message set is unknown.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 15, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 15 - The policy being checked against is tied to a Gmail user.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 18, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 18 - Message doesn't have a default route.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 19, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 19 - The address list you configured for domain default routing matches the correspondent of the message.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 20, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 20 - Message is from an address in your blocked senders list.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 21, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 21 - Message was sent over TLS and the SSL certificate is valid.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 22, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 22 - Message was sent over TLS.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 24, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 24 - The recipient of this message is unknown.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 25, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 25 - Message is a non-delivery report responding to a message that was not delivered.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 26, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 26 - Message triggered a rerouting rule, which you configured in domain default routing.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 27, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 27 - Sender successfully passed SPF/DKIM/DMARC authentication. If the sender isn't authenticated, the sender domain is untrusted and the message is not considered internal.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 28, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 28 - Exchange journal is archiving the message to Google Vault.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 29, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 29 - Message was routed through SMTP relay.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 30, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 30 - A recipient of the message matched one of the enumerated recipients (instead of a regular expression pattern) you configured for domain routing, or domain default routing.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 31, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 31 - Message matched a domain default routing condition you configured.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 32, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 32 - Message was created from an Exchange journal message for archiving to Google Vault.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 33, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 33 - Message has to be transmitted through a secure connection, such as TLS.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 34, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 34 - The policy being checked against is tied to a group instead of an individual Gmail user.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 35, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 35 - Message could not be authenticated in SMTP relay because it has an empty SMTP envelope-from address or is possibly an Exchange Journal message. It will be checked later at SMTP RCPT command Time.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 36, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 36 - Message has aggressive spam filtering enabled.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 37, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 37 - Message is authenticated for SMTP relay.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 39, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 39 - Sender is from an authenticated domain for relay.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 40, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 40 - Message is from a Google Workspace user in the domain being authenticated for relay.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 41, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 41 - Sender has successfully authenticated with SMTP AUTH, and Gmail is trying to authenticate SMTP relay for the sender's domain.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 42, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 42 - Message was sent from an address that is not authenticated.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 43, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 43 - Message was rerouted through an alias table.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 44, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 44 - Message triggered a rule that changes the route of the mail flow.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 45, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 45 - Message is to a catch-all account and Is being relayed to an on-premise server. System-of-record policies won't be applied to it.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 46, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 46 - Message bypassed the spam filter.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 47, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 47 - Message was detected to be spam by tag-and-deliver information in the inbound gateway settings.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 48, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 48 - Message was not checked for spam (by SMTP) due to a spam-override policy.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 49, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 49 - Always override spam rejection for the message.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 50, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 50 - Message matches a domain routing condition you configured.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 51, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 51 - Message triggered a rerouting rule that you configured for domain routing.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 55, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 55 - Message was created by the Exchange Journal generation setting.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 57, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 57 - Message was received from an inbound gateway rule that you configured.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 60, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 60 - Message is protected with Gmail confidential mode.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 61, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 61 - Message was caught by Security sandbox.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 62, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 62 - The address list you configured for domain default routing matches the SMTP envelope recipient instead of the correspondent of the message.. Else if the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field value is equal to 63, then the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the additional.fields.value UDM field is set to 63 - Message triggered a domain-level rerouting rule, which you configured for domain routing, or domain default routing. Otherwise, the additional.fields.key UDM field is set to a value generated from the template message_set_type_%{index2}%{index3}, where %{index2} and %{index3} are replaced with the values of the index2 and index3 log fields and the events.parameters.msgValue.parameter.multiMessageValue.parameter.intValue log field is mapped to the additional.fields.value UDM field.
delivery events.parameters[delivery].msgValue[message_info].parameter.intValue[moderation_reason] additional.fields[moderation_reason]
delivery events.parameters[delivery].msgValue[message_info].parameter.intValue[moderation_status] additional.fields[moderation_status]
delivery events.parameters[delivery].msgValue[message_info].parameter.intValue[num_message_attachments] additional.fields[num_message_attachments]
delivery events.parameters[delivery].msgValue[message_info].parameter.intValue[sequence_number] additional.fields[sequence_number]
delivery additional.fields[smime_content_type] If the events.parameters[delivery].msgValue[message_info].parameter.intValue[smime_content_type] log field value is equal to 0, then the additional.fields.key UDM field is set to smime_content_type and the additional.fields.value UDM field is set to 0 - Message does not have a recognized S/MIME Content-Type..
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[smime_content_type] log field value is equal to 1, then the additional.fields.key UDM field is set to smime_content_type and the additional.fields.value UDM field is set to 1 - An S/MIME message with a detached signature Indicated by content type multipart/signed with parameter protocol=application/pkcs7-signature..
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[smime_content_type] log field value is equal to 2, then the additional.fields.key UDM field is set to smime_content_type and the additional.fields.value UDM field is set to 2 - An S/MIME message with an opaque signature Indicated by content type application/pkcs7-mime or application/x-pkcs7-mime with parameter smime-type=signed-data..
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[smime_content_type] log field value is equal to 3, then the additional.fields.key UDM field is set to smime_content_type and the additional.fields.value UDM field is set to 3 - An S/MIME message that is encrypted Indicated by content type application/pkcs7-mime or application/x-pkcs7-mime with parameter smime-type=enveloped-data..
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[smime_content_type] log field value is equal to 4, then the additional.fields.key UDM field is set to smime_content_type and the additional.fields.value UDM field is set to 4 - An S/MIME message that is compressed Indicated by content type application/pkcs7-mime or application/x-pkcs7-mime with parameter smime-type=compressed-data..
delivery events.parameters[delivery].msgValue[message_info].parameter.boolValue[smime_encrypt_message] additional.fields[smime_encrypt_message]
delivery events.parameters[delivery].msgValue[message_info].parameter.boolValue[smime_extraction_success] additional.fields[smime_extraction_success]
delivery events.parameters[delivery].msgValue[message_info].parameter.boolValue[smime_packaging_success] additional.fields[smime_packaging_success]
delivery events.parameters[delivery].msgValue[message_info].parameter.boolValue[smime_sign_message] additional.fields[smime_sign_message]
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[spf_pass] security_result.detection_fields[spf_pass]
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[tls_required_but_unavailable] additional.fields[tls_required_but_unavailable]
delivery events.parameters.msgValue.parameter.multiMessageValue.parameter.value network.email.to Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to destination, then
Iterate through log field events.parameters.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to address, then the events.parameters.msgValue.parameter.multiMessageValue.parameter.value log field is mapped to the network.email.to UDM field.
delivery events.parameters[delivery].msgValue[event_info].parameter.msgValue[client_context].parameter.value[client_type] principal.resource.attribute.labels[client_type]
delivery events.parameters[delivery].msgValue[event_info].parameter.msgValue[client_context].parameter.msgValue[session_context].parameter.value[delegate_user_email] principal.user.email_addresses
delivery events.parameters[delivery].msgValue[event_info].parameter.msgValue[client_context].parameter.msgValue[session_context].parameter.value[dusi] additional.fields[dusi]
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[confidential_mode_info].parameter.boolValue[is_confidential_mode] additional.fields[is_confidential_mode]
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.msgValue[interaction].parameter.value[drive_id] about.resource.product_object_id
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.msgValue[interaction].parameter.msgValue[attachment].parameter.value[file_name] about.file.names
delivery about.security_result.category If the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.msgValue[interaction].parameter.msgValue[attachment].parameter.value[malware_family] log field value is not empty, then The about.security_result.category UDM field is set to SOFTWARE_MALICIOUS.
delivery about.security_result.category_details If the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.msgValue[interaction].parameter.msgValue[attachment].parameter.value[malware_family] log field value is equal to 1, then the security_result.category_details UDM field is set to 1 - A known malicious program type of malware.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.msgValue[interaction].parameter.msgValue[attachment].parameter.value[malware_family] log field value is equal to 2, then the security_result.category_details UDM field is set to 2 - A virus or worm type of malware.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.msgValue[interaction].parameter.msgValue[attachment].parameter.value[malware_family] log field value is equal to 3, then the security_result.category_details UDM field is set to 3 - Possible harmful email content.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.msgValue[interaction].parameter.msgValue[attachment].parameter.value[malware_family] log field value is equal to 4, then the security_result.category_details UDM field is set to 4 - Possible unwanted email content.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.msgValue[interaction].parameter.msgValue[attachment].parameter.value[malware_family] log field value is equal to 5, then the security_result.category_details UDM field is set to 5 - Other type of malware.
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.msgValue[interaction].parameter.msgValue[attachment].parameter.value[sha256] about.file.sha256 If the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.msgValue[interaction].parameter.msgValue[attachment].parameter.value[sha256] log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the about.file.sha256 UDM field is set to events.parameters.msgValue.parameter.msgValue.parameter.msgValue.parameter.msgValue.parameter.value.
delivery target.resource.resource_subtype If the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.msgValue[data_classification].parameter.intValue[classified_entity] log field value is equal to 1, then the target.resource.resource_subtype UDM field is set to 1 - Message body.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.msgValue[data_classification].parameter.intValue[classified_entity] log field value is equal to 2, then the target.resource.resource_subtype UDM field is set to 2 - Attachment.
delivery security_result.detection_fields[event_type] If the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.msgValue[data_classification].parameter.intValue[event_type] log field value is equal to 1, then the security_result.detection_fields.key UDM field is set to event_type and the security_result.detection_fields.value UDM field is set to 1 - Label changed.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.msgValue[data_classification].parameter.intValue[event_type] log field value is equal to 2, then the security_result.detection_fields.key UDM field is set to event_type and the security_result.detection_fields.value UDM field is set to 2 - Label newly applied.
Else if the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.msgValue[data_classification].parameter.intValue[event_type] log field value is equal to 3, then the security_result.detection_fields.key UDM field is set to event_type and the security_result.detection_fields.value UDM field is set to 3 - Label removed.
Otherwise, the security_result.detection_fields.key UDM field is set to event_type and the events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.msgValue[data_classification].parameter.intValue[event_type] log field is mapped to the security_result.detection_fields.value UDM field.
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.msgValue[data_classification].parameter.msgValue[labels].parameter.value[field_value_display_name] target.resource.attribute.labels[labels_field_value_display_name]
delivery events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.msgValue[data_classification].parameter.msgValue[previous_labels].parameter.value[field_value_display_name] target.resource.attribute.labels[previous_labels_field_value_display_name]
delivery security_result.summary If the events.parameters[delivery].msgValue[message_info].parameter.intValue[smtp_relay_error] log field value is equal to 1, then the security_result.summary UDM field is set to 1 - Authentication error.
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[smtp_relay_error] log field value is equal to 2, then the security_result.summary UDM field is set to 2 - Daily rate limit exceeded.
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[smtp_relay_error] log field value is equal to 3, then the security_result.summary UDM field is set to 3 - Peak rate limit exceeded.
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[smtp_relay_error] log field value is equal to 4, then the security_result.summary UDM field is set to 4 - Abuse of SMTP relay.
Else if the events.parameters[delivery].msgValue[message_info].parameter.intValue[smtp_relay_error] log field value is equal to 5, then the security_result.summary UDM field is set to 5 - Per-user rate limit exceeded.
delivery events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.value about.file.mime_type Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to message_info, then
Iterate through log field events.parameters.msgValue.parameter:
if the events.parameters.msgValue.parameter.name log field value is equal to structured_policy_log_info, then
Iterate through log field events.parameters.msgValue.parameter.msgValue.parameter:
if the events.parameters.msgValue.parameter.msgValue.parameter.name log field value is equal to detected_file_types, then
Iterate through log field events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue:
iterate through log field events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter:
if the events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.name log field value is equal to mime_type, then the events.parameters.msgValue.parameter.msgValue.parameter.multiMessageValue.parameter.value log field is mapped to the about.file.mime_type UDM field.

Field mapping reference: workspace activity gemini_in_workspace_apps application

The following table provides the log fields to UDM field mapping corresponding to events for the gemini_in_workspace_apps application. corresponding UDM fields.

Event Name Log field UDM mapping Logic
feature_utilization action metadata.description
feature_utilization app_name target.application
feature_utilization event_category security_result.category_details
feature_utilization feature_source security_result.action_details

Field mapping reference: workspace activity access_evaluation application

The following table provides the log fields to UDM field mapping corresponding to events for the access_evaluation application. fields.

Event Name Log field UDM mapping Logic
allow_token_impersonation client_type additional.fields[client_type]
allow_token_impersonation configuration_source additional.fields[configuration_source]
allow_token_impersonation events.parameters.value principal.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to device_id, then The principal.asset_id UDM field is set to a value generated from the template AssetId:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
allow_token_impersonation scope_data additional.fields[scope_data]
allow_token_impersonation scopes_requested additional.fields[scopes_requested]
allow_token_impersonation service_account target.user.user_display_name
allow_token_request client_type additional.fields[client_type]
allow_token_request configuration_source additional.fields[configuration_source]
allow_token_request events.parameters.value principal.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to device_id, then The principal.asset_id UDM field is set to a value generated from the template AssetId:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
allow_token_request scope_data additional.fields[scope_data]
allow_token_request scopes_requested additional.fields[scopes_requested]
allow_credential_validation_request scopes_requested additional.fields[scopes_requested]

Field mapping reference: workspace activity admin_data_action application

The following table provides the log fields to UDM field mapping corresponding to events for the admin_data_action application. fields.

Event Name Log field UDM mapping Logic
SENSITIVE_AUDIT_EVENTS_ACCESSED APPLICATION_NAME_OF_TARGET_DATA target.resource.name
SENSITIVE_AUDIT_EVENTS_ACCESSED EVENT_IDS_ACCESSED target.resource.attribute.labels[EVENT_IDS_ACCESSED]
SENSITIVE_AUDIT_EVENTS_ACCESSED FILTERS_APPLIED_IN_QUERY target.resource.attribute.labels[FILTERS_APPLIED_IN_QUERY]
SENSITIVE_AUDIT_EVENTS_ACCESSED JUSTIFICATION security_result.summary
SENSITIVE_AUDIT_EVENTS_ACCESSED TIME_USEC_OF_TARGET_DATA additional.fields[TIME_USEC_OF_TARGET_DATA]
SENSITIVE_AUDIT_EVENTS_ACCESSED UNIQUE_QUALIFIER_ACCESSED target.resource.attribute.labels[UNIQUE_QUALIFIER_HIDDEN]
SENSITIVE_AUDIT_EVENTS_HIDDEN APPLICATION_NAME_OF_TARGET_DATA target.resource.name
SENSITIVE_AUDIT_EVENTS_HIDDEN EVENT_IDS_HIDDEN target.resource.attribute.labels[EVENT_IDS_HIDDEN]
SENSITIVE_AUDIT_EVENTS_HIDDEN JUSTIFICATION security_result.summary
SENSITIVE_AUDIT_EVENTS_HIDDEN TIME_USEC_OF_TARGET_DATA additional.fields[TIME_USEC_OF_TARGET_DATA]
SENSITIVE_AUDIT_EVENTS_HIDDEN UNIQUE_QUALIFIER_HIDDEN target.resource.attribute.labels[UNIQUE_QUALIFIER_HIDDEN]
SENSITIVE_AUDIT_EVENTS_UNHIDDEN APPLICATION_NAME_OF_TARGET_DATA target.resource.name
SENSITIVE_AUDIT_EVENTS_UNHIDDEN EVENT_IDS_UNHIDDEN target.resource.attribute.labels[EVENT_IDS_UNHIDDEN]
SENSITIVE_AUDIT_EVENTS_UNHIDDEN JUSTIFICATION security_result.summary
SENSITIVE_AUDIT_EVENTS_UNHIDDEN TIME_USEC_OF_TARGET_DATA additional.fields[TIME_USEC_OF_TARGET_DATA]
SENSITIVE_AUDIT_EVENTS_UNHIDDEN UNIQUE_QUALIFIER_UNHIDDEN target.resource.attribute.labels[UNIQUE_QUALIFIER_HIDDEN]

Field mapping reference: workspace activity assignments application

The following table provides the log fields to UDM field mapping corresponding to events for the assignments application. fields.

Event Name Log field UDM mapping Logic
user_joined_course course_id target.resource.product_object_id
user_joined_course course_join_method additional.fields[course_join_method]
user_joined_course course_role target.resource.attribute.labels[course_role]
user_joined_course course_title target.resource.name
user_removed_from_course course_id target.resource.product_object_id
user_removed_from_course course_role target.resource.attribute.labels[course_role]
user_removed_from_course course_title target.resource.name
user_removed_from_course impacted_users target.user.email_addresses
created_course course_id target.resource.product_object_id
created_course course_title target.resource.name
deleted_course course_id target.resource.product_object_id
deleted_course course_title target.resource.name
changed_submission_state course_id about.resource.product_object_id
changed_submission_state course_title about.resource.name
changed_submission_state course_work_title target.resource.name
changed_submission_state has_grade additional.fields[has_grade]
changed_submission_state impacted_users target.user.email_addresses
changed_submission_state is_late additional.fields[is_late]
changed_submission_state post_id additional.fields[post_id]
changed_submission_state submission_state target.resource.attribute.labels[submission_state]
published_course_work course_id about.resource.product_object_id
published_course_work course_title about.resource.name
published_course_work course_work_title target.resource.name
published_course_work course_work_type target.resource.attribute.labels[course_work_type]
published_course_work post_id additional.fields[post_id]
set_grade course_id about.resource.product_object_id
set_grade course_title about.resource.name
set_grade course_work_title target.resource.name
set_grade impacted_users target.user.email_addresses
set_grade post_id additional.fields[post_id]

Field mapping reference: workspace activity classroom application

The following table provides the log fields to UDM field mapping corresponding to events for the classroom application.

Event Name Log field UDM mapping Logic
created_add_on_attachment add_on_attachment_id target.resource.product_object_id
created_add_on_attachment add_on_attachment_title target.resource.name
created_add_on_attachment add_on_id target.resource.attribute.labels[add_on_id]
created_add_on_attachment add_on_title target.resource.attribute.labels[add_on_title]
created_add_on_attachment course_id about.resource.product_object_id
created_add_on_attachment course_title about.resource.name
created_add_on_attachment course_work_title about.resource.name
created_add_on_attachment course_work_type about.resource.attribute.labels[course_work_type]
created_add_on_attachment post_id additional.fields[post_id]
deleted_add_on_attachment add_on_actor additional.fields[add_on_actor]
deleted_add_on_attachment add_on_attachment_id target.resource.product_object_id
deleted_add_on_attachment add_on_attachment_title target.resource.name
deleted_add_on_attachment add_on_id target.resource.attribute.labels[add_on_id]
deleted_add_on_attachment add_on_title target.resource.attribute.labels[add_on_title]
deleted_add_on_attachment course_id about.resource.product_object_id
deleted_add_on_attachment course_title about.resource.name
deleted_add_on_attachment course_work_title about.resource.name
deleted_add_on_attachment course_work_type about.resource.attribute.labels[course_work_type]
deleted_add_on_attachment post_id additional.fields[post_id]
updated_add_on_attachment add_on_attachment_id target.resource.product_object_id
updated_add_on_attachment add_on_attachment_title target.resource.name
updated_add_on_attachment add_on_id target.resource.attribute.labels[add_on_id]
updated_add_on_attachment add_on_title target.resource.attribute.labels[add_on_title]
updated_add_on_attachment course_id about.resource.product_object_id
updated_add_on_attachment course_title about.resource.name
updated_add_on_attachment course_work_title about.resource.name
updated_add_on_attachment course_work_type about.resource.attribute.labels[course_work_type]
updated_add_on_attachment due_date additional.fields[due_date]
updated_add_on_attachment grade_denominator additional.fields[grade_denominator]
updated_add_on_attachment post_id additional.fields[post_id]
updated_add_on_attachment_submission_grade add_on_attachment_id target.resource.product_object_id
updated_add_on_attachment_submission_grade add_on_attachment_title target.resource.name
updated_add_on_attachment_submission_grade add_on_id target.resource.attribute.labels[add_on_id]
updated_add_on_attachment_submission_grade add_on_title target.resource.attribute.labels[add_on_title]
updated_add_on_attachment_submission_grade course_id about.resource.product_object_id
updated_add_on_attachment_submission_grade course_title about.resource.name
updated_add_on_attachment_submission_grade course_work_title about.resource.name
updated_add_on_attachment_submission_grade course_work_type about.resource.attribute.labels[course_work_type]
updated_add_on_attachment_submission_grade impacted_users target.user.email_addresses
updated_add_on_attachment_submission_grade post_id additional.fields[post_id]
user_added_to_course course_id target.resource.product_object_id
user_added_to_course course_role target.resource.attribute.labels[course_role]
user_added_to_course course_title target.resource.name
user_added_to_course impacted_users target.user.email_addresses
user_gained_preview_access_to_course course_id target.resource.product_object_id
user_gained_preview_access_to_course course_title target.resource.name
user_gained_preview_access_to_course expiration_timestamp additional.fields[expiration_timestamp]
user_gained_preview_access_to_course impacted_users target.user.email_addresses
user_gained_preview_access_to_course previewer_type additional.fields[previewer_type]
user_invited_to_course course_id target.resource.product_object_id
user_invited_to_course course_role target.resource.attribute.labels[course_role]
user_invited_to_course course_title target.resource.name
user_invited_to_course impacted_users target.user.email_addresses
user_joined_course course_id target.resource.product_object_id
user_joined_course course_join_method additional.fields[course_join_method]
user_joined_course course_role target.resource.attribute.labels[course_role]
user_joined_course course_title target.resource.name
user_joined_course event_source additional.fields[event_source]
user_joined_course user_previously_student additional.fields[user_previously_student]
user_removed_from_course course_id target.resource.product_object_id
user_removed_from_course course_role target.resource.attribute.labels[course_role]
user_removed_from_course course_title target.resource.name
user_removed_from_course event_source additional.fields[event_source]
user_removed_from_course impacted_users target.user.email_addresses
archived_course course_id target.resource.product_object_id
archived_course course_title target.resource.name
created_course course_id target.resource.product_object_id
created_course course_title target.resource.name
created_course event_source additional.fields[event_source]
created_course_quick_link course_id target.resource.product_object_id
created_course_quick_link course_title target.resource.name
created_course_quick_link link_display_title target.resource.attribute.labels[link_display_title]
created_grade_category course_id about.resource.product_object_id
created_grade_category course_title about.resource.name
created_grade_category grade_category_default_denominator target.resource.attribute.labels[grade_category_default_denominator]
created_grade_category grade_category_id target.resource.product_object_id
created_grade_category grade_category_name target.resource.name
created_grade_category grade_category_weight target.resource.attribute.labels[grade_category_weight]
deleted_course acting_sis_integrator target.resource.attribute.labels[acting_sis_integrator]
deleted_course course_id target.resource.product_object_id
deleted_course course_title target.resource.name
deleted_course event_source additional.fields[event_source]
deleted_course_quick_link course_id target.resource.product_object_id
deleted_course_quick_link course_title target.resource.name
deleted_course_quick_link link_display_title target.resource.attribute.labels[link_display_title]
deleted_grade_category course_id about.resource.product_object_id
deleted_grade_category course_title about.resource.name
deleted_grade_category grade_category_default_denominator target.resource.attribute.labels[grade_category_default_denominator]
deleted_grade_category grade_category_id target.resource.product_object_id
deleted_grade_category grade_category_name target.resource.name
deleted_grade_category grade_category_weight target.resource.attribute.labels[grade_category_weight]
edited_course_quick_link course_id target.resource.product_object_id
edited_course_quick_link course_title target.resource.name
edited_course_quick_link link_display_title target.resource.attribute.labels[link_display_title]
edited_grade_category course_id about.resource.product_object_id
edited_grade_category course_title about.resource.name
edited_grade_category grade_category_default_denominator target.resource.attribute.labels[grade_category_default_denominator]
edited_grade_category grade_category_id target.resource.product_object_id
edited_grade_category grade_category_name target.resource.name
edited_grade_category grade_category_weight target.resource.attribute.labels[grade_category_weight]
new_user_owns_course course_id target.resource.product_object_id
new_user_owns_course course_join_method additional.fields[course_join_method]
new_user_owns_course course_title target.resource.name
new_user_owns_course event_source additional.fields[event_source]
restored_course course_id target.resource.product_object_id
restored_course course_title target.resource.name
share_classwork_settings_updated_for_course course_id target.resource.product_object_id
share_classwork_settings_updated_for_course course_title target.resource.name
share_classwork_settings_updated_for_course setting_status additional.fields[setting_status]
share_classwork_settings_updated_for_course target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
transferred_ownership_of_course course_id target.resource.product_object_id
transferred_ownership_of_course course_title target.resource.name
transferred_ownership_of_course event_source additional.fields[event_source]
transferred_ownership_of_course impacted_users target.user.email_addresses
transferred_ownership_of_course previous_course_owner about.user.email_addresses
user_invited_to_own_course course_id target.resource.product_object_id
user_invited_to_own_course course_title target.resource.name
user_invited_to_own_course event_source additional.fields[event_source]
user_invited_to_own_course impacted_users target.user.email_addresses
changed_submission_state course_id about.resource.product_object_id
changed_submission_state course_title about.resource.name
changed_submission_state course_work_title target.resource.name
changed_submission_state has_grade additional.fields[has_grade]
changed_submission_state impacted_users target.user.email_addresses
changed_submission_state is_late additional.fields[is_late]
changed_submission_state post_id additional.fields[post_id]
changed_submission_state submission_state target.resource.attribute.labels[submission_state]
commented_announcement course_id target.resource.product_object_id
commented_announcement course_title target.resource.name
commented_announcement post_id additional.fields[post_id]
commented_course_work course_id about.resource.product_object_id
commented_course_work course_title about.resource.name
commented_course_work course_work_title target.resource.name
commented_course_work course_work_type target.resource.attribute.labels[course_work_type]
commented_course_work post_id additional.fields[post_id]
commented_submission_private course_id about.resource.product_object_id
commented_submission_private course_title about.resource.name
commented_submission_private course_work_title target.resource.name
commented_submission_private course_work_type target.resource.attribute.labels[course_work_type]
commented_submission_private impacted_users target.user.email_addresses
commented_submission_private post_id additional.fields[post_id]
commented_submission_public course_id about.resource.product_object_id
commented_submission_public course_title about.resource.name
commented_submission_public course_work_title target.resource.name
commented_submission_public course_work_type target.resource.attribute.labels[course_work_type]
commented_submission_public impacted_users target.user.email_addresses
commented_submission_public post_id additional.fields[post_id]
created_rubric_for_course_work course_id about.resource.product_object_id
created_rubric_for_course_work course_title about.resource.name
created_rubric_for_course_work course_work_title target.resource.name
created_rubric_for_course_work course_work_type target.resource.attribute.labels[course_work_type]
created_rubric_for_course_work post_id additional.fields[post_id]
published_announcement attachment_types additional.fields[attachment_types]
published_announcement course_id target.resource.product_object_id
published_announcement course_title target.resource.name
published_announcement impacted_users target.user.email_addresses
published_announcement post_id additional.fields[post_id]
published_course_work attachment_types additional.fields[attachment_types]
published_course_work course_id about.resource.product_object_id
published_course_work course_title about.resource.name
published_course_work course_work_max_points additional.fields[course_work_max_points]
published_course_work course_work_title target.resource.name
published_course_work course_work_type target.resource.attribute.labels[course_work_type]
published_course_work grade_category_id additional.fields[grade_category_id]
published_course_work impacted_users target.user.email_addresses
published_course_work post_id additional.fields[post_id]
scored_rubric course_id about.resource.product_object_id
scored_rubric course_title about.resource.name
scored_rubric course_work_title target.resource.name
scored_rubric impacted_users target.user.email_addresses
scored_rubric post_id additional.fields[post_id]
set_draft_grade course_id about.resource.product_object_id
set_draft_grade course_title about.resource.name
set_draft_grade course_work_title target.resource.name
set_draft_grade course_work_type target.resource.attribute.labels[course_work_type]
set_draft_grade draft_grade additional.fields[draft_grade]
set_draft_grade impacted_users target.user.email_addresses
set_draft_grade post_id additional.fields[post_id]
set_grade course_id about.resource.product_object_id
set_grade course_title about.resource.name
set_grade course_work_title target.resource.name
set_grade course_work_type target.resource.attribute.labels[course_work_type]
set_grade grade additional.fields[grade]
set_grade impacted_users target.user.email_addresses
set_grade post_id additional.fields[post_id]
unset_draft_grade course_id about.resource.product_object_id
unset_draft_grade course_title about.resource.name
unset_draft_grade course_work_title target.resource.name
unset_draft_grade course_work_type target.resource.attribute.labels[course_work_type]
unset_draft_grade impacted_users target.user.email_addresses
unset_draft_grade post_id additional.fields[post_id]
unset_grade course_id about.resource.product_object_id
unset_grade course_title about.resource.name
unset_grade course_work_title target.resource.name
unset_grade course_work_type target.resource.attribute.labels[course_work_type]
unset_grade impacted_users target.user.email_addresses
unset_grade post_id additional.fields[post_id]
updated_announcement attachment_types additional.fields[attachment_types]
updated_announcement course_id target.resource.product_object_id
updated_announcement course_title target.resource.name
updated_announcement impacted_users target.user.email_addresses
updated_announcement post_id additional.fields[post_id]
updated_course_work attachment_types additional.fields[attachment_types]
updated_course_work course_id about.resource.product_object_id
updated_course_work course_title about.resource.name
updated_course_work course_work_max_points additional.fields[course_work_max_points]
updated_course_work course_work_title target.resource.name
updated_course_work course_work_type target.resource.attribute.labels[course_work_type]
updated_course_work grade_category_id additional.fields[grade_category_id]
updated_course_work impacted_users target.user.email_addresses
updated_course_work post_id additional.fields[post_id]
grade_export_for_course_work course_id about.resource.product_object_id
grade_export_for_course_work course_title about.resource.name
grade_export_for_course_work course_work_title target.resource.name
grade_export_for_course_work course_work_type target.resource.attribute.labels[course_work_type]
grade_export_for_course_work post_id additional.fields[post_id]
grade_export_for_submission course_id about.resource.product_object_id
grade_export_for_submission course_title about.resource.name
grade_export_for_submission course_work_title target.resource.name
grade_export_for_submission impacted_users target.user.email_addresses
grade_export_for_submission post_id additional.fields[post_id]
grade_export_for_submission submission_id target.resource.product_object_id
default_guardian_summaries_settings_updated_for_teacher summaries_status additional.fields[summaries_status]
guardian_invited_for_student event_source additional.fields[event_source]
guardian_invited_for_student impacted_users target.user.email_addresses
guardian_removed_for_student event_source additional.fields[event_source]
guardian_removed_for_student guardians about.user.email_addresses
guardian_removed_for_student impacted_users target.user.email_addresses
guardian_responded_to_invite impacted_users about.user.email_addresses
guardian_responded_to_invite invite_status additional.fields[invite_status]
guardian_responded_to_invite invited_emails target.user.email_addresses
guardian_summaries_settings_updated_for_course course_id target.resource.product_object_id
guardian_summaries_settings_updated_for_course course_title target.resource.name
guardian_summaries_settings_updated_for_course event_source additional.fields[event_source]
guardian_summaries_settings_updated_for_course summaries_status additional.fields[summaries_status]
guardian_summaries_settings_updated_for_course target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
guardian_summaries_settings_updated_for_teacher summaries_status additional.fields[summaries_status]
guardian_updated_email impacted_users target.user.email_addresses
guardian_updated_email previous_email about.user.email_addresses
originality_report_created course_id about.resource.product_object_id
originality_report_created course_title about.resource.name
originality_report_created course_work_title about.resource.name
originality_report_created course_work_type target.resource.attribute.labels[course_work_type]
originality_report_created document_id target.resource.product_object_id
originality_report_created impacted_users target.user.email_addresses
originality_report_created post_id additional.fields[post_id]

Field mapping reference: workspace activity cloud_search application

The following table provides the log fields to UDM field mapping corresponding to events for the cloud_search application. fields.

Event Name Log field UDM mapping Logic
LIST_QUERY_SOURCES api_call_common_fields_container additional.fields[api_call_common_fields_container]
LIST_QUERY_SOURCES api_status additional.fields[api_status]
LIST_QUERY_SOURCES device_info additional.fields[device_info]
LIST_QUERY_SOURCES list_query_sources_request additional.fields[list_query_sources_request]
LIST_QUERY_SOURCES list_query_sources_response additional.fields[list_query_sources_response]
LIST_QUERY_SOURCES request_type additional.fields[request_type]
SEARCH api_call_common_fields_container additional.fields[api_call_common_fields_container]
SEARCH api_status additional.fields[api_status]
SEARCH device_info additional.fields[device_info]
SEARCH request_type additional.fields[request_type]
SEARCH SEARCH_APPLICATION_ID target.resource.product_object_id
SEARCH search_request additional.fields[search_request]
SEARCH search_response additional.fields[search_response]
SUGGEST api_call_common_fields_container additional.fields[api_call_common_fields_container]
SUGGEST api_status additional.fields[api_status]
SUGGEST device_info additional.fields[device_info]
SUGGEST request_type additional.fields[request_type]
SUGGEST suggest_request additional.fields[search_request]
SUGGEST suggest_response additional.fields[search_response]

Field mapping reference: workspace activity contacts application

The following table provides the log fields to UDM field mapping corresponding to events for the contacts application.

Event Name Log field UDM mapping Logic
accept_merge_and_fix_suggestions CHANGES_COUNT additional.fields[CHANGES_COUNT]
add_to_contacts CONTACTS_COUNT additional.fields[CONTACTS_COUNT]
create_multiple_contacts CONTACTS_COUNT additional.fields[CONTACTS_COUNT]
delete_contacts CONTACTS_COUNT additional.fields[CONTACTS_COUNT]
delete_trashed_contacts CONTACTS_COUNT additional.fields[CONTACTS_COUNT]
hide_contacts CONTACTS_COUNT additional.fields[CONTACTS_COUNT]
import_contacts CONTACTS_COUNT additional.fields[CONTACTS_COUNT]
recover_trashed_contacts CONTACTS_COUNT additional.fields[CONTACTS_COUNT]
export_contacts CONTACTS_COUNT additional.fields[CONTACTS_COUNT]
print_contacts CONTACTS_COUNT additional.fields[CONTACTS_COUNT]

Field mapping reference: workspace activity data_migration application

The following table provides the log fields to UDM field mapping corresponding to events for the data_migration application. fields.

