Coletar registros do Google Workspace

Compatível com:

Este documento descreve como coletar registros do Google Workspace configurando um feed do Google Security Operations e como os campos de registro são mapeados para os campos do modelo de dados unificado (UDM, na sigla em inglês) do Google Security Operations. Este documento também lista os tipos de registro e de evento compatíveis com o Google Workspace.

Para mais informações, consulte Ingestão de dados para as operações de segurança do Google.

Uma implantação típica consiste no Google Workspace e no feed do Google Security Operations configurado para enviar registros ao Google Security Operations. Cada implantação do cliente pode ser diferente e mais complexa.

A implantação contém os seguintes componentes:

  • Google Workspace. A plataforma do Google Workspace de onde você coleta os registros.

  • Feed do Google Security Operations. O feed do Google Security Operations que extrai registros do Google Workspace e os grava no Google Security Operations.

  • Google Security Operations. O Google Security Operations retém e analisa os registros do Google Workspace.

Um rótulo de transferência identifica o analisador que normaliza os dados de registro brutos para o formato estruturado do UDM. As informações neste documento se aplicam a analisadores do Google Workspace com os seguintes rótulos de transferência:

  • WORKSPACE_ACTIVITY
  • WORKSPACE_ALERTS
  • WORKSPACE_CHROMEOS
  • WORKSPACE_GROUPS
  • WORKSPACE_MOBILE
  • WORKSPACE_PRIVILEGES
  • WORKSPACE_USERS

Antes de começar

  • Use o Google Workspace Business Standard ou Business Plus, porque o analisador do Google Workspace oferece suporte a essas duas edições.

  • Verifique se você tem uma conta de administrador do Google Workspace.

  • Ative as seguintes APIs no seu projeto do Google Cloud:

  • Para autenticar as APIs do Google Workspace, crie uma conta de serviço no seu projeto do Google Cloud e anote o ID numérico exclusivo e o endereço de e-mail da conta de serviço. Para mais informações sobre como criar uma conta de serviço, consulte Criar e gerenciar contas de serviço.

  • Crie um usuário que imite a conta de serviço e conceda privilégios a ele:

    1. Faça login no Google Admin Console.
    2. Selecione Diretório > Usuários e clique em Adicionar novo usuário.
    3. Insira os detalhes do usuário.
    4. Clique em Adicionar novo usuário.
    5. Clique no link do usuário recém-criado e em Funções e privilégios do administrador.
    6. Clique em Abrir menos.
    7. Clique em Criar função personalizada.
    8. Clique em Criar nova função e dê um nome a ela.
    9. Conceda os seguintes privilégios ao papel:
      • Privilégios > Relatórios
      • Privilégios > Serviços > Central de alertas > Acesso total > Acesso para visualização
      • Privilégios > Serviços > Gerenciamento de dispositivos móveis > Gerenciar dispositivos e configurações
      • Privilégios > Serviços > Gerenciamento do Chrome > Configurações
      • API Admin > Privilégios > Usuários > Leitura
      • API Admin > Privilégios > Grupos > Leitura
    10. Clique em Continuar e em Criar função.
    11. Clique em Atribuir usuários.
    12. Selecione o usuário para atribuir a função.
    13. Clique em Atribuir função.
  • Crie credenciais de acesso. Para mais informações sobre como criar credenciais de acesso, consulte Criar uma chave de conta de serviço.

  • Para acessar dados, autorize a delegação em todo o domínio para a conta de serviço com os seguintes escopos:

    • https://www.googleapis.com/auth/admin.reports.audit.readonly
    • https://www.googleapis.com/auth/apps.alerts
    • https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly
    • https://www.googleapis.com/auth/admin.directory.group.readonly
    • https://www.googleapis.com/auth/admin.directory.device.mobile.readonly
    • https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly
    • https://www.googleapis.com/auth/admin.directory.user.readonly
  • Para localizar o ID do cliente do Google Workspace, no Google Admin Console, selecione Conta > Configurações da conta > Perfil.

  • Verifique se todos os sistemas na arquitetura de implantação estão configurados no fuso horário UTC.

  • Verifique os tipos de registro compatíveis com o analisador do Google Security Operations. Para saber mais sobre os registros do Google Workspace aceitos, consulte Tipos de registros do Google Workspace aceitos.

Configurar um feed nas Operações de segurança do Google para processar registros do Google Workspace

  1. Na barra de navegação, selecione Configurações > Configurações do SIEM > Feeds.
  2. Clique em Add New.
  3. Selecione API de terceiros como Tipo de origem.
  4. Para criar um feed de atividades do Workspace, selecione Atividades do Workspace como o Tipo de registro.
  5. Clique em Próxima.
  6. Com base na configuração do Google Workspace que você criou, especifique valores para os seguintes campos:

    • Endpoint do JWT do OAuth. O endpoint que contém o JSON Web Token do OAuth. Especifique o valor token_uri da chave JSON da conta de serviço.
    • Emissor de declarações do JWT. Esse é o ID do cliente. Especifique o valor client_email da chave JSON da conta de serviço. Por exemplo, InsertServiceAccount@project.iam.gserviceaccount.com
    • Assunto das declarações do JWT. Especifique o endereço de e-mail do usuário que você criou no console do administrador do Google Workspace.
    • Declaração de público do JWT. Especifique o valor token_uri da chave JSON da conta de serviço.
    • Chave privada RSA. Uma chave privada RSA no formato PEM. A chave PEM está disponível no arquivo de chave da conta de serviço. Ao inserir a chave privada, inclua o cabeçalho BEGIN PRIVATE KEY e o rodapé END PRIVATE KEY e substitua todas as instâncias do token \n por um pressionamento de tecla Enter real na caixa de texto.

    • ID do cliente. Para todos os tipos de registro, exceto o tipo de registro de alertas, o campo de ID do cliente precisa de um caractere 'C' inicial. Se o campo de ID do cliente não tiver um caractere 'C' inicial, adicione o valor com um caractere 'C'.

    • Aplicativos. O campo Aplicativos é obrigatório apenas quando você cria um feed para atividades do Workspace.

  7. Clique em Próxima e em Enviar.

  8. Depois de concluir as etapas para criar um feed para atividades do Workspace, repita as etapas para criar um feed separado para cada um dos seguintes tipos de registro.

    • Workspace Alerts
    • Workspace ChromeOS Devices
    • Workspace Groups
    • Workspace Mobile Devices
    • Workspace Privileges
    • Workspace Users

Para mais informações sobre os feeds do Google Security Operations, consulte a documentação dos feeds do Google Security Operations. Para informações sobre os requisitos de cada tipo de feed, consulte Configuração de feeds por tipo.

Se você tiver problemas ao criar feeds, entre em contato com o suporte da Google Security Operations.

Tipos de registro do Google Workspace compatíveis

As seções a seguir listam os tipos de registro compatíveis com o analisador do Google Workspace:

WORKSPACE_ACTIVITY

A tabela a seguir lista o nome do aplicativo com suporte e os tipos de evento para o tipo de registro WORKSPACE_ACTIVITY.

Nome do aplicativo Tipo de evento
access_transparency GSUITE_RESOURCE
chrome CHROME_OS_ADD_REMOVE_USER_TYPE
DEVICE_BOOT_STATE_CHANGE_TYPE
CHROME_OS_LOGIN_LOGOUT_TYPE
CHROME_OS_REPORTING_DATA_LOST_TYPE
SAFE_BROWSING_PASSWORD_ALERT
DLP_EVENTS_TYPE
CONTENT_TRANSFER_TYPE
CONTENT_UNSCANNED_TYPE
EXTENSION_REQUEST_TYPE
LOGIN_EVENT_TYPE
MALWARE_TRANSFER_TYPE
PASSWORD_BREACH_TYPE
SENSITIVE_DATA_TRANSFER_TYPE
UNSAFE_SITE_VISIT_TYPE
context_aware_access CONTEXT_AWARE_ACCESS_USER_EVENT
gplus comment_change
plusone_change
poll_vote_change
post_change
data_studio ACCESS
ACL_CHANGE
mobile device_applications
device_updates
suspicious_activity
groups_enterprise moderator_action
calendar calendar_change
notification
subscription_change
event_change
interop
chat user_action
gcp CLOUD_OSLOGIN
drive access
acl_change
pooled_quota_metadata
groups acl_change
moderator_action
keep user_action
meet call
token auth
rules action_complete_type
rule_match_type
rule_trigger_type
saml login
user_accounts 2sv_change
password_change
recovery_info_change
titanium_change
email_forwarding_change
login 2sv_change
password_change
recovery_info_change
account_warning
titanium_change
email_forwarding_change
jamboard administrative_action
setting_change
status_change
admin USER_SETTINGS

Para mais informações sobre os aplicativos do Google Workspace compatíveis com o Google Security Operations, consulte Aplicativos do Google Workspace.

WORKSPACE_ALERTS

Confira a lista de tipos de alertas compatíveis:

  • Customer takeout initiated
  • Malware reclassification
  • Misconfigured whitelist
  • Phishing reclassification
  • Suspicious message reported
  • User reported phishing
  • User reported spam spike
  • Leaked password
  • Suspicious login
  • Suspicious login (less secure app)
  • Suspicious programmatic login
  • User suspended
  • User suspended (spam)
  • User suspended (spam through relay)
  • User suspended (suspicious activity)
  • Google Operations
  • Configuration problem
  • Government attack warning
  • Device compromised
  • Suspicious activity
  • AppMaker Default Cloud SQL setup
  • Activity Rule
  • Data Loss Prevention
  • Apps outage
  • Primary admin changed
  • SSO profile added
  • SSO profile updated
  • SSO profile deleted
  • Super admin password reset

WORKSPACE_CHROMEOS

Para saber mais sobre o esquema de registro do ChromeOS compatível, consulte Dispositivos ChromeOS.

WORKSPACE_GROUPS

Para saber mais sobre o esquema de registro de grupos com suporte, consulte grupo.

WORKSPACE_MOBILE

Para informações sobre o esquema de registro de dispositivos móveis com suporte, consulte dispositivos móveis.

WORKSPACE_PRIVILEGES

Para informações sobre o esquema de registro de privilégios com suporte, consulte privilégio.

WORKSPACE_USERS

Para informações sobre o esquema de registro de usuários com suporte, consulte users.

Referência de mapeamento de campo { :#field-mapping }

As seções a seguir explicam como o analisador de operações de segurança do Google mapeia os campos de registro do Google Workspace para os campos do modelo de dados unificado (UDM, na sigla em inglês) das operações de segurança do Google. Os mapeamentos de campo desse analisador permanecem os mesmos para a transferência de dados baseada em feed e a transferência de dados nativa.

Referência de mapeamento de campo: tipos de registro WORKSPACE_ACTIVITY para o tipo de evento do UDM

A tabela a seguir lista os tipos de registro WORKSPACE_ACTIVITY e os tipos de evento do UDM correspondentes.

Workspace application Event identifier Event type
access_transparency ACCESS USER_RESOURCE_ACCESS
chrome CHROME_OS_ADD_USER USER_CREATION
chrome CHROME_OS_REMOVE_USER USER_DELETION
chrome DEVICE_BOOT_STATE_CHANGE SETTING_MODIFICATION
chrome CHROME_OS_LOGIN_FAILURE_EVENT USER_LOGIN
chrome CHROME_OS_LOGIN_LOGOUT_EVENT USER_LOGIN
chrome CHROME_OS_LOGIN_EVENT USER_LOGIN
chrome CHROME_OS_LOGOUT_EVENT USER_LOGOUT
chrome CHROME_OS_REPORTING_DATA_LOST STATUS_UPDATE
chrome PASSWORD_CHANGED USER_CHANGE_PASSWORD
chrome PASSWORD_REUSE USER_UNCATEGORIZED
chrome DLP_EVENT USER_UNCATEGORIZED
chrome CONTENT_TRANSFER STATUS_UNCATEGORIZED
chrome CONTENT_UNSCANNED SCAN_UNCATEGORIZED
chrome EXTENSION_REQUEST USER_UNCATEGORIZED
chrome LOGIN_EVENT USER_LOGIN
chrome MALWARE_TRANSFER SCAN_UNCATEGORIZED.

The security category is SOFTWARE_MALICIOUS.

chrome PASSWORD_BREACH USER_RESOURCE_ACCESS.

The security category is PHISHING.

chrome SENSITIVE_DATA_TRANSFER SCAN_UNCATEGORIZED
chrome UNSAFE_SITE_VISIT NETWORK_UNCATEGORIZED.

