Google Workspace

Alerts

• Google Workspace - Login failed: This alert is generated when user fails to login.
• Google Workspace - Suspicious login: This alert is generated when any suspicious login is detected.

Reports 

• Google Workspace - Login Failure: This report gives information regarding all the login failures detected in Google Workspace. Reports contains IP address, logon type, username and other useful information for further analysis.

Reports 

• Google Workspace - Admin Activities: This report gives the information about the admin activities performed such as user creation, email log search, google chrome, hangout activities, etc. Reports contains IP address, username, customer id, log type and other fields which will be helpful for further investigation.
• Google Workspace - Mobile Activities: This report gives the information about all the mobile activities such as device application change, OS update, device compliance status, device action, device ownership, device settings change etc. Reports contains user email, device ID, device type, device events, etc. which can be used for further investigation.
• Google Workspace - Token Activities: This report gives information about all the OAuth token audit activity events like authorize and revoke. Reports contains IP address, application name which used the token, action as authorize or revoke and other useful details for further investigation.

Reports

• Google Workspace - Login and Logout Activities: This report gives information about all the login and logout activities detected in Google Workspace. Report contains IP address, username, action as logout, successful login or login failure, logon type and if the login is suspicious, and other useful information.