Event Name Log field UDM mapping Logic
CRAWL_FAILURE EXECUTION_ID additional.fields[EXECUTION_ID]
CRAWL_FAILURE MIGRATION_TYPE additional.fields[MIGRATION_TYPE]
CRAWL_FAILURE SOURCE_IDENTIFIER src.resource.name
CRAWL_FAILURE SOURCE_TYPE src.resource.resource_subtype
CRAWL_FAILURE SOURCE_URI src.url
CRAWL_FAILURE TARGET_IDENTIFIER target.resource.name
CRAWL_FAILURE TARGET_TYPE target.resource.resource_subtype
CRAWL_FAILURE TARGET_URI target.url
CREATE_CALENDAR EXECUTION_ID additional.fields[EXECUTION_ID]
CREATE_CALENDAR MIGRATION_TYPE additional.fields[MIGRATION_TYPE]
CREATE_CALENDAR SOURCE_IDENTIFIER src.resource.name
CREATE_CALENDAR SOURCE_TYPE src.resource.resource_subtype
CREATE_CALENDAR SOURCE_URI src.url
CREATE_CALENDAR TARGET_IDENTIFIER target.resource.name
CREATE_CALENDAR TARGET_TYPE target.resource.resource_subtype
CREATE_CALENDAR TARGET_URI target.url
CREATE_CALENDAR_ACL EXECUTION_ID additional.fields[EXECUTION_ID]
CREATE_CALENDAR_ACL MIGRATION_TYPE additional.fields[MIGRATION_TYPE]
CREATE_CALENDAR_ACL SOURCE_IDENTIFIER src.resource.name
CREATE_CALENDAR_ACL SOURCE_TYPE src.resource.resource_subtype
CREATE_CALENDAR_ACL SOURCE_URI src.url
CREATE_CALENDAR_ACL TARGET_IDENTIFIER target.resource.name
CREATE_CALENDAR_ACL TARGET_TYPE target.resource.resource_subtype
CREATE_CALENDAR_ACL TARGET_URI target.url
CREATE_CALENDAR_EVENT EXECUTION_ID additional.fields[EXECUTION_ID]
CREATE_CALENDAR_EVENT MIGRATION_TYPE additional.fields[MIGRATION_TYPE]
CREATE_CALENDAR_EVENT SOURCE_IDENTIFIER src.resource.name
CREATE_CALENDAR_EVENT SOURCE_TYPE src.resource.resource_subtype
CREATE_CALENDAR_EVENT SOURCE_URI src.url
CREATE_CALENDAR_EVENT TARGET_IDENTIFIER target.resource.name
CREATE_CALENDAR_EVENT TARGET_TYPE target.resource.resource_subtype
CREATE_CALENDAR_EVENT TARGET_URI target.url
CREATE_CALENDAR_USER_SETTINGS EXECUTION_ID additional.fields[EXECUTION_ID]
CREATE_CALENDAR_USER_SETTINGS MIGRATION_TYPE additional.fields[MIGRATION_TYPE]
CREATE_CALENDAR_USER_SETTINGS SOURCE_IDENTIFIER src.resource.name
CREATE_CALENDAR_USER_SETTINGS SOURCE_TYPE src.resource.resource_subtype
CREATE_CALENDAR_USER_SETTINGS SOURCE_URI src.url
CREATE_CALENDAR_USER_SETTINGS TARGET_IDENTIFIER target.resource.name
CREATE_CALENDAR_USER_SETTINGS TARGET_TYPE target.resource.resource_subtype
CREATE_CALENDAR_USER_SETTINGS TARGET_URI target.url
CREATE_CONTACT EXECUTION_ID additional.fields[EXECUTION_ID]
CREATE_CONTACT MIGRATION_TYPE additional.fields[MIGRATION_TYPE]
CREATE_CONTACT SOURCE_IDENTIFIER src.resource.name
CREATE_CONTACT SOURCE_TYPE src.resource.resource_subtype
CREATE_CONTACT SOURCE_URI src.url
CREATE_CONTACT TARGET_IDENTIFIER target.resource.name
CREATE_CONTACT TARGET_TYPE target.resource.resource_subtype
CREATE_CONTACT TARGET_URI target.url
CREATE_CONTACT_GROUP EXECUTION_ID additional.fields[EXECUTION_ID]
CREATE_CONTACT_GROUP MIGRATION_TYPE additional.fields[MIGRATION_TYPE]
CREATE_CONTACT_GROUP SOURCE_IDENTIFIER src.resource.name
CREATE_CONTACT_GROUP SOURCE_TYPE src.resource.resource_subtype
CREATE_CONTACT_GROUP SOURCE_URI src.url
CREATE_CONTACT_GROUP TARGET_IDENTIFIER target.resource.name
CREATE_CONTACT_GROUP TARGET_TYPE target.resource.resource_subtype
CREATE_CONTACT_GROUP TARGET_URI target.url
CREATE_FILE EXECUTION_ID additional.fields[EXECUTION_ID]
CREATE_FILE MIGRATION_TYPE additional.fields[MIGRATION_TYPE]
CREATE_FILE SOURCE_IDENTIFIER src.file.names
CREATE_FILE SOURCE_IDENTIFIER src.resource.name
CREATE_FILE SOURCE_TYPE src.resource.resource_subtype
CREATE_FILE SOURCE_URI src.url
CREATE_FILE TARGET_IDENTIFIER target.file.names
CREATE_FILE TARGET_IDENTIFIER target.resource.name
CREATE_FILE TARGET_TYPE target.resource.resource_subtype
CREATE_FILE TARGET_URI target.url
CREATE_FILE_VERSION EXECUTION_ID additional.fields[EXECUTION_ID]
CREATE_FILE_VERSION MIGRATION_TYPE additional.fields[MIGRATION_TYPE]
CREATE_FILE_VERSION SOURCE_IDENTIFIER src.file.names
CREATE_FILE_VERSION SOURCE_IDENTIFIER src.resource.name
CREATE_FILE_VERSION SOURCE_TYPE src.resource.resource_subtype
CREATE_FILE_VERSION SOURCE_URI src.url
CREATE_FILE_VERSION TARGET_IDENTIFIER target.file.names
CREATE_FILE_VERSION TARGET_IDENTIFIER target.resource.name
CREATE_FILE_VERSION TARGET_TYPE target.resource.resource_subtype
CREATE_FILE_VERSION TARGET_URI target.url
CREATE_FOLDER EXECUTION_ID additional.fields[EXECUTION_ID]
CREATE_FOLDER MIGRATION_TYPE additional.fields[MIGRATION_TYPE]
CREATE_FOLDER SOURCE_IDENTIFIER src.resource.name
CREATE_FOLDER SOURCE_TYPE src.resource.resource_subtype
CREATE_FOLDER SOURCE_URI src.url
CREATE_FOLDER TARGET_IDENTIFIER target.resource.name
CREATE_FOLDER TARGET_TYPE target.resource.resource_subtype
CREATE_FOLDER TARGET_URI target.url
CREATE_GMAIL_LABEL EXECUTION_ID additional.fields[EXECUTION_ID]
CREATE_GMAIL_LABEL MIGRATION_TYPE additional.fields[MIGRATION_TYPE]
CREATE_GMAIL_LABEL SOURCE_IDENTIFIER src.resource.name
CREATE_GMAIL_LABEL SOURCE_TYPE src.resource.resource_subtype
CREATE_GMAIL_LABEL SOURCE_URI src.url
CREATE_GMAIL_LABEL TARGET_IDENTIFIER target.resource.name
CREATE_GMAIL_LABEL TARGET_TYPE target.resource.resource_subtype
CREATE_GMAIL_LABEL TARGET_URI target.url
CREATE_GMAIL_MESSAGE EXECUTION_ID additional.fields[EXECUTION_ID]
CREATE_GMAIL_MESSAGE MIGRATION_TYPE additional.fields[MIGRATION_TYPE]
CREATE_GMAIL_MESSAGE SOURCE_IDENTIFIER src.resource.name
CREATE_GMAIL_MESSAGE SOURCE_TYPE src.resource.resource_subtype
CREATE_GMAIL_MESSAGE SOURCE_URI src.url
CREATE_GMAIL_MESSAGE TARGET_IDENTIFIER target.resource.name
CREATE_GMAIL_MESSAGE TARGET_TYPE target.resource.resource_subtype
CREATE_GMAIL_MESSAGE TARGET_URI target.url
CREATE_SPACE EXECUTION_ID additional.fields[EXECUTION_ID]
CREATE_SPACE MIGRATION_TYPE additional.fields[MIGRATION_TYPE]
CREATE_SPACE SOURCE_IDENTIFIER src.resource.name
CREATE_SPACE SOURCE_TYPE src.resource.resource_subtype
CREATE_SPACE SOURCE_URI src.url
CREATE_SPACE TARGET_IDENTIFIER target.resource.name
CREATE_SPACE TARGET_TYPE target.resource.resource_subtype
CREATE_SPACE TARGET_URI target.url
CREATE_SPACE_MEMBERSHIP EXECUTION_ID additional.fields[EXECUTION_ID]
CREATE_SPACE_MEMBERSHIP MIGRATION_TYPE additional.fields[MIGRATION_TYPE]
CREATE_SPACE_MEMBERSHIP SOURCE_IDENTIFIER src.resource.name
CREATE_SPACE_MEMBERSHIP SOURCE_TYPE src.resource.resource_subtype
CREATE_SPACE_MEMBERSHIP SOURCE_URI src.url
CREATE_SPACE_MEMBERSHIP TARGET_IDENTIFIER target.resource.name
CREATE_SPACE_MEMBERSHIP TARGET_TYPE target.resource.resource_subtype
CREATE_SPACE_MEMBERSHIP TARGET_URI target.url
CREATE_SPACE_MESSAGE EXECUTION_ID additional.fields[EXECUTION_ID]
CREATE_SPACE_MESSAGE MIGRATION_TYPE additional.fields[MIGRATION_TYPE]
CREATE_SPACE_MESSAGE SOURCE_IDENTIFIER src.resource.name
CREATE_SPACE_MESSAGE SOURCE_TYPE src.resource.resource_subtype
CREATE_SPACE_MESSAGE SOURCE_URI src.url
CREATE_SPACE_MESSAGE TARGET_IDENTIFIER target.resource.name
CREATE_SPACE_MESSAGE TARGET_TYPE target.resource.resource_subtype
CREATE_SPACE_MESSAGE TARGET_URI target.url
GO_LIVE_SPACE EXECUTION_ID additional.fields[EXECUTION_ID]
GO_LIVE_SPACE MIGRATION_TYPE additional.fields[MIGRATION_TYPE]
GO_LIVE_SPACE SOURCE_IDENTIFIER src.resource.name
GO_LIVE_SPACE SOURCE_TYPE src.resource.resource_subtype
GO_LIVE_SPACE SOURCE_URI src.url
GO_LIVE_SPACE TARGET_IDENTIFIER target.resource.name
GO_LIVE_SPACE TARGET_TYPE target.resource.resource_subtype
GO_LIVE_SPACE TARGET_URI target.url
CREATE_CONNECTION MIGRATION_TYPE additional.fields[MIGRATION_TYPE]
CREATE_CONNECTION TARGET_IDENTIFIER target.resource.name
CREATE_CONNECTION TARGET_URI target.url
CREATE_MIGRATION_MAP MIGRATION_TYPE additional.fields[MIGRATION_TYPE]
CREATE_MIGRATION_MAP TARGET_IDENTIFIER target.resource.name
CREATE_MIGRATION_MAP TARGET_URI target.url
DELETE_CONNECTION MIGRATION_TYPE additional.fields[MIGRATION_TYPE]
DELETE_CONNECTION TARGET_IDENTIFIER target.resource.name
EXIT_MIGRATION MIGRATION_TYPE additional.fields[MIGRATION_TYPE]
EXIT_MIGRATION TARGET_IDENTIFIER target.resource.name
GRANT_CONSENT MIGRATION_TYPE additional.fields[MIGRATION_TYPE]
GRANT_CONSENT TARGET_IDENTIFIER target.resource.name
REQUEST_CONNECTION_VERIFICATION MIGRATION_TYPE additional.fields[MIGRATION_TYPE]
REQUEST_CONNECTION_VERIFICATION TARGET_IDENTIFIER target.resource.name
START_MIGRATION EXECUTION_ID additional.fields[EXECUTION_ID]
START_MIGRATION MIGRATION_TYPE additional.fields[MIGRATION_TYPE]
START_MIGRATION TARGET_IDENTIFIER target.resource.name
START_MIGRATION TARGET_URI target.url
START_MIGRATION_REPORT_DOWNLOAD EXECUTION_ID additional.fields[EXECUTION_ID]
START_MIGRATION_REPORT_DOWNLOAD MIGRATION_TYPE additional.fields[MIGRATION_TYPE]
START_MIGRATION_REPORT_DOWNLOAD TARGET_IDENTIFIER target.resource.name
START_MIGRATION_REPORT_DOWNLOAD TARGET_URI target.url
START_MIGRATION_SETUP MIGRATION_TYPE additional.fields[MIGRATION_TYPE]
START_MIGRATION_SETUP TARGET_IDENTIFIER target.resource.name
START_MIGRATION_SUMMARY_REPORT_DOWNLOAD EXECUTION_ID additional.fields[EXECUTION_ID]
START_MIGRATION_SUMMARY_REPORT_DOWNLOAD MIGRATION_TYPE additional.fields[MIGRATION_TYPE]
START_MIGRATION_SUMMARY_REPORT_DOWNLOAD TARGET_IDENTIFIER target.resource.name
START_MIGRATION_SUMMARY_REPORT_DOWNLOAD TARGET_URI target.url
STOP_MIGRATION EXECUTION_ID additional.fields[EXECUTION_ID]
STOP_MIGRATION MIGRATION_TYPE additional.fields[MIGRATION_TYPE]
STOP_MIGRATION TARGET_IDENTIFIER target.resource.name
STOP_MIGRATION TARGET_URI target.url
UPDATE_MIGRATION_SETTINGS MIGRATION_TYPE additional.fields[MIGRATION_TYPE]
UPDATE_MIGRATION_SETTINGS TARGET_IDENTIFIER target.resource.name
UPDATE_MIGRATION_SETTINGS TARGET_URI target.url

Field mapping reference: workspace activity directory_sync application

The following table provides the log fields to UDM field mapping corresponding to events for the directory_sync application. fields.

Event Name Log field UDM mapping Logic
ADDED_GROUP_MEMBERSHIP DRY_RUN additional.fields[DRY_RUN]
ADDED_GROUP_MEMBERSHIP ENTITY_TYPE additional.fields[ENTITY_TYPE]
ADDED_GROUP_MEMBERSHIP GROUP_ID target.group.email_addresses
ADDED_GROUP_MEMBERSHIP LOG_LEVEL additional.fields[LOG_LEVEL]
ADDED_GROUP_MEMBERSHIP NEW_MEMBERSHIP_ROLE target.user.attribute.roles.name ENTITY_TYPE log field value is set to empty and NEW_MEMBERSHIP_ROLE log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to ENTITY_TYPE, then ENTITY_TYPE log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to NEW_MEMBERSHIP_ROLE, then NEW_MEMBERSHIP_ROLE log field value is set to the events.parameters.value log field value.
If the ENTITY_TYPE log field value is equal to USER, then the NEW_MEMBERSHIP_ROLE log field is mapped to the target.user.attribute.roles.name UDM field.
Otherwise, the NEW_MEMBERSHIP_ROLE log field is mapped to the target.group.attribute.roles.name UDM field.
ADDED_GROUP_MEMBERSHIP REMOTE_DIRECTORY target.resource.name
ADDED_GROUP_MEMBERSHIP SOURCE_DIRECTORY_DISPLAY_NAME about.resource.name
ADDED_GROUP_MEMBERSHIP SOURCE_IMMUTABLE_ID about.resource.product_object_id
ADDED_GROUP_MEMBERSHIP SOURCE_OBJECT_ID about.user.product_object_id ENTITY_TYPE log field value is set to empty and SOURCE_OBJECT_ID log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to ENTITY_TYPE, then ENTITY_TYPE log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to SOURCE_OBJECT_ID, then SOURCE_OBJECT_ID log field value is set to the events.parameters.value log field value.
If the ENTITY_TYPE log field value is equal to USER, then the SOURCE_OBJECT_ID log field is mapped to the about.user.product_object_id UDM field.
Otherwise, the SOURCE_OBJECT_ID log field is mapped to the about.group.product_object_id UDM field.
ADDED_GROUP_MEMBERSHIP SYNC_JOB additional.fields[SYNC_JOB]
ADDED_GROUP_MEMBERSHIP SYNC_RUN additional.fields[SYNC_RUN]
ADDED_GROUP_MEMBERSHIP TARGET_OBJECT_ID target.user.product_object_id ENTITY_TYPE log field value is set to empty and TARGET_OBJECT_ID log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to ENTITY_TYPE, then ENTITY_TYPE log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to TARGET_OBJECT_ID, then TARGET_OBJECT_ID log field value is set to the events.parameters.value log field value.
If the ENTITY_TYPE log field value is equal to USER, then the TARGET_OBJECT_ID log field is mapped to the target.user.product_object_id UDM field.
Otherwise, the TARGET_OBJECT_ID log field is mapped to the target.group.product_object_id UDM field.
ADDED_GROUP_MEMBERSHIP VERBOSE additional.fields[VERBOSE]
CLOUD_DIRECTORY_READ DRY_RUN additional.fields[DRY_RUN]
CLOUD_DIRECTORY_READ ENTITY_TYPE additional.fields[ENTITY_TYPE]
CLOUD_DIRECTORY_READ LOG_LEVEL additional.fields[LOG_LEVEL]
CLOUD_DIRECTORY_READ REMOTE_DIRECTORY target.resource.name
CLOUD_DIRECTORY_READ SOURCE_DIRECTORY_DISPLAY_NAME about.resource.name
CLOUD_DIRECTORY_READ SYNC_JOB additional.fields[SYNC_JOB]
CLOUD_DIRECTORY_READ SYNC_RUN additional.fields[SYNC_RUN]
CLOUD_DIRECTORY_READ VERBOSE additional.fields[VERBOSE]
CLOUD_DIRECTORY_READ_FINISHED COUNT additional.fields[COUNT]
CLOUD_DIRECTORY_READ_FINISHED DRY_RUN additional.fields[DRY_RUN]
CLOUD_DIRECTORY_READ_FINISHED ENTITY_TYPE additional.fields[ENTITY_TYPE]
CLOUD_DIRECTORY_READ_FINISHED LOG_LEVEL additional.fields[LOG_LEVEL]
CLOUD_DIRECTORY_READ_FINISHED REMOTE_DIRECTORY target.resource.name
CLOUD_DIRECTORY_READ_FINISHED SOURCE_DIRECTORY_DISPLAY_NAME about.resource.name
CLOUD_DIRECTORY_READ_FINISHED SYNC_JOB additional.fields[SYNC_JOB]
CLOUD_DIRECTORY_READ_FINISHED SYNC_RUN additional.fields[SYNC_RUN]
CLOUD_DIRECTORY_READ_FINISHED VERBOSE additional.fields[VERBOSE]
ENTITY_CHANGES CREATED_COUNT additional.fields[CREATED_COUNT]
ENTITY_CHANGES DELETED_COUNT additional.fields[DELETED_COUNT]
ENTITY_CHANGES DRY_RUN additional.fields[DRY_RUN]
ENTITY_CHANGES ENTITY_TYPE additional.fields[ENTITY_TYPE]
ENTITY_CHANGES FAILED_COUNT additional.fields[FAILED_COUNT]
ENTITY_CHANGES LOG_LEVEL additional.fields[LOG_LEVEL]
ENTITY_CHANGES REMOTE_DIRECTORY target.resource.name
ENTITY_CHANGES SKIPPED_COUNT additional.fields[SKIPPED_COUNT]
ENTITY_CHANGES SKIPPED_ERROR_COUNT additional.fields[SKIPPED_ERROR_COUNT]
ENTITY_CHANGES SOURCE_DIRECTORY_DISPLAY_NAME about.resource.name
ENTITY_CHANGES SYNC_JOB additional.fields[SYNC_JOB]
ENTITY_CHANGES SYNC_RUN additional.fields[SYNC_RUN]
ENTITY_CHANGES UPDATED_COUNT additional.fields[UPDATED_COUNT]
ENTITY_CHANGES VERBOSE additional.fields[VERBOSE]
ENTITY_CREATED DRY_RUN additional.fields[DRY_RUN]
ENTITY_CREATED ENTITY_TYPE additional.fields[ENTITY_TYPE]
ENTITY_CREATED LOG_LEVEL additional.fields[LOG_LEVEL]
ENTITY_CREATED REMOTE_DIRECTORY target.resource.name
ENTITY_CREATED SOURCE_DIRECTORY_DISPLAY_NAME about.resource.name
ENTITY_CREATED SOURCE_IMMUTABLE_ID about.resource.product_object_id
ENTITY_CREATED SOURCE_OBJECT_ID about.user.product_object_id ENTITY_TYPE log field value is set to empty and SOURCE_OBJECT_ID log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to ENTITY_TYPE, then ENTITY_TYPE log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to SOURCE_OBJECT_ID, then SOURCE_OBJECT_ID log field value is set to the events.parameters.value log field value.
If the ENTITY_TYPE log field value is equal to USER, then the SOURCE_OBJECT_ID log field is mapped to the about.user.product_object_id UDM field.
Otherwise, the SOURCE_OBJECT_ID log field is mapped to the about.group.product_object_id UDM field.
ENTITY_CREATED SYNC_JOB additional.fields[SYNC_JOB]
ENTITY_CREATED SYNC_RUN additional.fields[SYNC_RUN]
ENTITY_CREATED TARGET_OBJECT_ID target.user.product_object_id ENTITY_TYPE log field value is set to empty and TARGET_OBJECT_ID log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to ENTITY_TYPE, then ENTITY_TYPE log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to TARGET_OBJECT_ID, then TARGET_OBJECT_ID log field value is set to the events.parameters.value log field value.
If the ENTITY_TYPE log field value is equal to USER, then the TARGET_OBJECT_ID log field is mapped to the target.user.product_object_id UDM field.
Otherwise, the TARGET_OBJECT_ID log field is mapped to the target.group.product_object_id UDM field.
ENTITY_CREATED VERBOSE additional.fields[VERBOSE]
ENTITY_EXCLUDED DRY_RUN additional.fields[DRY_RUN]
ENTITY_EXCLUDED ENTITY_TYPE additional.fields[ENTITY_TYPE]
ENTITY_EXCLUDED EXCLUSION_RULE security_result.rule_name
ENTITY_EXCLUDED LOG_LEVEL additional.fields[LOG_LEVEL]
ENTITY_EXCLUDED REMOTE_DIRECTORY target.resource.name
ENTITY_EXCLUDED SOURCE_DIRECTORY_DISPLAY_NAME about.resource.name
ENTITY_EXCLUDED SOURCE_IMMUTABLE_ID about.resource.product_object_id
ENTITY_EXCLUDED SOURCE_OBJECT_ID about.user.product_object_id ENTITY_TYPE log field value is set to empty and SOURCE_OBJECT_ID log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to ENTITY_TYPE, then ENTITY_TYPE log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to SOURCE_OBJECT_ID, then SOURCE_OBJECT_ID log field value is set to the events.parameters.value log field value.
If the ENTITY_TYPE log field value is equal to USER, then the SOURCE_OBJECT_ID log field is mapped to the about.user.product_object_id UDM field.
Otherwise, the SOURCE_OBJECT_ID log field is mapped to the about.group.product_object_id UDM field.
ENTITY_EXCLUDED SYNC_JOB additional.fields[SYNC_JOB]
ENTITY_EXCLUDED SYNC_RUN additional.fields[SYNC_RUN]
ENTITY_EXCLUDED VERBOSE additional.fields[VERBOSE]
ENTITY_EXCLUSIONS_SUMMARY DRY_RUN additional.fields[DRY_RUN]
ENTITY_EXCLUSIONS_SUMMARY ENTITY_TYPE additional.fields[ENTITY_TYPE]
ENTITY_EXCLUSIONS_SUMMARY EXCLUDED_COUNT additional.fields[EXCLUDED_COUNT]
ENTITY_EXCLUSIONS_SUMMARY LOG_LEVEL additional.fields[LOG_LEVEL]
ENTITY_EXCLUSIONS_SUMMARY REMOTE_DIRECTORY target.resource.name
ENTITY_EXCLUSIONS_SUMMARY SOURCE_DIRECTORY_DISPLAY_NAME about.resource.name
ENTITY_EXCLUSIONS_SUMMARY SYNC_JOB additional.fields[SYNC_JOB]
ENTITY_EXCLUSIONS_SUMMARY SYNC_RUN additional.fields[SYNC_RUN]
ENTITY_EXCLUSIONS_SUMMARY VERBOSE additional.fields[VERBOSE]
ENTITY_NOT_CREATED DRY_RUN additional.fields[DRY_RUN]
ENTITY_NOT_CREATED ENTITY_TYPE additional.fields[ENTITY_TYPE]
ENTITY_NOT_CREATED LOG_LEVEL additional.fields[LOG_LEVEL]
ENTITY_NOT_CREATED MESSAGE metadata.description
ENTITY_NOT_CREATED REMOTE_DIRECTORY target.resource.name
ENTITY_NOT_CREATED SOURCE_DIRECTORY_DISPLAY_NAME about.resource.name
ENTITY_NOT_CREATED SOURCE_IMMUTABLE_ID about.resource.product_object_id
ENTITY_NOT_CREATED SOURCE_OBJECT_ID about.user.product_object_id ENTITY_TYPE log field value is set to empty and SOURCE_OBJECT_ID log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to ENTITY_TYPE, then ENTITY_TYPE log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to SOURCE_OBJECT_ID, then SOURCE_OBJECT_ID log field value is set to the events.parameters.value log field value.
If the ENTITY_TYPE log field value is equal to USER, then the SOURCE_OBJECT_ID log field is mapped to the about.user.product_object_id UDM field.
Otherwise, the SOURCE_OBJECT_ID log field is mapped to the about.group.product_object_id UDM field.
ENTITY_NOT_CREATED SYNC_JOB additional.fields[SYNC_JOB]
ENTITY_NOT_CREATED SYNC_RUN additional.fields[SYNC_RUN]
ENTITY_NOT_CREATED TARGET_OBJECT_ID target.user.product_object_id ENTITY_TYPE log field value is set to empty and TARGET_OBJECT_ID log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to ENTITY_TYPE, then ENTITY_TYPE log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to TARGET_OBJECT_ID, then TARGET_OBJECT_ID log field value is set to the events.parameters.value log field value.
If the ENTITY_TYPE log field value is equal to USER, then the TARGET_OBJECT_ID log field is mapped to the target.user.product_object_id UDM field.
Otherwise, the TARGET_OBJECT_ID log field is mapped to the target.group.product_object_id UDM field.
ENTITY_NOT_CREATED VERBOSE additional.fields[VERBOSE]
ENTITY_SKIPPED DRY_RUN additional.fields[DRY_RUN]
ENTITY_SKIPPED ENTITY_TYPE additional.fields[ENTITY_TYPE]
ENTITY_SKIPPED LOG_LEVEL additional.fields[LOG_LEVEL]
ENTITY_SKIPPED MESSAGE metadata.description
ENTITY_SKIPPED REMOTE_DIRECTORY target.resource.name
ENTITY_SKIPPED SOURCE_DIRECTORY_DISPLAY_NAME about.resource.name
ENTITY_SKIPPED SOURCE_IMMUTABLE_ID about.resource.product_object_id
ENTITY_SKIPPED SOURCE_OBJECT_ID about.user.product_object_id ENTITY_TYPE log field value is set to empty and SOURCE_OBJECT_ID log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to ENTITY_TYPE, then ENTITY_TYPE log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to SOURCE_OBJECT_ID, then SOURCE_OBJECT_ID log field value is set to the events.parameters.value log field value.
If the ENTITY_TYPE log field value is equal to USER, then the SOURCE_OBJECT_ID log field is mapped to the about.user.product_object_id UDM field.
Otherwise, the SOURCE_OBJECT_ID log field is mapped to the about.group.product_object_id UDM field.
ENTITY_SKIPPED SYNC_JOB additional.fields[SYNC_JOB]
ENTITY_SKIPPED SYNC_RUN additional.fields[SYNC_RUN]
ENTITY_SKIPPED VERBOSE additional.fields[VERBOSE]
ENTITY_SYNC_FAILED DRY_RUN additional.fields[DRY_RUN]
ENTITY_SYNC_FAILED ENTITY_TYPE additional.fields[ENTITY_TYPE]
ENTITY_SYNC_FAILED GROUP_ID target.group.email_addresses
ENTITY_SYNC_FAILED LOG_LEVEL additional.fields[LOG_LEVEL]
ENTITY_SYNC_FAILED MESSAGE metadata.description
ENTITY_SYNC_FAILED REMOTE_DIRECTORY target.resource.name
ENTITY_SYNC_FAILED SOURCE_DIRECTORY_DISPLAY_NAME about.resource.name
ENTITY_SYNC_FAILED SOURCE_IMMUTABLE_ID about.resource.product_object_id
ENTITY_SYNC_FAILED SOURCE_OBJECT_ID about.user.product_object_id ENTITY_TYPE log field value is set to empty and SOURCE_OBJECT_ID log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to ENTITY_TYPE, then ENTITY_TYPE log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to SOURCE_OBJECT_ID, then SOURCE_OBJECT_ID log field value is set to the events.parameters.value log field value.
If the ENTITY_TYPE log field value is equal to USER, then the SOURCE_OBJECT_ID log field is mapped to the about.user.product_object_id UDM field.
Otherwise, the SOURCE_OBJECT_ID log field is mapped to the about.group.product_object_id UDM field.
ENTITY_SYNC_FAILED SYNC_JOB additional.fields[SYNC_JOB]
ENTITY_SYNC_FAILED SYNC_RUN additional.fields[SYNC_RUN]
ENTITY_SYNC_FAILED TARGET_OBJECT_ID target.user.product_object_id ENTITY_TYPE log field value is set to empty and TARGET_OBJECT_ID log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to ENTITY_TYPE, then ENTITY_TYPE log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to TARGET_OBJECT_ID, then TARGET_OBJECT_ID log field value is set to the events.parameters.value log field value.
If the ENTITY_TYPE log field value is equal to USER, then the TARGET_OBJECT_ID log field is mapped to the target.user.product_object_id UDM field.
Otherwise, the TARGET_OBJECT_ID log field is mapped to the target.group.product_object_id UDM field.
ENTITY_SYNC_FAILED VERBOSE additional.fields[VERBOSE]
ENTITY_UPDATED DRY_RUN additional.fields[DRY_RUN]
ENTITY_UPDATED ENTITY_TYPE additional.fields[ENTITY_TYPE]
ENTITY_UPDATED LOG_LEVEL additional.fields[LOG_LEVEL]
ENTITY_UPDATED NEW_ATTRIBUTES target.user.attribute.labels[NEW_ATTRIBUTES] ENTITY_TYPE log field value is set to empty and NEW_ATTRIBUTES log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to ENTITY_TYPE, then ENTITY_TYPE log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to NEW_ATTRIBUTES, then NEW_ATTRIBUTES log field value is set to the events.parameters.value log field value.
If the ENTITY_TYPE log field value is equal to USER, then the target.user.attribute.labels.key UDM field is set to NEW_ATTRIBUTES and the NEW_ATTRIBUTES log field is mapped to the target.user.attribute.labels.value UDM field.
Otherwise, the target.group.attribute.labels.key UDM field is set to NEW_ATTRIBUTES and the NEW_ATTRIBUTES log field is mapped to the target.group.attribute.labels.value UDM field.
ENTITY_UPDATED OLD_ATTRIBUTES target.user.attribute.labels[OLD_ATTRIBUTES] ENTITY_TYPE log field value is set to empty and OLD_ATTRIBUTES log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to ENTITY_TYPE, then ENTITY_TYPE log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to OLD_ATTRIBUTES, then OLD_ATTRIBUTES log field value is set to the events.parameters.value log field value.
If the ENTITY_TYPE log field value is equal to USER, then the target.user.attribute.labels.key UDM field is set to OLD_ATTRIBUTES and the OLD_ATTRIBUTES log field is mapped to the target.user.attribute.labels.value UDM field.
Otherwise, the target.group.attribute.labels.key UDM field is set to OLD_ATTRIBUTES and the OLD_ATTRIBUTES log field is mapped to the target.group.attribute.labels.value UDM field.
ENTITY_UPDATED REMOTE_DIRECTORY target.resource.name
ENTITY_UPDATED SOURCE_DIRECTORY_DISPLAY_NAME about.resource.name
ENTITY_UPDATED SOURCE_IMMUTABLE_ID about.resource.product_object_id
ENTITY_UPDATED SOURCE_OBJECT_ID about.user.product_object_id ENTITY_TYPE log field value is set to empty and SOURCE_OBJECT_ID log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to ENTITY_TYPE, then ENTITY_TYPE log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to SOURCE_OBJECT_ID, then SOURCE_OBJECT_ID log field value is set to the events.parameters.value log field value.
If the ENTITY_TYPE log field value is equal to USER, then the SOURCE_OBJECT_ID log field is mapped to the about.user.product_object_id UDM field.
Otherwise, the SOURCE_OBJECT_ID log field is mapped to the about.group.product_object_id UDM field.
ENTITY_UPDATED SYNC_JOB additional.fields[SYNC_JOB]
ENTITY_UPDATED SYNC_RUN additional.fields[SYNC_RUN]
ENTITY_UPDATED TARGET_OBJECT_ID target.user.product_object_id ENTITY_TYPE log field value is set to empty and TARGET_OBJECT_ID log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to ENTITY_TYPE, then ENTITY_TYPE log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to TARGET_OBJECT_ID, then TARGET_OBJECT_ID log field value is set to the events.parameters.value log field value.
If the ENTITY_TYPE log field value is equal to USER, then the TARGET_OBJECT_ID log field is mapped to the target.user.product_object_id UDM field.
Otherwise, the TARGET_OBJECT_ID log field is mapped to the target.group.product_object_id UDM field.
ENTITY_UPDATED VERBOSE additional.fields[VERBOSE]
ERROR DRY_RUN additional.fields[DRY_RUN]
ERROR ENTITY_TYPE additional.fields[ENTITY_TYPE]
ERROR LOG_LEVEL additional.fields[LOG_LEVEL]
ERROR MESSAGE metadata.description
ERROR REMOTE_DIRECTORY target.resource.name
ERROR SOURCE_DIRECTORY_DISPLAY_NAME about.resource.name
ERROR SOURCE_IMMUTABLE_ID about.resource.product_object_id
ERROR SOURCE_OBJECT_ID about.user.product_object_id ENTITY_TYPE log field value is set to empty and SOURCE_OBJECT_ID log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to ENTITY_TYPE, then ENTITY_TYPE log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to SOURCE_OBJECT_ID, then SOURCE_OBJECT_ID log field value is set to the events.parameters.value log field value.
If the ENTITY_TYPE log field value is equal to USER, then the SOURCE_OBJECT_ID log field is mapped to the about.user.product_object_id UDM field.
Otherwise, the SOURCE_OBJECT_ID log field is mapped to the about.group.product_object_id UDM field.
ERROR SYNC_JOB additional.fields[SYNC_JOB]
ERROR SYNC_RUN additional.fields[SYNC_RUN]
ERROR TARGET_OBJECT_ID target.user.product_object_id ENTITY_TYPE log field value is set to empty and TARGET_OBJECT_ID log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to ENTITY_TYPE, then ENTITY_TYPE log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to TARGET_OBJECT_ID, then TARGET_OBJECT_ID log field value is set to the events.parameters.value log field value.
If the ENTITY_TYPE log field value is equal to USER, then the TARGET_OBJECT_ID log field is mapped to the target.user.product_object_id UDM field.
Otherwise, the TARGET_OBJECT_ID log field is mapped to the target.group.product_object_id UDM field.
ERROR VERBOSE additional.fields[VERBOSE]
OBJECT_DEPROVISIONED DEPROVISION_ACTION additional.fields[DEPROVISION_ACTION]
OBJECT_DEPROVISIONED DRY_RUN additional.fields[DRY_RUN]
OBJECT_DEPROVISIONED ENTITY_TYPE additional.fields[ENTITY_TYPE]
OBJECT_DEPROVISIONED LOG_LEVEL additional.fields[LOG_LEVEL]
OBJECT_DEPROVISIONED MESSAGE metadata.description
OBJECT_DEPROVISIONED REMOTE_DIRECTORY target.resource.name
OBJECT_DEPROVISIONED SOURCE_DIRECTORY_DISPLAY_NAME about.resource.name
OBJECT_DEPROVISIONED SOURCE_IMMUTABLE_ID about.resource.product_object_id
OBJECT_DEPROVISIONED SOURCE_OBJECT_ID about.user.product_object_id ENTITY_TYPE log field value is set to empty and SOURCE_OBJECT_ID log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to ENTITY_TYPE, then ENTITY_TYPE log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to SOURCE_OBJECT_ID, then SOURCE_OBJECT_ID log field value is set to the events.parameters.value log field value.
If the ENTITY_TYPE log field value is equal to USER, then the SOURCE_OBJECT_ID log field is mapped to the about.user.product_object_id UDM field.
Otherwise, the SOURCE_OBJECT_ID log field is mapped to the about.group.product_object_id UDM field.
OBJECT_DEPROVISIONED SYNC_JOB additional.fields[SYNC_JOB]
OBJECT_DEPROVISIONED SYNC_RUN additional.fields[SYNC_RUN]
OBJECT_DEPROVISIONED TARGET_OBJECT_ID target.user.product_object_id ENTITY_TYPE log field value is set to empty and TARGET_OBJECT_ID log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to ENTITY_TYPE, then ENTITY_TYPE log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to TARGET_OBJECT_ID, then TARGET_OBJECT_ID log field value is set to the events.parameters.value log field value.
If the ENTITY_TYPE log field value is equal to USER, then the TARGET_OBJECT_ID log field is mapped to the target.user.product_object_id UDM field.
Otherwise, the TARGET_OBJECT_ID log field is mapped to the target.group.product_object_id UDM field.
OBJECT_DEPROVISIONED VERBOSE additional.fields[VERBOSE]
REMOTE_DIRECTORY_ENTITY_READ DRY_RUN additional.fields[DRY_RUN]
REMOTE_DIRECTORY_ENTITY_READ ENTITY_TYPE additional.fields[ENTITY_TYPE]
REMOTE_DIRECTORY_ENTITY_READ LOG_LEVEL additional.fields[LOG_LEVEL]
REMOTE_DIRECTORY_ENTITY_READ OLD_ATTRIBUTES target.user.attribute.labels[OLD_ATTRIBUTES] ENTITY_TYPE log field value is set to empty and OLD_ATTRIBUTES log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to ENTITY_TYPE, then ENTITY_TYPE log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to OLD_ATTRIBUTES, then OLD_ATTRIBUTES log field value is set to the events.parameters.value log field value.
If the ENTITY_TYPE log field value is equal to USER, then the target.user.attribute.labels.key UDM field is set to OLD_ATTRIBUTES and the OLD_ATTRIBUTES log field is mapped to the target.user.attribute.labels.value UDM field.
Otherwise, the target.group.attribute.labels.key UDM field is set to OLD_ATTRIBUTES and the OLD_ATTRIBUTES log field is mapped to the target.group.attribute.labels.value UDM field.
REMOTE_DIRECTORY_ENTITY_READ REMOTE_DIRECTORY target.resource.name
REMOTE_DIRECTORY_ENTITY_READ SOURCE_DIRECTORY_DISPLAY_NAME about.resource.name
REMOTE_DIRECTORY_ENTITY_READ SOURCE_IMMUTABLE_ID about.resource.product_object_id
REMOTE_DIRECTORY_ENTITY_READ SOURCE_OBJECT_ID about.user.product_object_id ENTITY_TYPE log field value is set to empty and SOURCE_OBJECT_ID log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to ENTITY_TYPE, then ENTITY_TYPE log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to SOURCE_OBJECT_ID, then SOURCE_OBJECT_ID log field value is set to the events.parameters.value log field value.
If the ENTITY_TYPE log field value is equal to USER, then the SOURCE_OBJECT_ID log field is mapped to the about.user.product_object_id UDM field.
Otherwise, the SOURCE_OBJECT_ID log field is mapped to the about.group.product_object_id UDM field.
REMOTE_DIRECTORY_ENTITY_READ SYNC_JOB additional.fields[SYNC_JOB]
REMOTE_DIRECTORY_ENTITY_READ SYNC_RUN additional.fields[SYNC_RUN]
REMOTE_DIRECTORY_ENTITY_READ VERBOSE additional.fields[VERBOSE]
REMOTE_DIRECTORY_READ DRY_RUN additional.fields[DRY_RUN]
REMOTE_DIRECTORY_READ ENTITY_TYPE additional.fields[ENTITY_TYPE]
REMOTE_DIRECTORY_READ FILTER additional.fields[FILTER]
REMOTE_DIRECTORY_READ LOG_LEVEL additional.fields[LOG_LEVEL]
REMOTE_DIRECTORY_READ REMOTE_DIRECTORY target.resource.name
REMOTE_DIRECTORY_READ SOURCE_DIRECTORY_DISPLAY_NAME about.resource.name
REMOTE_DIRECTORY_READ SYNC_JOB additional.fields[SYNC_JOB]
REMOTE_DIRECTORY_READ SYNC_RUN additional.fields[SYNC_RUN]
REMOTE_DIRECTORY_READ VERBOSE additional.fields[VERBOSE]
REMOTE_DIRECTORY_READ_FINISHED COUNT additional.fields[COUNT]
REMOTE_DIRECTORY_READ_FINISHED DRY_RUN additional.fields[DRY_RUN]
REMOTE_DIRECTORY_READ_FINISHED ENTITY_TYPE additional.fields[ENTITY_TYPE]
REMOTE_DIRECTORY_READ_FINISHED LOG_LEVEL additional.fields[LOG_LEVEL]
REMOTE_DIRECTORY_READ_FINISHED REMOTE_DIRECTORY target.resource.name
REMOTE_DIRECTORY_READ_FINISHED SOURCE_DIRECTORY_DISPLAY_NAME about.resource.name
REMOTE_DIRECTORY_READ_FINISHED SYNC_JOB additional.fields[SYNC_JOB]
REMOTE_DIRECTORY_READ_FINISHED SYNC_RUN additional.fields[SYNC_RUN]
REMOTE_DIRECTORY_READ_FINISHED VERBOSE additional.fields[VERBOSE]
REMOVED_GROUP_MEMBERSHIP DRY_RUN additional.fields[DRY_RUN]
REMOVED_GROUP_MEMBERSHIP ENTITY_TYPE additional.fields[ENTITY_TYPE]
REMOVED_GROUP_MEMBERSHIP GROUP_ID target.group.email_addresses
REMOVED_GROUP_MEMBERSHIP LOG_LEVEL additional.fields[LOG_LEVEL]
REMOVED_GROUP_MEMBERSHIP OLD_MEMBERSHIP_ROLE target.user.attribute.roles.name ENTITY_TYPE log field value is set to empty and OLD_MEMBERSHIP_ROLE log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to ENTITY_TYPE, then ENTITY_TYPE log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to OLD_MEMBERSHIP_ROLE, then OLD_MEMBERSHIP_ROLE log field value is set to the events.parameters.value log field value.
If the ENTITY_TYPE log field value is equal to USER, then the OLD_MEMBERSHIP_ROLE log field is mapped to the target.user.attribute.roles.name UDM field.
Otherwise, the OLD_MEMBERSHIP_ROLE log field is mapped to the target.group.attribute.roles.name UDM field.
REMOVED_GROUP_MEMBERSHIP REMOTE_DIRECTORY target.resource.name
REMOVED_GROUP_MEMBERSHIP SOURCE_DIRECTORY_DISPLAY_NAME about.resource.name
REMOVED_GROUP_MEMBERSHIP SOURCE_IMMUTABLE_ID about.resource.product_object_id
REMOVED_GROUP_MEMBERSHIP SOURCE_OBJECT_ID about.user.product_object_id ENTITY_TYPE log field value is set to empty and SOURCE_OBJECT_ID log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to ENTITY_TYPE, then ENTITY_TYPE log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to SOURCE_OBJECT_ID, then SOURCE_OBJECT_ID log field value is set to the events.parameters.value log field value.
If the ENTITY_TYPE log field value is equal to USER, then the SOURCE_OBJECT_ID log field is mapped to the about.user.product_object_id UDM field.
Otherwise, the SOURCE_OBJECT_ID log field is mapped to the about.group.product_object_id UDM field.
REMOVED_GROUP_MEMBERSHIP SYNC_JOB additional.fields[SYNC_JOB]
REMOVED_GROUP_MEMBERSHIP SYNC_RUN additional.fields[SYNC_RUN]
REMOVED_GROUP_MEMBERSHIP TARGET_OBJECT_ID target.user.product_object_id ENTITY_TYPE log field value is set to empty and TARGET_OBJECT_ID log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to ENTITY_TYPE, then ENTITY_TYPE log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to TARGET_OBJECT_ID, then TARGET_OBJECT_ID log field value is set to the events.parameters.value log field value.
If the ENTITY_TYPE log field value is equal to USER, then the TARGET_OBJECT_ID log field is mapped to the target.user.product_object_id UDM field.
Otherwise, the TARGET_OBJECT_ID log field is mapped to the target.group.product_object_id UDM field.
REMOVED_GROUP_MEMBERSHIP VERBOSE additional.fields[VERBOSE]
TARGET_ENTITY_SKIPPED DRY_RUN additional.fields[DRY_RUN]
TARGET_ENTITY_SKIPPED ENTITY_TYPE additional.fields[ENTITY_TYPE]
TARGET_ENTITY_SKIPPED LOG_LEVEL additional.fields[LOG_LEVEL]
TARGET_ENTITY_SKIPPED MESSAGE metadata.description
TARGET_ENTITY_SKIPPED REMOTE_DIRECTORY target.resource.name
TARGET_ENTITY_SKIPPED SOURCE_DIRECTORY_DISPLAY_NAME about.resource.name
TARGET_ENTITY_SKIPPED SYNC_JOB additional.fields[SYNC_JOB]
TARGET_ENTITY_SKIPPED SYNC_RUN additional.fields[SYNC_RUN]
TARGET_ENTITY_SKIPPED TARGET_OBJECT_ID target.user.product_object_id ENTITY_TYPE log field value is set to empty and TARGET_OBJECT_ID log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to ENTITY_TYPE, then ENTITY_TYPE log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to TARGET_OBJECT_ID, then TARGET_OBJECT_ID log field value is set to the events.parameters.value log field value.
If the ENTITY_TYPE log field value is equal to USER, then the TARGET_OBJECT_ID log field is mapped to the target.user.product_object_id UDM field.
Otherwise, the TARGET_OBJECT_ID log field is mapped to the target.group.product_object_id UDM field.
TARGET_ENTITY_SKIPPED VERBOSE additional.fields[VERBOSE]
UPDATED_GROUP_MEMBERSHIP DRY_RUN additional.fields[DRY_RUN]
UPDATED_GROUP_MEMBERSHIP ENTITY_TYPE additional.fields[ENTITY_TYPE]
UPDATED_GROUP_MEMBERSHIP GROUP_ID target.group.email_addresses
UPDATED_GROUP_MEMBERSHIP LOG_LEVEL additional.fields[LOG_LEVEL]
UPDATED_GROUP_MEMBERSHIP NEW_MEMBERSHIP_ROLE target.user.attribute.roles.name ENTITY_TYPE log field value is set to empty and NEW_MEMBERSHIP_ROLE log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to ENTITY_TYPE, then ENTITY_TYPE log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to NEW_MEMBERSHIP_ROLE, then NEW_MEMBERSHIP_ROLE log field value is set to the events.parameters.value log field value.
If the ENTITY_TYPE log field value is equal to USER, then the NEW_MEMBERSHIP_ROLE log field is mapped to the target.user.attribute.roles.name UDM field.
Otherwise, the NEW_MEMBERSHIP_ROLE log field is mapped to the target.group.attribute.roles.name UDM field.
UPDATED_GROUP_MEMBERSHIP REMOTE_DIRECTORY target.resource.name
UPDATED_GROUP_MEMBERSHIP SOURCE_DIRECTORY_DISPLAY_NAME about.resource.name
UPDATED_GROUP_MEMBERSHIP SOURCE_IMMUTABLE_ID about.resource.product_object_id
UPDATED_GROUP_MEMBERSHIP SOURCE_OBJECT_ID about.user.product_object_id ENTITY_TYPE log field value is set to empty and SOURCE_OBJECT_ID log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to ENTITY_TYPE, then ENTITY_TYPE log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to SOURCE_OBJECT_ID, then SOURCE_OBJECT_ID log field value is set to the events.parameters.value log field value.
If the ENTITY_TYPE log field value is equal to USER, then the SOURCE_OBJECT_ID log field is mapped to the about.user.product_object_id UDM field.
Otherwise, the SOURCE_OBJECT_ID log field is mapped to the about.group.product_object_id UDM field.
UPDATED_GROUP_MEMBERSHIP SYNC_JOB additional.fields[SYNC_JOB]
UPDATED_GROUP_MEMBERSHIP SYNC_RUN additional.fields[SYNC_RUN]
UPDATED_GROUP_MEMBERSHIP TARGET_OBJECT_ID target.user.product_object_id ENTITY_TYPE log field value is set to empty and TARGET_OBJECT_ID log field value is set to empty.
Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to ENTITY_TYPE, then ENTITY_TYPE log field value is set to the events.parameters.value log field value.
Else if the events.parameters.name log field value is equal to TARGET_OBJECT_ID, then TARGET_OBJECT_ID log field value is set to the events.parameters.value log field value.
If the ENTITY_TYPE log field value is equal to USER, then the TARGET_OBJECT_ID log field is mapped to the target.user.product_object_id UDM field.
Otherwise, the TARGET_OBJECT_ID log field is mapped to the target.group.product_object_id UDM field.
UPDATED_GROUP_MEMBERSHIP VERBOSE additional.fields[VERBOSE]
SYNC_RUN_END DRY_RUN additional.fields[DRY_RUN]
SYNC_RUN_END ENTITY_TYPE additional.fields[ENTITY_TYPE]
SYNC_RUN_END LOG_LEVEL additional.fields[LOG_LEVEL]
SYNC_RUN_END REMOTE_DIRECTORY target.resource.name
SYNC_RUN_END SOURCE_DIRECTORY_DISPLAY_NAME about.resource.name
SYNC_RUN_END SYNC_JOB additional.fields[SYNC_JOB]
SYNC_RUN_END SYNC_RUN additional.fields[SYNC_RUN]
SYNC_RUN_END VERBOSE additional.fields[VERBOSE]
SYNC_RUN_FAILED DRY_RUN additional.fields[DRY_RUN]
SYNC_RUN_FAILED ENTITY_TYPE additional.fields[ENTITY_TYPE]
SYNC_RUN_FAILED LOG_LEVEL additional.fields[LOG_LEVEL]
SYNC_RUN_FAILED MESSAGE metadata.description
SYNC_RUN_FAILED REMOTE_DIRECTORY target.resource.name
SYNC_RUN_FAILED SOURCE_DIRECTORY_DISPLAY_NAME about.resource.name
SYNC_RUN_FAILED SYNC_JOB additional.fields[SYNC_JOB]
SYNC_RUN_FAILED SYNC_RUN additional.fields[SYNC_RUN]
SYNC_RUN_FAILED VERBOSE additional.fields[VERBOSE]
SYNC_RUN_FAILED_RETRY DRY_RUN additional.fields[DRY_RUN]
SYNC_RUN_FAILED_RETRY ENTITY_TYPE additional.fields[ENTITY_TYPE]
SYNC_RUN_FAILED_RETRY LOG_LEVEL additional.fields[LOG_LEVEL]
SYNC_RUN_FAILED_RETRY MESSAGE metadata.description
SYNC_RUN_FAILED_RETRY REMOTE_DIRECTORY target.resource.name
SYNC_RUN_FAILED_RETRY SOURCE_DIRECTORY_DISPLAY_NAME about.resource.name
SYNC_RUN_FAILED_RETRY SYNC_JOB additional.fields[SYNC_JOB]
SYNC_RUN_FAILED_RETRY SYNC_RUN additional.fields[SYNC_RUN]
SYNC_RUN_FAILED_RETRY VERBOSE additional.fields[VERBOSE]
SYNC_RUN_START DRY_RUN additional.fields[DRY_RUN]
SYNC_RUN_START ENTITY_TYPE additional.fields[ENTITY_TYPE]
SYNC_RUN_START LOG_LEVEL additional.fields[LOG_LEVEL]
SYNC_RUN_START REMOTE_DIRECTORY target.resource.name
SYNC_RUN_START SOURCE_DIRECTORY_DISPLAY_NAME about.resource.name
SYNC_RUN_START SYNC_JOB additional.fields[SYNC_JOB]
SYNC_RUN_START SYNC_JOB_CONFIG additional.fields[SYNC_JOB_CONFIG]
SYNC_RUN_START SYNC_RUN additional.fields[SYNC_RUN]
SYNC_RUN_START VERBOSE additional.fields[VERBOSE]