The security category is NETWORK_SUSPICIOUS.

chrome BROWSER_CRASH STATUS_UNCATEGORIZED
chrome BROWSER_EXTENSION_INSTALL USER_RESOURCE_UPDATE_CONTENT
chrome CHROMEOS_AFFILIATED_LOCK_SUCCESS USER_LOGOUT
chrome CHROMEOS_AFFILIATED_UNLOCK_FAILURE USER_LOGIN
chrome CHROMEOS_AFFILIATED_UNLOCK_SUCCESS USER_LOGIN
chrome CHROMEOS_PERIPHERAL_ADDED USER_RESOURCE_ACCESS
chrome CHROMEOS_PERIPHERAL_REMOVED USER_RESOURCE_DELETION
chrome CHROMEOS_PERIPHERAL_STATUS_UPDATED USER_RESOURCE_UPDATE_CONTENT
chrome CHROMEOS_UPDATE_FAILURE STATUS_UNCATEGORIZED
chrome CHROMEOS_UPDATE_SUCCESS STATUS_UNCATEGORIZED
chrome CHROME_OS_CRD_CLIENT_CONNECTED USER_LOGIN
chrome CHROME_OS_CRD_HOST_ENDED STATUS_STARTUP
chrome CHROME_OS_CRD_HOST_STARTED STATUS_STARTUP
chrome URL_FILTERING_INTERSTITIAL STATUS_UNCATEGORIZED
context_aware_access ACCESS_DENY_EVENT USER_RESOURCE_ACCESS
context_aware_access ACCESS_DENY_INTERNAL_ERROR_EVENT USER_RESOURCE_ACCESS
context_aware_access MONITOR_MODE_ACCESS_DENY_EVENT USER_RESOURCE_ACCESS
gplus create_comment USER_RESOURCE_CREATION
gplus delete_comment USER_RESOURCE_DELETION
gplus edit_comment USER_RESOURCE_UPDATE_CONTENT
gplus add_plusone STATUS_UPDATE
gplus remove_plusone STATUS_UPDATE
gplus add_poll_vote STATUS_UPDATE
gplus remove_poll_vote STATUS_UPDATE
gplus create_post USER_RESOURCE_CREATION
gplus delete_post USER_RESOURCE_DELETION
gplus content_manager_delete_post USER_RESOURCE_DELETION
gplus edit_post USER_RESOURCE_UPDATE_CONTENT
data_studio ADD_REPORT_EMAIL_DELIVERY USER_UNCATEGORIZED
data_studio CREATE USER_RESOURCE_CREATION
data_studio DATA_EXPORT USER_RESOURCE_ACCESS
data_studio DELETE USER_RESOURCE_DELETION
data_studio DOWNLOAD_REPORT USER_UNCATEGORIZED
data_studio EDIT USER_RESOURCE_UPDATE_CONTENT
data_studio RESTORE USER_RESOURCE_CREATION
data_studio STOP_REPORT_EMAIL_DELIVERY USER_UNCATEGORIZED
data_studio TRASH USER_RESOURCE_DELETION
data_studio UPDATE_REPORT_EMAIL_DELIVERY USER_UNCATEGORIZED
data_studio VIEW USER_RESOURCE_ACCESS
data_studio CHANGE_DATA_SOURCE_ACCESS_TYPE USER_RESOURCE_UPDATE_PERMISSIONS
data_studio CHANGE_ASSET_LINK_SHARING_ACCESS_TYPE USER_RESOURCE_UPDATE_PERMISSIONS
data_studio CHANGE_ASSET_LINK_SHARING_VISIBILITY USER_RESOURCE_UPDATE_PERMISSIONS
data_studio CHANGE_USER_ACCESS USER_CHANGE_PERMISSIONS
mobile APPLICATION_EVENT USER_RESOURCE_UPDATE_CONTENT
mobile APPLICATION_REPORT_EVENT STATUS_UPDATE
mobile DEVICE_REGISTER_UNREGISTER_EVENT USER_RESOURCE_UPDATE_PERMISSIONS
mobile ADVANCED_POLICY_SYNC_EVENT STATUS_UPDATE
mobile DEVICE_ACTION_EVENT USER_RESOURCE_UPDATE_CONTENT
mobile DEVICE_COMPLIANCE_CHANGED_EVENT STATUS_UPDATE
mobile OS_UPDATED_EVENT USER_RESOURCE_UPDATE_CONTENT
mobile DEVICE_OWNERSHIP_CHANGE_EVENT STATUS_UPDATE
mobile DEVICE_SETTINGS_UPDATED_EVENT SETTING_MODIFICATION
mobile APPLE_DEP_DEVICE_UPDATE_ON_APPLE_PORTAL_EVENT STATUS_UPDATE
mobile DEVICE_SYNC_EVENT USER_RESOURCE_UPDATE_CONTENT
mobile RISK_SIGNAL_UPDATED_EVENT STATUS_UPDATE
mobile ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT STATUS_UPDATE
mobile DEVICE_COMPROMISED_EVENT STATUS_UPDATE
mobile FAILED_PASSWORD_ATTEMPTS_EVENT STATUS_UPDATE
mobile SUSPICIOUS_ACTIVITY_EVENT STATUS_UPDATE
groups_enterprise accept_invitation USER_UNCATEGORIZED
groups_enterprise add_info_setting GROUP_MODIFICATION
groups_enterprise add_member GROUP_MODIFICATION
groups_enterprise add_member_role USER_CHANGE_PERMISSIONS
groups_enterprise add_security_setting GROUP_MODIFICATION
groups_enterprise add_service_account_permission USER_CHANGE_PERMISSIONS
groups_enterprise approve_join_request USER_UNCATEGORIZED
groups_enterprise ban_member_with_moderation GROUP_MODIFICATION
groups_enterprise change_info_setting GROUP_MODIFICATION
groups_enterprise change_security_setting GROUP_MODIFICATION
groups_enterprise create_group GROUP_CREATION
groups_enterprise create_namespace GROUP_UNCATEGORIZED
groups_enterprise delete_group GROUP_DELETION
groups_enterprise delete_namespace GROUP_UNCATEGORIZED
groups_enterprise add_dynamic_group_query GROUP_UNCATEGORIZED
groups_enterprise change_dynamic_group_query GROUP_MODIFICATION
groups_enterprise invite_member GROUP_UNCATEGORIZED
groups_enterprise join GROUP_MODIFICATION
groups_enterprise add_membership_expiry GROUP_MODIFICATION
groups_enterprise remove_membership_expiry GROUP_MODIFICATION
groups_enterprise update_membership_expiry GROUP_MODIFICATION
groups_enterprise reject_invitation USER_UNCATEGORIZED
groups_enterprise reject_join_request USER_UNCATEGORIZED
groups_enterprise remove_info_setting GROUP_MODIFICATION
groups_enterprise remove_member GROUP_MODIFICATION
groups_enterprise remove_member_role GROUP_MODIFICATION
groups_enterprise remove_security_setting GROUP_MODIFICATION
groups_enterprise remove_service_account_permission GROUP_MODIFICATION
groups_enterprise request_to_join USER_UNCATEGORIZED
groups_enterprise revoke_invitation USER_UNCATEGORIZED
groups_enterprise unban_member GROUP_MODIFICATION
calendar change_calendar_acls USER_CHANGE_PERMISSIONS
calendar change_calendar_country USER_RESOURCE_UPDATE_CONTENT
calendar create_calendar USER_RESOURCE_CREATION
calendar delete_calendar USER_RESOURCE_DELETION
calendar change_calendar_description USER_RESOURCE_UPDATE_CONTENT
calendar change_calendar_location USER_RESOURCE_UPDATE_CONTENT
calendar change_calendar_timezone USER_RESOURCE_UPDATE_CONTENT
calendar change_calendar_title USER_RESOURCE_UPDATE_CONTENT
calendar notification_triggered USER_UNCATEGORIZED
calendar add_subscription USER_UNCATEGORIZED
calendar delete_subscription STATUS_UPDATE
calendar create_event USER_RESOURCE_UPDATE_CONTENT
calendar delete_event USER_RESOURCE_UPDATE_CONTENT
calendar add_event_guest USER_RESOURCE_UPDATE_CONTENT
calendar change_event_guest_response_auto USER_UNCATEGORIZED
calendar remove_event_guest USER_RESOURCE_UPDATE_CONTENT
calendar change_event_guest_response USER_RESOURCE_UPDATE_CONTENT
calendar change_event USER_RESOURCE_UPDATE_CONTENT
calendar remove_event_from_trash USER_RESOURCE_UPDATE_CONTENT
calendar restore_event USER_RESOURCE_UPDATE_CONTENT
calendar change_event_start_time USER_RESOURCE_UPDATE_CONTENT
calendar change_event_title USER_RESOURCE_UPDATE_CONTENT
calendar transfer_event_requested USER_UNCATEGORIZED
calendar transfer_event_completed USER_UNCATEGORIZED
calendar interop_freebusy_lookup_outbound_successful USER_RESOURCE_ACCESS
calendar interop_freebusy_lookup_inbound_successful USER_RESOURCE_ACCESS
calendar interop_exchange_resource_availability_lookup_successful USER_RESOURCE_ACCESS
calendar interop_exchange_resource_list_lookup_successful USER_RESOURCE_ACCESS
calendar interop_freebusy_lookup_outbound_unsuccessful USER_RESOURCE_ACCESS
calendar interop_freebusy_lookup_inbound_unsuccessful USER_RESOURCE_ACCESS
calendar interop_exchange_resource_availability_lookup_unsuccessful USER_RESOURCE_ACCESS
calendar interop_exchange_resource_list_lookup_unsuccessful USER_RESOURCE_ACCESS
chat add_room_member GROUP_MODIFICATION
chat attachment_download FILE_UNCATEGORIZED
chat attachment_upload FILE_UNCATEGORIZED
chat block_room GROUP_UNCATEGORIZED
chat block_user USER_UNCATEGORIZED
chat direct_message_started USER_UNCATEGORIZED
chat invite_accept USER_UNCATEGORIZED
chat invite_decline USER_UNCATEGORIZED
chat invite_send USER_UNCATEGORIZED
chat message_edited USER_RESOURCE_UPDATE_CONTENT
chat message_posted USER_RESOURCE_CREATION
chat message_reported USER_UNCATEGORIZED
chat message_deleted USER_RESOURCE_DELETION
chat remove_room_member GROUP_MODIFICATION
chat room_created GROUP_CREATED
chat reaction_added USER_UNCATEGORIZED
chat call_ended USER_UNCATEGORIZED
chat presentation_started STATUS_UNCATEGORIZED
chat invitation_sent STATUS_UNCATEGORIZED
chat presentation_stopped STATUS_UNCATEGORIZED
gcp IMPORT_SSH_PUBLIC_KEY USER_UNCATEGORIZED
gcp DELETE_POSIX_ACCOUNT USER_UNCATEGORIZED
gcp DELETE_SSH_PUBLIC_KEY USER_UNCATEGORIZED
gcp GET_SSH_PUBLIC_KEY USER_UNCATEGORIZED
gcp GET_LOGIN_PROFILE USER_UNCATEGORIZED
gcp UPDATE_SSH_PUBLIC_KEY USER_UNCATEGORIZED
drive add_to_folder USER_RESOURCE_CREATION
drive approval_canceled USER_UNCATEGORIZED
drive approval_comment_added USER_UNCATEGORIZED
drive approval_completed USER_UNCATEGORIZED
drive approval_decisions_reset USER_UNCATEGORIZED
drive approval_due_time_change USER_UNCATEGORIZED