Field mapping reference: workspace activity graduation application

The following table provides the log fields to UDM field mapping corresponding to events for the graduation application. fields.

Event Name Log field UDM mapping Logic
COMPLETED_ACCOUNT_MIGRATION COMPLETION_TIME additional.fields[COMPLETION_TIME]
COMPLETED_ACCOUNT_MIGRATION DRIVE_PERCENT_OF_FILES_MIGRATED additional.fields[DRIVE_PERCENT_OF_FILES_MIGRATED]
COMPLETED_ACCOUNT_MIGRATION GMAIL_PERCENT_OF_FILES_MIGRATED additional.fields[GMAIL_PERCENT_OF_FILES_MIGRATED]
COMPLETED_ACCOUNT_MIGRATION START_TIME additional.fields[START_TIME]
COMPLETED_ACCOUNT_MIGRATION USER_EMAIL target.user.email_addresses
STARTED_ACCOUNT_MIGRATION START_TIME additional.fields[START_TIME]
STARTED_ACCOUNT_MIGRATION USER_EMAIL target.user.email_addresses

Field mapping reference: workspace activity ldap application

The following table provides the log fields to UDM field mapping corresponding to events for the ldap application.

Event Name Log field UDM mapping Logic
bind_failure connection_id network.session_id
bind_failure ldap_audit_application_id additional.fields[ldap_audit_application_id]
bind_failure ldap_audit_application_name target.application
bind_failure ldap_audit_message_id additional.fields[ldap_audit_message_id]
bind_failure name principal.user.user_display_name
bind_failure request_controls additional.fields[request_controls]
bind_failure result_code additional.fields[result_code]
bind_failure result_controls additional.fields[result_controls]
bind_failure version network.application_protocol_version
bind_success connection_id network.session_id
bind_success ldap_audit_application_id additional.fields[ldap_audit_application_id]
bind_success ldap_audit_application_name target.application
bind_success ldap_audit_message_id additional.fields[ldap_audit_message_id]
bind_success name principal.user.user_display_name
bind_success request_controls additional.fields[request_controls]
bind_success result_code additional.fields[result_code]
bind_success result_controls additional.fields[result_controls]
bind_success version network.application_protocol_version
search_failed attributes target.resource.attribute.labels[attributes]
search_failed base_object target.resource.name
search_failed connection_id network.session_id
search_failed deref_aliases additional.fields[deref_aliases]
search_failed filter additional.fields[filter]
search_failed is_types_only additional.fields[is_types_only]
search_failed ldap_audit_application_id additional.fields[ldap_audit_application_id]
search_failed ldap_audit_application_name target.application
search_failed ldap_audit_message_id additional.fields[ldap_audit_message_id]
search_failed ldap_audit_scope additional.fields[search_scope]
search_failed request_controls additional.fields[request_controls]
search_failed result_code additional.fields[result_code]
search_failed result_controls additional.fields[result_controls]
search_failed size_limit additional.fields[size_limit]
search_failed time_limit additional.fields[time_limit]
search_success attributes target.resource.attribute.labels[attributes]
search_success base_object target.resource.name
search_success bind_quota_usage additional.fields[bind_quota_usage]
search_success connection_id network.session_id
search_success deref_aliases additional.fields[deref_aliases]
search_success dropped_attributes target.resource.attribute.labels[dropped_attributes]
search_success filter additional.fields[filter]
search_success is_types_only additional.fields[is_types_only]
search_success ldap_audit_application_id additional.fields[ldap_audit_application_id]
search_success ldap_audit_application_name target.application
search_success ldap_audit_message_id additional.fields[ldap_audit_message_id]
search_success ldap_audit_scope additional.fields[search_scope]
search_success request_controls additional.fields[request_controls]
search_success result_code additional.fields[result_code]
search_success result_controls additional.fields[result_controls]
search_success size_limit additional.fields[size_limit]
search_success time_limit additional.fields[time_limit]
unbind connection_id network.session_id
unbind ldap_audit_application_id additional.fields[ldap_audit_application_id]
unbind ldap_audit_application_name target.application
unbind ldap_audit_message_id additional.fields[ldap_audit_message_id]
unbind request_controls additional.fields[request_controls]

Field mapping reference: workspace activity meet_hardware application

The following table provides the log fields to UDM field mapping corresponding to events for the meet_hardware application. fields.

Event Name Log field UDM mapping Logic
EVENT_BOARDCAM_PRESENT_ENDED DEVICE_DISPLAY_NAME target.hostname
EVENT_BOARDCAM_PRESENT_ENDED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_BOARDCAM_PRESENT_ENDED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_BOARDCAM_PRESENT_STARTED DEVICE_DISPLAY_NAME target.hostname
EVENT_BOARDCAM_PRESENT_STARTED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_BOARDCAM_PRESENT_STARTED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_BYOD_ENTERED DEVICE_DISPLAY_NAME target.hostname
EVENT_BYOD_ENTERED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_BYOD_ENTERED EVENT_DATA metadata.description
EVENT_BYOD_ENTERED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_BYOD_EXITED DEVICE_DISPLAY_NAME target.hostname
EVENT_BYOD_EXITED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_BYOD_EXITED EVENT_DATA metadata.description
EVENT_BYOD_EXITED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_LOCAL_PRESENT_ENDED DEVICE_DISPLAY_NAME target.hostname
EVENT_LOCAL_PRESENT_ENDED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_LOCAL_PRESENT_ENDED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_LOCAL_PRESENT_STARTED DEVICE_DISPLAY_NAME target.hostname
EVENT_LOCAL_PRESENT_STARTED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_LOCAL_PRESENT_STARTED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_MEET_CALL_DISCONNECTED DEVICE_DISPLAY_NAME target.hostname
EVENT_MEET_CALL_DISCONNECTED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_MEET_CALL_DISCONNECTED EVENT_DATA metadata.description
EVENT_MEET_CALL_DISCONNECTED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_MEET_CALL_JOINED DEVICE_DISPLAY_NAME target.hostname
EVENT_MEET_CALL_JOINED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_MEET_CALL_JOINED EVENT_DATA metadata.description
EVENT_MEET_CALL_JOINED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_SLEEP_SCREEN_ENTERED DEVICE_DISPLAY_NAME target.hostname
EVENT_SLEEP_SCREEN_ENTERED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_SLEEP_SCREEN_ENTERED EVENT_DATA metadata.description
EVENT_SLEEP_SCREEN_ENTERED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_SLEEP_SCREEN_EXITED DEVICE_DISPLAY_NAME target.hostname
EVENT_SLEEP_SCREEN_EXITED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_SLEEP_SCREEN_EXITED EVENT_DATA metadata.description
EVENT_SLEEP_SCREEN_EXITED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_TEAMS_CALL_DISCONNECTED DEVICE_DISPLAY_NAME target.hostname
EVENT_TEAMS_CALL_DISCONNECTED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_TEAMS_CALL_DISCONNECTED EVENT_DATA metadata.description
EVENT_TEAMS_CALL_DISCONNECTED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_TEAMS_CALL_JOINED DEVICE_DISPLAY_NAME target.hostname
EVENT_TEAMS_CALL_JOINED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_TEAMS_CALL_JOINED EVENT_DATA metadata.description
EVENT_TEAMS_CALL_JOINED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_WEBEX_CALL_DISCONNECTED DEVICE_DISPLAY_NAME target.hostname
EVENT_WEBEX_CALL_DISCONNECTED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_WEBEX_CALL_DISCONNECTED EVENT_DATA metadata.description
EVENT_WEBEX_CALL_DISCONNECTED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_WEBEX_CALL_JOINED DEVICE_DISPLAY_NAME target.hostname
EVENT_WEBEX_CALL_JOINED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_WEBEX_CALL_JOINED EVENT_DATA metadata.description
EVENT_WEBEX_CALL_JOINED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_ZOOM_CALL_DISCONNECTED DEVICE_DISPLAY_NAME target.hostname
EVENT_ZOOM_CALL_DISCONNECTED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_ZOOM_CALL_DISCONNECTED EVENT_DATA metadata.description
EVENT_ZOOM_CALL_DISCONNECTED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_ZOOM_CALL_JOINED DEVICE_DISPLAY_NAME target.hostname
EVENT_ZOOM_CALL_JOINED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_ZOOM_CALL_JOINED EVENT_DATA metadata.description
EVENT_ZOOM_CALL_JOINED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_FEEDBACK_FILED DEVICE_DISPLAY_NAME target.hostname
EVENT_FEEDBACK_FILED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_FEEDBACK_FILED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_RESTART_APP DEVICE_DISPLAY_NAME target.hostname
EVENT_RESTART_APP DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_RESTART_APP EVENT_DATA metadata.description
EVENT_RESTART_APP SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_RESTART_MACHINE DEVICE_DISPLAY_NAME target.hostname
EVENT_RESTART_MACHINE DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_RESTART_MACHINE EVENT_DATA metadata.description
EVENT_RESTART_MACHINE SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_RESTART_UNKNOWN DEVICE_DISPLAY_NAME target.hostname
EVENT_RESTART_UNKNOWN DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_RESTART_UNKNOWN SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_BROWSER_UPDATE DEVICE_DISPLAY_NAME target.hostname
EVENT_BROWSER_UPDATE DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_BROWSER_UPDATE EVENT_DATA metadata.description
EVENT_BROWSER_UPDATE SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_CLIENT_APP_UPDATE DEVICE_DISPLAY_NAME target.hostname
EVENT_CLIENT_APP_UPDATE DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_CLIENT_APP_UPDATE EVENT_DATA metadata.description
EVENT_CLIENT_APP_UPDATE SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_OS_UPDATE DEVICE_DISPLAY_NAME target.hostname
EVENT_OS_UPDATE DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_OS_UPDATE EVENT_DATA metadata.description
EVENT_OS_UPDATE SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_ADD_ON_CAMERA_ATTACHED AFFECTED_PERIPHERAL target.resource.name
EVENT_ADD_ON_CAMERA_ATTACHED DEVICE_DISPLAY_NAME target.hostname
EVENT_ADD_ON_CAMERA_ATTACHED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_ADD_ON_CAMERA_ATTACHED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_ADD_ON_CAMERA_DETACHED AFFECTED_PERIPHERAL target.resource.name
EVENT_ADD_ON_CAMERA_DETACHED DEVICE_DISPLAY_NAME target.hostname
EVENT_ADD_ON_CAMERA_DETACHED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_ADD_ON_CAMERA_DETACHED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_CAMERA_ATTACHED AFFECTED_PERIPHERAL target.resource.name
EVENT_CAMERA_ATTACHED DEVICE_DISPLAY_NAME target.hostname
EVENT_CAMERA_ATTACHED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_CAMERA_ATTACHED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_CAMERA_DETACHED AFFECTED_PERIPHERAL target.resource.name
EVENT_CAMERA_DETACHED DEVICE_DISPLAY_NAME target.hostname
EVENT_CAMERA_DETACHED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_CAMERA_DETACHED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_DEFAULT_CAMERA_SET AFFECTED_PERIPHERAL target.resource.name
EVENT_DEFAULT_CAMERA_SET DEVICE_DISPLAY_NAME target.hostname
EVENT_DEFAULT_CAMERA_SET DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_DEFAULT_CAMERA_SET target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
EVENT_DEFAULT_CAMERA_SET SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_DEFAULT_CAMERA_UNSET AFFECTED_PERIPHERAL target.resource.name
EVENT_DEFAULT_CAMERA_UNSET DEVICE_DISPLAY_NAME target.hostname
EVENT_DEFAULT_CAMERA_UNSET DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_DEFAULT_CAMERA_UNSET target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
EVENT_DEFAULT_CAMERA_UNSET SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_DEFAULT_MICROPHONE_SET AFFECTED_PERIPHERAL target.resource.name
EVENT_DEFAULT_MICROPHONE_SET DEVICE_DISPLAY_NAME target.hostname
EVENT_DEFAULT_MICROPHONE_SET DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_DEFAULT_MICROPHONE_SET target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
EVENT_DEFAULT_MICROPHONE_SET SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_DEFAULT_MICROPHONE_UNSET AFFECTED_PERIPHERAL target.resource.name
EVENT_DEFAULT_MICROPHONE_UNSET DEVICE_DISPLAY_NAME target.hostname
EVENT_DEFAULT_MICROPHONE_UNSET DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_DEFAULT_MICROPHONE_UNSET target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
EVENT_DEFAULT_MICROPHONE_UNSET SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_DEFAULT_SPEAKER_SET AFFECTED_PERIPHERAL target.resource.name
EVENT_DEFAULT_SPEAKER_SET DEVICE_DISPLAY_NAME target.hostname
EVENT_DEFAULT_SPEAKER_SET DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_DEFAULT_SPEAKER_SET target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
EVENT_DEFAULT_SPEAKER_SET SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_DEFAULT_SPEAKER_UNSET AFFECTED_PERIPHERAL target.resource.name
EVENT_DEFAULT_SPEAKER_UNSET DEVICE_DISPLAY_NAME target.hostname
EVENT_DEFAULT_SPEAKER_UNSET DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_DEFAULT_SPEAKER_UNSET target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
EVENT_DEFAULT_SPEAKER_UNSET SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_DEFAULT_VIDEO_CAPTURE_CONTENT_CAMERA_SET AFFECTED_PERIPHERAL target.resource.name
EVENT_DEFAULT_VIDEO_CAPTURE_CONTENT_CAMERA_SET DEVICE_DISPLAY_NAME target.hostname
EVENT_DEFAULT_VIDEO_CAPTURE_CONTENT_CAMERA_SET DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_DEFAULT_VIDEO_CAPTURE_CONTENT_CAMERA_SET target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
EVENT_DEFAULT_VIDEO_CAPTURE_CONTENT_CAMERA_SET SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_DEFAULT_VIDEO_CAPTURE_CONTENT_CAMERA_UNSET AFFECTED_PERIPHERAL target.resource.name
EVENT_DEFAULT_VIDEO_CAPTURE_CONTENT_CAMERA_UNSET DEVICE_DISPLAY_NAME target.hostname
EVENT_DEFAULT_VIDEO_CAPTURE_CONTENT_CAMERA_UNSET DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_DEFAULT_VIDEO_CAPTURE_CONTENT_CAMERA_UNSET target.resource.resource_type The target.resource.resource_type UDM field is set to SETTING.
EVENT_DEFAULT_VIDEO_CAPTURE_CONTENT_CAMERA_UNSET SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_DEVICE_FOUND DEVICE_DISPLAY_NAME target.hostname
EVENT_DEVICE_FOUND DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_DEVICE_FOUND SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_DEVICE_MISSING DEVICE_DISPLAY_NAME target.hostname
EVENT_DEVICE_MISSING DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_DEVICE_MISSING SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_DISPLAY_ATTACHED AFFECTED_PERIPHERAL target.resource.name
EVENT_DISPLAY_ATTACHED DEVICE_DISPLAY_NAME target.hostname
EVENT_DISPLAY_ATTACHED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_DISPLAY_ATTACHED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_DISPLAY_DETACHED AFFECTED_PERIPHERAL target.resource.name
EVENT_DISPLAY_DETACHED DEVICE_DISPLAY_NAME target.hostname
EVENT_DISPLAY_DETACHED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_DISPLAY_DETACHED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_FRONTEND_LOAD_AUTH_FAILURE_ERROR DEVICE_DISPLAY_NAME target.hostname
EVENT_FRONTEND_LOAD_AUTH_FAILURE_ERROR DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_FRONTEND_LOAD_AUTH_FAILURE_ERROR EVENT_DATA metadata.description
EVENT_FRONTEND_LOAD_AUTH_FAILURE_ERROR SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_FRONTEND_LOAD_BAD_STATUS_CODE_4XX_ERROR DEVICE_DISPLAY_NAME target.hostname
EVENT_FRONTEND_LOAD_BAD_STATUS_CODE_4XX_ERROR DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_FRONTEND_LOAD_BAD_STATUS_CODE_4XX_ERROR EVENT_DATA metadata.description
EVENT_FRONTEND_LOAD_BAD_STATUS_CODE_4XX_ERROR SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_FRONTEND_LOAD_BAD_STATUS_CODE_5XX_ERROR DEVICE_DISPLAY_NAME target.hostname
EVENT_FRONTEND_LOAD_BAD_STATUS_CODE_5XX_ERROR DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_FRONTEND_LOAD_BAD_STATUS_CODE_5XX_ERROR EVENT_DATA metadata.description
EVENT_FRONTEND_LOAD_BAD_STATUS_CODE_5XX_ERROR SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_FRONTEND_LOAD_FIRMWARE_UPDATE_ENDED DEVICE_DISPLAY_NAME target.hostname
EVENT_FRONTEND_LOAD_FIRMWARE_UPDATE_ENDED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_FRONTEND_LOAD_FIRMWARE_UPDATE_ENDED EVENT_DATA metadata.description
EVENT_FRONTEND_LOAD_FIRMWARE_UPDATE_ENDED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_FRONTEND_LOAD_NETWORK_INTERRUPTED_ERROR DEVICE_DISPLAY_NAME target.hostname
EVENT_FRONTEND_LOAD_NETWORK_INTERRUPTED_ERROR DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_FRONTEND_LOAD_NETWORK_INTERRUPTED_ERROR EVENT_DATA metadata.description
EVENT_FRONTEND_LOAD_NETWORK_INTERRUPTED_ERROR SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_FRONTEND_LOAD_SHIM_FRAMEWORK_ERROR DEVICE_DISPLAY_NAME target.hostname
EVENT_FRONTEND_LOAD_SHIM_FRAMEWORK_ERROR DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_FRONTEND_LOAD_SHIM_FRAMEWORK_ERROR EVENT_DATA metadata.description
EVENT_FRONTEND_LOAD_SHIM_FRAMEWORK_ERROR SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_FRONTEND_LOAD_SUCCESS DEVICE_DISPLAY_NAME target.hostname
EVENT_FRONTEND_LOAD_SUCCESS DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_FRONTEND_LOAD_SUCCESS EVENT_DATA metadata.description
EVENT_FRONTEND_LOAD_SUCCESS SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_FRONTEND_LOAD_TIMEOUT_ERROR DEVICE_DISPLAY_NAME target.hostname
EVENT_FRONTEND_LOAD_TIMEOUT_ERROR DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_FRONTEND_LOAD_TIMEOUT_ERROR EVENT_DATA metadata.description
EVENT_FRONTEND_LOAD_TIMEOUT_ERROR SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_FRONTEND_LOAD_TRANSPORT_FAILURE_ERROR DEVICE_DISPLAY_NAME target.hostname
EVENT_FRONTEND_LOAD_TRANSPORT_FAILURE_ERROR DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_FRONTEND_LOAD_TRANSPORT_FAILURE_ERROR EVENT_DATA metadata.description
EVENT_FRONTEND_LOAD_TRANSPORT_FAILURE_ERROR SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_FRONTEND_LOAD_WAITING_FOR_NETWORK DEVICE_DISPLAY_NAME target.hostname
EVENT_FRONTEND_LOAD_WAITING_FOR_NETWORK DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_FRONTEND_LOAD_WAITING_FOR_NETWORK EVENT_DATA metadata.description
EVENT_FRONTEND_LOAD_WAITING_FOR_NETWORK SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_FRONTEND_LOAD_WAIT_FOR_DEVICE_FIRMWARE_UPDATE DEVICE_DISPLAY_NAME target.hostname
EVENT_FRONTEND_LOAD_WAIT_FOR_DEVICE_FIRMWARE_UPDATE DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_FRONTEND_LOAD_WAIT_FOR_DEVICE_FIRMWARE_UPDATE EVENT_DATA metadata.description
EVENT_FRONTEND_LOAD_WAIT_FOR_DEVICE_FIRMWARE_UPDATE SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_FRONTEND_LOAD_WEBVIEW_ERROR DEVICE_DISPLAY_NAME target.hostname
EVENT_FRONTEND_LOAD_WEBVIEW_ERROR DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_FRONTEND_LOAD_WEBVIEW_ERROR EVENT_DATA metadata.description
EVENT_FRONTEND_LOAD_WEBVIEW_ERROR SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_FRONTEND_LOAD_WEBVIEW_EXIT_ERROR DEVICE_DISPLAY_NAME target.hostname
EVENT_FRONTEND_LOAD_WEBVIEW_EXIT_ERROR DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_FRONTEND_LOAD_WEBVIEW_EXIT_ERROR EVENT_DATA metadata.description
EVENT_FRONTEND_LOAD_WEBVIEW_EXIT_ERROR SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_HANDHELD_CONTROLLER_ATTACHED AFFECTED_PERIPHERAL target.resource.name
EVENT_HANDHELD_CONTROLLER_ATTACHED DEVICE_DISPLAY_NAME target.hostname
EVENT_HANDHELD_CONTROLLER_ATTACHED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_HANDHELD_CONTROLLER_ATTACHED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_HANDHELD_CONTROLLER_DETACHED AFFECTED_PERIPHERAL target.resource.name
EVENT_HANDHELD_CONTROLLER_DETACHED DEVICE_DISPLAY_NAME target.hostname
EVENT_HANDHELD_CONTROLLER_DETACHED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_HANDHELD_CONTROLLER_DETACHED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_MIC_ATTACHED AFFECTED_PERIPHERAL target.resource.name
EVENT_MIC_ATTACHED DEVICE_DISPLAY_NAME target.hostname
EVENT_MIC_ATTACHED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_MIC_ATTACHED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_MIC_DETACHED AFFECTED_PERIPHERAL target.resource.name
EVENT_MIC_DETACHED DEVICE_DISPLAY_NAME target.hostname
EVENT_MIC_DETACHED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_MIC_DETACHED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_SPEAKER_ATTACHED AFFECTED_PERIPHERAL target.resource.name
EVENT_SPEAKER_ATTACHED DEVICE_DISPLAY_NAME target.hostname
EVENT_SPEAKER_ATTACHED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_SPEAKER_ATTACHED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_SPEAKER_DETACHED AFFECTED_PERIPHERAL target.resource.name
EVENT_SPEAKER_DETACHED DEVICE_DISPLAY_NAME target.hostname
EVENT_SPEAKER_DETACHED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_SPEAKER_DETACHED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_TOUCH_CONTROLLER_ATTACHED AFFECTED_PERIPHERAL target.resource.name
EVENT_TOUCH_CONTROLLER_ATTACHED DEVICE_DISPLAY_NAME target.hostname
EVENT_TOUCH_CONTROLLER_ATTACHED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_TOUCH_CONTROLLER_ATTACHED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_TOUCH_CONTROLLER_DETACHED AFFECTED_PERIPHERAL target.resource.name
EVENT_TOUCH_CONTROLLER_DETACHED DEVICE_DISPLAY_NAME target.hostname
EVENT_TOUCH_CONTROLLER_DETACHED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_TOUCH_CONTROLLER_DETACHED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_VIDEO_CAPTURE_CONTENT_CAMERA_ATTACHED AFFECTED_PERIPHERAL target.resource.name
EVENT_VIDEO_CAPTURE_CONTENT_CAMERA_ATTACHED DEVICE_DISPLAY_NAME target.hostname
EVENT_VIDEO_CAPTURE_CONTENT_CAMERA_ATTACHED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_VIDEO_CAPTURE_CONTENT_CAMERA_ATTACHED SERIAL_NUMBER target.asset.hardware.serial_number
EVENT_VIDEO_CAPTURE_CONTENT_CAMERA_DETACHED AFFECTED_PERIPHERAL target.resource.name
EVENT_VIDEO_CAPTURE_CONTENT_CAMERA_DETACHED DEVICE_DISPLAY_NAME target.hostname
EVENT_VIDEO_CAPTURE_CONTENT_CAMERA_DETACHED DEVICE_ID target.asset_id Iterate through log field events.parameters:
if the events.parameters.name log field value is equal to DEVICE_ID, then The target.asset_id UDM field is set to a value generated from the template asset_id:%{events.parameters.value}, where %{events.parameters.value} is replaced with the value of the events.parameters.value log field.
EVENT_VIDEO_CAPTURE_CONTENT_CAMERA_DETACHED SERIAL_NUMBER target.asset.hardware.serial_number

Field mapping reference: workspace activity profile application

The following table provides the log fields to UDM field mapping corresponding to events for the profile application.

Event Name Log field UDM mapping Logic
PROFILE_MUTATE_BY_USER PROFILE_FIELD_MUTATION_TYPE additional.fields[PROFILE_FIELD_MUTATION_TYPE]
PROFILE_MUTATE_BY_USER PROFILE_FIELD_NAME additional.fields[PROFILE_FIELD_NAME]

Field mapping reference: workspace activity takeout application

The following table provides the log fields to UDM field mapping corresponding to events for the takeout application.

Event Name Log field UDM mapping Logic
COMPLETED_USER_TAKEOUT COMPLETION_TIME additional.fields[COMPLETION_TIME]
COMPLETED_USER_TAKEOUT INITIATED_BY principal.user.user_display_name
COMPLETED_USER_TAKEOUT PRODUCTS_REQUESTED target.resource.attribute.labels[PRODUCTS_REQUESTED]
COMPLETED_USER_TAKEOUT TAKEOUT_DESTINATION target.application
COMPLETED_USER_TAKEOUT TAKEOUT_ID target.resource.product_object_id
COMPLETED_USER_TAKEOUT TAKEOUT_STATUS target.resource.attribute.labels[TAKEOUT_STATUS]
COMPLETED_USER_TAKEOUT USER_EMAIL target.user.email_addresses
DOWNLOADED_USER_TAKEOUT DOWNLOAD_TIME additional.fields[DOWNLOAD_TIME]
DOWNLOADED_USER_TAKEOUT PRODUCTS_REQUESTED target.resource.attribute.labels[PRODUCTS_REQUESTED]
DOWNLOADED_USER_TAKEOUT TAKEOUT_ID target.resource.product_object_id
DOWNLOADED_USER_TAKEOUT USER_EMAIL target.user.email_addresses
SCHEDULED_USER_TAKEOUT PRODUCTS_REQUESTED target.resource.attribute.labels[PRODUCTS_REQUESTED]
SCHEDULED_USER_TAKEOUT SCHEDULED_TAKEOUT_EXPIRATION target.resource.attribute.labels[SCHEDULED_TAKEOUT_EXPIRATION]
SCHEDULED_USER_TAKEOUT TAKEOUT_DESTINATION target.application
SCHEDULED_USER_TAKEOUT TAKEOUT_INTERVAL_UNITS target.resource.attribute.labels[TAKEOUT_INTERVAL_UNITS]
SCHEDULED_USER_TAKEOUT TAKEOUT_INTERVAL_VALUE target.resource.attribute.labels[TAKEOUT_INTERVAL_VALUE]
SCHEDULED_USER_TAKEOUT TAKEOUT_STATUS target.resource.attribute.labels[TAKEOUT_STATUS]
SCHEDULED_USER_TAKEOUT USER_EMAIL target.user.email_addresses
STARTED_USER_TAKEOUT INITIATED_BY principal.user.user_display_name
STARTED_USER_TAKEOUT PRODUCTS_REQUESTED target.resource.attribute.labels[PRODUCTS_REQUESTED]
STARTED_USER_TAKEOUT START_TIME additional.fields[START_TIME]
STARTED_USER_TAKEOUT TAKEOUT_DESTINATION target.application
STARTED_USER_TAKEOUT TAKEOUT_ID target.resource.product_object_id
STARTED_USER_TAKEOUT USER_EMAIL target.user.email_addresses

Field mapping reference: workspace activity tasks application

The following table provides the log fields to UDM field mapping corresponding to events for the tasks application.

Event Name Log field UDM mapping Logic
recurrence_created host_product target.application
recurrence_created recurrence_id target.resource.product_object_id
recurrence_created task_list_id about.resource.product_object_id
recurrence_created task_list_title about.resource.name
recurrence_created task_owner target.resource.attribute.labels[task_owner]
recurrence_created task_owner_type target.resource.attribute.labels[task_owner_type]
recurrence_created task_title target.resource.name
recurrence_created user_agent network.http.user_agent
recurrence_created target.resource.resource_type The target.resource.resource_type UDM field is set to TASK.
recurrence_created_from_task host_product target.application
recurrence_created_from_task recurrence_id about.resource.product_object_id
recurrence_created_from_task task_id target.resource.product_object_id
recurrence_created_from_task task_list_id about.resource.product_object_id
recurrence_created_from_task task_owner target.resource.attribute.labels[task_owner]
recurrence_created_from_task task_owner_type target.resource.attribute.labels[task_owner_type]
recurrence_created_from_task task_title target.resource.name
recurrence_created_from_task user_agent network.http.user_agent
recurrence_created_from_task target.resource.resource_type The target.resource.resource_type UDM field is set to TASK.
recurrence_deleted host_product target.application
recurrence_deleted recurrence_id target.resource.product_object_id
recurrence_deleted task_list_id about.resource.product_object_id
recurrence_deleted task_owner target.resource.attribute.labels[task_owner]
recurrence_deleted task_owner_type target.resource.attribute.labels[task_owner_type]
recurrence_deleted task_title target.resource.name
recurrence_deleted user_agent network.http.user_agent
recurrence_modified host_product target.application
recurrence_modified recurrence_id target.resource.product_object_id
recurrence_modified task_list_id about.resource.product_object_id
recurrence_modified task_owner target.resource.attribute.labels[task_owner]
recurrence_modified task_owner_type target.resource.attribute.labels[task_owner_type]
recurrence_modified task_title target.resource.name
recurrence_modified user_agent network.http.user_agent
recurrence_title_changed host_product target.application
recurrence_title_changed new_task_title target.resource.attribute.labels[new_task_title]
recurrence_title_changed recurrence_id target.resource.product_object_id
recurrence_title_changed task_list_id about.resource.product_object_id
recurrence_title_changed task_owner target.resource.attribute.labels[task_owner]
recurrence_title_changed task_owner_type target.resource.attribute.labels[task_owner_type]
recurrence_title_changed task_title target.resource.name
recurrence_title_changed user_agent network.http.user_agent
task_assigned assignee_email target.user.email_addresses
task_assigned host_product target.application
task_assigned shared_task_origin_type about.resource.attribute.labels[shared_task_origin_type]
task_assigned task_id target.resource.product_object_id
task_assigned task_list_id about.resource.product_object_id
task_assigned task_origin_space about.url
task_assigned task_owner target.resource.attribute.labels[task_owner]
task_assigned task_owner_type target.resource.attribute.labels[task_owner_type]
task_assigned task_time additional.fields[task_time]
task_assigned task_title target.resource.name
task_assigned user_agent network.http.user_agent
task_completed host_product target.application
task_completed recurrence_id about.resource.product_object_id
task_completed shared_task_origin_type about.resource.attribute.labels[shared_task_origin_type]
task_completed task_id target.resource.product_object_id
task_completed task_list_id about.resource.product_object_id
task_completed task_origin_space about.url
task_completed task_owner target.resource.attribute.labels[task_owner]
task_completed task_owner_type target.resource.attribute.labels[task_owner_type]
task_completed task_title target.resource.name
task_completed user_agent network.http.user_agent
task_created host_product target.application
task_created task_creation_point_type about.resource.attribute.labels[task_creation_point_type]
task_created task_creation_point_url about.url
task_created task_id target.resource.product_object_id
task_created task_list_id about.resource.product_object_id
task_created task_list_title about.resource.name
task_created task_owner target.resource.attribute.labels[task_owner]
task_created task_owner_type target.resource.attribute.labels[task_owner_type]
task_created task_time additional.fields[task_time]
task_created task_title target.resource.name
task_created user_agent network.http.user_agent
task_deleted host_product target.application
task_deleted recurrence_id about.resource.product_object_id
task_deleted shared_task_origin_type about.resource.attribute.labels[shared_task_origin_type]
task_deleted task_id target.resource.product_object_id
task_deleted task_list_id about.resource.product_object_id
task_deleted task_origin_space about.url
task_deleted task_owner target.resource.attribute.labels[task_owner]
task_deleted task_owner_type target.resource.attribute.labels[task_owner_type]
task_deleted task_title target.resource.name
task_deleted user_agent network.http.user_agent
task_marked_as_spam host_product target.application
task_marked_as_spam shared_task_origin_type about.resource.attribute.labels[shared_task_origin_type]
task_marked_as_spam task_id target.resource.product_object_id
task_marked_as_spam task_list_id about.resource.product_object_id
task_marked_as_spam task_origin_space about.url
task_marked_as_spam task_owner target.resource.attribute.labels[task_owner]
task_marked_as_spam task_owner_type target.resource.attribute.labels[task_owner_type]
task_marked_as_spam task_title target.resource.name
task_marked_as_spam user_agent network.http.user_agent
task_modified host_product target.application
task_modified recurrence_id about.resource.product_object_id
task_modified shared_task_origin_type about.resource.attribute.labels[shared_task_origin_type]
task_modified task_id target.resource.product_object_id
task_modified task_list_id about.resource.product_object_id
task_modified task_origin_space about.url
task_modified task_owner target.resource.attribute.labels[task_owner]
task_modified task_owner_type target.resource.attribute.labels[task_owner_type]
task_modified task_title target.resource.name
task_modified user_agent network.http.user_agent
task_moved_between_lists host_product target.application
task_moved_between_lists new_task_list_id target.resource.product_object_id
task_moved_between_lists new_task_list_title target.resource.name
task_moved_between_lists task_id about.resource.product_object_id
task_moved_between_lists task_list_id src.resource.product_object_id
task_moved_between_lists task_list_title src.resource.name
task_moved_between_lists task_owner target.resource.attribute.labels[task_owner]
task_moved_between_lists task_owner_type target.resource.attribute.labels[task_owner_type]
task_moved_between_lists task_title about.resource.name
task_moved_between_lists user_agent network.http.user_agent
task_reassigned assignee_email src.user.email_addresses
task_reassigned host_product target.application
task_reassigned new_assignee_email target.user.email_addresses
task_reassigned shared_task_origin_type about.resource.attribute.labels[shared_task_origin_type]
task_reassigned task_id target.resource.product_object_id
task_reassigned task_list_id about.resource.product_object_id
task_reassigned task_origin_space about.url
task_reassigned task_owner target.resource.attribute.labels[task_owner]
task_reassigned task_owner_type target.resource.attribute.labels[task_owner_type]
task_reassigned task_title target.resource.name
task_reassigned user_agent network.http.user_agent
task_restored host_product target.application
task_restored recurrence_id about.resource.product_object_id
task_restored shared_task_origin_type about.resource.attribute.labels[shared_task_origin_type]
task_restored task_id target.resource.product_object_id
task_restored task_list_id about.resource.product_object_id
task_restored task_origin_space about.url
task_restored task_owner target.resource.attribute.labels[task_owner]
task_restored task_owner_type target.resource.attribute.labels[task_owner_type]
task_restored task_title target.resource.name
task_restored user_agent network.http.user_agent
task_time_changed host_product target.application
task_time_changed recurrence_id about.resource.product_object_id
task_time_changed shared_task_origin_type about.resource.attribute.labels[shared_task_origin_type]
task_time_changed task_id target.resource.product_object_id
task_time_changed task_list_id about.resource.product_object_id
task_time_changed task_origin_space about.url
task_time_changed task_owner target.resource.attribute.labels[task_owner]
task_time_changed task_owner_type target.resource.attribute.labels[task_owner_type]
task_time_changed task_time additional.fields[task_time]
task_time_changed task_title target.resource.name
task_time_changed user_agent network.http.user_agent
task_title_changed host_product target.application
task_title_changed new_task_title target.resource.name
task_title_changed recurrence_id about.resource.product_object_id
task_title_changed shared_task_origin_type about.resource.attribute.labels[shared_task_origin_type]
task_title_changed task_id target.resource.product_object_id
task_title_changed task_list_id about.resource.product_object_id
task_title_changed task_origin_space about.url
task_title_changed task_owner target.resource.attribute.labels[task_owner]
task_title_changed task_owner_type target.resource.attribute.labels[task_owner_type]
task_title_changed task_title src.resource.name
task_title_changed user_agent network.http.user_agent
task_unassigned assignee_email target.user.email_addresses
task_unassigned host_product target.application
task_unassigned shared_task_origin_type about.resource.attribute.labels[shared_task_origin_type]
task_unassigned task_id target.resource.product_object_id
task_unassigned task_list_id about.resource.product_object_id
task_unassigned task_origin_space about.url
task_unassigned task_owner target.resource.attribute.labels[task_owner]
task_unassigned task_owner_type target.resource.attribute.labels[task_owner_type]
task_unassigned task_title target.resource.name
task_unassigned user_agent network.http.user_agent
task_uncompleted host_product target.application
task_uncompleted recurrence_id about.resource.product_object_id
task_uncompleted shared_task_origin_type about.resource.attribute.labels[shared_task_origin_type]
task_uncompleted task_id target.resource.product_object_id
task_uncompleted task_list_id about.resource.product_object_id
task_uncompleted task_origin_space about.url
task_uncompleted task_owner target.resource.attribute.labels[task_owner]
task_uncompleted task_owner_type target.resource.attribute.labels[task_owner_type]
task_uncompleted task_title target.resource.name
task_uncompleted user_agent network.http.user_agent
task_list_completed_tasks_deleted host_product target.application
task_list_completed_tasks_deleted task_list_id target.resource.product_object_id
task_list_completed_tasks_deleted task_list_title target.resource.name
task_list_completed_tasks_deleted task_owner target.resource.attribute.labels[task_owner]
task_list_completed_tasks_deleted task_owner_type target.resource.attribute.labels[task_owner_type]
task_list_completed_tasks_deleted user_agent network.http.user_agent
task_list_created host_product target.application
task_list_created task_list_id target.resource.product_object_id
task_list_created task_list_title target.resource.name
task_list_created task_owner target.resource.attribute.labels[task_owner]
task_list_created task_owner_type target.resource.attribute.labels[task_owner_type]
task_list_created user_agent network.http.user_agent
task_list_deleted host_product target.application
task_list_deleted task_list_id target.resource.product_object_id
task_list_deleted task_list_title target.resource.name
task_list_deleted task_owner target.resource.attribute.labels[task_owner]
task_list_deleted task_owner_type target.resource.attribute.labels[task_owner_type]
task_list_deleted user_agent network.http.user_agent
task_list_structure_changed host_product target.application
task_list_structure_changed task_list_id target.resource.product_object_id
task_list_structure_changed task_list_title target.resource.name
task_list_structure_changed task_owner target.resource.attribute.labels[task_owner]
task_list_structure_changed task_owner_type target.resource.attribute.labels[task_owner_type]
task_list_structure_changed user_agent network.http.user_agent
task_list_title_changed host_product target.application
task_list_title_changed new_task_list_title target.resource.name
task_list_title_changed task_list_id target.resource.product_object_id
task_list_title_changed task_list_title src.resource.name
task_list_title_changed task_owner target.resource.attribute.labels[task_owner]
task_list_title_changed task_owner_type target.resource.attribute.labels[task_owner_type]
task_list_title_changed user_agent network.http.user_agent

Field mapping reference: workspace activity vault application

The following table provides the log fields to UDM field mapping corresponding to events for the vault application.