drive approval_requested USER_UNCATEGORIZED
drive approval_reviewer_change USER_UNCATEGORIZED
drive approval_reviewer_responded USER_UNCATEGORIZED
drive copy USER_RESOURCE_CREATION
drive create USER_RESOURCE_CREATION
drive delete USER_RESOURCE_DELETION
drive download USER_RESOURCE_ACCESS
drive email_as_attachment EMAIL_TRANSACTION
drive edit USER_RESOURCE_UPDATE_CONTENT
drive label_added USER_UNCATEGORIZED
drive label_added_by_item_create USER_UNCATEGORIZED
drive label_field_changed USER_UNCATEGORIZED
drive label_removed USER_UNCATEGORIZED
drive add_lock USER_UNCATEGORIZED
drive move USER_UNCATEGORIZED
drive preview USER_RESOURCE_ACCESS
drive print USER_UNCATEGORIZED
drive remove_from_folder USER_RESOURCE_DELETION
drive rename USER_RESOURCE_UPDATE_CONTENT
drive untrash USER_RESOURCE_CREATION
drive sheets_import_range USER_RESOURCE_ACCESS
drive source_copy USER_RESOURCE_UPDATE_CONTENT
drive trash USER_RESOURCE_DELETION
drive remove_lock USER_UNCATEGORIZED
drive unmovable_item_reparented USER_UNCATEGORIZED
drive upload USER_RESOURCE_CREATION
drive view USER_RESOURCE_ACCESS
drive connected_sheets_query USER_RESOURCE_ACCESS
drive accept_suggestion USER_RESOURCE_UPDATE_CONTENT
drive create_comment USER_RESOURCE_CREATION
drive create_suggestion USER_RESOURCE_CREATION
drive delete_comment USER_RESOURCE_DELETION
drive delete_suggestion USER_RESOURCE_DELETION
drive edit_comment USER_RESOURCE_UPDATE_CONTENT
drive expire_access_request USER_RESOURCE_UPDATE_PERMISSIONS
drive reassign_comment USER_RESOURCE_UPDATE_CONTENT
drive reject_suggestion USER_RESOURCE_UPDATE_CONTENT
drive reopen_comment USER_RESOURCE_UPDATE_CONTENT
drive request_access USER_RESOURCE_UPDATE_PERMISSIONS
drive resolve_comment USER_RESOURCE_UPDATE_CONTENT
drive deny_access_request USER_UNCATEGORIZED
drive download_forms_response USER_RESOURCE_ACCESS
drive email_collaborators EMAIL_UNCATEGORIZED
drive access_url USER_RESOURCE_ACCESS
drive access_item_content USER_RESOURCE_ACCESS
drive sheets_import_url USER_UNCATEGORIZED
drive apply_security_update USER_RESOURCE_UPDATE_PERMISSIONS
drive shared_drive_apply_security_update USER_RESOURCE_UPDATE_PERMISSIONS
drive shared_drive_remove_security_update USER_RESOURCE_UPDATE_PERMISSIONS
drive publish_change USER_RESOURCE_UPDATE_PERMISSIONS
drive change_acl_editors USER_RESOURCE_UPDATE_PERMISSIONS
drive change_document_access_scope USER_RESOURCE_UPDATE_PERMISSIONS
drive change_document_access_scope_hierarchy_reconciled USER_RESOURCE_UPDATE_PERMISSIONS
drive change_document_visibility USER_RESOURCE_UPDATE_PERMISSIONS
drive change_document_visibility_hierarchy_reconciled USER_RESOURCE_UPDATE_PERMISSIONS
drive remove_security_update USER_RESOURCE_UPDATE_PERMISSIONS
drive shared_drive_membership_change USER_RESOURCE_UPDATE_PERMISSIONS
drive shared_drive_settings_change USER_RESOURCE_UPDATE_PERMISSIONS
drive sheets_import_range_access_change USER_RESOURCE_UPDATE_PERMISSIONS
drive change_user_access USER_CHANGE_PERMISSIONS
drive change_user_access_hierarchy_reconciled USER_CHANGE_PERMISSIONS
drive change_owner USER_CHANGE_PERMISSIONS
drive publish_new_version USER_UNCATEGORIZED
drive change_owner_hierarchy_reconciled USER_CHANGE_PERMISSIONS
drive team_drive_membership_change USER_CHANGE_PERMISSIONS
drive team_drive_settings_change USER_CHANGE_PERMISSIONS
drive storage_usage_update USER_RESOURCE_ACCESS
groups change_acl_permission GROUP_MODIFICATION
groups accept_invitation USER_UNCATEGORIZED
groups approve_join_request USER_UNCATEGORIZED
groups join GROUP_MODIFICATION
groups request_to_join USER_UNCATEGORIZED
groups change_basic_setting GROUP_MODIFICATION
groups create_group GROUP_CREATION
groups delete_group GROUP_DELETION
groups change_identity_setting GROUP_MODIFICATION
groups add_info_setting GROUP_MODIFICATION
groups change_info_setting GROUP_MODIFICATION
groups remove_info_setting GROUP_MODIFICATION
groups change_new_members_restrictions_setting GROUP_UNCATEGORIZED
groups change_post_replies_setting GROUP_MODIFICATION
groups change_spam_moderation_setting GROUP_MODIFICATION
groups change_topic_setting GROUP_MODIFICATION
groups moderate_message GROUP_MODIFICATION
groups always_post_from_user USER_UNCATEGORIZED
groups add_user GROUP_MODIFICATION
groups ban_user_with_moderation GROUP_MODIFICATION
groups revoke_invitation USER_UNCATEGORIZED
groups invite_user USER_UNCATEGORIZED
groups reject_join_request USER_UNCATEGORIZED
groups reinvite_user USER_UNCATEGORIZED
groups remove_user GROUP_MODIFICATION
groups change_email_subscription_type GROUP_MODIFICATION
groups unsubscribe_via_mail USER_UNCATEGORIZED
keep deleted_attachment USER_UNCATEGORIZED
keep uploaded_attachment USER_UNCATEGORIZED
keep edited_note_content USER_RESOURCE_UPDATE_CONTENT
keep created_note USER_RESOURCE_CREATION
keep deleted_note USER_RESOURCE_DELETION
keep modified_acl USER_RESOURCE_UPDATE_PERMISSIONS
meet abuse_report_submitted USER_UNCATEGORIZED
meet call_ended USER_UNCATEGORIZED
meet livestream_watched USER_COMMUNICATION
meet invitation_sent STATUS_UNCATEGORIZED
meet presentation_started STATUS_UNCATEGORIZED
meet presentation_stopped STATUS_UNCATEGORIZED
meet knocking_denied STATUS_UNCATEGORIZED
meet knocking_accepted STATUS_UNCATEGORIZED
meet recording_activity STATUS_UNCATEGORIZED
meet dialed_out STATUS_UNCATEGORIZED
token activity USER_RESOURCE_ACCESS
token authorize USER_RESOURCE_ACCESS
token revoke USER_RESOURCE_UPDATE_PERMISSIONS
rules action_complete USER_RESOURCE_ACCESS
rules rule_match USER_RESOURCE_ACCESS
rules rule_trigger USER_RESOURCE_ACCESS
rules label_field_value_changed USER_RESOURCE_UPDATE_CONTENT
rules label_applied USER_RESOURCE_UPDATE_CONTENT
rules sharing_blocked USER_RESOURCE_UPDATE_CONTENT
rules content_matched USER_RESOURCE_ACCESS
rules content_unmatched USER_RESOURCE_ACCESS
saml login_failure USER_LOGIN
saml login_success USER_LOGIN
user_accounts 2sv_disable USER_UNCATEGORIZED
user_accounts 2sv_enroll USER_UNCATEGORIZED
user_accounts password_edit USER_UNCATEGORIZED
user_accounts recovery_email_edit USER_UNCATEGORIZED
user_accounts recovery_phone_edit USER_UNCATEGORIZED
user_accounts recovery_secret_qa_edit USER_UNCATEGORIZED
user_accounts titanium_enroll USER_UNCATEGORIZED
user_accounts titanium_unenroll USER_UNCATEGORIZED
user_accounts email_forwarding_out_of_domain USER_UNCATEGORIZED
jamboard DEVICE_LICENSE_ENROLLMENT_CHANGE SETTING_MODIFICATION
jamboard DEVICE_OTA_UPDATE_REQUESTED SETTING_MODIFICATION
jamboard DEVICE_PROVISIONING_CHANGE SETTING_MODIFICATION
jamboard DEVICE_REBOOT_REQUESTED USER_UNCATEGORIZED
jamboard EXPORT_JAMBOARD_FLEET USER_UNCATEGORIZED
jamboard ADB_ENABLED_STATE_CHANGE SETTING_MODIFICATION
jamboard DEVICE_ADDITIONAL_IMES_CHANGE SETTING_MODIFICATION
jamboard DEVICE_LOGGING_CHANGE SETTING_MODIFICATION
jamboard DEMO_MODE_AVAILABILITY_CHANGE SETTING_MODIFICATION
jamboard DEMO_MODE_CHANGE SETTING_MODIFICATION
jamboard FINGER_ERASING_CHANGE SETTING_MODIFICATION
jamboard DEVICE_LANGUAGE_CHANGE SETTING_MODIFICATION
jamboard DEVICE_LOCATION_CHANGE STATUS_UPDATE
jamboard DEVICE_NAME_CHANGE STATUS_UPDATE
jamboard DEVICE_NOTE_CHANGE STATUS_UPDATE
jamboard DEVICE_PAIRING_CHANGE SETTING_MODIFICATION
jamboard SCREENSAVER_TIMEOUT_CHANGE SETTING_MODIFICATION
jamboard DEVICE_SETTING_LOCKED SETTING_MODIFICATION
jamboard DEVICE_SETTING_UNLOCKED SETTING_MODIFICATION
jamboard VIDEOCONF_ENABLED_CHANGE SETTING_MODIFICATION
jamboard DEVICE_UPDATE STATUS_UPDATE
login 2sv_disable SERVICE_STOP
login 2sv_enroll SERVICE_START
login password_edit USER_CHANGE_PASSWORD
login recovery_email_edit USER_UNCATEGORIZED
login recovery_phone_edit USER_UNCATEGORIZED
login recovery_secret_qa_edit USER_UNCATEGORIZED
login account_disabled_password_leak USER_UNCATEGORIZED
login suspicious_login USER_LOGIN
login suspicious_login_less_secure_app USER_LOGIN
login suspicious_programmatic_login USER_LOGIN
login account_disabled_generic USER_UNCATEGORIZED
login account_disabled_spamming_through_relay USER_UNCATEGORIZED
login account_disabled_spamming USER_UNCATEGORIZED
login account_disabled_hijacked USER_UNCATEGORIZED
login titanium_enroll USER_UNCATEGORIZED
login titanium_unenroll USER_UNCATEGORIZED
login gov_attack_warning STATUS_UNCATEGORIZED
login email_forwarding_out_of_domain USER_UNCATEGORIZED
login login_failure USER_LOGIN.