Event Name Log field UDM mapping Logic
add_collaborator_begin additional_details additional.fields[additional_details]
add_collaborator_begin matter_id target.resource.attribute.labels[matter_id]
add_collaborator_begin organizational_unit_name additional.fields[organizational_unit_name]
add_collaborator_begin query additional.fields[query]
add_collaborator_begin resource_name target.resource.name
add_collaborator_begin resource_url target.url
add_collaborator_begin target_user target.user.email_addresses
add_collaborator_end additional_details additional.fields[additional_details]
add_collaborator_end matter_id target.resource.attribute.labels[matter_id]
add_collaborator_end organizational_unit_name additional.fields[organizational_unit_name]
add_collaborator_end query additional.fields[query]
add_collaborator_end resource_name target.resource.name
add_collaborator_end resource_url target.url
add_collaborator_end target_user target.user.email_addresses
add_litigation_hold_begin additional_details additional.fields[additional_details]
add_litigation_hold_begin matter_id target.resource.attribute.labels[matter_id]
add_litigation_hold_begin organizational_unit_name additional.fields[organizational_unit_name]
add_litigation_hold_begin query additional.fields[query]
add_litigation_hold_begin resource_name target.resource.name
add_litigation_hold_begin resource_url target.url
add_litigation_hold_begin target_user target.user.email_addresses
add_litigation_hold_end additional_details additional.fields[additional_details]
add_litigation_hold_end matter_id target.resource.attribute.labels[matter_id]
add_litigation_hold_end organizational_unit_name additional.fields[organizational_unit_name]
add_litigation_hold_end query additional.fields[query]
add_litigation_hold_end resource_name target.resource.name
add_litigation_hold_end resource_url target.url
add_litigation_hold_end target_user target.user.email_addresses
add_preservation_rule_begin additional_details additional.fields[additional_details]
add_preservation_rule_begin matter_id target.resource.attribute.labels[matter_id]
add_preservation_rule_begin organizational_unit_name additional.fields[organizational_unit_name]
add_preservation_rule_begin query additional.fields[query]
add_preservation_rule_begin resource_name target.resource.name
add_preservation_rule_begin resource_url target.url
add_preservation_rule_begin target_user target.user.email_addresses
add_preservation_rule_end additional_details additional.fields[additional_details]
add_preservation_rule_end matter_id target.resource.attribute.labels[matter_id]
add_preservation_rule_end organizational_unit_name additional.fields[organizational_unit_name]
add_preservation_rule_end query additional.fields[query]
add_preservation_rule_end resource_name target.resource.name
add_preservation_rule_end resource_url target.url
add_preservation_rule_end target_user target.user.email_addresses
add_retention_rule_begin additional_details additional.fields[additional_details]
add_retention_rule_begin matter_id target.resource.attribute.labels[matter_id]
add_retention_rule_begin organizational_unit_name additional.fields[organizational_unit_name]
add_retention_rule_begin query additional.fields[query]
add_retention_rule_begin resource_name target.resource.name
add_retention_rule_begin resource_url target.url
add_retention_rule_begin target_user target.user.email_addresses
add_retention_rule_end additional_details additional.fields[additional_details]
add_retention_rule_end matter_id target.resource.attribute.labels[matter_id]
add_retention_rule_end organizational_unit_name additional.fields[organizational_unit_name]
add_retention_rule_end query additional.fields[query]
add_retention_rule_end resource_name target.resource.name
add_retention_rule_end resource_url target.url
add_retention_rule_end target_user target.user.email_addresses
cancel_accelerated_deletion_begin additional_details additional.fields[additional_details]
cancel_accelerated_deletion_begin matter_id target.resource.attribute.labels[matter_id]
cancel_accelerated_deletion_begin organizational_unit_name additional.fields[organizational_unit_name]
cancel_accelerated_deletion_begin query additional.fields[query]
cancel_accelerated_deletion_begin resource_name target.resource.name
cancel_accelerated_deletion_begin resource_url target.url
cancel_accelerated_deletion_begin target_user target.user.email_addresses
cancel_accelerated_deletion_end additional_details additional.fields[additional_details]
cancel_accelerated_deletion_end matter_id target.resource.attribute.labels[matter_id]
cancel_accelerated_deletion_end organizational_unit_name additional.fields[organizational_unit_name]
cancel_accelerated_deletion_end query additional.fields[query]
cancel_accelerated_deletion_end resource_name target.resource.name
cancel_accelerated_deletion_end resource_url target.url
cancel_accelerated_deletion_end target_user target.user.email_addresses
close_investigation_begin additional_details additional.fields[additional_details]
close_investigation_begin matter_id target.resource.attribute.labels[matter_id]
close_investigation_begin organizational_unit_name additional.fields[organizational_unit_name]
close_investigation_begin query additional.fields[query]
close_investigation_begin resource_name target.resource.name
close_investigation_begin resource_url target.url
close_investigation_begin target_user target.user.email_addresses
close_investigation_end additional_details additional.fields[additional_details]
close_investigation_end matter_id target.resource.attribute.labels[matter_id]
close_investigation_end organizational_unit_name additional.fields[organizational_unit_name]
close_investigation_end query additional.fields[query]
close_investigation_end resource_name target.resource.name
close_investigation_end resource_url target.url
close_investigation_end target_user target.user.email_addresses
convert_saved_query_to_collection_begin additional_details additional.fields[additional_details]
convert_saved_query_to_collection_begin matter_id target.resource.attribute.labels[matter_id]
convert_saved_query_to_collection_begin organizational_unit_name additional.fields[organizational_unit_name]
convert_saved_query_to_collection_begin query additional.fields[query]
convert_saved_query_to_collection_begin resource_name target.resource.name
convert_saved_query_to_collection_begin resource_url target.url
convert_saved_query_to_collection_begin target_user target.user.email_addresses
convert_saved_query_to_collection_end additional_details additional.fields[additional_details]
convert_saved_query_to_collection_end matter_id target.resource.attribute.labels[matter_id]
convert_saved_query_to_collection_end organizational_unit_name additional.fields[organizational_unit_name]
convert_saved_query_to_collection_end query additional.fields[query]
convert_saved_query_to_collection_end resource_name target.resource.name
convert_saved_query_to_collection_end resource_url target.url
convert_saved_query_to_collection_end target_user target.user.email_addresses
create_accelerated_deletion_begin additional_details additional.fields[additional_details]
create_accelerated_deletion_begin matter_id target.resource.attribute.labels[matter_id]
create_accelerated_deletion_begin organizational_unit_name additional.fields[organizational_unit_name]
create_accelerated_deletion_begin query additional.fields[query]
create_accelerated_deletion_begin resource_name target.resource.name
create_accelerated_deletion_begin resource_url target.url
create_accelerated_deletion_begin target_user target.user.email_addresses
create_accelerated_deletion_end additional_details additional.fields[additional_details]
create_accelerated_deletion_end matter_id target.resource.attribute.labels[matter_id]
create_accelerated_deletion_end organizational_unit_name additional.fields[organizational_unit_name]
create_accelerated_deletion_end query additional.fields[query]
create_accelerated_deletion_end resource_name target.resource.name
create_accelerated_deletion_end resource_url target.url
create_accelerated_deletion_end target_user target.user.email_addresses
create_export_begin additional_details additional.fields[additional_details]
create_export_begin matter_id target.resource.attribute.labels[matter_id]
create_export_begin organizational_unit_name additional.fields[organizational_unit_name]
create_export_begin query additional.fields[query]
create_export_begin resource_name target.resource.name
create_export_begin resource_url target.url
create_export_begin target_user target.user.email_addresses
create_export_end additional_details additional.fields[additional_details]
create_export_end matter_id target.resource.attribute.labels[matter_id]
create_export_end organizational_unit_name additional.fields[organizational_unit_name]
create_export_end query additional.fields[query]
create_export_end resource_name target.resource.name
create_export_end resource_url target.url
create_export_end target_user target.user.email_addresses
create_investigation_begin additional_details additional.fields[additional_details]
create_investigation_begin matter_id target.resource.attribute.labels[matter_id]
create_investigation_begin organizational_unit_name additional.fields[organizational_unit_name]
create_investigation_begin query additional.fields[query]
create_investigation_begin resource_name target.resource.name
create_investigation_begin resource_url target.url
create_investigation_begin target_user target.user.email_addresses
create_investigation_end additional_details additional.fields[additional_details]
create_investigation_end matter_id target.resource.attribute.labels[matter_id]
create_investigation_end organizational_unit_name additional.fields[organizational_unit_name]
create_investigation_end query additional.fields[query]
create_investigation_end resource_name target.resource.name
create_investigation_end resource_url target.url
create_investigation_end target_user target.user.email_addresses
create_saved_query_begin additional_details additional.fields[additional_details]
create_saved_query_begin matter_id target.resource.attribute.labels[matter_id]
create_saved_query_begin organizational_unit_name additional.fields[organizational_unit_name]
create_saved_query_begin query additional.fields[query]
create_saved_query_begin resource_name target.resource.name
create_saved_query_begin resource_url target.url
create_saved_query_begin target_user target.user.email_addresses
create_saved_query_end additional_details additional.fields[additional_details]
create_saved_query_end matter_id target.resource.attribute.labels[matter_id]
create_saved_query_end organizational_unit_name additional.fields[organizational_unit_name]
create_saved_query_end query additional.fields[query]
create_saved_query_end resource_name target.resource.name
create_saved_query_end resource_url target.url
create_saved_query_end target_user target.user.email_addresses
delete_export_begin additional_details additional.fields[additional_details]
delete_export_begin matter_id target.resource.attribute.labels[matter_id]
delete_export_begin organizational_unit_name additional.fields[organizational_unit_name]
delete_export_begin query additional.fields[query]
delete_export_begin resource_name target.resource.name
delete_export_begin resource_url target.url
delete_export_begin target_user target.user.email_addresses
delete_export_end additional_details additional.fields[additional_details]
delete_export_end matter_id target.resource.attribute.labels[matter_id]
delete_export_end organizational_unit_name additional.fields[organizational_unit_name]
delete_export_end query additional.fields[query]
delete_export_end resource_name target.resource.name
delete_export_end resource_url target.url
delete_export_end target_user target.user.email_addresses
delete_export_fail additional_details additional.fields[additional_details]
delete_export_fail matter_id target.resource.attribute.labels[matter_id]
delete_export_fail organizational_unit_name additional.fields[organizational_unit_name]
delete_export_fail query additional.fields[query]
delete_export_fail resource_name target.resource.name
delete_export_fail resource_url target.url
delete_export_fail target_user target.user.email_addresses
delete_investigation_begin additional_details additional.fields[additional_details]
delete_investigation_begin matter_id target.resource.attribute.labels[matter_id]
delete_investigation_begin organizational_unit_name additional.fields[organizational_unit_name]
delete_investigation_begin query additional.fields[query]
delete_investigation_begin resource_name target.resource.name
delete_investigation_begin resource_url target.url
delete_investigation_begin target_user target.user.email_addresses
delete_investigation_end additional_details additional.fields[additional_details]
delete_investigation_end matter_id target.resource.attribute.labels[matter_id]
delete_investigation_end organizational_unit_name additional.fields[organizational_unit_name]
delete_investigation_end query additional.fields[query]
delete_investigation_end resource_name target.resource.name
delete_investigation_end resource_url target.url
delete_investigation_end target_user target.user.email_addresses
delete_preservation_rule_begin additional_details additional.fields[additional_details]
delete_preservation_rule_begin matter_id target.resource.attribute.labels[matter_id]
delete_preservation_rule_begin organizational_unit_name additional.fields[organizational_unit_name]
delete_preservation_rule_begin query additional.fields[query]
delete_preservation_rule_begin resource_name target.resource.name
delete_preservation_rule_begin resource_url target.url
delete_preservation_rule_begin target_user target.user.email_addresses
delete_preservation_rule_end additional_details additional.fields[additional_details]
delete_preservation_rule_end matter_id target.resource.attribute.labels[matter_id]
delete_preservation_rule_end organizational_unit_name additional.fields[organizational_unit_name]
delete_preservation_rule_end query additional.fields[query]
delete_preservation_rule_end resource_name target.resource.name
delete_preservation_rule_end resource_url target.url
delete_preservation_rule_end target_user target.user.email_addresses
delete_retention_rule_begin additional_details additional.fields[additional_details]
delete_retention_rule_begin matter_id target.resource.attribute.labels[matter_id]
delete_retention_rule_begin organizational_unit_name additional.fields[organizational_unit_name]
delete_retention_rule_begin query additional.fields[query]
delete_retention_rule_begin resource_name target.resource.name
delete_retention_rule_begin resource_url target.url
delete_retention_rule_begin target_user target.user.email_addresses
delete_retention_rule_end additional_details additional.fields[additional_details]
delete_retention_rule_end matter_id target.resource.attribute.labels[matter_id]
delete_retention_rule_end organizational_unit_name additional.fields[organizational_unit_name]
delete_retention_rule_end query additional.fields[query]
delete_retention_rule_end resource_name target.resource.name
delete_retention_rule_end resource_url target.url
delete_retention_rule_end target_user target.user.email_addresses
delete_saved_query_begin additional_details additional.fields[additional_details]
delete_saved_query_begin matter_id target.resource.attribute.labels[matter_id]
delete_saved_query_begin organizational_unit_name additional.fields[organizational_unit_name]
delete_saved_query_begin query additional.fields[query]
delete_saved_query_begin resource_name target.resource.name
delete_saved_query_begin resource_url target.url
delete_saved_query_begin target_user target.user.email_addresses
delete_saved_query_end additional_details additional.fields[additional_details]
delete_saved_query_end matter_id target.resource.attribute.labels[matter_id]
delete_saved_query_end organizational_unit_name additional.fields[organizational_unit_name]
delete_saved_query_end query additional.fields[query]
delete_saved_query_end resource_name target.resource.name
delete_saved_query_end resource_url target.url
delete_saved_query_end target_user target.user.email_addresses
deletion_search additional_details additional.fields[additional_details]
deletion_search matter_id target.resource.attribute.labels[matter_id]
deletion_search organizational_unit_name additional.fields[organizational_unit_name]
deletion_search query additional.fields[query]
deletion_search resource_name target.resource.name
deletion_search resource_url target.url
deletion_search target_user target.user.email_addresses
download_count_per_account_csv additional_details additional.fields[additional_details]
download_count_per_account_csv matter_id target.resource.attribute.labels[matter_id]
download_count_per_account_csv organizational_unit_name additional.fields[organizational_unit_name]
download_count_per_account_csv query additional.fields[query]
download_count_per_account_csv resource_name target.resource.name
download_count_per_account_csv resource_url target.url
download_count_per_account_csv target_user target.user.email_addresses
download_cross_matter_litigation_hold_report additional_details additional.fields[additional_details]
download_cross_matter_litigation_hold_report matter_id target.resource.attribute.labels[matter_id]
download_cross_matter_litigation_hold_report organizational_unit_name additional.fields[organizational_unit_name]
download_cross_matter_litigation_hold_report query additional.fields[query]
download_cross_matter_litigation_hold_report resource_name target.resource.name
download_cross_matter_litigation_hold_report resource_url target.url
download_cross_matter_litigation_hold_report target_user target.user.email_addresses
download_per_matter_litigation_hold_report additional_details additional.fields[additional_details]
download_per_matter_litigation_hold_report matter_id target.resource.attribute.labels[matter_id]
download_per_matter_litigation_hold_report organizational_unit_name additional.fields[organizational_unit_name]
download_per_matter_litigation_hold_report query additional.fields[query]
download_per_matter_litigation_hold_report resource_name target.resource.name
download_per_matter_litigation_hold_report resource_url target.url
download_per_matter_litigation_hold_report target_user target.user.email_addresses
export additional_details additional.fields[additional_details]
export matter_id target.resource.attribute.labels[matter_id]
export organizational_unit_name additional.fields[organizational_unit_name]
export query additional.fields[query]
export resource_name target.resource.name
export resource_url target.url
export target_user target.user.email_addresses
export_file_download additional_details additional.fields[additional_details]
export_file_download matter_id target.resource.attribute.labels[matter_id]
export_file_download organizational_unit_name additional.fields[organizational_unit_name]
export_file_download query additional.fields[query]
export_file_download resource_name target.resource.name
export_file_download resource_url target.url
export_file_download target_user target.user.email_addresses
get_count_operation additional_details additional.fields[additional_details]
get_count_operation matter_id target.resource.attribute.labels[matter_id]
get_count_operation organizational_unit_name additional.fields[organizational_unit_name]
get_count_operation query additional.fields[query]
get_count_operation resource_name target.resource.name
get_count_operation resource_url target.url
get_count_operation target_user target.user.email_addresses
legacy_export_download additional_details additional.fields[additional_details]
legacy_export_download matter_id target.resource.attribute.labels[matter_id]
legacy_export_download organizational_unit_name additional.fields[organizational_unit_name]
legacy_export_download query additional.fields[query]
legacy_export_download resource_name target.resource.name
legacy_export_download resource_url target.url
legacy_export_download target_user target.user.email_addresses
modify_default_retention_period_begin additional_details additional.fields[additional_details]
modify_default_retention_period_begin matter_id target.resource.attribute.labels[matter_id]
modify_default_retention_period_begin organizational_unit_name additional.fields[organizational_unit_name]
modify_default_retention_period_begin query additional.fields[query]
modify_default_retention_period_begin resource_name target.resource.name
modify_default_retention_period_begin resource_url target.url
modify_default_retention_period_begin target_user target.user.email_addresses
modify_default_retention_period_end additional_details additional.fields[additional_details]
modify_default_retention_period_end matter_id target.resource.attribute.labels[matter_id]
modify_default_retention_period_end organizational_unit_name additional.fields[organizational_unit_name]
modify_default_retention_period_end query additional.fields[query]
modify_default_retention_period_end resource_name target.resource.name
modify_default_retention_period_end resource_url target.url
modify_default_retention_period_end target_user target.user.email_addresses
obsolete_api_exports_list additional_details additional.fields[additional_details]
obsolete_api_exports_list matter_id target.resource.attribute.labels[matter_id]
obsolete_api_exports_list organizational_unit_name additional.fields[organizational_unit_name]
obsolete_api_exports_list query additional.fields[query]
obsolete_api_exports_list resource_name target.resource.name
obsolete_api_exports_list resource_url target.url
obsolete_api_exports_list target_user target.user.email_addresses
obsolete_api_holds_insert additional_details additional.fields[additional_details]
obsolete_api_holds_insert matter_id target.resource.attribute.labels[matter_id]
obsolete_api_holds_insert organizational_unit_name additional.fields[organizational_unit_name]
obsolete_api_holds_insert query additional.fields[query]
obsolete_api_holds_insert resource_name target.resource.name
obsolete_api_holds_insert resource_url target.url
obsolete_api_holds_insert target_user target.user.email_addresses
obsolete_api_holds_list additional_details additional.fields[additional_details]
obsolete_api_holds_list matter_id target.resource.attribute.labels[matter_id]
obsolete_api_holds_list organizational_unit_name additional.fields[organizational_unit_name]
obsolete_api_holds_list query additional.fields[query]
obsolete_api_holds_list resource_name target.resource.name
obsolete_api_holds_list resource_url target.url
obsolete_api_holds_list target_user target.user.email_addresses
obsolete_api_matters_delete additional_details additional.fields[additional_details]
obsolete_api_matters_delete matter_id target.resource.attribute.labels[matter_id]
obsolete_api_matters_delete organizational_unit_name additional.fields[organizational_unit_name]
obsolete_api_matters_delete query additional.fields[query]
obsolete_api_matters_delete resource_name target.resource.name
obsolete_api_matters_delete resource_url target.url
obsolete_api_matters_delete target_user target.user.email_addresses
obsolete_api_matters_get additional_details additional.fields[additional_details]
obsolete_api_matters_get matter_id target.resource.attribute.labels[matter_id]
obsolete_api_matters_get organizational_unit_name additional.fields[organizational_unit_name]
obsolete_api_matters_get query additional.fields[query]
obsolete_api_matters_get resource_name target.resource.name
obsolete_api_matters_get resource_url target.url
obsolete_api_matters_get target_user target.user.email_addresses
obsolete_api_matters_insert additional_details additional.fields[additional_details]
obsolete_api_matters_insert matter_id target.resource.attribute.labels[matter_id]
obsolete_api_matters_insert organizational_unit_name additional.fields[organizational_unit_name]
obsolete_api_matters_insert query additional.fields[query]
obsolete_api_matters_insert resource_name target.resource.name
obsolete_api_matters_insert resource_url target.url
obsolete_api_matters_insert target_user target.user.email_addresses
obsolete_api_matters_list additional_details additional.fields[additional_details]
obsolete_api_matters_list matter_id target.resource.attribute.labels[matter_id]
obsolete_api_matters_list organizational_unit_name additional.fields[organizational_unit_name]
obsolete_api_matters_list query additional.fields[query]
obsolete_api_matters_list resource_name target.resource.name
obsolete_api_matters_list resource_url target.url
obsolete_api_matters_list target_user target.user.email_addresses
obsolete_api_matters_update additional_details additional.fields[additional_details]
obsolete_api_matters_update matter_id target.resource.attribute.labels[matter_id]
obsolete_api_matters_update organizational_unit_name additional.fields[organizational_unit_name]
obsolete_api_matters_update query additional.fields[query]
obsolete_api_matters_update resource_name target.resource.name
obsolete_api_matters_update resource_url target.url
obsolete_api_matters_update target_user target.user.email_addresses
obsolete_preview_retention_rule_count additional_details additional.fields[additional_details]
obsolete_preview_retention_rule_count matter_id target.resource.attribute.labels[matter_id]
obsolete_preview_retention_rule_count organizational_unit_name additional.fields[organizational_unit_name]
obsolete_preview_retention_rule_count query additional.fields[query]
obsolete_preview_retention_rule_count resource_name target.resource.name
obsolete_preview_retention_rule_count resource_url target.url
obsolete_preview_retention_rule_count target_user target.user.email_addresses
preview_retention_rule additional_details additional.fields[additional_details]
preview_retention_rule matter_id target.resource.attribute.labels[matter_id]
preview_retention_rule organizational_unit_name additional.fields[organizational_unit_name]
preview_retention_rule query additional.fields[query]
preview_retention_rule resource_name target.resource.name
preview_retention_rule resource_url target.url
preview_retention_rule target_user target.user.email_addresses
remove_collaborator_begin additional_details additional.fields[additional_details]
remove_collaborator_begin matter_id target.resource.attribute.labels[matter_id]
remove_collaborator_begin organizational_unit_name additional.fields[organizational_unit_name]
remove_collaborator_begin query additional.fields[query]
remove_collaborator_begin resource_name target.resource.name
remove_collaborator_begin resource_url target.url
remove_collaborator_begin target_user target.user.email_addresses
remove_collaborator_end additional_details additional.fields[additional_details]
remove_collaborator_end matter_id target.resource.attribute.labels[matter_id]
remove_collaborator_end organizational_unit_name additional.fields[organizational_unit_name]
remove_collaborator_end query additional.fields[query]
remove_collaborator_end resource_name target.resource.name
remove_collaborator_end resource_url target.url
remove_collaborator_end target_user target.user.email_addresses
remove_litigation_hold_begin additional_details additional.fields[additional_details]
remove_litigation_hold_begin matter_id target.resource.attribute.labels[matter_id]
remove_litigation_hold_begin organizational_unit_name additional.fields[organizational_unit_name]
remove_litigation_hold_begin query additional.fields[query]
remove_litigation_hold_begin resource_name target.resource.name
remove_litigation_hold_begin resource_url target.url
remove_litigation_hold_begin target_user target.user.email_addresses
remove_litigation_hold_end additional_details additional.fields[additional_details]
remove_litigation_hold_end matter_id target.resource.attribute.labels[matter_id]
remove_litigation_hold_end organizational_unit_name additional.fields[organizational_unit_name]
remove_litigation_hold_end query additional.fields[query]
remove_litigation_hold_end resource_name target.resource.name
remove_litigation_hold_end resource_url target.url
remove_litigation_hold_end target_user target.user.email_addresses
reopen_investigation_begin additional_details additional.fields[additional_details]
reopen_investigation_begin matter_id target.resource.attribute.labels[matter_id]
reopen_investigation_begin organizational_unit_name additional.fields[organizational_unit_name]
reopen_investigation_begin query additional.fields[query]
reopen_investigation_begin resource_name target.resource.name
reopen_investigation_begin resource_url target.url
reopen_investigation_begin target_user target.user.email_addresses
reopen_investigation_end additional_details additional.fields[additional_details]
reopen_investigation_end matter_id target.resource.attribute.labels[matter_id]
reopen_investigation_end organizational_unit_name additional.fields[organizational_unit_name]
reopen_investigation_end query additional.fields[query]
reopen_investigation_end resource_name target.resource.name
reopen_investigation_end resource_url target.url
reopen_investigation_end target_user target.user.email_addresses
restore_investigation_begin additional_details additional.fields[additional_details]
restore_investigation_begin matter_id target.resource.attribute.labels[matter_id]
restore_investigation_begin organizational_unit_name additional.fields[organizational_unit_name]
restore_investigation_begin query additional.fields[query]
restore_investigation_begin resource_name target.resource.name
restore_investigation_begin resource_url target.url
restore_investigation_begin target_user target.user.email_addresses
restore_investigation_end additional_details additional.fields[additional_details]
restore_investigation_end matter_id target.resource.attribute.labels[matter_id]
restore_investigation_end organizational_unit_name additional.fields[organizational_unit_name]
restore_investigation_end query additional.fields[query]
restore_investigation_end resource_name target.resource.name
restore_investigation_end resource_url target.url
restore_investigation_end target_user target.user.email_addresses
search additional_details additional.fields[additional_details]
search matter_id target.resource.attribute.labels[matter_id]
search organizational_unit_name additional.fields[organizational_unit_name]
search query additional.fields[query]
search resource_name target.resource.name
search resource_url target.url
search target_user target.user.email_addresses
search_count additional_details additional.fields[additional_details]
search_count matter_id target.resource.attribute.labels[matter_id]
search_count organizational_unit_name additional.fields[organizational_unit_name]
search_count query additional.fields[query]
search_count resource_name target.resource.name
search_count resource_url target.url
search_count target_user target.user.email_addresses
update_investigation_details_begin additional_details additional.fields[additional_details]
update_investigation_details_begin matter_id target.resource.attribute.labels[matter_id]
update_investigation_details_begin organizational_unit_name additional.fields[organizational_unit_name]
update_investigation_details_begin query additional.fields[query]
update_investigation_details_begin resource_name target.resource.name
update_investigation_details_begin resource_url target.url
update_investigation_details_begin target_user target.user.email_addresses
update_investigation_details_end additional_details additional.fields[additional_details]
update_investigation_details_end matter_id target.resource.attribute.labels[matter_id]
update_investigation_details_end organizational_unit_name additional.fields[organizational_unit_name]
update_investigation_details_end query additional.fields[query]
update_investigation_details_end resource_name target.resource.name
update_investigation_details_end resource_url target.url
update_investigation_details_end target_user target.user.email_addresses
update_preservation_rule_add_holds_begin additional_details additional.fields[additional_details]
update_preservation_rule_add_holds_begin matter_id target.resource.attribute.labels[matter_id]
update_preservation_rule_add_holds_begin organizational_unit_name additional.fields[organizational_unit_name]
update_preservation_rule_add_holds_begin query additional.fields[query]
update_preservation_rule_add_holds_begin resource_name target.resource.name
update_preservation_rule_add_holds_begin resource_url target.url
update_preservation_rule_add_holds_begin target_user target.user.email_addresses
update_preservation_rule_add_holds_end additional_details additional.fields[additional_details]
update_preservation_rule_add_holds_end matter_id target.resource.attribute.labels[matter_id]
update_preservation_rule_add_holds_end organizational_unit_name additional.fields[organizational_unit_name]
update_preservation_rule_add_holds_end query additional.fields[query]
update_preservation_rule_add_holds_end resource_name target.resource.name
update_preservation_rule_add_holds_end resource_url target.url
update_preservation_rule_add_holds_end target_user target.user.email_addresses
update_preservation_rule_query_begin additional_details additional.fields[additional_details]
update_preservation_rule_query_begin matter_id target.resource.attribute.labels[matter_id]
update_preservation_rule_query_begin organizational_unit_name additional.fields[organizational_unit_name]
update_preservation_rule_query_begin query additional.fields[query]
update_preservation_rule_query_begin resource_name target.resource.name
update_preservation_rule_query_begin resource_url target.url
update_preservation_rule_query_begin target_user target.user.email_addresses
update_preservation_rule_query_end additional_details additional.fields[additional_details]
update_preservation_rule_query_end matter_id target.resource.attribute.labels[matter_id]
update_preservation_rule_query_end organizational_unit_name additional.fields[organizational_unit_name]
update_preservation_rule_query_end query additional.fields[query]
update_preservation_rule_query_end resource_name target.resource.name
update_preservation_rule_query_end resource_url target.url
update_preservation_rule_query_end target_user target.user.email_addresses
update_preservation_rule_remove_holds_begin additional_details additional.fields[additional_details]
update_preservation_rule_remove_holds_begin matter_id target.resource.attribute.labels[matter_id]
update_preservation_rule_remove_holds_begin organizational_unit_name additional.fields[organizational_unit_name]
update_preservation_rule_remove_holds_begin query additional.fields[query]
update_preservation_rule_remove_holds_begin resource_name target.resource.name
update_preservation_rule_remove_holds_begin resource_url target.url
update_preservation_rule_remove_holds_begin target_user target.user.email_addresses
update_preservation_rule_remove_holds_end additional_details additional.fields[additional_details]
update_preservation_rule_remove_holds_end matter_id target.resource.attribute.labels[matter_id]
update_preservation_rule_remove_holds_end organizational_unit_name additional.fields[organizational_unit_name]
update_preservation_rule_remove_holds_end query additional.fields[query]
update_preservation_rule_remove_holds_end resource_name target.resource.name
update_preservation_rule_remove_holds_end resource_url target.url
update_preservation_rule_remove_holds_end target_user target.user.email_addresses
update_retention_rule_begin additional_details additional.fields[additional_details]
update_retention_rule_begin matter_id target.resource.attribute.labels[matter_id]
update_retention_rule_begin organizational_unit_name additional.fields[organizational_unit_name]
update_retention_rule_begin query additional.fields[query]
update_retention_rule_begin resource_name target.resource.name
update_retention_rule_begin resource_url target.url
update_retention_rule_begin target_user target.user.email_addresses
update_retention_rule_end additional_details additional.fields[additional_details]
update_retention_rule_end matter_id target.resource.attribute.labels[matter_id]
update_retention_rule_end organizational_unit_name additional.fields[organizational_unit_name]
update_retention_rule_end query additional.fields[query]
update_retention_rule_end resource_name target.resource.name
update_retention_rule_end resource_url target.url
update_retention_rule_end target_user target.user.email_addresses
update_retention_settings additional_details additional.fields[additional_details]
update_retention_settings matter_id target.resource.attribute.labels[matter_id]
update_retention_settings organizational_unit_name additional.fields[organizational_unit_name]
update_retention_settings query additional.fields[query]
update_retention_settings resource_name target.resource.name
update_retention_settings resource_url target.url
update_retention_settings target_user target.user.email_addresses
update_saved_query_details_begin additional_details additional.fields[additional_details]
update_saved_query_details_begin matter_id target.resource.attribute.labels[matter_id]
update_saved_query_details_begin organizational_unit_name additional.fields[organizational_unit_name]
update_saved_query_details_begin query additional.fields[query]
update_saved_query_details_begin resource_name target.resource.name
update_saved_query_details_begin resource_url target.url
update_saved_query_details_begin target_user target.user.email_addresses
update_saved_query_details_end additional_details additional.fields[additional_details]
update_saved_query_details_end matter_id target.resource.attribute.labels[matter_id]
update_saved_query_details_end organizational_unit_name additional.fields[organizational_unit_name]
update_saved_query_details_end query additional.fields[query]
update_saved_query_details_end resource_name target.resource.name
update_saved_query_details_end resource_url target.url
update_saved_query_details_end target_user target.user.email_addresses
view_cross_matter_litigation_hold_report additional_details additional.fields[additional_details]
view_cross_matter_litigation_hold_report matter_id target.resource.attribute.labels[matter_id]
view_cross_matter_litigation_hold_report organizational_unit_name additional.fields[organizational_unit_name]
view_cross_matter_litigation_hold_report query additional.fields[query]
view_cross_matter_litigation_hold_report resource_name target.resource.name
view_cross_matter_litigation_hold_report resource_url target.url
view_cross_matter_litigation_hold_report target_user target.user.email_addresses
view_custodian_litigation_hold_report additional_details additional.fields[additional_details]
view_custodian_litigation_hold_report matter_id target.resource.attribute.labels[matter_id]
view_custodian_litigation_hold_report organizational_unit_name additional.fields[organizational_unit_name]
view_custodian_litigation_hold_report query additional.fields[query]
view_custodian_litigation_hold_report resource_name target.resource.name
view_custodian_litigation_hold_report resource_url target.url
view_custodian_litigation_hold_report target_user target.user.email_addresses
view_document additional_details additional.fields[additional_details]
view_document matter_id target.resource.attribute.labels[matter_id]
view_document organizational_unit_name additional.fields[organizational_unit_name]
view_document query additional.fields[query]
view_document resource_name target.resource.name
view_document resource_url target.url
view_document target_user target.user.email_addresses
view_document_information additional_details additional.fields[additional_details]
view_document_information matter_id target.resource.attribute.labels[matter_id]
view_document_information organizational_unit_name additional.fields[organizational_unit_name]
view_document_information query additional.fields[query]
view_document_information resource_name target.resource.name
view_document_information resource_url target.url
view_document_information target_user target.user.email_addresses
view_external_document additional_details additional.fields[additional_details]
view_external_document matter_id target.resource.attribute.labels[matter_id]
view_external_document organizational_unit_name additional.fields[organizational_unit_name]
view_external_document query additional.fields[query]
view_external_document resource_name target.resource.name
view_external_document resource_url target.url
view_external_document target_user target.user.email_addresses
view_investigation additional_details additional.fields[additional_details]
view_investigation matter_id target.resource.attribute.labels[matter_id]
view_investigation organizational_unit_name additional.fields[organizational_unit_name]
view_investigation query additional.fields[query]
view_investigation resource_name target.resource.name
view_investigation resource_url target.url
view_investigation target_user target.user.email_addresses
view_matter_audit_log additional_details additional.fields[additional_details]
view_matter_audit_log matter_id target.resource.attribute.labels[matter_id]
view_matter_audit_log organizational_unit_name additional.fields[organizational_unit_name]
view_matter_audit_log query additional.fields[query]
view_matter_audit_log resource_name target.resource.name
view_matter_audit_log resource_url target.url
view_matter_audit_log target_user target.user.email_addresses
view_per_matter_litigation_hold_report additional_details additional.fields[additional_details]
view_per_matter_litigation_hold_report matter_id target.resource.attribute.labels[matter_id]
view_per_matter_litigation_hold_report organizational_unit_name additional.fields[organizational_unit_name]
view_per_matter_litigation_hold_report query additional.fields[query]
view_per_matter_litigation_hold_report resource_name target.resource.name
view_per_matter_litigation_hold_report resource_url target.url
view_per_matter_litigation_hold_report target_user target.user.email_addresses
view_retention_policy additional_details additional.fields[additional_details]
view_retention_policy matter_id target.resource.attribute.labels[matter_id]
view_retention_policy organizational_unit_name additional.fields[organizational_unit_name]
view_retention_policy query additional.fields[query]
view_retention_policy resource_name target.resource.name
view_retention_policy resource_url target.url
view_retention_policy target_user target.user.email_addresses
view_retention_settings additional_details additional.fields[additional_details]
view_retention_settings matter_id target.resource.attribute.labels[matter_id]
view_retention_settings organizational_unit_name additional.fields[organizational_unit_name]
view_retention_settings query additional.fields[query]
view_retention_settings resource_name target.resource.name
view_retention_settings resource_url target.url
view_retention_settings target_user target.user.email_addresses
view_system_audit_log additional_details additional.fields[additional_details]
view_system_audit_log matter_id target.resource.attribute.labels[matter_id]
view_system_audit_log organizational_unit_name additional.fields[organizational_unit_name]
view_system_audit_log query additional.fields[query]
view_system_audit_log resource_name target.resource.name
view_system_audit_log resource_url target.url
view_system_audit_log target_user target.user.email_addresses

Field mapping reference: WORKSPACE_ALERTS log types to UDM event type

The following table lists the WORKSPACE_ALERTS log types and their corresponding UDM event types.

Event Identifier Event Type Security Category
Customer takeout initiated STATUS_UPDATE
Malware reclassification EMAIL_TRANSACTION MAIL_PHISHING
Misconfigured whitelist EMAIL_TRANSACTION MAIL_PHISHING
Phishing reclassification EMAIL_TRANSACTION MAIL_PHISHING
Suspicious message reported EMAIL_TRANSACTION MAIL_PHISHING
User reported phishing EMAIL_TRANSACTION MAIL_PHISHING
User reported spam spike EMAIL_TRANSACTION MAIL_PHISHING
Leaked password USER_LOGIN ACL_VIOLATION
Suspicious login USER_LOGIN ACL_VIOLATION
Suspicious login (less secure app) USER_LOGIN ACL_VIOLATION
Suspicious programmatic login USER_LOGIN ACL_VIOLATION
User suspended USER_UNCATEGORIZED ACL_VIOLATION
User suspended (spam) USER_UNCATEGORIZED ACL_VIOLATION
User suspended (spam through relay) USER_UNCATEGORIZED ACL_VIOLATION
User suspended (suspicious activity) USER_UNCATEGORIZED ACL_VIOLATION
Google Operations STATUS_UPDATE
Configuration problem STATUS_UNCATEGORIZED
Government attack warning STATUS_UNCATEGORIZED
Device compromised GENERIC_EVENT
Suspicious activity USER_UNCATEGORIZED
AppMaker Default Cloud SQL setup USER_RESOURCE_ACCESS
Activity Rule STATUS_UNCATEGORIZED / USER_UNCATEGORIZED / EMAIL_UNCATEGORIZED POLICY_VIOLATION
Data Loss Prevention USER_UNCATEGORIZED POLICY_VIOLATION
Apps outage STATUS_UPDATE
Primary admin changed USER_UNCATEGORIZED
SSO profile added USER_RESOURCE_CREATION
SSO profile updated USER_RESOURCE_UPDATE_CONTENT
SSO profile deleted USER_RESOURCE_DELETION
Super admin password reset USER_CHANGE_PASSWORD
User deleted USER_DELETION
New user added USER_CREATION
User password changed USER_CHANGE_PASSWORD
Users Admin privilege revoked USER_CHANGE_PERMISSIONS
Suspended user made active USER_UNCATEGORIZED
User granted Admin privilege USER_CHANGE_PERMISSIONS
User suspended (Administrator email alert) USER_UNCATEGORIZED
Drive settings changed USER_RESOURCE_ACCESS
Calendar settings changed USER_RESOURCE_ACCESS
Reporting Rule STATUS_UPDATE
APNS certificate is expiring soon STATUS_UPDATE / GENERIC_EVENT
APNS certificate has expired STATUS_UPDATE / GENERIC_EVENT

Field mapping reference: WORKSPACE_ALERTS

The following table lists the log fields of the WORKSPACE_ALERTS log type and their corresponding UDM fields.

Log field UDM mapping Logic
data.domainId.customerPrimaryDomain about.administrative_domain
data.messages.attachmentsSha256Hash about.file.sha256
data.messages.attachmentsSha256Hash security_result.detection_fields[attachments_sha256_hash]
data.mergeInfo.newAlertId about.labels[new_alert_id] (deprecated)
data.mergeInfo.newAlertId additional.fields[new_alert_id]
data.mergeInfo.newIncidentTrackingId about.labels[new_incident_tracking_id] (deprecated)
data.mergeInfo.newIncidentTrackingId additional.fields[new_incident_tracking_id]
data.nextUpdateTime about.labels[next_update_time] (deprecated)
data.nextUpdateTime additional.fields[next_update_time]
data.resolutionTime about.labels[resolution_time] (deprecated)
data.resolutionTime additional.fields[resolution_time]
data.status about.labels[status] (deprecated)
data.status additional.fields[status]
data.incidentTrackingId about.labels[tracking_id] (deprecated)
data.incidentTrackingId additional.fields[tracking_id]
customerId about.resource.product_object_id If the customerId log field value is not empty, then the customerId log field is mapped to the about.resource.product_object_id UDM field.

Else, the metadata.customerId log field is mapped to the about.resource.product_object_id UDM field.
metadata.customerId about.resource.product_object_id If the customerId log field value is not empty, then the customerId log field is mapped to the about.resource.product_object_id UDM field.

Else, the metadata.customerId log field is mapped to the about.resource.product_object_id UDM field.
about.resource.resource_type The about.resource.resource_type UDM field is set to CLOUD_ORGANIZATION.
data.dashboardUri about.url
data.attachmentData.csv.dataRows.entries additional.fields.entries
data.attachmentData.csv.headers additional.fields.header
extensions.auth.mechanism If the data.@type log field value is equal to AccountWarning, then the extensions.auth.mechanism UDM field is set to USERNAME_PASSWORD.
extensions.auth.type If the data.@type log field value is equal to AccountWarning, then the extensions.auth.type UDM field is set to SSO.
data.description metadata.description
createTime metadata.event_timestamp
data.@type metadata.product_event_type
etag metadata.product_log_id If the etag log field value is not empty, then the etag log field is mapped to the metadata.product_log_id UDM field.

Else, the alertId log field is mapped to the metadata.product_log_id UDM field.
metadata.etag metadata.product_log_id If the metadata.etag log field value is not empty, then the metadata.etag log field is mapped to the metadata.product_log_id UDM field.

Else, the alertId log field is mapped to the metadata.product_log_id UDM field.
metadata.product_name The metadata.product_name UDM field is set to WORKSPACE_ALERTS.
metadata.vendor_name The metadata.vendor_name UDM field is set to GOOGLE.
data.maliciousEntity.fromHeader network.email.from
data.messages.messageId network.email.mail_id
data.messages.messageId security_result.detection_fields[message_id]
data.messages.subjectText network.email.subject
data.messages.recipient network.email.to
data.messages.recipient security_result.detection_fields[mail_recipient]
data.ruleViolationInfo.recipients network.email.to If the data.ruleViolationInfo.recipients log field value matches the regular expression pattern ^.+@.+$, then the data.ruleViolationInfo.recipients log field is mapped to the network.email.to UDM field.
data.ruleViolationInfo.recipients additional.fields[recipients] If the data.ruleViolationInfo.recipients log field value is equal to anyone, then the data.ruleViolationInfo.recipients log field is mapped to the additional.fields UDM field.
data.ruleViolationInfo.recipients target.domain.name If the data.ruleViolationInfo.recipients log field value matches the regular expression pattern ^[a-zA-Z0-9][a-zA-Z0-9-]{1,61}[a-zA-Z0-9](?:\.[a-zA-Z]{2,})+$, then the first occurrence of the matching value in the data.ruleViolationInfo.recipients log field is mapped to the target.domain.name UDM field and the other occurrences are mapped to the additional.fields[domain_recipients] UDM field.
data.sourceIp principal.ip
data.loginDetails.ipAddress principal.ip
data.maliciousEntity.displayName principal.labels[malicious_entity_display_name] (deprecated)
data.maliciousEntity.displayName additional.fields[malicious_entity_display_name]
data.requestInfo.appDeveloperEmail principal.user.email_addresses
data.actorEmail principal.user.email_addresses
data.ruleViolationInfo.triggeringUserEmail principal.user.email_addresses
data.email principal.user.email_addresses
data.domain security_result.about.administrative_domain
metadata.assignee security_result.about.labels[assignee] (deprecated)
metadata.assignee additional.fields[assignee]
data.header security_result.about.labels[header] (deprecated)
data.header additional.fields[header]
data.ruleViolationInfo.suppressedActionTypes security_result.about.labels[suppressed_action_types] (deprecated)
data.ruleViolationInfo.suppressedActionTypes additional.fields[suppressed_action_types]
data.title security_result.about.labels[title] (deprecated)
data.title additional.fields[title]
alertId security_result.about.object_reference
data.affectedUserEmails security_result.about.user.email_addresses
data.ruleViolationInfo.triggeredActionTypes security_result.action_details
security_result.action If the data.ruleViolationInfo.triggeredActionTypes log field value is equal to DRIVE_WARN_ON_EXTERNAL_SHARING or ALERT or RULE_ACTIVATE or RULE_DEACTIVATE, then the security_result.action UDM field is set to ALLOW.