The security category is AUTH_VIOLATION.

login login_challenge USER_LOGIN
login login_verification USER_LOGIN
login logout USER_LOGOUT
login login_success USER_LOGIN
login risky_sensitive_action_allowed USER_LOGIN
login risky_sensitive_action_blocked USER_LOGIN
login blocked_sender STATUS_UNCATEGORIZED
admin DELETE_2SV_SCRATCH_CODES USER_RESOURCE_DELETION
admin GENERATE_2SV_SCRATCH_CODES USER_RESOURCE_CREATION
admin REVOKE_3LO_DEVICE_TOKENS USER_RESOURCE_ACCESS
admin REVOKE_3LO_TOKEN USER_RESOURCE_ACCESS
admin ADD_RECOVERY_EMAIL USER_RESOURCE_CREATION
admin ADD_RECOVERY_PHONE USER_RESOURCE_CREATION
admin GRANT_ADMIN_PRIVILEGE USER_CHANGE_PERMISSIONS
admin REVOKE_ADMIN_PRIVILEGE USER_CHANGE_PERMISSIONS
admin REVOKE_ASP USER_CHANGE_PERMISSIONS
admin TOGGLE_AUTOMATIC_CONTACT_SHARING SETTING_MODIFICATION
admin BULK_UPLOAD USER_RESOURCE_CREATION
admin BULK_UPLOAD_NOTIFICATION_SENT USER_UNCATEGORIZED
admin CANCEL_USER_INVITE USER_UNCATEGORIZED
admin CHANGE_USER_CUSTOM_FIELD USER_UNCATEGORIZED
admin CHANGE_USER_EXTERNAL_ID USER_UNCATEGORIZED
admin CHANGE_USER_GENDER USER_UNCATEGORIZED
admin CHANGE_USER_IM USER_UNCATEGORIZED
admin ENABLE_USER_IP_WHITELIST USER_UNCATEGORIZED
admin CHANGE_USER_KEYWORD USER_UNCATEGORIZED
admin CHANGE_USER_LANGUAGE USER_UNCATEGORIZED
admin CHANGE_USER_LOCATION USER_UNCATEGORIZED
admin CHANGE_USER_ORGANIZATION USER_UNCATEGORIZED
admin CHANGE_USER_PHONE_NUMBER USER_UNCATEGORIZED
admin CHANGE_RECOVERY_EMAIL USER_UNCATEGORIZED
admin CHANGE_RECOVERY_PHONE USER_UNCATEGORIZED
admin CHANGE_USER_RELATION USER_UNCATEGORIZED
admin CHANGE_USER_ADDRESS USER_UNCATEGORIZED
admin CREATE_EMAIL_MONITOR SERVICE_CREATION
admin CREATE_DATA_TRANSFER_REQUEST USER_UNCATEGORIZED
admin GRANT_DELEGATED_ADMIN_PRIVILEGES USER_CHANGE_PERMISSIONS
admin DELETE_ACCOUNT_INFO_DUMP USER_RESOURCE_DELETION
admin DELETE_EMAIL_MONITOR SERVICE_DELETION
admin DELETE_MAILBOX_DUMP USER_RESOURCE_DELETION
admin DELETE_PROFILE_PHOTO USER_RESOURCE_DELETION
admin CHANGE_DISPLAY_NAME USER_UNCATEGORIZED
admin CHANGE_FIRST_NAME USER_UNCATEGORIZED
admin GMAIL_RESET_USER USER_UNCATEGORIZED
admin CHANGE_LAST_NAME USER_UNCATEGORIZED
admin MAIL_ROUTING_DESTINATION_ADDED USER_RESOURCE_CREATION
admin MAIL_ROUTING_DESTINATION_REMOVED USER_RESOURCE_DELETION
admin ADD_NICKNAME USER_UNCATEGORIZED
admin REMOVE_NICKNAME USER_UNCATEGORIZED
admin CHANGE_PASSWORD USER_CHANGE_PASSWORD
admin CHANGE_PASSWORD_ON_NEXT_LOGIN USER_CHANGE_PASSWORD
admin DOWNLOAD_PENDING_INVITES_LIST STATUS_UNCATEGORIZED
admin REMOVE_RECOVERY_EMAIL USER_RESOURCE_DELETION
admin REMOVE_RECOVERY_PHONE USER_RESOURCE_DELETION
admin REQUEST_ACCOUNT_INFO USER_UNCATEGORIZED
admin REQUEST_MAILBOX_DUMP USER_UNCATEGORIZED
admin RESEND_USER_INVITE USER_UNCATEGORIZED
admin RESET_SIGNIN_COOKIES USER_RESOURCE_UPDATE_CONTENT
admin SECURITY_KEY_REGISTERED_FOR_USER USER_RESOURCE_CREATION
admin REVOKE_SECURITY_KEY USER_RESOURCE_UPDATE_PERMISSIONS
admin USER_INVITE USER_UNCATEGORIZED
admin VIEW_TEMP_PASSWORD USER_UNCATEGORIZED
admin TURN_OFF_2_STEP_VERIFICATION USER_RESOURCE_UPDATE_PERMISSIONS
admin UNBLOCK_USER_SESSION USER_UNCATEGORIZED
admin UNMANAGED_USERS_BULK_UPLOAD USER_RESOURCE_CREATION
admin DOWNLOAD_UNMANAGED_USERS_LIST USER_UNCATEGORIZED
admin UPDATE_PROFILE_PHOTO USER_RESOURCE_UPDATE_CONTENT
admin UNENROLL_USER_FROM_TITANIUM USER_UNCATEGORIZED
admin ARCHIVE_USER USER_UNCATEGORIZED
admin UPDATE_BIRTHDATE USER_UNCATEGORIZED
admin CREATE_USER USER_CREATION
admin DELETE_USER USER_DELETION
admin DOWNGRADE_USER_FROM_GPLUS USER_CHANGE_PERMISSIONS
admin USER_ENROLLED_IN_TWO_STEP_VERIFICATION USER_UNCATEGORIZED
admin DOWNLOAD_USERLIST_CSV STATUS_UNCATEGORIZED
admin MOVE_USER_TO_ORG_UNIT USER_UNCATEGORIZED
admin USER_PUT_IN_TWO_STEP_VERIFICATION_GRACE_PERIOD USER_UNCATEGORIZED
admin RENAME_USER USER_RESOURCE_UPDATE_CONTENT
admin UNENROLL_USER_FROM_STRONG_AUTH USER_UNCATEGORIZED
admin SUSPEND_USER USER_UNCATEGORIZED
admin UNARCHIVE_USER USER_UNCATEGORIZED
admin UNDELETE_USER USER_UNCATEGORIZED
admin UNSUSPEND_USER USER_UNCATEGORIZED
admin UPGRADE_USER_TO_GPLUS USER_CHANGE_PERMISSIONS
admin USERS_BULK_UPLOAD USER_RESOURCE_CREATION
admin USERS_BULK_UPLOAD_NOTIFICATION_SENT USER_UNCATEGORIZED
admin ASSIGN_ROLE USER_RESOURCE_UPDATE_PERMISSIONS
admin CREATE_ROLE USER_RESOURCE_CREATION
admin UNASSIGN_ROLE USER_RESOURCE_UPDATE_PERMISSIONS
admin AUTHORIZE_API_CLIENT_ACCESS USER_RESOURCE_ACCESS
admin ADD_TRUSTED_DOMAINS USER_RESOURCE_UPDATE_CONTENT
admin CHANGE_DOMAIN_DEFAULT_TIMEZONE USER_RESOURCE_UPDATE_CONTENT
admin CHANGE_DOMAIN_DEFAULT_LOCALE USER_RESOURCE_UPDATE_CONTENT
admin CREATE_ALERT USER_RESOURCE_CREATION
admin REMOVE_APPLICATION USER_RESOURCE_DELETION
admin ADD_APPLICATION USER_RESOURCE_CREATION
admin REMOVE_API_CLIENT_ACCESS USER_RESOURCE_DELETION
admin CHANGE_SSO_SETTINGS SETTING_MODIFICATION
admin ALERT_CENTER_VIEW STATUS_UNCATEGORIZED
admin ALERT_CENTER_LIST_FEEDBACK STATUS_UNCATEGORIZED
admin ALERT_CENTER_GET_SIT_LINK STATUS_UNCATEGORIZED
admin ALERT_CENTER_LIST_CHANGE STATUS_UNCATEGORIZED
admin ALERT_CENTER_LIST_RELATED_ALERTS STATUS_UNCATEGORIZED
admin EMAIL_LOG_SEARCH EMAIL_UNCATEGORIZED
admin CHANGE_EMAIL_SETTING SETTING_MODIFICATION
admin CREATE_GMAIL_SETTING SETTING_MODIFICATION
admin CHANGE_GMAIL_SETTING SETTING_MODIFICATION
admin DELETE_GMAIL_SETTING SETTING_MODIFICATION
admin RELEASE_FROM_QUARANTINE EMAIL_UNCATEGORIZED
admin SECURITY_INVESTIGATION_QUERY STATUS_UNCATEGORIZED
admin SECURITY_INVESTIGATION_ACTION STATUS_UNCATEGORIZED
admin SECURITY_INVESTIGATION_OBJECT_CREATE_DRAFT_INVESTIGATION STATUS_UNCATEGORIZED
admin SECURITY_INVESTIGATION_ACTION_COMPLETION STATUS_UNCATEGORIZED
admin SECURITY_INVESTIGATION_EXPORT_QUERY STATUS_UNCATEGORIZED
admin SECURITY_INVESTIGATION_ACTION_CANCELLATION STATUS_UNCATEGORIZED
admin CHANGE_GROUP_SETTING GROUP_MODIFICATION
admin ADD_GROUP_MEMBER GROUP_MODIFICATION
admin CREATE_GROUP GROUP_CREATION
admin REMOVE_GROUP_MEMBER GROUP_MODIFICATION
admin UPDATE_GROUP_MEMBER_DELIVERY_SETTINGS GROUP_MODIFICATION
admin UPDATE_GROUP_MEMBER GROUP_MODIFICATION
admin DELETE_GROUP GROUP_DELETION
admin USER_LICENSE_ASSIGNMENT USER_RESOURCE_UPDATE_PERMISSIONS
admin USER_LICENSE_REVOKE USER_RESOURCE_UPDATE_PERMISSIONS
admin SECURITY_CHART_DRILLDOWN STATUS_UNCATEGORIZED
admin SYSTEM_DEFINED_RULE_UPDATED SETTING_MODIFICATION
admin CUSTOMER_USER_DEVICE_DELETION_EVENT USER_RESOURCE_DELETION
admin ADD_MOBILE_APPLICATION_TO_WHITELIST USER_RESOURCE_UPDATE_CONTENT
admin REMOVE_MOBILE_APPLICATION_FROM_WHITELIST USER_RESOURCE_UPDATE_CONTENT
admin CHANGE_MOBILE_APPLICATION_SETTINGS SETTING_MODIFICATION
admin ACTION_REQUESTED USER_UNCATEGORIZED
admin CREATE_APPLICATION_SETTING SETTING_CREATION
admin CHANGE_APPLICATION_SETTING SETTING_MODIFICATION
admin CREATE_SAML2_SERVICE_PROVIDER_CONFIG SETTING_CREATION
admin DELETE_SAML2_SERVICE_PROVIDER_CONFIG SETTING_DELETION
admin TOGGLE_SERVICE_ENABLED SETTING_MODIFICATION
admin CREATE_ORG_UNIT USER_RESOURCE_CREATION
admin MOVE_ORG_UNIT USER_RESOURCE_UPDATE_CONTENT
admin EDIT_ORG_UNIT_NAME USER_RESOURCE_UPDATE_CONTENT
admin REMOVE_ORG_UNIT USER_RESOURCE_DELETION
admin UNASSIGN_CUSTOM_LOGO USER_RESOURCE_UPDATE_CONTENT
admin ASSIGN_CUSTOM_LOGO USER_RESOURCE_UPDATE_CONTENT
admin EDIT_ORG_UNIT_DESCRIPTION USER_RESOURCE_UPDATE_CONTENT
admin CHANGE_DOCS_SETTING SETTING_MODIFICATION
admin CHANGE_CALENDAR_SETTING SETTING_MODIFICATION
admin SESSION_CONTROL_SETTINGS_CHANGE SETTING_MODIFICATION
admin DISALLOW_SERVICE_FOR_OAUTH2_ACCESS SETTING_MODIFICATION
admin ALLOW_STRONG_AUTHENTICATION SETTING_MODIFICATION
admin ENFORCE_STRONG_AUTHENTICATION SETTING_MODIFICATION
admin CHANGE_TWO_STEP_VERIFICATION_FREQUENCY SETTING_MODIFICATION
admin CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION SETTING_MODIFICATION
admin CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION SETTING_MODIFICATION
admin CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS SETTING_MODIFICATION
admin CHANGE_TWO_STEP_VERIFICATION_START_DATE SETTING_MODIFICATION
admin WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED SETTING_MODIFICATION
admin ADD_TO_BLOCKED_OAUTH2_APPS STATUS_UPDATE
admin ADD_TO_TRUSTED_OAUTH2_APPS STATUS_UPDATE
admin GENERATE_CERTIFICATE USER_RESOURCE_CREATION
admin ENABLE_DIRECTORY_SYNC SETTING_MODIFICATION
admin CHANGE_DEVICE_STATE STATUS_UPDATE
admin UPDATE_ACCESS_LEVEL_V2 USER_RESOURCE_UPDATE_PERMISSIONS
admin UPDATE_AUTO_PROVISIONED_USER STATUS_UPDATE
admin SECURITY_CENTER_RULE_THRESHOLD_TRIGGER STATUS_UPDATE
gmail EMAIL_TRANSACTION

Referência de mapeamento de campo: WORKSPACE_ACTIVITY-Common Fields

A tabela a seguir lista campos comuns do tipo de registro WORKSPACE_ACTIVITY e os campos correspondentes do UDM.

Log field UDM mapping Logic
actor.callerType target.user.attribute.labels[caller_type] If the event.name log field value is equal to one of the following values, then the actor.callerType log field is mapped to the target.user.attribute.labels UDM field:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_failure
  • login_challenge
  • login_verification
  • login_success
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
actor.callerType principal.user.attribute.labels[caller_type] If the event.name log field value is not equal to one of the following values, then the actor.callerType log field is mapped to the principal.user.attribute.labels UDM field:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_failure
  • login_challenge
  • login_verification
  • login_success
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked


If the id.applicationName log field value is equal to gmail, then principal.user.attribute.labels.key UDM field is set to actor_caller_type and actor.callerType log field is mapped to principal.user.attribute.labels.value UDM field.
actor.email target.user.email_addresses If the event.name log field value is equal to one of the following values, then the actor.email log field is mapped to the target.user.email_addresses UDM field:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_failure
  • login_challenge
  • login_verification
  • login_success
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked


If the id.applicationName log field value is equal to gmail, then actor.email log field is mapped to principal.user.email_addresses UDM field.
actor.email principal.user.email_addresses If the event.name log field value is not equal to one of the following values, then the actor.email log field is mapped to the principal.user.email_addresses UDM field:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_failure
  • login_challenge
  • login_verification
  • login_success
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
actor.email security_result.about.email
actor.key target.user.attribute.labels[actor_key] If the event.name log field value is equal to one of the following values, then the actor.key log field is mapped to the target.user.attribute.labels[actor_key] UDM field:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_failure
  • login_challenge
  • login_verification
  • login_success
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
actor.key principal.user.attribute.labels[actor_key] If the event.name log field value is not equal to one of the following values, then the actor.key log field is mapped to the principal.user.attribute.labels[actor_key] UDM field:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_failure
  • login_challenge
  • login_verification
  • login_success
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
actor.key target.user.userid The actor.key log field is mapped to the target.user.userid UDM field if the following conditions are met:
  • The actor.callerType log field value is equal to KEY.
  • The event.name log field value is equal to one of the following values:
    • CHROME_OS_LOGIN_FAILURE_EVENT
    • CHROME_OS_LOGIN_LOGOUT_EVENT
    • CHROME_OS_LOGIN_EVENT
    • LOGIN_EVENT
    • login_failure
    • login_success
    • suspicious_login
    • suspicious_login_less_secure_app
    • suspicious_programmatic_login
    • login_failure
    • login_challenge
    • login_verification
    • login_success
    • risky_sensitive_action_allowed
    • logout
    • CHROME_OS_LOGOUT_EVENT
    • risky_sensitive_action_blocked
actor.key principal.user.userid The actor.key log field is mapped to the principal.user.userid UDM field if the following conditions are met:
  • The actor.callerType log field value is equal to KEY.
  • If the event.name log field value is not equal to one of the following values:
    • CHROME_OS_LOGIN_FAILURE_EVENT
    • CHROME_OS_LOGIN_LOGOUT_EVENT
    • CHROME_OS_LOGIN_EVENT
    • LOGIN_EVENT
    • login_failure
    • login_success
    • suspicious_login
    • suspicious_login_less_secure_app
    • suspicious_programmatic_login
    • login_failure
    • login_challenge
    • login_verification
    • login_success
    • risky_sensitive_action_allowed
    • logout
    • CHROME_OS_LOGOUT_EVENT
    • risky_sensitive_action_blocked
actor.profileId target.user.product_object_id If the event.name log field value is equal to one of the following values, then the actor.profileId log field is mapped to the target.user.product_object_id UDM field:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_failure
  • login_challenge
  • login_verification
  • login_success
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
actor.profileId principal.user.product_object_id If the event.name log field value is not equal to one of the following values, then the actor.profileId log field is mapped to the principal.user.product_object_id UDM field:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_failure
  • login_challenge
  • login_verification
  • login_success
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
etag metadata.product_log_id
events.name metadata.product_event_type
events.type security_result.category_details
id.applicationName metadata.product_name
id.customerId about.resource.product_object_id
id.time metadata.event_timestamp
id.uniqueQualifier metadata.product_log_id
ipAddress principal.ip
kind about.labels[kind] (deprecated)
kind additional.fields[kind]
ownerDomain target.administrative_domain If the target.resource log field value is not empty, then the ownerDomain log field is mapped to the target.administrative_domain UDM field.