If the data.ruleViolationInfo.triggeredActionTypes log field value is equal to CHROME_WARN_FILE_DOWNLOAD or CHROME_WARN_FILE_UPLOAD or CHROME_WARN_WEB_CONTENT_UPLOAD or CHROME_WARN_PAGE_PRINT or CHROME_WARN_URL_VISITED or CHAT_WARN_USER, then the security_result.action UDM field is set to ALLOW_WITH_MODIFICATION.

If the data.ruleViolationInfo.triggeredActionTypes log field value is equal to DRIVE_BLOCK_EXTERNAL_SHARING or DRIVE_RESTRICT_DOWNLOAD_PRINT_COPY or CHROME_BLOCK_FILE_DOWNLOAD or CHROME_BLOCK_FILE_UPLOAD or CHROME_BLOCK_WEB_CONTENT_UPLOAD or CHROME_BLOCK_PAGE_PRINT or CHROME_BLOCK_URL_VISITED or CHAT_BLOCK_CONTENT or GMAIL_BLOCK_MESSAGE, then the security_result.action UDM field is set to BLOCK.

If the data.ruleViolationInfo.triggeredActionTypes log field value is equal to ACTION_TYPE_UNSPECIFIED or DRIVE_APPLY_DRIVE_LABELS or CHROME_STORE_CONTENT or DELETE_WEBPROTECT_EVIDENCE, then the security_result.action UDM field is set to UNKNOWN_ACTION.
security_result.category If the source log field value is equal to Gmail Phishing, then the security_result.category UDM field is set to MAIL_PHISHING.

If the source log field value is equal to Google Identity, then the security_result.category UDM field is set to ACL_VIOLATION.

If the source log field value is equal to Security Center rules or Data Loss Prevention, then the security_result.category UDM field is set to POLICY_VIOLATION.
source security_result.category_details
data.actionNames security_result.detection_fields[action_names]
data.alertDetails security_result.detection_fields[alert_details]
data.createTime security_result.detection_fields[create_time]
data.messages.date security_result.detection_fields[date] If the source log field value is equal to Gmail phishing, then the data.messages.date log field is mapped to the security_result.detection_fields UDM field.
data.messages.sentTime security_result.detection_fields[sent_time]
data.events.deviceCompromisedState security_result.detection_fields[device_compromised_state]
data.displayName security_result.detection_fields[display_name]
data.eventTime security_result.detection_fields[event_time]
data.isInternal security_result.detection_fields[is_internal]
data.loginDetails.loginTime security_result.detection_fields[login_time]
data.messages.md5HashMessageBody security_result.detection_fields[md5_hash_message_body] If the source log field value is equal to Gmail phishing, then the data.messages.md5HashMessageBody log field is mapped to the security_result.detection_fields UDM field.
data.messages.md5hashsubject security_result.detection_fields[md5_hash_subject] If the source log field value is equal to Gmail phishing, then the data.messages.md5hashsubject log field is mapped to the security_result.detection_fields UDM field.
data.messages.messageBodySnippet security_result.detection_fields[message_body_snippet]
metadata.status security_result.detection_fields[metadata_status]
data.query security_result.detection_fields[query]
securityInvestigationToolLink security_result.detection_fields[security_investigation_tool_link]
startTime security_result.detection_fields[start_time]
data.supersededAlerts security_result.detection_fields[superseded_alerts]
data.supersedingAlert security_result.detection_fields[superseding_alert]
data.systemActionType security_result.detection_fields[system_action_type]
data.threshold security_result.detection_fields[threshold]
data.triggerSource security_result.detection_fields[trigger_source]
data.ruleViolationInfo.trigger security_result.detection_fields[trigger]
data.updateTime security_result.detection_fields[update_time]
data.windowSize security_result.detection_fields[windows_size]
data.ruleViolationInfo.ruleInfo.resourceName security_result.rule_id
data.ruleViolationInfo.matchInfo.userDefinedDetector.displayName security_result.rule_labels[detector_display_name]
data.ruleViolationInfo.matchInfo.predefinedDetector.detectorName security_result.rule_labels[detector_name]
data.ruleViolationInfo.matchInfo.userDefinedDetector.resourceName security_result.rule_labels[detector_resource_name]
data.name security_result.rule_name
data.ruleViolationInfo.ruleInfo.displayName security_result.rule_name
metadata.severity security_result.severity
type security_result.summary
data.type security_result.summary If the type log field value is empty, then the data.type log field is mapped to the security_result.summary UDM field.
security_result.alert_state The security_result.alert_state UDM field is set to ALERTING.
data.requestInfo.appKey target.application
data.events.deviceId target.asset.asset_id
data.events.deviceProperty target.asset.attribute.labels[device_property]
data.events.iosVendorId target.asset.attribute.labels[ios_vendor_id]
data.events.newValue target.asset.attribute.labels[new_value]
data.events.oldValue target.asset.attribute.labels[old_value]
data.events.resourceId target.asset.attribute.labels[resource_id]
data.events.deviceModel target.asset.hardware.model
data.events.serialNumber target.asset.hardware.serial_number
data.events.deviceType target.asset.type
data.primaryAdminChangedEvent.domain target.domain.name
data.ssoProfileUpdatedEvent.inboundSsoProfileChanges target.labels[inbound_sso_profile_changes] (deprecated)
data.ssoProfileUpdatedEvent.inboundSsoProfileChanges additional.fields[inbound_sso_profile_changes]
data.requestInfo.numberOfRequests target.labels[number_of_requests] (deprecated)
data.requestInfo.numberOfRequests additional.fields[number_of_requests]
data.primaryAdminChangedEvent.previousAdminEmail target.labels[previous_admin_email] (deprecated)
data.primaryAdminChangedEvent.previousAdminEmail additional.fields[previous_admin_email]
data.products target.labels[product] (deprecated)
data.products additional.fields[product]
data.ruleViolationInfo.resourceInfo.resourceTitle target.labels[resource_title] (deprecated)
data.ruleViolationInfo.resourceInfo.resourceTitle additional.fields[resource_title]
data.takeoutRequestId target.labels[takeout_request_id] (deprecated)
data.takeoutRequestId additional.fields[takeout_request_id]
data.ruleViolationInfo.dataSource target.resource.name
data.ssoProfileCreatedEvent.inboundSsoProfileName target.resource.name
data.ssoProfileUpdatedEvent.inboundSsoProfileName target.resource.name
data.ssoProfileDeletedEvent.inboundSsoProfileName target.resource.name
data.ruleViolationInfo.resourceInfo.documentId target.resource.product_object_id
target.resource.resource_type If the data.@type log field value is equal to DlpRuleViolation, then the target.resource.resource_type UDM field is set to STORAGE_OBJECT.

If the data.@type log field value is equal to AppMakerSqlSetupNotification, then the target.resource.resource_type UDM field is set to DATABASE.

If the data.type log field value is equal to SSO profile added or SSO profile updated or SSO profile deleted, then the target.resource.resource_type UDM field is set to SETTING.
data.maliciousEntity.entity.emailAddress target.user.email_addresses
data.email target.user.email_addresses If the data.@type log field value is equal to StateSponsoredAttack, DeviceCompromised, or AccountWarning, then the data.email log field is mapped to the target.user.email_addresses UDM field.

Else, the data.email log field is mapped to the principal.user.email_addresses UDM field.
data.primaryAdminChangedEvent.updatedAdminEmail target.user.email_addresses
data.superAdminPasswordResetEvent.userEmail target.user.email_addresses
data.maliciousEntity.entity.displayName target.user.user_display_name
data.ruleViolationInfo.triggeredActionInfo
data.expirationTime target.resource.attribute.labels[expiration_time] If the data.@type log field value is equal to ApnsCertificateExpirationInfo, then the data.expirationTime log field is mapped to the target.resource.attribute.labels[expiration_time] UDM field.
data.appleId about.user.userid If the data.@type log field value is equal to ApnsCertificateExpirationInfo, then the data.appleId log field is mapped to the about.user.userid UDM field.
data.uid target.resource.product_object_id If the data.@type log field value is equal to ApnsCertificateExpirationInfo, then the data.uid log field is mapped to the target.resource.product_object_id UDM field.

Field mapping reference: WORKSPACE_GROUPS

The following table lists the log fields of the WORKSPACE_GROUPS log type and their corresponding UDM fields.

Log field UDM mapping Logic
adminCreated entity.group.attribute.labels[admin_created] If the adminCreated log field value is equal to true, then the admin_created.value UDM field is set to true.

Else, the admin_created.value UDM field is set to false.
description metadata.description
directMembersCount entity.group.attribute.labels[direct_members_count]
email entity.group.email_addresses
nonEditableAliases entity.group.email_addresses
aliases entity.group.email_addresses
etag entity.labels[etag] (deprecated)
etag additional.fields[etag]
id entity.group.product_object_id
kind entity.labels[kind] (deprecated)
kind additional.fields[kind]
name entity.group.group_display_name
metadata.vendor_name The metadata.vendor_name UDM field is set to GOOGLE.
metadata.product_name The metadata.product_name UDM field is set to WORKSPACE GROUPS.
metadata.entity_type The metadata.entity_type UDM field is set to GROUP.

Field mapping reference: WORKSPACE_USERS

The following table lists the log fields of the WORKSPACE_USERS log type and their corresponding UDM fields.

Log field UDM mapping Logic
addresses.country entity.user.personal_address.country_or_region
addresses.countryCode entity.user.attribute.labels[addresses_country_code]
addresses.customType entity.user.attribute.labels[addresses_custom_type]
addresses.extendedAddress entity.user.attribute.labels[addresses_extended_address]
addresses.formatted entity.user.office_address.name The addresses.formatted log field is mapped to the user.office_address.name UDM field if the following conditions are met:
  • The message log field value matches the regular expression pattern addresses.*?formatted.
  • The addresses.type log field value is equal to work.
  • The addresses.formatted log field value is not empty.
addresses.locality entity.user.attribute.labels[addresses_locality]
addresses.poBox entity.user.attribute.labels[addresses_pobox]
addresses.postalCode entity.user.attribute.labels[addresses_postal_code]
addresses.primary entity.user.attribute.labels[addresses_primary]
addresses.region entity.user.attribute.labels[addresses_region]
addresses.sourceIsStructured entity.user.attribute.labels[addresses_source_is_structured]
addresses.streetAddress entity.user.attribute.labels[addresses_street_address]
addresses.type entity.user.attribute.labels[addresses_type]
agreedToTerms entity.user.attribute.labels[agreed_to_terms]
aliases entity.user.attribute.labels[aliases_email]
changePasswordAtNextLogin entity.user.attribute.labels[change_password_at_next_login] If the changePasswordAtNextLogin log field value is equal to true, then the change_password_at_next_login.value UDM field is set to true.

Else, the change_password_at_next_login.value UDM field is set to false.
creationTime entity.user.attribute.creation_time
customerId entity.user.attribute.labels[customer_id]
deletionTime entity.user.attribute.labels[deletion_time]
emails.customType entity.user.attribute.labels[email_acustom_type]
emails.primary entity.user.attribute.labels[email_primary]
emails.type entity.user.attribute.labels[email_type]
etag entity.labels[etag] (deprecated)
etag additional.fields[etag]
externalIds.customType entity.user.attribute.labels[external_id_custom_type]
externalIds.type entity.user.attribute.labels[external_id_type]
externalIds.value entity.user.employee_id If the externalIds.type log field value is equal to organization, then the externalIds.value log field is mapped to the user.employee_id UDM field.
gender.addressMeAs entity.user.attribute.labels[gender_address_me_as]
gender.customGender entity.user.attribute.labels[custom_gender]
gender.type entity.user.attribute.labels[gender]
hashFunction entity.user.attribute.labels[hash_function]
id entity.user.product_object_id
ims.customProtocol entity.user.attribute.labels[ims_custom_protocol]
ims.customType entity.user.attribute.labels[ims_custom_type]
ims.im entity.user.attribute.labels[ims_im]
ims.primary entity.user.attribute.labels[ims_primary]
ims.protocol entity.user.attribute.labels[ims_protocol]
ims.type entity.user.attribute.labels[ims_type]
includeInGlobalAddressList entity.user.attribute.labels[included_in_global_address_list] If the includeInGlobalAddressList log field value is equal to true, then the included_in_global_address_list.value UDM field is set to true, else, then the included_in_global_address_list.value UDM field is set to false.
ipWhitelisted entity.user.attribute.labels[ip_whitelisted]
isAdmin entity.user.attribute.labels[is_admin]
isDelegatedAdmin entity.user.attribute.labels[is_delegated_admin]
user.attribute.roles.type If the isAdmin log field value or the isDelegatedAdmin log field value is equal to true, then the user.attribute.roles.type UDM field is set to ADMINISTRATOR.
isEnforcedIn2Sv entity.user.attribute.labels[is_enforced_in_2sv] If the isEnforcedIn2Sv log field value is equal to true, then the is_enforced_in_2sv.value UDM field is set to true, else, then the is_enforced_in_2sv.value UDM field is set to false.
isEnrolledIn2Sv entity.user.attribute.labels[is_enrolled_in_2sv] If the isEnrolledIn2Sv log field value is equal to true, then the is_enrolled_in_2sv.value UDM field is set to true, else, then the is_enrolled_in_2sv.value UDM field is set to false.
isMailboxSetup entity.user.attribute.labels[is_mailbox_setup] If the isMailboxSetup log field value is equal to true, then the is_mail_box_setup.value UDM field is set to true, else, then the is_mail_box_setup.value UDM field is set to false.
keywords.customType entity.user.attribute.labels[keywords_custom_type]
keywords.type entity.user.attribute.labels[keywords_type]
keywords.value entity.user.attribute.labels[keywords_value]
kind entity.labels[kind] (deprecated)
kind additional.fields[kind]
languages.customLanguage entity.user.attribute.labels[language_custom_language]
languages.languageCode entity.user.attribute.labels[language_code]
languages.preference entity.user.attribute.labels[preferred_language]
lastLoginTime entity.user.last_login_time
locations.area entity.user.office_address.country_or_region
locations.buildingId entity.user.attribute.labels[locations_buildingId]
locations.customType entity.user.attribute.labels[locations_customType]
locations.deskCode entity.user.officel_address.desk_name
locations.floorName entity.user.office_address.floor_name
locations.floorSection entity.user.attribute.labels[locations_floorSection]
locations.type entity.user.attribute.labels[locations_type]
name.familyName entity.user.last_name
name.fullName entity.user.user_display_name
name.givenName entity.user.first_name
notes.contentType entity.user.attribute.labels[notes_content_type]
notes.value entity.user.attribute.labels[notes_value]
organizations.costCenter entity.user.attribute.labels[organization_cost_center]
organizations.customType entity.user.attribute.labels[organization_custom_type]
organizations.department entity.user.department The organizations.department log field is mapped to the user.department UDM field if the following conditions are met:
  • The message log field value matches the regular expression pattern organizations.*?department.
  • The org.department log field value is not empty.
organizations.description entity.user.attribute.labels [organizations_description]
organizations.domain entity.user.attribute.labels[organization_domain]
organizations.fullTimeEquivalent entity.user.attribute.labels[organization_full_time_equivalent]
organizations.location entity.user.attribute.labels[organization_location]
organizations.name entity.user.attribute.labels[organization_name]
organizations.primary entity.user.attribute.labels[organization_primary]
organizations.symbol entity.user.attribute.labels[organization_symbol]
organizations.title entity.user.title
organizations.type entity.user.attribute.labels[organization_type]
orgUnitPath entity.user.attribute.labels[org_unit_path]
password entity.user.attribute.labels[password]
phones.customType entity.user.attribute.labels[phone_custom_type]
phones.primary entity.user.attribute.labels[phone_primary]
phones.type entity.user.attribute.labels[phone_type]
phones.value entity.user.phone_numbers If the phones.value log field value matches the regular expression pattern (^the +.0-9 log field value*), then the phones.value log field is mapped to the user.phone_numbers UDM field.
recoveryPhone entity.user.phone_numbers
posixAccounts.accountId entity.user.attribute.labels[posix_account_id]
posixAccounts.gecos entity.user.attribute.labels[posix_account_gecos]
posixAccounts.gid entity.user.group_identifiers
posixAccounts.homeDirectory entity.user.attribute.labels[posix_account_home_directory]
posixAccounts.operatingSystemType entity.platform If the posixAccounts.operatingSystemType log field value is equal to linux, then the entity.platform UDM field is set to LINUX.

If the posixAccounts.operatingSystemType log field value is equal to windows, then the entity.platform UDM field is set to WINDOWS.

Else, the entity.platform UDM field is set to UNKNOWN_PLATFORM.
posixAccounts.primary entity.user.attribute.labels[posix_account_primary]
posixAccounts.shell entity.user.attribute.labels[posix_account_shell]
posixAccounts.systemId entity.asset.asset_id
posixAccounts.uid entity.user.attribute.labels[posix_account_uid]
posixAccounts.username entity.user.userid If the posixAccounts.username log field value is not empty, then the posixAccounts.username log field is mapped to the entity.user.userid UDM field.
primaryEmail entity.user.email_addresses
recoveryEmail entity.user.email_addresses
nonEditableAliases entity.user.email_addresses
emails.address entity.user.email_addresses If the emails.address log field value is not equal to primaryEmail, then the emails.address log field is mapped to the entity.user.email_addresses UDM field.
relations.customType entity.user.attribute.labels[relations_custom_type]
relations.type entity.user.attribute.labels[relation_type]
relations.value entity.user.managers.email_addresses If the relation.type log field value is equal to manager, then the relations.value log field is mapped to the user.managers.email_addresses UDM field.

Else, the relations.value log field is mapped to the user.attribute.labels UDM field.
relations.value entity.user.attribute.labels[relations_type] If the relation.type log field value is equal to manager, then the relations.value log field is mapped to the user.managers.email_addresses UDM field.

Else, the relations.value log field is mapped to the user.attribute.labels UDM field.
sshPublicKeys.expirationTimeUsec entity.user.attribute.labels[ssh_key_expiration_timec]
sshPublicKeys.fingerprint entity.user.attribute.labels[ssh_key_fingerprint]
sshPublicKeys.key entity.user.attribute.labels[ssh_key]
suspended entity.user.user_authentication_status If the suspended log field value is equal to true and the archived log field value is not equal to true, then the entity.user.user_authentication_status UDM field is set to SUSPENDED.

If the archived log field value is equal to true, then the entity.user.user_authentication_status UDM field is set to DELETED.

Else, the entity.user.user_authentication_status UDM field is set to ACTIVE.
archived entity.user.user_authentication_status If the suspended log field value is equal to true and the archived log field value is not equal to true, then the entity.user.user_authentication_status UDM field is set to SUSPENDED.

If the archived log field value is equal to true, then the entity.user.user_authentication_status UDM field is set to DELETED.

Else, the entity.user.user_authentication_status UDM field is set to ACTIVE.
suspensionReason entity.user.attribute.labels[suspension_reason]
thumbnailPhotoEtag entity.user.attribute.labels[thumbnail_photo_etag]
thumbnailPhotoUrl entity.url
websites.customType entity.user.attribute.labels[websites_custom_type]
websites.primary entity.user.attribute.labels[websites_primary]
websites.type entity.user.attribute.labels[websites_type]
websites.value entity.user.attribute.labels[websites_value]
metadata.vendor_name The metadata.vendor_name UDM field is set to GOOGLE.
metadata.product_name The metadata.product_name UDM field is set to Cloud Identity.
metadata.entity_type The metadata.entity_type UDM field is set to USER.
customSchemas additional.fields[custom_schemas] Iterate for each key-value pair of customSchemas, then
key log field is mapped to the additional.fields.key UDM field.
Iterate for each key-value pair of log field value, then
%{key}_%{key1} log field is mapped to the additional.fields.key UDM field.
Iterate for each key-value pair of log field value1, then
%{key}_%{key1}_%{key2} log field is mapped to the additional.fields.key UDM field.
Iterate for each key-value pair of log field value2, then
%{key}_%{key1}_%{key2}_%{key3} log field is mapped to the additional.fields.key UDM field.

Field mapping reference: WORKSPACE_MOBILE_DEVICES

The following table lists the log fields of the WORKSPACE_MOBILE_DEVICES log type and their corresponding UDM fields.

Log field UDM mapping Logic
adbStatus entity.asset.attribute.labels[abd status]
applications.displayName entity.asset.software.name
applications.packageName entity.asset.attribute.labels[application_package_name]
applications.permission entity.asset.software.permissions.name
applications.versionCode entity.asset.attribute.labels[application_version_code]
applications.versionName entity.asset.software.version
basebandVersion entity.asset.attribute.labels[baseband_version]
bootloaderVersion entity.asset.attribute.labels[bootloader_version]
brand entity.asset.attribute.labels[brand]
buildNumber entity.asset.attribute.labels[build_number]
defaultLanguage entity.asset.attribute.labels[default_language]
developerOptionsStatus entity.asset.attribute.labels[developer_options_status]
deviceCompromisedStatus entity.asset.attribute.labels[device_compromised_status]
deviceId entity.asset.asset_id
devicePasswordStatus entity.asset.attribute.labels[device_password_status]
email entity.user.email_addresses
encryptionStatus entity.asset.attribute.labels[encryption_status]
etag entity.labels[etag] (deprecated)
etag additional.fields[etag]
firstSync entity.asset.attribute.labels[first_sync]
hardware entity.asset.attribute.labels[hardware]
hardwareId entity.asset.attribute.labels[hardware_id]
imei entity.asset.asset_id
deviceId entity.asset.asset_id If the imei log field value is empty, then the deviceId log field is mapped to the entity.asset.asset_id UDM field.
kernelVersion entity.asset.attribute.labels[kernel_version]
kind entity.labels[kind] (deprecated)
kind additional.fields[kind]
lastSync entity.asset.attribute.labels[last_sync]
managedAccountIsOnOwnerProfile entity.asset.attribute.labels[managed_account_is_on_owner_profile]
manufacturer entity.asset.hardware.manufacturer
meid entity.asset.attribute.labels[meid]
model entity.asset.hardware.model
name entity.user.user_display_name
networkOperator entity.asset.attribute.labels[network_operator]
os entity.asset.platform_software.platform If the os log field value matches iOS, then the entity.asset.platform_software.platform UDM field is set to IOS.

If the os log field value matches Android, then the entity.asset.platform_software.platform UDM field is set to ANDROID.

Else, the entity.asset.platform_software.platform UDM field is set to UNKNOWN_PLATFORM.
otherAccountsInfo[] entity.asset.attribute.labels[other_accounts_info]
privilege entity.asset.attribute.labels[privilege]
releaseVersion entity.asset.attribute.labels[release_version]
resourceId entity.asset.product_object_id
securityPatchLevel entity.asset.platform_software.platform_patch_level
serialNumber entity.asset.hardware.serial_number
status entity.user.user_authentication_status If the status log field value is equal to approved, then the entity.user.user_authentication_status UDM field is set to ACTIVE.

If the status log field value is equal to unprovisined, then the entity.user.user_authentication_status UDM field is set to SUSPENDED.
supportsWorkProfile entity.asset.attribute.labels[supports_work_profile]
type entity.asset.attribute.labels[type]
unknownSourcesStatus entity.asset.attribute.labels[unknown_sources_status]
userAgent entity.asset.attribute.labels[user_agent]
wifiMacAddress entity.asset.mac
metadata.entity_type The metadata.entity_type UDM field is set to ASSET.
metadata.product_name The metadata.product_name UDM field is set to WORKSPACE_MOBILE.
metadata.vendor_name The metadata.vendor_name UDM field is set to GOOGLE.
relations.entity_type The relations.entity_type UDM field is set to USER.
relations.relationship The relations.relationship UDM field is set to MEMBER.

Field mapping reference: WORKSPACE_CHROMEOS

The following table lists the log fields of the WORKSPACE_CHROMEOS log type and their corresponding UDM fields.

Log field UDM mapping Logic
activeTimeRanges.activeTime entity.asset.attribute.labels[active_time]
activeTimeRanges.date entity.asset.attribute.labels[active_time_range_date]
annotatedAssetId entity.asset.asset_id If the annotatedAssetId log field value is not empty, then the ASSET ID: annotatedAssetId log field is mapped to the entity.asset.asset_id UDM field.
deviceId entity.asset.asset_id If the annotatedAssetId log field value is empty, then the CHROMEOS:deviceId log field is mapped to the entity.asset.asset_id UDM field.
annotatedLocation entity.asset.location.name
annotatedUser relations.entity.user.user_display_name If the annotatedUser log field value is not empty and the annotatedUser log field value does not match the regular expression @, then the annotatedUser log field is mapped to the relations.entity.user.user_display_name UDM field.
autoUpdateExpiration entity.asset.attribute.labels[auto_update_expiration]
bootMode entity.asset.attribute.labels[boot_mode]
cpuInfo.architecture entity.asset.attribute.labels[cpu_architecture]
cpuInfo.logicalCpus.cStates.displayName entity.asset.attribute.labels[cpu_logical_cups_cstates_display_name]
cpuInfo.logicalCpus.cStates.sessionDuration entity.asset.attribute.labels[cpu_logical_cups_cstates_session_duration]
cpuInfo.logicalCpus.currentScalingFrequencyKhz entity.asset.attribute.labels[cpu_current_scaling_frequency]
cpuInfo.logicalCpus.idleDuration entity.asset.attribute.labels[cpu_ideal_duration]
cpuInfo.logicalCpus.maxScalingFrequencyKhz entity.asset.attribute.labels[cpu_max_scaling_frequency]
cpuInfo.maxClockSpeedKhz entity.asset.attribute.labels[cpu_max_clock_speed]
cpuInfo.model entity.asset.hardware.cpu_model
cpuStatusReports.cpuTemperatureInfo.label entity.asset.attribute.labels[cpu_temperature_label]
cpuStatusReports.cpuTemperatureInfo.temperature entity.asset.attribute.labels[cpu_temperature]
cpuStatusReports.cpuUtilizationPercentageInfo entity.asset.attribute.labels[cpu_utilization_percentage_info]
cpuStatusReports.reportTime entity.asset.attribute.labels[cpu_report_time]
deviceFiles.createTime relations.entity.file.first_seen_time
deviceFiles.downloadUrl relations.entity.file.full_path
deviceFiles.name relations.entity.file.names
deviceFiles.type relations.entity.file.mime_type
relations.entity_type The relations.entity_type UDM field is set to FILE.
relations.relationship The relations.relationship UDM field is set to MEMBER.
deviceId entity.asset.product_object_id
diskVolumeReports.volumeInfo.storageFree entity.asset.attribute.labels[volume_info_storage_free]
diskVolumeReports.volumeInfo.storageTotal entity.asset.attribute.labels[volume_info_storage_total]
diskVolumeReports.volumeInfo.volumeId entity.asset.attribute.labels[volume_id]
dockMacAddress entity.asset.attribute.labels[dock_mac_address]
etag entity.labels[etag] (deprecated)
etag additional.fields[etag]
ethernetMacAddress0 entity.asset.attribute.labels[ethernet_mac_address]
firmwareVersion entity.asset.attribute.labels[firmware_version]
kind entity.labels[kind] (deprecated)
kind additional.fields[kind]
lastEnrollmentTime entity.asset.last_discover_time
lastKnownNetwork.ipAddress entity.asset.ip
lastKnownNetwork.wanIpAddress entity.asset.nat_ip
lastSync entity.asset.system_last_update_time
macAddress entity.asset.mac
ethernetMacAddress entity.asset.mac
manufactureDate entity.asset.attribute.labels[manufacture_date]
meid entity.asset.attribute.labels[meid]
model entity.asset.hardware.model
notes entity.asset.attribute.labels[notes]
orderNumber entity.asset.attribute.labels[order_number]
orgUnitId entity.asset.attribute.labels[org_unit_id]
orgUnitPath entity.user.attribute.labels[org_unit_path]
osVersion entity.asset.attribute.labels[os_version]
platformVersion entity.asset.platform_software.platform_version
annotatedUser entity.user.email_addresses If the annotatedUser log field value is not empty and the annotatedUser log field value matches the regular expression @, then the annotatedUser log field is mapped to the entity.user.email_addresses UDM field.
recentUsers.email entity.user.email_addresses
recentUsers.type relations.entity.user.attribute.roles.name
relations.entity.user.attribute.roles.description If the recentUsers.type log field value is equal to USER_TYPE_MANAGED, then the relations.entity.user.attribute.roles.description UDM field is set to The user is managed by the domain.

Else, if the recentUsers.type log field value is equal to USER_TYPE_UNMANAGED, then the relations.entity.user.attribute.roles.description UDM field is set to The user is not managed by the domain.
screenshotFiles.createTime relations.entity.file.first_seen_time
screenshotFiles.downloadUrl relations.entity.file.full_path
screenshotFiles.name relations.entity.file.names
screenshotFiles.type relations.entity.file.mime_type
serialNumber entity.asset.hardware.serial_number
status entity.asset.deployment_status If the status log field value is equal to DEPROVISIONED, then the entity.asset.deployment_status UDM field is set to DECOMMISSIONED.

Else, the entity.asset.deployment_status UDM field is set to ACTIVE.
supportEndDate entity.asset.attribute.labels[support_end_date]
systemRamFreeReports.reportTime entity.asset.attribute.labels[system_ram_report_time]
systemRamFreeReports.systemRamFreeInfo entity.asset.attribute.labels[system_ram_free_info]
systemRamTotal entity.asset.hardware.ram
tpmVersionInfo.family entity.asset.attribute.labels[tpm_ver_info_family]
tpmVersionInfo.firmwareVersion entity.asset.attribute.labels[tpm_ver_info_firmware_version]
tpmVersionInfo.manufacturer entity.asset.attribute.labels[tpm_ver_info_manufacturer]
tpmVersionInfo.specLevel entity.asset.attribute.labels[tpm_ver_info_spec_level]
tpmVersionInfo.tpmModel entity.asset.attribute.labels[tpm_ver_info_tpm_model]
tpmVersionInfo.vendorSpecific entity.asset.attribute.labels[tpm_ver_info_vendor_specific]
willAutoRenew entity.asset.attribute.labels[will_auto_renew]
entity.asset.type The entity.asset.type UDM field is set to WORKSTATION.
metadata.entity_type The metadata.entity_type UDM field is set to ASSET.
metadata.product_name The metadata.product_name UDM field is set to ChromeOS.
metadata.vendor_name The metadata.vendor_name UDM field is set to GOOGLE.
relations.entity_type The relations.entity_type UDM field is set to USER.
relations.relationship The relations.relationship UDM field is set to MEMBER.

Field mapping reference: WORKSPACE_PRIVILEGES

The following table lists the log fields of the WORKSPACE_PRIVILEGES log type and their corresponding UDM fields.

Log field UDM mapping
roleAssignments.assignedTo metadata.product_entity_id
roleAssignments.roleAssignmentId entity.user.attribute.labels[role_assignment_id]
roleAssignments.roleDetails.roleDescription entity.user.attribute.roles.description
roleAssignments.roleDetails.roleId entity.user.attribute.labels[role_details_role_id]
roleAssignments.roleDetails.roleName entity.user.attribute.roles.name
roleAssignments.roleDetails.rolePrivileges.details.childPrivileges.etag
roleAssignments.roleDetails.rolePrivileges.details.childPrivileges.isOuScopable
roleAssignments.roleDetails.rolePrivileges.details.childPrivileges.kind
roleAssignments.roleDetails.rolePrivileges.details.childPrivileges.privilegeName entity.user.attribute.labels[%{rolePrivilege.privilegeName}_CHILD_PRIVILEGES]
roleAssignments.roleDetails.rolePrivileges.details.childPrivileges.serviceId
roleAssignments.roleDetails.rolePrivileges.details.childPrivileges.serviceName
roleAssignments.roleDetails.rolePrivileges.details.etag entity.labels[etag] (deprecated)
roleAssignments.roleDetails.rolePrivileges.details.etag additional.fields[etag]
roleAssignments.roleDetails.rolePrivileges.details.isOuScopable entity.user.attribute.labels[is_ou_scopable]
roleAssignments.roleDetails.rolePrivileges.details.kind entity.labels[kind] (deprecated)
roleAssignments.roleDetails.rolePrivileges.details.kind additional.fields[kind]
roleAssignments.roleDetails.rolePrivileges.details.privilegeName
roleAssignments.roleDetails.rolePrivileges.details.serviceId
roleAssignments.roleDetails.rolePrivileges.details.serviceName entity.user.attribute.labels[service_name]
roleAssignments.roleDetails.rolePrivileges.privilegeName entity.user.attribute.permissions.name
roleAssignments.roleDetails.rolePrivileges.serviceId entity.user.attribute.permissions.description
roleAssignments.roleId entity.user.attribute.labels[role_id]
roleAssignments.scopeType entity.user.attribute.labels[scope_type]
userId entity.user.userid
metadata.vendor_name
metadata.product_name
metadata.entity_type

Change Log

View the Change Log for this parser

UDM Mapping Delta

UDM Event Type Mapping Delta

The following table lists the delta between the old UDM Mapping of Workspace Activity and the new UDM Mapping of Workspace Activity.