If the principal.resource log field value is not empty, then the ownerDomain log field is mapped to the principal.administrative_domain

If the id.applicationName log field value is equal to gmail, then ownerDomain log field is mapped to principal.administrative_domain UDM field.
about.resource.resource_type The about.resource.resource_type UDM field is set to CLOUD_ORGANIZATION.
metadata.vendor_name The metadata.vendor_name UDM field is set to GOOGLE.
actor.gaiaId principal.user.product_object_id If the event.name log field value is not equal to one of the following values, then the actor.gaiaId log field is mapped to the principal.user.product_object_id UDM field:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_failure
  • login_challenge
  • login_verification
  • login_success
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
actor.gaiaId target.user.product_object_id If the event.name log field value is equal to one of the following values, then the actor.gaiaId log field is mapped to the target.user.product_object_id UDM field:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_failure
  • login_challenge
  • login_verification
  • login_success
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
actor.orgunitPath principal.user.attribute.labels[org_unit_path] If the event.name log field value is not equal to one of the following values, then the actor.orgunitPath log field is mapped to the principal.user.attribute.labels[org_unit_path] UDM field:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_failure
  • login_challenge
  • login_verification
  • login_success
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
actor.orgunitPath target.user.attribute.labels[org_unit_path] If the event.name log field value is equal to one of the following values, then the actor.orgunitPath log field is mapped to the target.user.attribute.labels[org_unit_path] UDM field:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_failure
  • login_challenge
  • login_verification
  • login_success
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
actor.groupId principal.user.group_identifiers If the event.name log field value is not equal to one of the following values, then the actor.groupId log field is mapped to the principal.user.group_identifiers UDM field:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_failure
  • login_challenge
  • login_verification
  • login_success
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked
actor.groupId target.user.group_identifiers If the event.name log field value is equal to one of the following values, then the actor.groupId log field is mapped to the target.user.group_identifiers UDM field:
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • LOGIN_EVENT
  • login_failure
  • login_success
  • suspicious_login
  • suspicious_login_less_secure_app
  • suspicious_programmatic_login
  • login_failure
  • login_challenge
  • login_verification
  • login_success
  • risky_sensitive_action_allowed
  • logout
  • CHROME_OS_LOGOUT_EVENT
  • risky_sensitive_action_blocked

Referência de mapeamento de campo: WORKSPACE_ACTIVITY

A tabela a seguir lista os campos de registro do tipo de registro WORKSPACE_ACTIVITY e os campos correspondentes do UDM.

Workspace application Log field UDM mapping Logic
access_transparency ACCESS_APPROVAL_REQUEST_IDS about.labels [access_approval_request_ids] (deprecated)
access_transparency ACCESS_APPROVAL_REQUEST_IDS additional.fields [access_approval_request_ids]
access_transparency ACCESS_MANAGEMENT_POLICY about.labels [access_management_policy] (deprecated)
access_transparency ACCESS_MANAGEMENT_POLICY additional.fields [access_management_policy]
access_transparency ACTOR_HOME_OFFICE principal.user.office_address.country_or_region If the event.name log field value is equal to ACCESS, then the ACTOR_HOME_OFFICE log field is mapped to the principal.user.office_address.country_or_region UDM field.
access_transparency GSUITE_PRODUCT_NAME target.application If the event.name log field value is equal to ACCESS, then the GSUITE_PRODUCT_NAME log field is mapped to the target.application UDM field.
access_transparency JUSTIFICATIONS about.labels [justifications] (deprecated) If the event.name log field value is equal to ACCESS, then the JUSTIFICATIONS log field is mapped to the about.labels UDM field.
access_transparency JUSTIFICATIONS additional.fields [justifications] If the event.name log field value is equal to ACCESS, then the JUSTIFICATIONS log field is mapped to the additional.fields UDM field.
access_transparency LOG_ID about.labels [logid] (deprecated) If the event.name log field value is equal to ACCESS, then the LOG_ID log field is mapped to the about.labels UDM field.
access_transparency LOG_ID additional.fields [logid] If the event.name log field value is equal to ACCESS, then the LOG_ID log field is mapped to the additional.fields UDM field.
access_transparency ON_BEHALF_OF about.labels [on_behalf_of] (deprecated) If the event.name log field value is equal to ACCESS, then the ON_BEHALF_OF log field is mapped to the about.labels UDM field.
access_transparency ON_BEHALF_OF additional.fields [on_behalf_of] If the event.name log field value is equal to ACCESS, then the ON_BEHALF_OF log field is mapped to the additional.fields UDM field.
access_transparency OWNER_EMAIL target.user.email_addresses If the event.name log field value is equal to ACCESS, then the OWNER_EMAIL log field is mapped to the target.user.email_addresses UDM field.
access_transparency RESOURCE_NAME target.resource.name If the event.name log field value is equal to ACCESS, then the RESOURCE_NAME log field is mapped to the target.resource.name UDM field.
access_transparency TICKETS about.labels [tickets] (deprecated)
access_transparency TICKETS additional.fields [tickets]
chrome DEVICE_NAME target.asset.attribute.labels [device_name] If the event.name log field value is equal to one of the following values, then the DEVICE_NAME log field is mapped to the target.asset.attribute.labels UDM field:
  • CHROME_OS_ADD_USER
  • CHROME_OS_REMOVE_USER
  • DEVICE_BOOT_STATE_CHANGE
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • CHROME_OS_LOGOUT_EVENT
  • CHROME_OS_REPORTING_DATA_LOST
  • PASSWORD_CHANGED
  • PASSWORD_REUSE
  • DLP_EVENT
  • CONTENT_TRANSFER
  • CONTENT_UNSCANNED
  • EXTENSION_REQUEST
  • LOGIN_EVENT
  • MALWARE_TRANSFER
  • PASSWORD_BREACH
  • SENSITIVE_DATA_TRANSFER
  • UNSAFE_SITE_VISIT
  • BROWSER_EXTENSION_INSTALL
  • CHROMEOS_AFFILIATED_LOCK_SUCCESS
  • CHROMEOS_AFFILIATED_UNLOCK_FAILURE
  • CHROMEOS_AFFILIATED_UNLOCK_SUCCESS
  • CHROMEOS_PERIPHERAL_ADDED
  • CHROMEOS_PERIPHERAL_REMOVED
  • CHROMEOS_PERIPHERAL_STATUS_UPDATED
  • CHROMEOS_UPDATE_FAILURE
  • CHROMEOS_UPDATE_SUCCESS
  • CHROME_OS_CRD_CLIENT_CONNECTED
  • CHROME_OS_CRD_HOST_ENDED
  • CHROME_OS_CRD_HOST_STARTED
  • URL_FILTERING_INTERSTITIAL
  • BROWSER_CRASH
chrome DEVICE_PLATFORM target.asset.platform_software.platform If the DEVICE_PLATFORM log field value matches windows, then the target.asset.platform_software.platform UDM field is set to WINDOWS.

If the DEVICE_PLATFORM log field value matches mac, then the target.asset.platform_software.platform UDM field is set to MAC.

If the DEVICE_PLATFORM log field value matches linux, then the target.asset.platform_software.platform UDM field is set to LINUX.

Else, the target.asset.platform_software.platform UDM field is set to UNKNOWN_PLATFORM.
chrome DEVICE_USER principal.user.user_display_name If the event.name log field value is equal to LOGIN_EVENT, then the DEVICE_USER log field is mapped to the principal.user.user_display_name UDM field.
chrome LOGIN_USER_NAME target.user.user_display_name If the event.name log field value is equal to LOGIN_EVENT, then the LOGIN_USER_NAME log field is mapped to the target.user.user_display_name UDM field.
chrome DEVICE_USER target.user.user_display_name If the event.name log field value is equal to one of the following values, then the DEVICE_USER log field is mapped to the target.user.user_display_name UDM field:
  • CHROME_OS_ADD_USER
  • CHROME_OS_REMOVE_USER
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • CHROME_OS_LOGOUT_EVENT
  • PASSWORD_CHANGED
  • PASSWORD_REUSE
  • DLP_EVENT
  • CONTENT_TRANSFER
  • CONTENT_UNSCANNED
  • EXTENSION_REQUEST
  • LOGIN_EVENT
  • MALWARE_TRANSFER
  • PASSWORD_BREACH
  • SENSITIVE_DATA_TRANSFER
  • UNSAFE_SITE_VISIT
  • BROWSER_EXTENSION_INSTALL
  • CHROMEOS_AFFILIATED_LOCK_SUCCESS
  • CHROMEOS_AFFILIATED_UNLOCK_FAILURE
  • CHROMEOS_AFFILIATED_UNLOCK_SUCCESS
  • CHROMEOS_PERIPHERAL_ADDED
  • CHROMEOS_PERIPHERAL_REMOVED
  • CHROMEOS_PERIPHERAL_STATUS_UPDATED
  • CHROMEOS_UPDATE_FAILURE
  • CHROMEOS_UPDATE_SUCCESS
  • CHROME_OS_CRD_CLIENT_CONNECTED
  • CHROME_OS_CRD_HOST_ENDED
  • CHROME_OS_CRD_HOST_STARTED
  • URL_FILTERING_INTERSTITIAL
  • BROWSER_CRASH


If the event.name log field value is equal to LOGIN_EVENT, then the LOGIN_USER_NAME log field is mapped to the target.user.user_display_name UDM field.
chrome PROFILE_USER_NAME target.user.attribute.labels [profile_user_name] If the event.name log field value is equal to one of the following values, then the PROFILE_USER_NAME log field is mapped to the target.user.attribute.labels UDM field:
  • PASSWORD_CHANGED
  • PASSWORD_REUSE
  • CONTENT_TRANSFER
  • CONTENT_UNSCANNED
  • LOGIN_EVENT
  • MALWARE_TRANSFER
  • PASSWORD_BREACH
  • SENSITIVE_DATA_TRANSFER
  • UNSAFE_SITE_VISIT
  • URL_FILTERING_INTERSTITIAL
chrome DIRECTORY_DEVICE_ID about.labels [directory_device_id] (deprecated) If the event.name log field value is equal to one of the following values, then the DIRECTORY_DEVICE_ID log field is mapped to the about.labels UDM field:
  • CHROME_OS_ADD_USER
  • CHROME_OS_REMOVE_USER
  • DEVICE_BOOT_STATE_CHANGE
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • CHROME_OS_LOGOUT_EVENT
  • CHROME_OS_REPORTING_DATA_LOST
  • PASSWORD_CHANGED
  • PASSWORD_REUSE
  • CONTENT_TRANSFER
  • CONTENT_UNSCANNED
  • EXTENSION_REQUEST
  • LOGIN_EVENT
  • MALWARE_TRANSFER
  • PASSWORD_BREACH
  • SENSITIVE_DATA_TRANSFER
  • UNSAFE_SITE_VISIT
  • BROWSER_EXTENSION_INSTALL
  • CHROMEOS_AFFILIATED_LOCK_SUCCESS
  • CHROMEOS_AFFILIATED_UNLOCK_FAILURE
  • CHROMEOS_AFFILIATED_UNLOCK_SUCCESS
  • CHROMEOS_PERIPHERAL_ADDED
  • CHROMEOS_PERIPHERAL_REMOVED
  • CHROMEOS_PERIPHERAL_STATUS_UPDATED
  • CHROMEOS_UPDATE_FAILURE
  • CHROMEOS_UPDATE_SUCCESS
  • CHROME_OS_CRD_CLIENT_CONNECTED
  • CHROME_OS_CRD_HOST_ENDED
  • CHROME_OS_CRD_HOST_STARTED
  • URL_FILTERING_INTERSTITIAL
  • BROWSER_CRASH
chrome DIRECTORY_DEVICE_ID additional.fields [directory_device_id] If the event.name log field value is equal to one of the following values, then the DIRECTORY_DEVICE_ID log field is mapped to the additional.fields UDM field:
  • CHROME_OS_ADD_USER
  • CHROME_OS_REMOVE_USER
  • DEVICE_BOOT_STATE_CHANGE
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • CHROME_OS_LOGOUT_EVENT
  • CHROME_OS_REPORTING_DATA_LOST
  • PASSWORD_CHANGED
  • PASSWORD_REUSE
  • CONTENT_TRANSFER
  • CONTENT_UNSCANNED
  • EXTENSION_REQUEST
  • LOGIN_EVENT
  • MALWARE_TRANSFER
  • PASSWORD_BREACH
  • SENSITIVE_DATA_TRANSFER
  • UNSAFE_SITE_VISIT
  • BROWSER_EXTENSION_INSTALL
  • CHROMEOS_AFFILIATED_LOCK_SUCCESS
  • CHROMEOS_AFFILIATED_UNLOCK_FAILURE
  • CHROMEOS_AFFILIATED_UNLOCK_SUCCESS
  • CHROMEOS_PERIPHERAL_ADDED
  • CHROMEOS_PERIPHERAL_REMOVED
  • CHROMEOS_PERIPHERAL_STATUS_UPDATED
  • CHROMEOS_UPDATE_FAILURE
  • CHROMEOS_UPDATE_SUCCESS
  • CHROME_OS_CRD_CLIENT_CONNECTED
  • CHROME_OS_CRD_HOST_ENDED
  • CHROME_OS_CRD_HOST_STARTED
  • URL_FILTERING_INTERSTITIAL
  • BROWSER_CRASH
chrome DEVICE_ID target.asset.asset_id If the event.name log field value is equal to one of the following values, then the DEVICE_ID log field is mapped to the target.asset.asset_id UDM field:
  • CONTENT_TRANSFER
  • CONTENT_UNSCANNED
  • MALWARE_TRANSFER
  • SENSITIVE_DATA_TRANSFER
  • UNSAFE_SITE_VISIT
chrome VIRTUAL_DEVICE_ID about.labels [virtual_device_id] (deprecated) If the event.name log field value is equal to one of the following values, then the VIRTUAL_DEVICE_ID log field is mapped to the about.labels UDM field:
  • PASSWORD_CHANGED
  • PASSWORD_REUSE
  • CONTENT_TRANSFER
  • CONTENT_UNSCANNED
  • LOGIN_EVENT
  • MALWARE_TRANSFER
  • PASSWORD_BREACH
  • SENSITIVE_DATA_TRANSFER
  • UNSAFE_SITE_VISIT
  • BROWSER_EXTENSION_INSTALL
  • URL_FILTERING_INTERSTITIAL
  • BROWSER_CRASH
chrome VIRTUAL_DEVICE_ID additional.fields [virtual_device_id] If the event.name log field value is equal to one of the following values, then the VIRTUAL_DEVICE_ID log field is mapped to the additional.fields UDM field:
  • PASSWORD_CHANGED
  • PASSWORD_REUSE
  • CONTENT_TRANSFER
  • CONTENT_UNSCANNED
  • LOGIN_EVENT
  • MALWARE_TRANSFER
  • PASSWORD_BREACH
  • SENSITIVE_DATA_TRANSFER
  • UNSAFE_SITE_VISIT
  • BROWSER_EXTENSION_INSTALL
  • URL_FILTERING_INTERSTITIAL
  • BROWSER_CRASH
chrome EVENT_REASON security_result.summary If the event.name log field value is equal to one of the following values, then the EVENT_REASON log field is mapped to the security_result.summary UDM field:
  • CHROME_OS_ADD_USER
  • CHROME_OS_REMOVE_USER
  • DEVICE_BOOT_STATE_CHANGE
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • CHROME_OS_LOGOUT_EVENT
  • CHROME_OS_REPORTING_DATA_LOST
  • PASSWORD_REUSE
  • DLP_EVENT
  • CONTENT_UNSCANNED
  • LOGIN_EVENT
  • MALWARE_TRANSFER
  • PASSWORD_BREACH
  • UNSAFE_SITE_VISIT
  • BROWSER_EXTENSION_INSTALL
  • CHROMEOS_AFFILIATED_LOCK_SUCCESS
  • CHROMEOS_AFFILIATED_UNLOCK_FAILURE
  • CHROMEOS_AFFILIATED_UNLOCK_SUCCESS
  • CHROMEOS_PERIPHERAL_ADDED
  • CHROMEOS_PERIPHERAL_REMOVED
  • CHROMEOS_PERIPHERAL_STATUS_UPDATED
  • CHROMEOS_UPDATE_FAILURE
  • CHROMEOS_UPDATE_SUCCESS
  • CHROME_OS_CRD_CLIENT_CONNECTED
  • CHROME_OS_CRD_HOST_ENDED
  • CHROME_OS_CRD_HOST_STARTED
  • BROWSER_CRASH
chrome EVENT_RESULT security_result.action_details If the event.name log field value is equal to one of the following values, then the EVENT_RESULT log field is mapped to the security_result.action_details UDM field:
  • PASSWORD_REUSE
  • DLP_EVENT
  • CONTENT_TRANSFER
  • CONTENT_UNSCANNED
  • MALWARE_TRANSFER
  • PASSWORD_BREACH
  • SENSITIVE_DATA_TRANSFER
  • UNSAFE_SITE_VISIT
  • URL_FILTERING_INTERSTITIAL
  • BROWSER_CRASH
chrome security_result.action The security_result.action UDM field is set to ALLOW.
chrome TIMESTAMP about.labels [timestamp] (deprecated) If the event.name log field value is equal to one of the following values, then the TIMESTAMP log field is mapped to the about.labels UDM field:
  • CHROME_OS_ADD_USER
  • CHROME_OS_REMOVE_USER
  • DEVICE_BOOT_STATE_CHANGE
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • CHROME_OS_LOGOUT_EVENT
  • CHROME_OS_REPORTING_DATA_LOST
  • PASSWORD_CHANGED
  • PASSWORD_REUSE
  • DLP_EVENT
  • CONTENT_TRANSFER
  • CONTENT_UNSCANNED
  • EXTENSION_REQUEST
  • LOGIN_EVENT
  • MALWARE_TRANSFER
  • PASSWORD_BREACH
  • SENSITIVE_DATA_TRANSFER
  • UNSAFE_SITE_VISIT
  • BROWSER_EXTENSION_INSTALL
  • CHROMEOS_AFFILIATED_LOCK_SUCCESS
  • CHROMEOS_AFFILIATED_UNLOCK_FAILURE
  • CHROMEOS_AFFILIATED_UNLOCK_SUCCESS
  • CHROMEOS_PERIPHERAL_ADDED
  • CHROMEOS_PERIPHERAL_REMOVED
  • CHROMEOS_PERIPHERAL_STATUS_UPDATED
  • CHROMEOS_UPDATE_FAILURE
  • CHROMEOS_UPDATE_SUCCESS
  • CHROME_OS_CRD_CLIENT_CONNECTED
  • CHROME_OS_CRD_HOST_ENDED
  • CHROME_OS_CRD_HOST_STARTED
  • URL_FILTERING_INTERSTITIAL
  • BROWSER_CRASH
chrome TIMESTAMP additional.fields [timestamp] If the event.name log field value is equal to one of the following values, then the TIMESTAMP log field is mapped to the additional.fields UDM field:
  • CHROME_OS_ADD_USER
  • CHROME_OS_REMOVE_USER
  • DEVICE_BOOT_STATE_CHANGE
  • CHROME_OS_LOGIN_FAILURE_EVENT
  • CHROME_OS_LOGIN_LOGOUT_EVENT
  • CHROME_OS_LOGIN_EVENT
  • CHROME_OS_LOGOUT_EVENT
  • CHROME_OS_REPORTING_DATA_LOST
  • PASSWORD_CHANGED
  • PASSWORD_REUSE
  • DLP_EVENT
  • CONTENT_TRANSFER
  • CONTENT_UNSCANNED
  • EXTENSION_REQUEST
  • LOGIN_EVENT
  • MALWARE_TRANSFER
  • PASSWORD_BREACH
  • SENSITIVE_DATA_TRANSFER
  • UNSAFE_SITE_VISIT
  • BROWSER_EXTENSION_INSTALL
  • CHROMEOS_AFFILIATED_LOCK_SUCCESS
  • CHROMEOS_AFFILIATED_UNLOCK_FAILURE
  • CHROMEOS_AFFILIATED_UNLOCK_SUCCESS
  • CHROMEOS_PERIPHERAL_ADDED
  • CHROMEOS_PERIPHERAL_REMOVED
  • CHROMEOS_PERIPHERAL_STATUS_UPDATED
  • CHROMEOS_UPDATE_FAILURE
  • CHROMEOS_UPDATE_SUCCESS
  • CHROME_OS_CRD_CLIENT_CONNECTED
  • CHROME_OS_CRD_HOST_ENDED
  • CHROME_OS_CRD_HOST_STARTED
  • URL_FILTERING_INTERSTITIAL
  • BROWSER_CRASH
chrome BROWSER_VERSION target.resource.attribute.labels [browser_version] If the event.name log field value is equal to one of the following values, then the BROWSER_VERSION log field is mapped to the target.resource.attribute.labels UDM field:
  • PASSWORD_CHANGED
  • PASSWORD_REUSE
  • DLP_EVENT
  • CONTENT_TRANSFER
  • CONTENT_UNSCANNED
  • LOGIN_EVENT
  • MALWARE_TRANSFER
  • PASSWORD_BREACH
  • SENSITIVE_DATA_TRANSFER
  • UNSAFE_SITE_VISIT
  • BROWSER_EXTENSION_INSTALL
  • URL_FILTERING_INTERSTITIAL
  • BROWSER_CRASH
chrome LOGIN_FAILURE_REASON security_result.description
chrome USER_AGENT network.http.user_agent If the event.name log field value is equal to one of the following values, then the USER_AGENT log field is mapped to the network.http.user_agent UDM field:
  • PASSWORD_CHANGED
  • PASSWORD_REUSE
  • DLP_EVENT
  • CONTENT_TRANSFER
  • CONTENT_UNSCANNED
  • LOGIN_EVENT
  • MALWARE_TRANSFER
  • PASSWORD_BREACH
  • SENSITIVE_DATA_TRANSFER
  • UNSAFE_SITE_VISIT
  • BROWSER_EXTENSION_INSTALL
  • URL_FILTERING_INTERSTITIAL
  • BROWSER_CRASH
chrome URL target.url If the event.name log field value is equal to one of the following values, then the URL log field is mapped to the about.url UDM field:
  • PASSWORD_REUSE
  • DLP_EVENT
  • CONTENT_TRANSFER
  • CONTENT_UNSCANNED
  • LOGIN_EVENT
  • MALWARE_TRANSFER
  • PASSWORD_BREACH
  • SENSITIVE_DATA_TRANSFER
  • UNSAFE_SITE_VISIT
  • URL_FILTERING_INTERSTITIAL
chrome SCAN_ID about.labels [scan_id] (deprecated) If the event.name log field value is equal to one of the following values, then the SCAN_ID log field is mapped to the about.labels UDM field:
  • CONTENT_TRANSFER
  • MALWARE_TRANSFER
  • SENSITIVE_DATA_TRANSFER
chrome SCAN_ID additional.fields [scan_id] If the event.name log field value is equal to one of the following values, then the SCAN_ID log field is mapped to the additional.fields UDM field:
  • CONTENT_TRANSFER
  • MALWARE_TRANSFER
  • SENSITIVE_DATA_TRANSFER
chrome REMOVE_USER_REASON security_result.detection_fields [remove_user_reason] If the event.name log field value is equal to CHROME_OS_REMOVE_USER, then the REMOVE_USER_REASON log field is mapped to the security_result.detection_fields UDM field.
chrome NEW_BOOT_MODE target.asset.attribute.labels [new_boot_mode]
chrome PREVIOUS_BOOT_MODE target.asset.attribute.labels [previous_boot_mode]
chrome CLIENT_TYPE target.resource.attribute.labels [client_type]
chrome TRIGGER_USER security_result.about.labels [trigger_user] (deprecated)
chrome TRIGGER_USER additional.fields [trigger_user]
chrome TRIGGER_DESTINATION security_result.about.labels [trigger_destination] (deprecated)
chrome TRIGGER_DESTINATION additional.fields [trigger_destination]
chrome TRIGGER_SOURCE security_result.about.labels [trigger_source] (deprecated)
chrome TRIGGER_SOURCE additional.fields [trigger_source]
chrome TRIGGER_TYPE security_result.about.labels [trigger_type] (deprecated)
chrome TRIGGER_TYPE additional.fields [trigger_type]
chrome TRIGGERED_RULES_REASON security_result.about.labels [triggered_rules_reason] (deprecated)
chrome TRIGGERED_RULES_REASON additional.fields [triggered_rules_reason]
chrome CONTENT_HASH about.labels [content_hash] (deprecated)
chrome CONTENT_HASH additional.fields [content_hash]
chrome CONTENT_NAME about.labels [content_name] (deprecated)
chrome CONTENT_NAME additional.fields [content_name]
chrome CONTENT_SIZE about.labels [content_size] (deprecated)
chrome CONTENT_SIZE additional.fields [content_size]
chrome CONTENT_TYPE about.labels [content_type] (deprecated)
chrome CONTENT_TYPE additional.fields [content_type]
chrome APP_NAME target.application If the event.name log field value is equal to one of the following values, then the APP_NAME log field is mapped to the target.application UDM field:
  • EXTENSION_REQUEST
  • BROWSER_EXTENSION_INSTALL
chrome PRODUCT_NAME target.application If the event.name log field value is equal to one of the following values, then the PRODUCT_NAME log field is mapped to the target.application UDM field:
  • CHROMEOS_PERIPHERAL_ADDED
  • CHROMEOS_PERIPHERAL_REMOVED
  • CHROMEOS_PERIPHERAL_STATUS_UPDATED