UDM Event Type Delta

Application Name RawField Event Name Old UDM Event Type New UDM Event Type
Chrome DLP_EVENT USER_UNCATEGORIZED SCAN_UNCATEGORIZED
Chrome CONTENT_TRANSFER STATUS_UNCATEGORIZED GENERIC_EVENT
Chrome PASSWORD_BREACH USER_RESOURCE_ACCESS SCAN_UNCATEGORIZED
Chrome UNSAFE_SITE_VISIT NETWORK_UNCATEGORIZED NETWORK_CONNECTION
Chrome BROWSER_EXTENSION_INSTALL USER_RESOURCE_UPDATE_CONTENT USER_UNCATEGORIZED
gplus create_comment USER_RESOURCE_CREATION GENERIC_EVENT
gplus delete_comment USER_RESOURCE_DELETION GENERIC_EVENT
gplus edit_comment USER_RESOURCE_UPDATE_CONTENT GENERIC_EVENT
data_studio DOWNLOAD_REPORT USER_UNCATEGORIZED USER_RESOURCE_ACCESS
mobile DEVICE_REGISTER_UNREGISTER_EVENT USER_RESOURCE_UPDATE_PERMISSIONS USER_RESOURCE_DELETION or USER_RESOURCE_CREATION based on value of ACCOUNT_STATE
mobile ADVANCED_POLICY_SYNC_EVENT STATUS_UPDATE DEVICE_CONFIG_UPDATE
mobile DEVICE_ACTION_EVENT USER_RESOURCE_UPDATE_CONTENT DEVICE_CONFIG_UPDATE
mobile OS_UPDATED_EVENT USER_RESOURCE_UPDATE_CONTENT DEVICE_CONFIG_UPDATE
mobile DEVICE_SETTINGS_UPDATED_EVENT SETTING_MODIFICATION DEVICE_CONFIG_UPDATE
mobile DEVICE_SYNC_EVENT USER_RESOURCE_UPDATE_CONTENT STATUS_UPDATE
mobile DEVICE_COMPROMISED_EVENT STATUS_UPDATE SCAN_HOST
mobile FAILED_PASSWORD_ATTEMPTS_EVENT STATUS_UPDATE USER_LOGIN
groups_enterprise accept_invitation USER_UNCATEGORIZED GROUP_MODIFICATION
groups_enterprise add_info_setting GROUP_MODIFICATION SETTING_CREATION
groups_enterprise add_security_setting GROUP_MODIFICATION SETTING_CREATION
groups_enterprise approve_join_request USER_UNCATEGORIZED GROUP_MODIFICATION
groups_enterprise change_info_setting GROUP_MODIFICATION SETTING_MODIFICATION
groups_enterprise change_security_setting GROUP_MODIFICATION SETTING_MODIFICATION
groups_enterprise add_dynamic_group_query GROUP_UNCATEGORIZED GROUP_MODIFICATION
groups_enterprise invite_member GROUP_UNCATEGORIZED USER_UNCATEGORIZED
groups_enterprise remove_info_setting GROUP_MODIFICATION SETTING_DELETION
groups_enterprise remove_security_setting GROUP_MODIFICATION SETTING_DELETION
groups_enterprise remove_service_account_permission GROUP_MODIFICATION USER_CHANGE_PERMISSIONS
calendar notification_triggered USER_UNCATEGORIZED GENERIC_EVENT
calendar transfer_event_requested USER_UNCATEGORIZED USER_RESOURCE_UPDATE_PERMISSIONS
google_chat/chat invite_accept USER_UNCATEGORIZED GROUP_MODIFICATION
google_chat/chat call_ended USER_UNCATEGORIZED USER_COMMUNICATION
drive approval_canceled USER_UNCATEGORIZED USER_RESOURCE_UPDATE_PERMISSIONS
drive approval_completed USER_UNCATEGORIZED USER_RESOURCE_UPDATE_PERMISSIONS
drive approval_decisions_reset USER_UNCATEGORIZED USER_RESOURCE_UPDATE_PERMISSIONS
drive approval_due_time_change USER_UNCATEGORIZED USER_RESOURCE_UPDATE_PERMISSIONS
drive approval_reviewer_responded USER_UNCATEGORIZED USER_RESOURCE_UPDATE_PERMISSIONS
drive label_added USER_UNCATEGORIZED GENERIC_EVENT
drive label_added_by_item_create USER_UNCATEGORIZED GENERIC_EVENT
drive label_field_changed USER_UNCATEGORIZED GENERIC_EVENT
drive label_removed USER_UNCATEGORIZED GENERIC_EVENT
drive add_lock USER_UNCATEGORIZED SETTING_MODIFICATION
drive source_copy USER_RESOURCE_UPDATE_CONTENT USER_UNCATEGORIZED
drive remove_lock USER_UNCATEGORIZED SETTING_MODIFICATION
drive create_comment USER_RESOURCE_CREATION GENERIC_EVENT
drive create_suggestion USER_RESOURCE_CREATION GENERIC_EVENT
drive delete_comment USER_RESOURCE_DELETION GENERIC_EVENT
drive delete_suggestion USER_RESOURCE_DELETION GENERIC_EVENT
drive edit_comment USER_RESOURCE_UPDATE_CONTENT GENERIC_EVENT
drive reassign_comment USER_RESOURCE_UPDATE_CONTENT GENERIC_EVENT
drive reject_suggestion USER_RESOURCE_UPDATE_CONTENT GENERIC_EVENT
drive reopen_comment USER_RESOURCE_UPDATE_CONTENT GENERIC_EVENT
drive request_access USER_RESOURCE_UPDATE_PERMISSIONS USER_UNCATEGORIZED
drive resolve_comment USER_RESOURCE_UPDATE_CONTENT GENERIC_EVENT
drive access_url USER_RESOURCE_ACCESS GENERIC_EVENT
drive sheets_import_url USER_UNCATEGORIZED GENERIC_EVENT
drive apply_security_update USER_RESOURCE_UPDATE_PERMISSIONS STATUS_UPDATE
drive shared_drive_apply_security_update USER_RESOURCE_UPDATE_PERMISSIONS STATUS_UPDATE
drive shared_drive_remove_security_update USER_RESOURCE_UPDATE_PERMISSIONS STATUS_UPDATE
drive remove_security_update USER_RESOURCE_UPDATE_PERMISSIONS STATUS_UPDATE
drive storage_usage_update USER_RESOURCE_ACCESS GENERIC_EVENT
groups accept_invitation USER_UNCATEGORIZED GROUP_MODIFICATION
groups approve_join_request USER_UNCATEGORIZED GROUP_MODIFICATION
groups change_basic_setting GROUP_MODIFICATION SETTING_MODIFICATION
groups change_identity_setting GROUP_MODIFICATION SETTING_MODIFICATION
groups add_info_setting GROUP_MODIFICATION SETTING_CREATION
groups change_info_setting GROUP_MODIFICATION SETTING_MODIFICATION
groups remove_info_setting GROUP_MODIFICATION SETTING_DELETION
groups change_new_members_restrictions_setting GROUP_UNCATEGORIZED SETTING_MODIFICATION
groups change_post_replies_setting GROUP_MODIFICATION SETTING_MODIFICATION
groups change_spam_moderation_setting GROUP_MODIFICATION SETTING_MODIFICATION
groups change_topic_setting GROUP_MODIFICATION SETTING_MODIFICATION
groups moderate_message GROUP_MODIFICATION USER_UNCATEGORIZED
keep deleted_attachment USER_UNCATEGORIZED USER_RESOURCE_UPDATE_CONTENT
keep uploaded_attachment USER_UNCATEGORIZED USER_RESOURCE_UPDATE_CONTENT
google_meet call_ended USER_UNCATEGORIZED USER_COMMUNICATION
rules action_complete USER_RESOURCE_ACCESS GENERIC_EVENT
rules rule_match USER_RESOURCE_ACCESS SCAN_UNCATEGORIZED
rules rule_trigger USER_RESOURCE_ACCESS SCAN_UNCATEGORIZED
rules label_field_value_changed USER_RESOURCE_UPDATE_CONTENT GENERIC_EVENT
rules label_applied USER_RESOURCE_UPDATE_CONTENT GENERIC_EVENT
user_accounts password_edit USER_UNCATEGORIZED USER_CHANGE_PASSWORD
login 2sv_disable SERVICE_STOP USER_UNCATEGORIZED
login 2sv_enroll SERVICE_START USER_UNCATEGORIZED
login gov_attack_warning STATUS_UNCATEGORIZED USER_UNCATEGORIZED
login blocked_sender STATUS_UNCATEGORIZED USER_UNCATEGORIZED
admin DELETE_2SV_SCRATCH_CODES USER_RESOURCE_DELETION USER_UNCATEGORIZED
admin GENERATE_2SV_SCRATCH_CODES USER_RESOURCE_CREATION USER_UNCATEGORIZED
admin REVOKE_3LO_DEVICE_TOKENS USER_RESOURCE_ACCESS USER_CHANGE_PERMISSIONS
admin REVOKE_3LO_TOKEN USER_RESOURCE_ACCESS USER_CHANGE_PERMISSIONS
admin ADD_RECOVERY_EMAIL USER_RESOURCE_CREATION USER_UNCATEGORIZED
admin ADD_RECOVERY_PHONE USER_RESOURCE_CREATION USER_UNCATEGORIZED
admin TOGGLE_AUTOMATIC_CONTACT_SHARING SETTING_MODIFICATION USER_CHANGE_PERMISSIONS
admin BULK_UPLOAD_NOTIFICATION_SENT USER_UNCATEGORIZED EMAIL_TRANSACTION
admin CREATE_EMAIL_MONITOR SERVICE_CREATION USER_UNCATEGORIZED
admin DELETE_ACCOUNT_INFO_DUMP USER_RESOURCE_DELETION USER_DELETION
admin DELETE_EMAIL_MONITOR SERVICE_DELETION USER_UNCATEGORIZED
admin MAIL_ROUTING_DESTINATION_ADDED USER_RESOURCE_CREATION USER_UNCATEGORIZED
admin MAIL_ROUTING_DESTINATION_REMOVED USER_RESOURCE_DELETION USER_UNCATEGORIZED
admin REMOVE_RECOVERY_EMAIL USER_RESOURCE_DELETION USER_UNCATEGORIZED
admin REMOVE_RECOVERY_PHONE USER_RESOURCE_DELETION USER_UNCATEGORIZED
admin RESEND_USER_INVITE USER_UNCATEGORIZED EMAIL_TRANSACTION
admin USER_INVITE USER_UNCATEGORIZED EMAIL_TRANSACTION
admin TURN_OFF_2_STEP_VERIFICATION USER_RESOURCE_UPDATE_PERMISSIONS USER_UNCATEGORIZED
admin UPDATE_PROFILE_PHOTO USER_RESOURCE_UPDATE_CONTENT USER_UNCATEGORIZED
admin DOWNLOAD_USERLIST_CSV STATUS_UNCATEGORIZED USER_UNCATEGORIZED
admin RENAME_USER USER_RESOURCE_UPDATE_CONTENT USER_UNCATEGORIZED
admin USERS_BULK_UPLOAD_NOTIFICATION_SENT USER_UNCATEGORIZED EMAIL_TRANSACTION
admin ASSIGN_ROLE USER_RESOURCE_UPDATE_PERMISSIONS USER_CHANGE_PERMISSIONS
admin UNASSIGN_ROLE USER_RESOURCE_UPDATE_PERMISSIONS USER_CHANGE_PERMISSIONS
admin AUTHORIZE_API_CLIENT_ACCESS USER_RESOURCE_ACCESS SETTING_CREATION
admin ADD_TRUSTED_DOMAINS USER_RESOURCE_UPDATE_CONTENT SETTING_CREATION
admin CHANGE_DOMAIN_DEFAULT_TIMEZONE USER_RESOURCE_UPDATE_CONTENT SETTING_MODIFICATION
admin CHANGE_DOMAIN_DEFAULT_LOCALE USER_RESOURCE_UPDATE_CONTENT SETTING_MODIFICATION
admin CREATE_ALERT USER_RESOURCE_CREATION SETTING_CREATION
admin REMOVE_API_CLIENT_ACCESS USER_RESOURCE_DELETION SETTING_DELETION
admin CREATE_GMAIL_SETTING SETTING_MODIFICATION SETTING_CREATION
admin DELETE_GMAIL_SETTING SETTING_MODIFICATION SETTING_DELETION
admin USER_LICENSE_ASSIGNMENT USER_RESOURCE_UPDATE_PERMISSIONS USER_CHANGE_PERMISSIONS
admin USER_LICENSE_REVOKE USER_RESOURCE_UPDATE_PERMISSIONS USER_CHANGE_PERMISSIONS
admin ADD_MOBILE_APPLICATION_TO_WHITELIST USER_RESOURCE_UPDATE_CONTENT RESOURCE_PERMISSIONS_CHANGE
admin REMOVE_MOBILE_APPLICATION_FROM_WHITELIST USER_RESOURCE_UPDATE_CONTENT RESOURCE_PERMISSIONS_CHANGE
admin CUSTOMER_USER_DEVICE_DELETION_EVENT USER_RESOURCE_DELETION SETTING_MODIFICATION

Common Fields Mapping Delta

The following table lists the delta between the old and new UDM field mappings for common Google Workspace log fields.

RawLog Field Name Old UDM Field Name New UDM Field Name
actor.callerType principal.user.attribute.labels[actor_caller_type]
target.user.attribute.labels[actor_caller_type]

If the events.name log field value is not one of the following:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_challenge
  • login_verification
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
Then, the principal.user.attribute.labels.key is set to actor_caller_type and actor.callerType log field is mapped to the principal.user.attribute.labels.value UDM field.

Else, the target.user.attribute.labels.key is set to actor_caller_type and actor.callerType log field is mapped to the target.user.attribute.labels.value UDM field. 		principal.user.attribute.labels[actor_caller_type]
target.user.attribute.labels[actor_caller_type]

If the events.name log field value is not one of the following:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_challenge
  • login_verification
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
  • CHROMEOS_AFFILIATED_UNLOCK_FAILURE
  • CHROMEOS_AFFILIATED_UNLOCK_SUCCESS
  • CHROME_OS_CRD_CLIENT_CONNECTED
  • CHROMEOS_AFFILIATED_LOCK_SUCCESS
  • FAILED_PASSWORD_ATTEMPTS_EVENT
Then, the principal.user.attribute.labels.key is set to actor_caller_type and actor.callerType log field is mapped to the principal.user.attribute.labels.value UDM field.

Else, the target.user.attribute.labels.key is set to actor_caller_type and actor.callerType log field is mapped to the target.user.attribute.labels.value UDM field.
actor.email target.user.email_addresses
principal.user.email_addresses
network.email.to
security_result.about.email

If id.applicationName is equal to gmail, then actor.email is mapped to principal.user.email_addresses.
Else if events.name is one of the following:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_challenge
  • login_verification
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
Then, actor.email is mapped to target.user.email_addresses.
Else, if id.applicationName is equal to gmail, then actor.email is mapped to principal.user.email_addresses.
If id.applicationName is not equal to gmail and actor.email matches the regular expression pattern ^.+@.+$, then actor.email is mapped to network.email.to.
If id.applicationName is not equal to gmail, then actor.email is mapped to security_result.about.email. 		target.user.email_addresses
principal.user.email_addresses
security_result.about.email
network.email.to

If id.applicationName is equal to gmail then, if the actor.email is equal to message_info.destination.address or message_info.flattened_destinations then, actor.email log field is mapped to the target.user.email_addresses UDM field.
Else, actor.email log field is mapped to the principal.user.email_addresses UDM field.
If the events.name log field value is one of the following:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_challenge
  • login_verification
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
  • CHROMEOS_AFFILIATED_UNLOCK_FAILURE
  • CHROMEOS_AFFILIATED_UNLOCK_SUCCESS
  • CHROME_OS_CRD_CLIENT_CONNECTED
  • CHROMEOS_AFFILIATED_LOCK_SUCCESS
  • FAILED_PASSWORD_ATTEMPTS_EVENT
  • delivery
Then, the actor.email log field is mapped to the target.user.email_addresses UDM field.
Else, the actor.email log field is mapped to the principal.user.email_addresses UDM field.
If the actor.email log field value matches the regular expression pattern ^.+@.+$, then the actor.email log field is mapped to the network.email.to UDM field.
The actor.email log field is mapped to the security_result.about.email UDM field.
actor.key target.user.attribute.labels[actor_key]
principal.user.attribute.labels[actor_key]
target.user.userid
principal.user.userid

If actor.profileId is not empty and if events.name is one of the following:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_challenge
  • login_verification
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
Then, the target.user.attribute.labels.key is set to actor_key and actor.key log field is mapped to the target.user.attribute.labels.value UDM field.
Else, the principal.user.attribute.labels.key is set to actor_key and actor.key log field is mapped to the principal.user.attribute.labels.value UDM field.
If actor.callerType is equal to KEY and if events.name is in the same list above, actor.key is mapped to target.user.userid.
Else, actor.key is mapped to principal.user.userid. 		target.user.attribute.labels[actor_key]
principal.user.attribute.labels[actor_key]
target.user.userid
principal.user.userid

If actor.profileId is not empty and if events.name is one of the following:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_challenge
  • login_verification
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
  • CHROMEOS_AFFILIATED_UNLOCK_FAILURE
  • CHROMEOS_AFFILIATED_UNLOCK_SUCCESS
  • CHROME_OS_CRD_CLIENT_CONNECTED
  • CHROMEOS_AFFILIATED_LOCK_SUCCESS
  • FAILED_PASSWORD_ATTEMPTS_EVENT
Then, the target.user.attribute.labels.key is set to actor_key and actor.key log field is mapped to the target.user.attribute.labels.value UDM field.
Else, the principal.user.attribute.labels.key is set to actor_key and actor.key log field is mapped to the principal.user.attribute.labels.value UDM field.
If actor.callerType is equal to KEY and if events.name is in the same list above, actor.key is mapped to target.user.userid.
Else, actor.key is mapped to principal.user.userid.
actor.profileId target.user.product_object_id
principal.user.product_object_id

If events.name is one of the following:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_challenge
  • login_verification
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
Then, the actor.profileId log field is mapped to the target.user.product_object_id UDM field.
Else, the actor.profileId log field is mapped to the principal.user.product_object_id UDM field. 		target.user.product_object_id
principal.user.product_object_id

If events.name is one of the following:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_challenge
  • login_verification
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
  • CHROMEOS_AFFILIATED_UNLOCK_FAILURE
  • CHROMEOS_AFFILIATED_UNLOCK_SUCCESS
  • CHROME_OS_CRD_CLIENT_CONNECTED
  • CHROMEOS_AFFILIATED_LOCK_SUCCESS
  • FAILED_PASSWORD_ATTEMPTS_EVENT
Then, the actor.profileId log field is mapped to the target.user.product_object_id UDM field.
Else, the actor.profileId log field is mapped to the principal.user.product_object_id UDM field.
The UDM field about.resource.resource_type is set to CLOUD_ORGANIZATION.
actor.gaiaId principal.user.product_object_id
target.user.product_object_id

If events.name is one of the following:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_challenge
  • login_verification
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
Then, the actor.gaiaId log field is mapped to the target.user.product_object_id UDM field.
Else, the actor.gaiaId log field is mapped to the principal.user.product_object_id UDM field. 		principal.user.product_object_id
target.user.product_object_id

If events.name is one of the following:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_challenge
  • login_verification
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
  • CHROMEOS_AFFILIATED_UNLOCK_FAILURE
  • CHROMEOS_AFFILIATED_UNLOCK_SUCCESS
  • CHROME_OS_CRD_CLIENT_CONNECTED
  • CHROMEOS_AFFILIATED_LOCK_SUCCESS
  • FAILED_PASSWORD_ATTEMPTS_EVENT
Then, the actor.gaiaId log field is mapped to the target.user.product_object_id UDM field.
Else, the actor.gaiaId log field is mapped to the principal.user.product_object_id UDM field.
actor.orgunitPath target.user.attribute.labels[org_unit_path]
principal.user.attribute.labels[org_unit_path]

If events.name is one of the following:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_challenge
  • login_verification
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
Then, iterate through each element in actor.orgunitPath and target.resource.attribute.labels.key is set to org_unit_path and actor.orgunitPath log field is mapped to the target.resource.attribute.labels.value UDM field.
Else, iterate through each element in actor.orgunitPath and principal.resource.attribute.labels.key is set to orgunitPath and actor.orgunitPath log field is mapped to the principal.resource.attribute.labels.value UDM field. 		target.user.attribute.labels[org_unit_path]
principal.user.attribute.labels[org_unit_path]

If events.name is one of the following:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_challenge
  • login_verification
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
  • CHROMEOS_AFFILIATED_UNLOCK_FAILURE
  • CHROMEOS_AFFILIATED_UNLOCK_SUCCESS
  • CHROME_OS_CRD_CLIENT_CONNECTED
  • CHROMEOS_AFFILIATED_LOCK_SUCCESS
  • FAILED_PASSWORD_ATTEMPTS_EVENT
Then, iterate through each element in actor.orgunitPath and target.resource.attribute.labels.key is set to org_unit_path and actor.orgunitPath log field is mapped to the target.resource.attribute.labels.value UDM field.
Else, iterate through each element in actor.orgunitPath and principal.resource.attribute.labels.key is set to org_unit_path and actor.orgunitPath log field is mapped to the principal.resource.attribute.labels.value UDM field.
actor.groupId target.user.group_identifiers
principal.user.group_identifiers

If events.name is one of the following:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_challenge
  • login_verification
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
Then, the actor.groupId log field is mapped to the target.user.group_identifiers UDM field.
Else, the actor.groupId log field is mapped to the principal.user.group_identifiers UDM field. 		target.user.group_identifiers
principal.user.group_identifiers

If events.name is one of the following:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_challenge
  • login_verification
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
  • CHROMEOS_AFFILIATED_UNLOCK_FAILURE
  • CHROMEOS_AFFILIATED_UNLOCK_SUCCESS
  • CHROME_OS_CRD_CLIENT_CONNECTED
  • CHROMEOS_AFFILIATED_LOCK_SUCCESS
  • FAILED_PASSWORD_ATTEMPTS_EVENT
Then, the actor.groupId log field is mapped to the target.user.group_identifiers UDM field.
Else, the actor.groupId log field is mapped to the principal.user.group_identifiers UDM field.

Application Specific Field Mapping Delta

The following table lists the delta between the old and new UDM field mappings for Application Specific Google Workspace log fields.

Application RawLog Field Name Old UDM Field Name New UDM Field Name
chrome DEVICE_NAME target.asset.attribute.labels[device_name]
principal.hostname
principal.asset.hostname		 principal.hostname
principal.asset.hostname
chrome DEVICE_PLATFORM if the DEVICE_PLATFORM log field value is equal to windows, then the target.asset.platform_software.platform UDM field is set to WINDOWS.
Else, if the DEVICE_PLATFORM log field value is equal to mac, then the target.asset.platform_software.platform UDM field is set to MAC.
Else, if the DEVICE_PLATFORM log field value is equal to linux, then the target.asset.platform_software.platform UDM field is set to LINUX.		 if the DEVICE_PLATFORM log field value is equal to windows, then the principal.asset.platform_software.platform UDM field is set to WINDOWS.
Else, if the DEVICE_PLATFORM log field value is equal to mac, then the principal.asset.platform_software.platform UDM field is set to MAC.
Else, if the DEVICE_PLATFORM log field value is equal to linux, then the principal.asset.platform_software.platform UDM field is set to LINUX.
chrome DEVICE_USER If the events.name is equal to LOGIN_EVENT, then the DEVICE_USER log field is mapped to the principal.user.user_display_name UDM field.
Else, the DEVICE_USER log field is mapped to the target.user.user_display_name UDM field.		 If the events.name log field value is one of the following values:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • CHROME_OS_LOGOUT_EVENT
  • PASSWORD_CHANGED
  • PASSWORD_REUSE
  • DLP_EVENT
  • CONTENT_TRANSFER
  • CONTENT_UNSCANNED
  • EXTENSION_REQUEST
  • MALWARE_TRANSFER
  • SENSITIVE_DATA_TRANSFER
  • LOGIN_EVENT
, then the DEVICE_USER log field is mapped to the principal.user.user_display_name UDM field.
Else, the DEVICE_USER log field is mapped to the target.user.user_display_name UDM field.
chrome PROFILE_USER_NAME target.user.attribute.labels[profile_user_name] about.user.user_display_name
chrome DIRECTORY_DEVICE_ID additional.fields[directory_device_id] principal.asset.attribute.labels[directory_device_id]
chrome DEVICE_ID target.asset_id
target.asset.asset_id
The target.asset_id and target.asset.asset_id is set to asset_id:%{DEVICE_ID} 		principal.asset_id
principal.asset.asset_id
The principal.asset_id and principal.asset.asset_id is set to asset_id:%{DEVICE_ID}
chrome EVENT_RESULT security_result.action
If the EVENT_RESULT log field value is one of the following values:
  • BLOCK
  • BLOCKED
, then the security_result.action UDM field is set to BLOCK.
Else, the security_result.action UDM field is set to ALLOW.		 security_result.action
If the EVENT_RESULT log field value is one of the following values:
  • BLOCK
  • BLOCKED
, then the security_result.action UDM field is set to BLOCK.
Else, if the EVENT_RESULT log field value is equal to ALLOWED, then the security_result.action UDM field is set to ALLOW.
chrome REMOVE_USER_REASON security_result.detection_fields[remove_user_reason] security_result.description
chrome NEW_BOOT_MODE target.asset.attribute.labels[new_boot_mode] principal.asset.attribute.labels[new_boot_mode]
chrome PREVIOUS_BOOT_MODE target.asset.attribute.labels[previous_boot_mode] principal.asset.attribute.labels[previous_boot_mode]
chrome PREVIOUS_OS_VERSION target.asset.attribute.labels[previous_os_version] principal.asset.attribute.labels[previous_os_version]
chrome CURRENT_OS_VERSION target.asset.platform_software.platform_version principal.asset.platform_software.platform_version
chrome TRIGGER_USER additional.fields[trigger_user] If the TRIGGER_USER log field value matches the regular expression pattern ^.+@.+$, then the TRIGGER_USER log field is mapped to the target.user.email_addresses UDM field.
Else, the TRIGGER_USER log field is mapped to the target.user.userid UDM field.
chrome TRIGGER_TYPE additional.fields[trigger_type] security_result.detection_fields[trigger_type]
chrome CONTENT_HASH additional.fields[content_hash] If the CONTENT_HASH log field value matches the regular expression pattern ^[a-f0-9]{64}$, then the CONTENT_HASH log field is mapped to the target.file.sha256 UDM field.
Else, if the CONTENT_HASH log field value matches the regular expression pattern ^[a-fA-F0-9]{32}$, then the CONTENT_HASH log field is mapped to the target.file.md5 UDM field.
Else, if the CONTENT_HASH log field value matches the regular expression pattern ^[0-9a-f]+$, then the CONTENT_HASH log field is mapped to the target.file.sha1 UDM field.
chrome CONTENT_NAME additional.fields[content_name] target.file.full_path
target.file.file_type
The file_type field is extracted from CONTENT_NAME log field using the Grok pattern, and the file_type is set to FILE_TYPE_%{file_type}. If the file_type log field value is one of the following values:
  • FILE_TYPE_ACE
  • FILE_TYPE_ANDROID
  • FILE_TYPE_APPLE
  • FILE_TYPE_APPLE_PLIST
  • FILE_TYPE_APPLEDOUBLE
  • FILE_TYPE_APPLESCRIPT
  • FILE_TYPE_APPLESCRIPT_COMPILED
  • FILE_TYPE_APPLESINGLE
  • FILE_TYPE_ARC
  • FILE_TYPE_ARJ
  • FILE_TYPE_ASD
  • FILE_TYPE_ASF
  • FILE_TYPE_AVI
  • FILE_TYPE_AWK
  • FILE_TYPE_BLACKHOLE
  • FILE_TYPE_BMP
  • FILE_TYPE_BZIP
  • FILE_TYPE_C
  • FILE_TYPE_CAB
  • FILE_TYPE_CAP
  • FILE_TYPE_CHM
  • FILE_TYPE_COFF
  • FILE_TYPE_COOKIE
  • FILE_TYPE_CPP
  • FILE_TYPE_CRX
  • FILE_TYPE_DEB
  • FILE_TYPE_DIB
  • FILE_TYPE_DIVX
  • FILE_TYPE_DMG
  • FILE_TYPE_DOC
  • FILE_TYPE_DOCX
  • FILE_TYPE_DOS_COM
  • FILE_TYPE_DOS_EXE
  • FILE_TYPE_DYALOG
  • FILE_TYPE_DZIP
  • FILE_TYPE_EBOOK
  • FILE_TYPE_ELF
  • FILE_TYPE_EMAIL_TYPE
  • FILE_TYPE_EMF
  • FILE_TYPE_EOT
  • FILE_TYPE_EPS
  • FILE_TYPE_FLA
  • FILE_TYPE_FLAC
  • FILE_TYPE_FLC
  • FILE_TYPE_FLI
  • FILE_TYPE_FLV
  • FILE_TYPE_FORTRAN
  • FILE_TYPE_FPX
  • FILE_TYPE_GIF
  • FILE_TYPE_GIMP
  • FILE_TYPE_GUL
  • FILE_TYPE_GZIP
  • FILE_TYPE_HTML
  • FILE_TYPE_HWP
  • FILE_TYPE_ICO
  • FILE_TYPE_IN_DESIGN
  • FILE_TYPE_IPHONE
  • FILE_TYPE_ISOIMAGE
  • FILE_TYPE_JAR
  • FILE_TYPE_JAVA
  • FILE_TYPE_JAVA_BYTECODE
  • FILE_TYPE_JAVASCRIPT
  • FILE_TYPE_JNG
  • FILE_TYPE_JPEG
  • FILE_TYPE_KGB
  • FILE_TYPE_LATEX
  • FILE_TYPE_LINUX
  • FILE_TYPE_LINUX_KERNEL
  • FILE_TYPE_LNK
  • FILE_TYPE_MACH_O
  • FILE_TYPE_MACINTOSH
  • FILE_TYPE_MACINTOSH_HFS
  • FILE_TYPE_MACINTOSH_LIB
  • FILE_TYPE_MIDI
  • FILE_TYPE_MOV
  • FILE_TYPE_MP3
  • FILE_TYPE_MP4
  • FILE_TYPE_MPEG
  • FILE_TYPE_MSCOMPRESS
  • FILE_TYPE_MSI
  • FILE_TYPE_NE_DLL
  • FILE_TYPE_NE_EXE
  • FILE_TYPE_ODF
  • FILE_TYPE_ODG
  • FILE_TYPE_ODP
  • FILE_TYPE_ODS
  • FILE_TYPE_ODT
  • FILE_TYPE_OGG
  • FILE_TYPE_OUTLOOK
  • FILE_TYPE_PALMOS
  • FILE_TYPE_PASCAL
  • FILE_TYPE_PDF
  • FILE_TYPE_PE_DLL
  • FILE_TYPE_PE_EXE
  • FILE_TYPE_PERL
  • FILE_TYPE_PHP
  • FILE_TYPE_PKG
  • FILE_TYPE_PNG
  • FILE_TYPE_POWERSHELL
  • FILE_TYPE_PPSX
  • FILE_TYPE_PPT
  • FILE_TYPE_PPTX
  • FILE_TYPE_PS
  • FILE_TYPE_PSD
  • FILE_TYPE_PYTHON
  • FILE_TYPE_QUICKTIME
  • FILE_TYPE_RAR
  • FILE_TYPE_RM
  • FILE_TYPE_ROM
  • FILE_TYPE_RPM
  • FILE_TYPE_RTF
  • FILE_TYPE_RUBY
  • FILE_TYPE_RZIP
  • FILE_TYPE_SCRIPT
  • FILE_TYPE_SEVENZIP
  • FILE_TYPE_SHELLSCRIPT
  • FILE_TYPE_SVG
  • FILE_TYPE_SWF
  • FILE_TYPE_SYMBIAN
  • FILE_TYPE_T3GP
  • FILE_TYPE_TAR
  • FILE_TYPE_TARGA
  • FILE_TYPE_TEXT
  • FILE_TYPE_TIFF
  • FILE_TYPE_TORRENT
  • FILE_TYPE_TTF
  • FILE_TYPE_UNSPECIFIED
  • FILE_TYPE_VBA
  • FILE_TYPE_WAV
  • FILE_TYPE_WEBP
  • FILE_TYPE_WINCE
  • FILE_TYPE_WMA
  • FILE_TYPE_WMV
  • FILE_TYPE_WOFF
  • FILE_TYPE_XLS
  • FILE_TYPE_XLSX
  • FILE_TYPE_XML
  • FILE_TYPE_XPI
  • FILE_TYPE_XWD
  • FILE_TYPE_ZIP
  • FILE_TYPE_ZLIB
, then the file_type log field is mapped to the target.file.file_type UDM field.
chrome CONTENT_SIZE additional.fields[content_size] target.file.size
chrome CONTENT_TYPE additional.fields[content_type] target.file.mime_type
chrome USER_JUSTIFICATION principal.user.attribute.labels[user_justification] security_result.detection_fields[user_justification]
chrome security_result.category If the events.name log field value is equal to PASSWORD_BREACH, then the security_result.category UDM field is set to PHISHING.
Else, if the events.name log field value is equal to MALWARE_TRANSFER, then the security_result.category UDM field is set to SOFTWARE_MALICIOUS.
Else, if the events.name log field value is equal to UNSAFE_SITE_VISIT, then the security_result.category UDM field is set to NETWORK_SUSPICIOUS.
context_aware_access CAA_APPLICATION target.resource.name target.application
context_aware_access BLOCKED_API_ACCESS additional.fields[blocked_api_access] target.resource.name
context_aware_access The target.application UDM field is set to Context Aware Access. If the CAA_APPLICATION log field value is equal to empty, then the target.application UDM field is set to Context Aware Access
gplus comment_resource_name target.resource.product_object_id additional.fields[comment_resource_name]
gplus post_resource_name target.resource_ancestors.product_object_id target.resource.product_object_id
gplus post_permalink target.resource_ancestors.attribute.labels[post_permalink] target.resource.attribute.labels[post_permalink]
gplus post_visibility target.resource_ancestors.attribute.labels[post_visibility] target.resource.attribute.labels[post_visibility]
gplus plusone_context target.resource_ancestors.attribute.labels[plusone_context] If the plusone_context log field value is equal to post, then the target.resource.attribute.labels.key is set to plusone_context and plusone_context log field is mapped to the target.resource.attribute.labels.value UDM field.
Else, the additional.fields.key is set to plusone_context and plusone_context log field is mapped to the additional.fields.value UDM field.
gplus post_author_name target.user.user_display_name target.resource.attribute.labels[post_author_name]
data_studio ASSET_ID If the ASSET_TYPE log field value is equal to DATA_SOURCE, then the ASSET_ID log field is mapped to the principal.resource.product_object_id UDM field.
Else, ASSET_ID log field is mapped to the target.resource.product_object_id UDM field.		 target.resource.product_object_id
data_studio ASSET_NAME If the ASSET_TYPE log field value is equal to DATA_SOURCE, then the ASSET_NAME log field is mapped to the principal.resource.name UDM field.
Else, ASSET_NAME log field is mapped to the target.resource.name UDM field.		 target.resource.name
data_studio ASSET_TYPE principal.resource.resource_subtype target.resource.resource_subtype
data_studio OWNER_EMAIL principal.user.email_addresses target.resource.attribute.labels[OWNER_EMAIL]
chat external_room additional.fields[external_room] target.group.attribute.labels[external_room]
chat identifier_type principal.user.attribute.labels[identifier_type] If the identifier_type log field value is equal to device_id, then the principal.asset.attribute.labels.key is set to identifier_type and identifier_type log field is mapped to the principal.asset.attribute.labels.value UDM field.
Else, the principal.user.attribute.labels.key is set to identifier_type and identifier_type log field is mapped to the principal.user.attribute.labels.value UDM field.
chat location_region principal.user.attribute.labels[location_region] principal.location.city
chat identifier principal.user.userid If the identifier_type log field value is equal to device_id, then the identifier log field is mapped to the principal.asset.asset_id UDM field.
Else, if the identifier_type log field value is equal to phone_number, then the identifier log field is mapped to the principal.user.phone_numbers UDM field.
Else, if the identifier_type log field value is equal to email_address and if the actor.email log field value is not equal to the identifier log field value, then the identifier log field is mapped to the principal.user.email_addresses UDM field.
chat product_type principal.resource.resource_subtype target.resource.resource_subtype
chat message_type if the events.name log field value is one of the following values:
  • message_edited
  • message_posted
  • message_reported
, then the target.resource.resource_subtype is set to Google Chat - Message		 If the events.name log field value is equal to message_reported, then the target.resource.resource_subtype UDM field is set to Google Chat - Message.
Else, if the events.name log field value is one of the following values:
  • message_edited
  • message_posted
, then the message_type log field is mapped to the target.resource.resource_subtype UDM field.
chat ip_address target.ip
target.asset.ip		 principal.ip
principal.asset.ip
chat duration_seconds target.resource.attribute.labels[duration_seconds] network.session_duration
groups_enterprise group_id target.user.group_identifiers target.group.email_addresses
groups_enterprise info_setting target.group.attribute.labels[info_setting] target.resource.name
groups_enterprise membership_expiry target.group.attribute.labels[membership_query] target.user.attribute.labels[membership_query]
groups_enterprise new_value target.group.attribute.labels[new_value] target.resource.attribute.labels[new_value]
groups_enterprise old_value target.group.attribute.labels[old_value] target.resource.attribute.labels[old_value]
groups_enterprise value target.group.attribute.labels[value] target.resource.attribute.labels[value]
groups_enterprise security_setting target.group.attribute.labels[security_setting] target.resource.name
calendar access_level additional.fields[access_level] target.resource.attribute.labels[access_level]
calendar event_title target.resource.attribute.labels[event_title] target.resource.name
calendar interop_error_code security_result.action_details metadata.description
calendar organizer_calendar_id principal.user.attribute.labels[organizer_calendar_id] target.resource.attribute.labels[organizer_calendar_id]
calendar recipient_email principal.user.email_addresses target.user.email_addresses
calendar remote_ews_url additional.fields[remote_ews_url] target.url
calendar subscriber_calendar_id principal.user.attribute.labels[subscriber_calendar_id] target.resource.attribute.labels[subscriber_calendar_id]
calendar api_kind target.resource.attribute.labels[api_kind] if the api_kind log field value is equal to android, then the principal.resource.name UDM field is set to Android device.
Else, if the api_kind log field value is equal to api_v3, then the principal.resource.name UDM field is set to Calendar API.
Else, if the api_kind log field value is equal to caldav, then the principal.resource.name UDM field is set to Calendar CalDAV API.
Else, if the api_kind log field value is equal to ews, then the principal.resource.name UDM field is set to Calendar EWS API.
Else, if the api_kind log field value is equal to gdata, then the principal.resource.name UDM field is set to Calendar GData API.
Else, if the api_kind log field value is equal to ical, then the principal.resource.name UDM field is set to Google Calendar app for iOS.
Else, if the api_kind log field value is equal to trip_service, then the principal.resource.name UDM field is set to Gmail.
Else, if the api_kind log field value is equal to web, then the principal.resource.name UDM field is set to Calendar Web interface.
gcp USER_EMAIL principal.user.email_addresses target.user.email_addresses
drive doc_id If the events.name log field value is one of the following values:
  • add_to_folder
  • move
  • unmovable_item_reparented
, then the doc_id log field is mapped to the src.resource.product_object_id UDM field.
Else, the doc_id log field is mapped to the target.resource.product_object_id UDM field.		 The doc_id log field is mapped to the target.resource.product_object_id UDM field.
If the events.name log field value is one of the following values:
  • move
  • unmovable_item_reparented
, then the doc_id log field is mapped to the src.resource.product_object_id UDM field.
drive destination_folder_id target.resource.product_object_id target.resource_ancestors.product_object_id
drive doc_title If the events.name log field value is one of the following values:
  • add_to_folder
  • move
  • unmovable_item_reparented
, then the doc_title log field is mapped to the src.resource.name UDM field.
Else, the doc_title log field is mapped to the target.resource.name UDM field.		 The doc_title log field is mapped to the target.resource.name UDM field.
If the events.name log field value is one of the following values:
  • move
  • unmovable_item_reparented
, then the doc_title log field is mapped to the src.resource.name UDM field.
drive destination_folder_title target.resource.name target.resource_ancestors.name
drive doc_type If the events.name log field value is one of the following values:
  • add_to_folder
  • move
  • unmovable_item_reparented
, then the src.resource.attribute.labels.key is set to doc_type and the doc_type log field is mapped to the src.resource.attribute.labels.value UDM field.
Else, the target.resource.attribute.labels.key is set to doc_type and the doc_type log field is mapped to the target.resource.attribute.labels.value UDM field.		 The src.resource.attribute.labels.key is set to doc_type and the doc_type log field is mapped to the src.resource.attribute.labels.value UDM field.
If the events.name log field value is one of the following values:
  • move
  • unmovable_item_reparented
, then the target.resource.attribute.labels.key is set to doc_type and the doc_type log field is mapped to the target.resource.attribute.labels.value UDM field.
drive field target.resource.attribute.labels[field] additional.fields[field]
drive field_id target.resource.attribute.labels[field_id] additional.fields[field_id]
drive label target.resource.attribute.labels[label] additional.fields[label]
drive label_title target.resource.attribute.labels[label_title] additional.fields[label_title]
drive removed_role target.user.attribute.labels[removed_role] target.user.attribute.role.name
drive source_folder_id principal.resource.product_object_id If the events.name log field value is one of the following values:
  • move
  • unmovable_item_reparented