Else, the PRODUCT_NAME log field is mapped to the target.labels UDM field.
chrome PRODUCT_NAME target.labels [product_name] (deprecated) If the event.name log field value is equal to one of the following values, then the PRODUCT_NAME log field is mapped to the target.application UDM field:
  • CHROMEOS_PERIPHERAL_ADDED
  • CHROMEOS_PERIPHERAL_REMOVED
  • CHROMEOS_PERIPHERAL_STATUS_UPDATED


Else, the PRODUCT_NAME log field is mapped to the target.labels UDM field.
chrome PRODUCT_NAME additional.fields [product_name] If the event.name log field value is equal to one of the following values, then the PRODUCT_NAME log field is mapped to the target.application UDM field:
  • CHROMEOS_PERIPHERAL_ADDED
  • CHROMEOS_PERIPHERAL_REMOVED
  • CHROMEOS_PERIPHERAL_STATUS_UPDATED


Else, the PRODUCT_NAME log field is mapped to the additional.fields UDM field.
chrome ORG_UNIT_NAME about.labels [org_unit_name] (deprecated) If the event.name log field value is equal to EXTENSION_REQUEST, then the ORG_UNIT_NAME log field is mapped to the about.labels UDM field.
chrome ORG_UNIT_NAME additional.fields [org_unit_name] If the event.name log field value is equal to EXTENSION_REQUEST, then the ORG_UNIT_NAME log field is mapped to the additional.fields UDM field.
chrome USER_JUSTIFICATION principal.user.attribute.labels [user_justification]
chrome FEDERATED_ORIGIN security_result.about.labels [federated_origin] (deprecated)
chrome FEDERATED_ORIGIN additional.fields [federated_origin]
chrome IS_FEDERATED security_result.about.labels [is_federated] (deprecated)
chrome IS_FEDERATED additional.fields [is_federated]
chrome EVIDENCE_LOCKER_FILEPATH security_result.about.labels [evidence_locker_filepath] (deprecated)
chrome EVIDENCE_LOCKER_FILEPATH additional.fields [evidence_locker_filepath]
Google Chrome CONNECTION_TYPE about.labels[connection_type] (deprecated)
Google Chrome CONNECTION_TYPE additional.fields[connection_type]
Google Chrome PREVIOUS_OS_VERSION target.asset.attribute.labels[previous_os_version]
Google Chrome VENDOR_ID src.labels[vendor_id] (deprecated)
Google Chrome VENDOR_ID additional.fields[vendor_id]
Google Chrome LOCALIZED_URL_CATEGORY about.labels[localized_url_category] (deprecated)
Google Chrome LOCALIZED_URL_CATEGORY additional.fields[localized_url_category]
Google Chrome VENDOR_NAME src.labels[vendor_name] (deprecated)
Google Chrome VENDOR_NAME additional.fields[vendor_name]
Google Chrome SESSION_ID network.session_id
Google Chrome APP_ID target.resource.product_object_id If the event.name log field value is equal to BROWSER_EXTENSION_INSTALL, then the APP_ID log field is mapped to the target.resource.product_object_id UDM field.
Google Chrome CURRENT_OS_VERSION target.asset.platform_software.platform_version
Google Chrome PRODUCT_ID target.resource.product_object_id If the events.name log field value contains one of the following values, then the PRODUCT_ID log field is mapped to the target.resource.product_object_id UDM field.
  • CHROMEOS_PERIPHERAL_ADDED
  • CHROMEOS_PERIPHERAL_REMOVED
  • CHROMEOS_PERIPHERAL_STATUS_UPDATED


Else, the PRODUCT_ID log field is mapped to the target.labels UDM field.
Google Chrome PRODUCT_ID target.labels[product_id] (deprecated) If the events.name log field value contains one of the following values, then the PRODUCT_ID log field is mapped to the target.resource.product_object_id UDM field.
  • CHROMEOS_PERIPHERAL_ADDED
  • CHROMEOS_PERIPHERAL_REMOVED
  • CHROMEOS_PERIPHERAL_STATUS_UPDATED


Else, the PRODUCT_ID log field is mapped to the target.labels UDM field.
Google Chrome PRODUCT_ID additional.fields[product_id] If the events.name log field value contains one of the following values, then the PRODUCT_ID log field is mapped to the target.resource.product_object_id UDM field.
  • CHROMEOS_PERIPHERAL_ADDED
  • CHROMEOS_PERIPHERAL_REMOVED
  • CHROMEOS_PERIPHERAL_STATUS_UPDATED


Else, the PRODUCT_ID log field is mapped to the additional.fields UDM field.
Google Chrome UNLOCK_TYPE target.labels[unlock_type] (deprecated)
Google Chrome UNLOCK_TYPE additional.fields[unlock_type]
Google Chrome REPORT_ID target.labels[report_id] (deprecated)
Google Chrome REPORT_ID additional.fields[report_id]
Google Chrome CHANNEL target.labels[channel] (deprecated)
Google Chrome CHANNEL additional.fields[channel]
Google Chrome TAB_URL additional.fields[tab_url]
context_aware_access CAA_ACCESS_LEVEL_APPLIED security_result.about.labels [caa_access_level_applied] (deprecated) If the event.name log field value is equal to ACCESS_DENY_EVENT, then the CAA_ACCESS_LEVEL_APPLIED log field is mapped to the security_result.about.labels UDM field.
context_aware_access CAA_ACCESS_LEVEL_APPLIED additional.fields [caa_access_level_applied] If the event.name log field value is equal to ACCESS_DENY_EVENT, then the CAA_ACCESS_LEVEL_APPLIED log field is mapped to the additional.fields UDM field.
context_aware_access CAA_ACCESS_LEVEL_SATISFIED security_result.about.labels [caa_access_level_satisfied] (deprecated) If the event.name log field value is equal to ACCESS_DENY_EVENT, then the CAA_ACCESS_LEVEL_SATISFIED log field is mapped to the security_result.about.labels UDM field.
context_aware_access CAA_ACCESS_LEVEL_SATISFIED additional.fields [caa_access_level_satisfied] If the event.name log field value is equal to ACCESS_DENY_EVENT, then the CAA_ACCESS_LEVEL_SATISFIED log field is mapped to the additional.fields UDM field.
context_aware_access CAA_ACCESS_LEVEL_UNSATISFIED security_result.about.labels [caa_access_level_unsatisfied] (deprecated) If the event.name log field value is equal to ACCESS_DENY_EVENT, then the CAA_ACCESS_LEVEL_UNSATISFIED log field is mapped to the security_result.about.labels UDM field.
context_aware_access CAA_ACCESS_LEVEL_UNSATISFIED additional.fields [caa_access_level_unsatisfied] If the event.name log field value is equal to ACCESS_DENY_EVENT, then the CAA_ACCESS_LEVEL_UNSATISFIED log field is mapped to the additional.fields UDM field.
context_aware_access CAA_APPLICATION target.resource.name If the event.name log field value is equal to ACCESS_DENY_EVENT, then the CAA_APPLICATION log field is mapped to the target.resource.name UDM field.
context_aware_access target.resource.resource_type If the event.name log field value is equal to DEVICE_SETTINGS_UPDATED_EVENT, then the target.resource.resource_type UDM field is set to SETTING.

Else, the target.resource.resource_type UDM field is set to DEVICE.
context_aware_access CAA_DEVICE_ID principal.asset.asset_id If the event.name log field value is equal to ACCESS_DENY_EVENT, then the CAA_DEVICE_ID log field is mapped to the principal.asset.asset_id UDM field.
context_aware_access CAA_DEVICE_STATE principal.labels [caa_device_state] (deprecated) If the event.name log field value is equal to ACCESS_DENY_EVENT, then the CAA_DEVICE_STATE log field is mapped to the principal.labels UDM field.
context_aware_access CAA_DEVICE_STATE additional.fields [caa_device_state] If the event.name log field value is equal to ACCESS_DENY_EVENT, then the CAA_DEVICE_STATE log field is mapped to the additional.fields UDM field.
context_aware_access BLOCKED_API_ACCESS additional.fields [blocked_api_access]
gplus attachment_type target.resource.attribute.labels [attachment_type] If the event.name log field value is equal to one of the following values, then the attachment_type log field is mapped to the target.resource.attribute.labels UDM field:
  • create_comment
  • edit_comment
  • create_post
  • edit_post
gplus comment_resource_name target.resource.product_object_id If the event.name log field value is equal to one of the following values, then the comment_resource_name log field is mapped to the target.resource.product_object_id UDM field:
  • create_comment
  • delete_comment
  • edit_comment
  • add_plusone
  • remove_plusone
gplus post_resource_name target.resource_ancestors.product_object_id If the event.name log field value is equal to one of the following values, then the post_resource_name log field is mapped to the target.resource_ancestors.product_object_id UDM field:
  • create_comment
  • delete_comment
  • edit_comment
  • add_plusone
  • remove_plusone
  • add_poll_vote
  • remove_poll_vote
  • create_post
  • delete_post
  • content_manager_delete_post
  • edit_post
gplus post_permalink target.resource_ancestors.attribute.labels [post_permalink]
gplus post_visibility target.resource_ancestors.attribute.labels [post_visibility]
gplus plusone_context target.resource_ancestors.attribute.labels [plusone_context]
gplus post_author_name target.user.user_display_name If the event.name log field value is equal to content_manager_delete_post, then the post_resource_name log field is mapped to the target.user.user_display_name UDM field.
data_studio ASSET_ID principal.resource.product_object_id If the ASSET_TYPE log field value is equal to DATA_SOURCE, then the ASSET_ID log field is mapped to the principal.resource.product_object_id UDM field.

Else, the ASSET_ID log field is mapped to the target.resource.product_object_id UDM field.
data_studio ASSET_NAME principal.resource.name If the ASSET_TYPE log field value is equal to DATA_SOURCE, then the ASSET_NAME log field is mapped to the principal.resource.name UDM field.

Else, the ASSET_NAME log field is mapped to the target.resource.name UDM field.
data_studio ASSET_TYPE principal.resource.resource_subtype If the ASSET_TYPE log field value is equal to DATA_SOURCE, then the ASSET_TYPE log field is mapped to the principal.resource.resource_subtype UDM field.

Else, the ASSET_TYPE log field is mapped to the target.resource.resource_subtype UDM field.
data_studio ASSET_ID target.resource.product_object_id If the ASSET_TYPE log field value is equal to DATA_SOURCE, then the ASSET_ID log field is mapped to the principal.resource.product_object_id UDM field.

Else, the ASSET_ID log field is mapped to the target.resource.product_object_id UDM field.
data_studio ASSET_NAME target.resource.name If the ASSET_TYPE log field value is equal to DATA_SOURCE, then the ASSET_NAME log field is mapped to the principal.resource.name UDM field.

Else, the ASSET_NAME log field is mapped to the target.resource.name UDM field.
data_studio ASSET_TYPE target.resource.resource_subtype If the ASSET_TYPE log field value is equal to DATA_SOURCE, then the ASSET_TYPE log field is mapped to the principal.resource.resource_subtype UDM field.