, then the source_folder_id log field is mapped to the principal.resource_ancestors.product_object_id and src.resource_ancestors.product_object_id UDM fields.
Else, the source_folder_id log field is mapped to the principal.resource_ancestors.product_object_id UDM field.
drive new_value target.resource.attribute.labels[new_value] If the events.name log field value is one of the following values:
  • copy
  • source_copy

, then the new_value log field is mapped to the target.file.names UDM field.
Else, the target.resource.attribute.labels.key is set to new_value and the new_value log field is mapped to the target.resource.attribute.labels.value UDM field.
drive old_value target.resource.attribute.labels[old_value] If the events.name log field value is one of the following values:
  • copy
  • source_copy

, then the old_value log field is mapped to the src.file.names UDM field.
Else, the target.resource.attribute.labels.key is set to old_value and the old_value log field is mapped to the target.resource.attribute.labels.value UDM field.
drive source_folder_title principal.resource.name If the events.name log field value is one of the following values:
  • move
  • unmovable_item_reparented

, then the source_folder_title log field is mapped to the principal.resource_ancestors.name and src.resource_ancestors.name UDM fields.
Else, the source_folder_title log field is mapped to the principal.resource_ancestors.name UDM fields.
groups basic_setting target.group.attribute.labels[basic_setting] target.resource.name
groups identity_setting target.group.attribute.labels[identity_setting] target.resource.name
groups info_setting target.group.attribute.labels[info_setting] target.resource.name
groups message_moderation_action target.group.attribute.labels[message_moderation_action] security_result.action_details
groups new_members_restrictions_setting target.group.attribute.labels[new_members_restrictions_setting] target.resource.name
groups post_replies_setting target.group.attribute.labels[post_replies_setting] target.resource.name
groups spam_moderation_setting target.group.attribute.labels[spam_moderation_setting] target.resource.name
groups status target.group.attribute.labels[status] If the status log field value is equal to succeeded, then the security_result.action UDM field is set to ALLOW.
Else, the security_result.action UDM field is set to BLOCK.
groups topic_setting target.group.attribute.labels[topic_setting] target.resource.name
keep attachment_name target.resource.attribute.labels[attachment_name] target.file.names
keep owner_email principal.user.email_addresses about.user.email_addresses
keep target.resource.resource_subtype is set to GOOGLE KEEP
google_meet/meet duration_seconds target.resource.attribute.labels[duration_seconds] network.session_duration
google_meet/meet end_of_call_rating target.resource.attribute.labels[end_of_call_rating] additional.fields[end_of_call_rating]
google_meet/meet identifier_type principal.user.attribute.labels[identifier_type] If the identifier_type log field value is equal to device_id, then the principal.asset.attribute.labels.key is set to identifier_type and identifier_type log field is mapped to the principal.asset.attribute.labels.value UDM field. Else, the principal.user.attribute.labels.key is set to identifier_type and identifier_type log field is mapped to the principal.user.attribute.labels.value UDM field.
google_meet/meet ip_address target.ip
target.asset.ip		 principal.ip
principal.asset.ip
google_meet/meet location_region principal.user.attribute.labels[location_region] principal.location.name
google_meet/meet product_type principal.resource.resource_subtype target.resource.resource_subtype
google_meet/meet streaming_session_state additional.fields[streaming_session_state] target.resource.attribute.labels[streaming_session_state]
token api_name about.resource.attribute.labels[api_name] target.resource.attribute.labels[api_name]
token app_name target.resource.name target.resource.name
target.application
token client_id principal.asset.attribute.labels[client_id] target.resource.product_object_id
token client_type principal.asset.attribute.labels[client_type] target.resource.attribute.labels[client_type]
token num_response_bytes target.resource.attribute.labels[num_response_bytes] network.received_bytes
token target.application UDM field is set to OAuth Token If the app_name log field value is equal to empty, then the target.application UDM field is set to OAuth Token
rules application target.resource.attribute.labels[application] target.application
rules data_source security_result.detection_fields[data_source] target.application
rules mobile_device_type target.asset.category target.asset.attribute.labels[mobile_device_type]
rules resource_title additional.fields[resource_title] target.resource.name
rules resource_recipients If the resource_recipients is not equal to actor.email then, If resource_recipients matches the regular expression pattern ^.+@.+$, then the resource_recipients is mapped to principal.user.email_addresses UDM field.
Else, principal.user.attribute.labels.key is set to resource_recipients and resource_recipients is mapped to principal.user.attribute.labels.value UDM field.		 If resource_recipients matches the regular expression pattern ^.+@.+$, then the resource_recipients is mapped to target.user.email_addresses UDM field.
Else, target.user.attribute.labels.key is set to resource_recipients and resource_recipients is mapped to target.user.attribute.labels.value UDM field.
rules resource_owner_email principal.user.email_addresses about.user.email_addresses
rules suppressed_actions additional.fields[suppressed_actions] security_result.action_details
rules label_field target.resource.attribute.labels[label_field] additional.fields[label_field]
rules label_title target.resource.attribute.labels[label_title] additional.fields[label_title]
rules new_value target.resource.attribute.labels[new_value] additional.fields[new_value]
rules old_value target.resource.attribute.labels[old_value] additional.fields[old_value]
rules target.application UDM field is set to Rules If the application and data_source log field value is equal to empty, then the target.application UDM field is set to Rules
saml security_result.action If the events.name log field value is equal to login_failure, then the security_result.action UDM field is set to BLOCK.
Else, if the events.name log field value is equal to login_success, then the security_result.action UDM field is set to ALLOW.		 If the events.name log field value is equal to login_failure, then the security_result.action UDM field is set to FAIL.
Else, if the events.name log field value is equal to login_success, then the security_result.action UDM field is set to ALLOW.
saml The extensions.auth.mechanism UDM field is set to USERNAME_PASSWORD. The extensions.auth.mechanism UDM field is set to REMOTE.
login login_timestamp security_result.detection_fields[login_timestamp] If the id.time log field value is empty, then the login_timestamp log field is mapped to the metadata.event_timestamp UDM field.
Else, the security_result.detection_fields.key is set to login_timestamp and login_timestamp log field is mapped to the security_result.detection_fields.value UDM field.
login extensions.auth.mechanism is set to USERNAME_PASSWORD. If the login_challenge_method log field value is equal to password, then the extensions.auth.mechanism UDM field is set to USERNAME_PASSWORD.
Else, if the login_challenge_method log field value is equal to security_key_otp, then the extensions.auth.mechanism UDM field is set to OTP.
login security_result.action If the events.name log field value is equal to risky_sensitive_action_blocked or login_failure, then the security_result.action UDM field is set to BLOCK.
Else, the security_result.action UDM field is set to ALLOW.		 If the events.name log field value is equal to risky_sensitive_action_blocked, then the security_result.action UDM field is set to BLOCK.
Else, if the events.name log field value is equal to login_failure, then the security_result.action UDM field is set to FAIL.
Else, the security_result.action UDM field is set to ALLOW.
gmail events.parameters[delivery].msgValue[message_info].parameter[attachment].multiMsgValue.parameter.name[file_extension_type] about.file.mime_type
gmail events.parameters[delivery].msgValue[message_info].parameter.intValue[action_type] additional.fields[action_type] If the message_info.action_type log field value is equal to 1, then the security_result.action_details UDM field is set to 1 - Message received by inbound SMTP server.
Else, if the message_info.action_type log field value is equal to 2, then the security_result.action_details UDM field is set to 2 - Message accepted by Gmail and prepared for delivery.
Else, if the message_info.action_type log field value is equal to 3, then the security_result.action_details UDM field is set to 3 - Message was handled by Gmail.
Else, if the message_info.action_type log field value is equal to 10, then the security_result.action_details UDM field is set to 10 - Message sent out by outbound SMTP server.
Else, if the message_info.action_type log field value is equal to 14, then the security_result.action_details UDM field is set to 14 - A temporary error occurred when Gmail tried to deliver the message, and the message has been scheduled for retry.
Else, if the message_info.action_type log field value is equal to 18, then the security_result.action_details UDM field is set to 18 - Message could not be delivered and bounced.
Else, if the message_info.action_type log field value is equal to 19, then the security_result.action_details UDM field is set to 19 - Message was dropped by Gmail.
Else, if the message_info.action_type log field value is equal to 45, then the security_result.action_details UDM field is set to 45 - Message was accepted for delivery by the Google Groups subsystem.
Else, if the message_info.action_type log field value is equal to 46, then the security_result.action_details UDM field is set to 46 - Message's recipient address was a Google Group, and the recipient was expanded to each member of the Google Group that has message delivery enabled.
Else, if the message_info.action_type log field value is equal to 48, then the security_result.action_details UDM field is set to 48 - Message received by inbound SMTP server for relay.
Else, if the message_info.action_type log field value is equal to 49, then the security_result.action_details UDM field is set to 49 - Message sent through relay by outbound SMTP server.
Else, if the message_info.action_type log field value is equal to 51, then the security_result.action_details UDM field is set to 51 - Message was written to Google Groups storage.
Else, if the message_info.action_type log field value is equal to 54, then the security_result.action_details UDM field is set to 54 - Message was rejected by the Google Groups storage system.
Else, if the message_info.action_type log field value is equal to 55, then the security_result.action_details UDM field is set to 55 - Message was re-inserted into Gmail by policies that modify the primary delivery route or envelope recipient.
Else, if the message_info.action_type log field value is equal to 68, then the security_result.action_details UDM field is set to 68 - Message accepted by Gmail and prepared for delivery.
Else, if the message_info.action_type log field value is equal to 69, then the security_result.action_details UDM field is set to 69 - A user changed the message’s spam classification in Gmail.
Else, if the message_info.action_type log field value is equal to 70, then the security_result.action_details UDM field is set to 70 - The message was reclassified as spam or phishing after it was delivered to Gmail.
Else, if the message_info.action_type log field value is equal to 71, then the security_result.action_details UDM field is set to 71 - A user took an action in the inbox after receiving the message. Post-delivery actions include opening a message, clicking a link in a message, and downloading an attachment. BigQuery export doesn't provide details about the action.
gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[post_delivery_info].parameter.intValue[action_type] additional.fields[post_delivery_action_type] If the message_info.post_delivery_info.action_type log field value is equal to 1, then the security_result.action_details UDM field is set to 1 - Message opened for the first time.
Else, if the message_info.post_delivery_info.action_type log field value is equal to 2, then the security_result.action_details UDM field is set to 2 - Message marked as unread.
Else, if the message_info.post_delivery_info.action_type log field value is equal to 3, then the security_result.action_details UDM field is set to 3 - Message replied.
Else, if the message_info.post_delivery_info.action_type log field value is equal to 4, then the security_result.action_details UDM field is set to 4 - Message forwarded.
Else, if the message_info.post_delivery_info.action_type log field value is equal to 5, then the security_result.action_details UDM field is set to 5 - Message auto-forwarded by a Gmail setting.
Else, if the message_info.post_delivery_info.action_type log field value is equal to 6, then the security_result.action_details UDM field is set to 6 - Message moved to inbox.
Else, if the message_info.post_delivery_info.action_type log field value is equal to 7, then the security_result.action_details UDM field is set to 7 - Message moved to trash.
Else, if the message_info.post_delivery_info.action_type log field value is equal to 8, then the security_result.action_details UDM field is set to 8 - Message moved out of trash.
Else, if the message_info.post_delivery_info.action_type log field value is equal to 9, then the security_result.action_details UDM field is set to 9 - A link in the message body was clicked.
Else, if the message_info.post_delivery_info.action_type log field value is equal to 10, then the security_result.action_details UDM field is set to 10 - One or more message attachments were downloaded.
Else, if the message_info.post_delivery_info.action_type log field value is equal to 11, then the security_result.action_details UDM field is set to 11 - A link in an attachment was clicked when the attachment was previewed.
Else, if the message_info.post_delivery_info.action_type log field value is equal to 12, then the security_result.action_details UDM field is set to 12 - One or more message attachments were saved to Google Drive.
Else, if the message_info.post_delivery_info.action_type log field value is equal to 13, then the security_result.action_details UDM field is set to 13 - A link in the add-on was clicked.
Else, if the message_info.post_delivery_info.action_type log field value is equal to 14, then the security_result.action_details UDM field is set to 14 - One or more Google Drive items in the message were downloaded.
Else, if the message_info.post_delivery_info.action_type log field value is equal to 15, then the security_result.action_details UDM field is set to 15 - One or more Google Drive items in the message were saved to the recipient's Google Drive.
Else, if the message_info.post_delivery_info.action_type log field value is equal to 16, then the security_result.action_details UDM field is set to 16 - A classification label was applied to or changed for the message.
Else, if the message_info.post_delivery_info.action_type log field value is equal to 17, then the security_result.action_details UDM field is set to 17 - A classification label was applied to or changed for message attachments.
Else, if the message_info.post_delivery_info.action_type log field value is equal to 18, then the security_result.action_details UDM field is set to 18 - Message archived.
Else, if the message_info.post_delivery_info.action_type log field value is equal to 19, then the security_result.action_details UDM field is set to 19 - Message permanently deleted.
Else, if the message_info.post_delivery_info.action_type log field value is equal to 20, then the security_result.action_details UDM field is set to 20 - One or more message attachments were previewed.
Else, if the message_info.post_delivery_info.action_type log field value is equal to 21, then the security_result.action_details UDM field is set to 21 - Recipient blocked the message sender.
Else, if the message_info.post_delivery_info.action_type log field value is equal to 22, then the security_result.action_details UDM field is set to 22 - Message saved as draft.
Else, if the message_info.post_delivery_info.action_type log field value is equal to 23, then the security_result.action_details UDM field is set to 23 - Message viewed, including first and following readings.
gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[dkim_pass] additional.fields[dkim_pass] security_result.detection_fields[dkim_pass].
gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[dmarc_pass] additional.fields[dmarc_pass] security_result.detection_fields[dmarc_pass].
gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[dmarc_published_domain] additional.fields[dmarc_published_domain] security_result.detection_fields[dmarc_published_domain].
gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.value[address] network.smtp.rcpt_to
target.user.email_addresses		 network.email.to
network.smtp.rcpt_to
target.user.email_addresses
gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[spf_pass] additional.fields[spf_pass] security_result.detection_fields[spf_pass].
mobile ACTION_ID target.resource.attribute.labels[action_id] security_result.detection_fields[action_id].
mobile ACTION_TYPE target.resource.attribute.labels[action_type] security_result.action_details
mobile APPLICATION_REPORT_SEVERITY target.resource.attribute.labels[application_report_severity] security_result.severity_details
mobile DEVICE_COMPROMISED_STATE about.target.resource.attribute.labels[device_compromised_state] target.resource.attribute.labels[device_compromised_state]
mobile DEVICE_ID target.resource.product_object_id target.asset.asset_id
target.resource.product_object_id
mobile DEVICE_MODEL target.resource.attribute.labels[device_model] target.asset.hardware.model
mobile FAILED_PASSWD_ATTEMPTS target.resource.attribute.labels[failed_passwd_attempts] additional.fields[failed_passwd_attempts]
mobile OS_VERSION target.resource.attribute.labels[os_version] target.asset.platform_software.platform_version
mobile PHA_CATEGORY security_result.detection_fields[pha_category] security_result.category_details
mobile POLICY_NAME additional.fields[policy_name]
security_result.about.labels[policy_name]		 security_result.rule_name
mobile SERIAL_NUMBER target.resource.attribute.labels[serial_number] target.asset.hardware.serial_number
mobile USER_EMAIL If the events.name log field value is one of the following:
  • APPLICATION_EVENT
  • APPLICATION_REPORT_EVENT
  • DEVICE_REGISTER_UNREGISTER_EVENT
  • ADVANCED_POLICY_SYNC_EVENT
  • DEVICE_ACTION_EVENT
  • DEVICE_COMPLIANCE_CHANGED_EVENT
  • OS_UPDATED_EVENT
  • DEVICE_OWNERSHIP_CHANGE_EVENT
  • DEVICE_SETTINGS_UPDATED_EVENT
  • DEVICE_SYNC_EVENT
  • RISK_SIGNAL_UPDATED_EVENT
  • ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT
  • DEVICE_COMPROMISED_EVENT
  • FAILED_PASSWORD_ATTEMPTS_EVENT
  • SUSPICIOUS_ACTIVITY_EVENT

, then the USER_EMAIL log field is mapped to the target.user.email_addresses UDM field.		 If the events.name log field value is equal to FAILED_PASSWORD_ATTEMPTS_EVENT, then the USER_EMAIL log field is mapped to the target.user.email_addresses UDM field.
Else, if the events.name log field value is one of the following values:
  • APPLICATION_EVENT
  • APPLICATION_REPORT_EVENT
  • DEVICE_REGISTER_UNREGISTER_EVENT
  • ADVANCED_POLICY_SYNC_EVENT
  • DEVICE_ACTION_EVENT
  • DEVICE_COMPLIANCE_CHANGED_EVENT
  • OS_UPDATED_EVENT
  • DEVICE_OWNERSHIP_CHANGE_EVENT
  • DEVICE_SETTINGS_UPDATED_EVENT
  • DEVICE_SYNC_EVENT
  • RISK_SIGNAL_UPDATED_EVENT
  • ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT
  • DEVICE_COMPROMISED_EVENT
  • SUSPICIOUS_ACTIVITY_EVENT

, then the USER_EMAIL log field is mapped to the principal.user.email_addresses UDM field.
admin NEW_VALUE If the events.name log field value is equal to MAIL_ROUTING_DESTINATION_ADDED, then the NEW_VALUE log field is mapped to the target.resource.name UDM field. If the events.name log field value is equal to MAIL_ROUTING_DESTINATION_ADDED, then the target.resource.attribute.labels.key is set to new_value and the NEW_VALUE log field is mapped to the target.resource.attribute.labels.value UDM field.
admin APP_id target.resource.name target.resource.product_object_id
admin application_name The application_name log field is mapped to the target.application UDM field. The target.application UDM field is set to admin.

If the events.name log field value is equal to ADD_APPLICATION or REMOVE_APPLICATION, then the application_name log field is mapped to the target.resource.name UDM field.
Else, the application_name log field is mapped to the target.application UDM field.
admin BULK_UPLOAD_FAIL_USERS_NUMBER target.user.attribute.labels[bulk_upload_fail_users_number] additional.fields[bulk_upload_fail_users_number]
admin BULK_UPLOAD_TOTAL_USERS_NUMBER target.user.attribute.labels[bulk_upload_total_users_number] additional.fields[bulk_upload_total_users_number]
admin BEGIN_DATE_TIME target.resource.attribute.labels[begin_date_time] additional.fields[begin_date_time]
admin EMAIL_MONITOR_DEST_EMAIL target.resource.attribute.labels[email_monitor_dest_email] additional.fields[email_monitor_dest_email]
admin EMAIL_MONITOR_LEVEL_CHAT target.resource.attribute.labels[email_monitor_level_chat] additional.fields[email_monitor_level_chat]
admin EMAIL_MONITOR_LEVEL_DRAFT_EMAIL target.resource.attribute.labels[email_monitor_level_draft_email] additional.fields[email_monitor_level_draft_email]
admin EMAIL_MONITOR_LEVEL_INCOMING_EMAIL target.resource.attribute.labels[email_monitor_level_incoming_email] additional.fields[email_monitor_level_incoming_email]
admin EMAIL_MONITOR_LEVEL_OUTGOING_EMAIL target.resource.attribute.labels[email_monitor_level_outgoing_email] additional.fields[email_monitor_level_outgoing_email]
admin END_DATE_TIME target.resource.attribute.labels[end_date_time] additional.fields[end_date_time]
admin EMAIL_EXPORT_INCLUDE_DELETED target.resource.attribute.labels[email_export_include_deleted] additional.fields[email_export_include_deleted]
admin EMAIL_EXPORT_PACKAGE_CONTENT target.resource.attribute.labels[email_export_package_content] additional.fields[email_export_package_content]
admin SEARCH_QUERY_FOR_DUMP target.resource.attribute.labels[search_query_for_dump] additional.fields[search_query_for_dump]
admin ORG_UNIT_NAME If the events.name log field value is one of the following:
  • TOGGLE_SERVICE_ENABLED
  • CREATE_ORG_UNIT
  • MOVE_ORG_UNIT
  • EDIT_ORG_UNIT_NAME
  • REMOVE_ORG_UNIT
  • UNASSIGN_CUSTOM_LOGO
  • ASSIGN_CUSTOM_LOGO
  • EDIT_ORG_UNIT_DESCRIPTION
  • CHANGE_TWO_STEP_VERIFICATION_FREQUENCY
  • CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION
  • CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION
  • CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS
  • CHANGE_TWO_STEP_VERIFICATION_START_DATE
  • WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED

then, the additional.fields.key UDM field is set to org_unit_name and the org_unit_name log field is mapped to the additional.fields.value UDM field. 		If the events.name log field value is one of the following values:
  • CREATE_ORG_UNIT
  • MOVE_ORG_UNIT
  • EDIT_ORG_UNIT_NAME
  • REMOVE_ORG_UNIT
  • UNASSIGN_CUSTOM_LOGO
  • ASSIGN_CUSTOM_LOGO
  • EDIT_ORG_UNIT_DESCRIPTION

, then the ORG_UNIT_NAME log field is mapped to the target.resource.name UDM field.
Else, if the events.name log field value is one of the following values:
  • TOGGLE_SERVICE_ENABLED
  • CHANGE_TWO_STEP_VERIFICATION_FREQUENCY
  • CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION
  • CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION
  • CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS
  • CHANGE_TWO_STEP_VERIFICATION_START_DATE
  • WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED

, then the additional.fields.key is set to org_unit_name and the org_unit_name log field is mapped to the additional.fields.value UDM field.
admin API_SCOPES target.user.attribute.labels[api_scopes] additional.fields[api_scopes]
admin API_CLIENT_NAME If the API_CLIENT_NAME log field value matches the regular expression pattern ^(.){1,256}$, then the API_CLIENT_NAME log field is mapped to the target.user.userid UDM field.
Else, the target.user.attribute.labels.key is set to api_client_name and the api_client_name log field is mapped to the target.user.attribute.labels.value UDM field.		 The target.application UDM field is set to admin.

If the events.name log field value is equal to REMOVE_API_CLIENT_ACCESS or AUTHORIZE_API_CLIENT_ACCESS, then the API_CLIENT_NAME log field is mapped to the target.application UDM field.
Else, if the API_CLIENT_NAME log field value matches the regular expression pattern ^(.){1,256}$, then the API_CLIENT_NAME log field is mapped to the target.user.userid UDM field.
Else, the target.user.attribute.labels.key is set to api_client_name and the api_client_name log field is mapped to the target.user.attribute.labels.value UDM field.
admin EMAIL_LOG_SEARCH_MSG_ID network.email.mail_id additional.fields[email_log_search_msg_id]
admin EMAIL_LOG_SEARCH_RECIPIENT network.email.to additional.fields[email_log_search_recipient]
admin EMAIL_LOG_SEARCH_SENDER network.email.from additional.fields[email_log_search_sender]
admin PRODUCT_NAME target.resource.attribute.labels[product_name]
target.application		 The target.application UDM field is set to admin.

If the PRODUCT_NAME log field value is not equal to empty, then the PRODUCT_NAME log field is mapped to the target.application
admin If the events.name log field value is equal to GENERATE_CERTIFICATE, then the target.resource.resource_type is set to CREDENTIAL
Else, if the events.name log field value is equal to UPDATE_ACCESS_LEVEL_V2, then the target.resource.resource_type is set to ACCESS_POLICY
Else, if the the events.name log field value is not one of the following values:
  • EMAIL_LOG_SEARCH
  • ALERT_CENTER_VIEW
  • ALERT_CENTER_LIST_FEEDBACK
  • ALERT_CENTER_GET_SIT_LINK
  • ALERT_CENTER_LIST_RELATED_ALERTS
  • ALERT_CENTER_LIST_CHANGE
  • SECURITY_INVESTIGATION_QUERY
  • SECURITY_INVESTIGATION_ACTION
  • SECURITY_INVESTIGATION_OBJECT_CREATE_DRAFT_INVESTIGATION
  • SECURITY_CHART_DRILLDOWN
  • CHANGE_DEVICE_STATE
  • SECURITY_INVESTIGATION_ACTION_COMPLETION
  • ADD_TO_BLOCKED_OAUTH2_APPS
  • ADD_TO_TRUSTED_OAUTH2_APPS
  • CHANGE_APP_ACCESS
  • UPDATE_ACCESS_LEVEL_V2
  • UPDATE_AUTO_PROVISIONED_USER
  • SECURITY_INVESTIGATION_EXPORT_QUERY
  • SECURITY_INVESTIGATION_ACTION_CANCELLATION
  • DELETE_GROUP
  • SECURITY_CENTER_RULE_THRESHOLD_TRIGGER
  • RELEASE_FROM_QUARANTINE

, then the target.resource.resource_type UDM field is set to SETTING.		 If the events.name log field value is one of the following values:
  • REVOKE_SECURITY_KEY
  • SECURITY_KEY_REGISTERED_FOR_USER
  • GENERATE_CERTIFICATE

, then the target.resource.resource_type UDM field is set to CREDENTIAL.
Else, if the events.name log field value is equal to UPDATE_ACCESS_LEVEL_V2, then the target.resource.resource_type UDM field is set to ACCESS_POLICY.
Else, if the events.name log field value is not one of the following values:
  • EMAIL_LOG_SEARCH
  • ALERT_CENTER_VIEW
  • ALERT_CENTER_LIST_FEEDBACK
  • ALERT_CENTER_GET_SIT_LINK
  • ALERT_CENTER_LIST_RELATED_ALERTS
  • ALERT_CENTER_LIST_CHANGE
  • SECURITY_INVESTIGATION_QUERY
  • SECURITY_INVESTIGATION_ACTION
  • SECURITY_INVESTIGATION_OBJECT_CREATE_DRAFT_INVESTIGATION
  • SECURITY_CHART_DRILLDOWN
  • CHANGE_DEVICE_STATE
  • SECURITY_INVESTIGATION_ACTION_COMPLETION
  • ADD_TO_BLOCKED_OAUTH2_APPS
  • ADD_TO_TRUSTED_OAUTH2_APPS
  • CHANGE_APP_ACCESS
  • UPDATE_ACCESS_LEVEL_V2
  • UPDATE_AUTO_PROVISIONED_USER
  • SECURITY_INVESTIGATION_EXPORT_QUERY
  • SECURITY_INVESTIGATION_ACTION_CANCELLATION
  • DELETE_GROUP
  • SECURITY_CENTER_RULE_THRESHOLD_TRIGGER
  • RELEASE_FROM_QUARANTINE

, then the target.resource.resource_type UDM field is set to SETTING.
admin MOBILE_APP_PACKAGE_ID additional.fields[mobile_app_package_id] target.resource.name
admin security_result.action If the ACTION_TYPE log field value is equal to BLOCK or BLOCKED, then the security_result.action is set to BLOCK. Else, the security_result.action is set to ALLOW.

Need more help? Get answers from Community members and Google SecOps professionals.