Else, the ASSET_TYPE log field is mapped to the target.resource.resource_subtype UDM field.
data_studio CONNECTOR_TYPE target.resource.attribute.labels[connector_type]
data_studio EMBEDDED_IN_REPORT_ID target.resource.attribute.labels[embedded_in_report_id]
data_studio OWNER_EMAIL principal.user.email_addresses If the actor.email log field value is not equal to the OWNER_EMAIL, then the OWNER_EMAIL log field is mapped to the principal.user.email_addresses UDM field.
data_studio TARGET_USER_EMAIL target.user.email_addresses
data_studio PRIOR_VISIBILITY target.resource.attribute.labels [prior_visibility]
data_studio VISIBILITY target.resource.attribute.labels [visibility]
data_studio NEW_VALUE target.resource.attribute.labels [new_value]
data_studio OLD_VALUE target.resource.attribute.labels [old_value]
data_studio TARGET_DOMAIN target.domain.name [ target_domain]
data_studio DATA_EXPORT_TYPE target.resource.attribute.labels [data_export_type]
mobile target.resource.resource_type The target.resource.resource_type UDM field is set to DEVICE.
mobile ACCOUNT_STATE target.resource.attribute.labels [account_state]
mobile ACTION_EXECUTION_STATUS target.resource.attribute.labels [account_execution_status]
mobile ACTION_ID target.resource.attribute.labels [action_id]
mobile ACTION_TYPE target.resource.attribute.labels [action_type]
mobile APK_SHA256_HASH target.resource.attribute.labels [apk_sha256_hash]
mobile APPLICATION_ID target.resource.attribute.labels [application_id]
mobile APPLICATION_MESSAGE target.resource.attribute.labels [application_message]
mobile APPLICATION_REPORT_KEY target.resource.attribute.labels [application_report_key]
mobile APPLICATION_REPORT_SEVERITY target.resource.attribute.labels [application_report_severity]
mobile APPLICATION_STATE target.resource.attribute.labels [application_state]
mobile APPLICATION_REPORT_TIMESTAMP target.resource.attribute.labels [application_report_timestamp]
mobile BASIC_INTEGRITY target.resource.attribute.labels [basic_integrity]
mobile CTS_PROFILE_MATCH target.resource.attribute.labels [cts_profile_match]
mobile DEVICE_COMPLIANCE target.resource.attribute.labels [device_compliance]
mobile DEVICE_COMPROMISED_STATE about.target.resource.attribute.labels [device_compromised_state]
mobile DEVICE_DEACTIVATION_REASON target.resource.attribute.labels [device_deactivation_reason]
mobile DEVICE_ID target.resource.product_object_id If the event.name log field value is equal to one of the following values, then the DEVICE_ID log field is mapped to the target.resource.product_object_id UDM field:
  • APPLICATION_EVENT
  • APPLICATION_REPORT_EVENT
  • DEVICE_REGISTER_UNREGISTER_EVENT
  • ADVANCED_POLICY_SYNC_EVENT
  • DEVICE_ACTION_EVENT
  • DEVICE_COMPLIANCE_CHANGED_EVENT
  • OS_UPDATED_EVENT
  • DEVICE_OWNERSHIP_CHANGE_EVENT
  • DEVICE_SETTINGS_UPDATED_EVENT
  • DEVICE_SYNC_EVENT
  • RISK_SIGNAL_UPDATED_EVENT
  • ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT
  • DEVICE_COMPROMISED_EVENT
  • FAILED_PASSWORD_ATTEMPTS_EVENT
  • SUSPICIOUS_ACTIVITY_EVENT
mobile NEW_DEVICE_ID target.resource.attribute.labels [new_device_id] If the NEW_DEVICE_ID log field value is not empty, then the NEW_DEVICE_ID log field is mapped to the target.resource.product_object_id UDM field.
mobile DEVICE_MODEL target.resource.attribute.labels [device_model]
mobile DEVICE_OWNERSHIP target.resource.attribute.labels [device_ownership]
mobile DEVICE_PROPERTY target.resource.attribute.labels [device_property]
mobile DEVICE_SETTING target.resource.attribute.labels [device_setting]
mobile DEVICE_STATUS_ON_APPLE_PORTAL target.resource.attribute.labels [device_status_on_apple_portal]
mobile DEVICE_TYPE target.resource.resource_subtype If the event.name log field value is equal to one of the following values, then the DEVICE_TYPE log field is mapped to the target.resource.resource_subtype UDM field:
  • APPLICATION_EVENT
  • APPLICATION_REPORT_EVENT
  • DEVICE_REGISTER_UNREGISTER_EVENT
  • ADVANCED_POLICY_SYNC_EVENT
  • DEVICE_ACTION_EVENT
  • DEVICE_COMPLIANCE_CHANGED_EVENT
  • OS_UPDATED_EVENT
  • DEVICE_OWNERSHIP_CHANGE_EVENT
  • DEVICE_SETTINGS_UPDATED_EVENT
  • DEVICE_SYNC_EVENT
  • RISK_SIGNAL_UPDATED_EVENT
  • ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT
  • DEVICE_COMPROMISED_EVENT
  • FAILED_PASSWORD_ATTEMPTS_EVENT
  • SUSPICIOUS_ACTIVITY_EVENT
mobile FAILED_PASSWD_ATTEMPTS target.resource.attribute.labels [failed_passwd_attempts]
mobile IOS_VENDOR_ID target.resource.attribute.labels [ios_vendor_id]
mobile NEW_VALUE target.resource.attribute.labels [new_value]
mobile OLD_VALUE target.resource.attribute.labels [old_value]
mobile OS_EDITION target.resource.attribute.labels [os_edition]
mobile OS_PROPERTY target.resource.attribute.labels [os_property]
mobile OS_VERSION target.resource.attribute.labels [os_version]
mobile PHA_CATEGORY security_results.detection_fields
mobile POLICY_NAME security_result.about.labels [policy_name] (deprecated)
mobile POLICY_NAME additional.fields [policy_name]
mobile POLICY_SYNC_RESULT security_result.about.labels [policy_sync_result] (deprecated)
mobile POLICY_SYNC_RESULT additional.fields [policy_sync_result]
mobile POLICY_SYNC_TYPE security_result.about.labels [policy_sync_type] (deprecated)
mobile POLICY_SYNC_TYPE additional.fields [policy_sync_type]
mobile RESOURCE_ID target.resource.attribute.labels If the event.name log field value is equal to one of the following values, then the RESOURCE_ID log field is mapped to the target.resource.attribute.labels UDM field:
  • APPLICATION_EVENT
  • APPLICATION_REPORT_EVENT
  • DEVICE_REGISTER_UNREGISTER_EVENT
  • ADVANCED_POLICY_SYNC_EVENT
  • DEVICE_ACTION_EVENT
  • DEVICE_COMPLIANCE_CHANGED_EVENT
  • OS_UPDATED_EVENT
  • DEVICE_OWNERSHIP_CHANGE_EVENT
  • DEVICE_SETTINGS_UPDATED_EVENT
  • DEVICE_SYNC_EVENT
  • RISK_SIGNAL_UPDATED_EVENT
  • ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT
  • DEVICE_COMPROMISED_EVENT
  • FAILED_PASSWORD_ATTEMPTS_EVENT
  • SUSPICIOUS_ACTIVITY_EVENT
mobile REGISTER_PRIVILEGE security_result.about.labels [register_privilege] (deprecated)
mobile REGISTER_PRIVILEGE additional.fields
mobile RISK_SIGNAL security_result.about.labels [risk_signal] (deprecated)
mobile RISK_SIGNAL additional.fields [risk_signal]
mobile SECURITY_EVENT_ID security_result.about.labels [security_event_id] (deprecated) If the event.name log field value is equal to APPLICATION_EVENT, then the SECURITY_EVENT_ID log field is mapped to the security_result.about.labels UDM field.
mobile SECURITY_EVENT_ID additional.fields If the event.name log field value is equal to APPLICATION_EVENT, then the SECURITY_EVENT_ID log field is mapped to the additional.fields UDM field.
mobile SECURITY_PATCH_LEVEL security_result.about.labels [security_patch_level] (deprecated) If the event.name log field value is equal to one of the following values, then the SECURITY_PATCH_LEVEL log field is mapped to the security_result.about.labels UDM field:
  • DEVICE_SYNC_EVENT
  • DEVICE_REGISTER_UNREGISTER_EVENT
mobile SECURITY_PATCH_LEVEL additional.fields [security_patch_level] If the event.name log field value is equal to one of the following values, then the SECURITY_PATCH_LEVEL log field is mapped to the additional.fields UDM field:
  • DEVICE_SYNC_EVENT
  • DEVICE_REGISTER_UNREGISTER_EVENT
mobile SERIAL_NUMBER target.resource.attribute.labels [serial_number]
mobile USER_EMAIL target.user.email_addresses If the event.name log field value is equal to one of the following values, then the USER_EMAIL log field is mapped to the target.user.email_addresses UDM field:
  • APPLICATION_EVENT
  • APPLICATION_REPORT_EVENT
  • DEVICE_REGISTER_UNREGISTER_EVENT
  • ADVANCED_POLICY_SYNC_EVENT
  • DEVICE_ACTION_EVENT
  • DEVICE_COMPLIANCE_CHANGED_EVENT
  • OS_UPDATED_EVENT
  • DEVICE_OWNERSHIP_CHANGE_EVENT
  • DEVICE_SETTINGS_UPDATED_EVENT
  • DEVICE_SYNC_EVENT
  • RISK_SIGNAL_UPDATED_EVENT
  • ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT
  • DEVICE_COMPROMISED_EVENT
  • FAILED_PASSWORD_ATTEMPTS_EVENT
  • SUSPICIOUS_ACTIVITY_EVENT
mobile VALUE security_result.about.labels [value] (deprecated)
mobile VALUE additional.fields [value]
mobile WINDOWS_SYNCML_POLICY_STATUS_CODE security_result.about.labels [windows_syncml_policy_status_code] (deprecated)
mobile WINDOWS_SYNCML_POLICY_STATUS_CODE additional.fields [windows_syncml_policy_status_code]
mobile LAST_SYNC_AUDIT_DATE target.resource.attribute.labels[LAST_SYNC_AUDIT_DATE]
groups_enterprise dynamic_group_query target.group.attribute.labels [dynamic_group_query]
groups_enterprise group_id target.user.group_identifiers If the event.name log field value is equal to one of the following values, then the group_id log field is mapped to the target.user.group_identifiers UDM field:
  • accept_invitation
  • add_info_setting
  • add_member
  • add_member_role
  • add_security_setting
  • approve_join_request
  • ban_member_with_moderation
  • change_info_setting
  • change_security_setting
  • create_group
  • delete_group
  • add_dynamic_group_query
  • change_dynamic_group_query
  • invite_member
  • join
  • add_membership_expiry
  • remove_membership_expiry
  • update_membership_expiry
  • reject_invitation
  • reject_join_request
  • remove_info_setting
  • remove_member
  • remove_member_role
  • remove_security_setting
  • request_to_join
  • revoke_invitation
  • unban_member
groups_enterprise info_setting target.group.attribute.labels [info_setting]
groups_enterprise member_id target.user.email_addresses If the event.name log field value is equal to one of the following values, then the member_id log field is mapped to the target.user.email_addresses UDM field:
  • add_member
  • add_member_role
  • add_service_account_permission
  • approve_join_request
  • ban_member_with_moderation
  • invite_member
  • add_membership_expiry
  • remove_membership_expiry
  • update_membership_expiry
  • reject_join_request
  • remove_member
  • remove_member_role
  • remove_service_account_permission
  • revoke_invitation
  • unban_member
groups_enterprise member_role target.user.attribute.roles.name If the event.name log field value is equal to one of the following values, then the member_role log field is mapped to the target.user.attribute.roles.name UDM field:
  • add_member
  • add_member_role
  • add_service_account_permission
  • remove_member_role
  • remove_service_account_permission
groups_enterprise member_type target.user.attribute.labels[member_type]
groups_enterprise membership_expiry target.group.attribute.labels [membership_query]
groups_enterprise namespace target.group.group_display_name
groups_enterprise new_value target.group.attribute.labels [new_value]
groups_enterprise old_value target.group.attribute.labels [old_value]
groups_enterprise value target.group.attribute.labels [value]
groups_enterprise security_setting target.group.attribute.labels [security_setting]
calendar access_level security_result.about.labels [access_level] (deprecated)
calendar access_level additional.fields [access_level]
calendar api_kind target.resource.attribute.labels [api_kind]
calendar calendar_country target.resource.attribute.labels [calendar_country] If the event.name log field value is equal to change_calendar_country, then the calendar_country log field is mapped to the target.resource.attribute.labels UDM field.
calendar calendar_description target.resource.attribute.labels [calendar_description]
calendar calendar_id target.resource.product_object_id If the event.name log field value is equal to one of the following values, then the calendar_id log field is mapped to the target.resource.product_object_id UDM field:
  • change_calendar_acls
  • change_calendar_country
  • create_calendar
  • delete_calendar
  • change_calendar_description
  • change_calendar_location
  • change_calendar_timezone
  • change_calendar_title
  • notification_triggered
  • add_subscription
  • delete_subscription
  • create_event
  • delete_event
  • add_event_guest
  • change_event_guest_response_auto
  • remove_event_guest
  • change_event_guest_response
  • change_event
  • remove_event_from_trash
  • restore_event
  • change_event_start_time
  • change_event_title
  • interop_freebusy_lookup_outbound_successful
  • interop_freebusy_lookup_inbound_successful
  • interop_exchange_resource_availability_lookup_successful
  • interop_freebusy_lookup_outbound_unsuccessful
  • interop_freebusy_lookup_inbound_unsuccessful
  • interop_exchange_resource_availability_lookup_unsuccessful
  • transfer_event_requested
  • transfer_event_completed
  • calendar calendar_location target.resource.attribute.labels [calendar_location]
    calendar calendar_timezone target.resource.attribute.labels [calendar_timezone]
    calendar calendar_title target.resource.name If the event.name log field value is equal to change_calendar_title, then the calendar_title log field is mapped to the target.resource.name UDM field.
    calendar end_time target.resource.attribute.labels [end_time]
    calendar start_time target.resource.attribute.labels [start_time]
    calendar event_guest target.labels [event_guest] (deprecated)
    calendar event_guest additional.fields [event_guest]
    calendar event_id target.resource.attribute.labels [event_id] If the event.name log field value is equal to one of the following values, then the event_id log field is mapped to the target.resource.attribute.labels UDM field:
    • notification_triggered
    • add_subscription
    • delete_subscription
    • create_event
    • delete_event
    • add_event_guest
    • change_event_guest_response_auto
    • remove_event_guest
    • change_event_guest_response
    • change_event
    • remove_event_from_trash
    • restore_event
    • change_event_start_time
    • change_event_title
    • transfer_event_requested
    • transfer_event_completed
    calendar event_response_status target.resource.attribute.labels [event_response_status]
    calendar event_title target.resource.attribute.labels [event_title] If the event.name log field value is equal to one of the following values, then the event_title log field is mapped to the target.resource.attribute.labels UDM field:
    • create_event
    • delete_event
    • add_event_guest
    • change_event_guest_response_auto
    • remove_event_guest
    • change_event_guest_response
    • change_event
    • remove_event_from_trash
    • restore_event
    • change_event_start_time
    • change_event_title
    • transfer_event_requested
    • transfer_event_completed
    calendar old_event_title target.resource.attribute.labels [old_event_title]
    calendar grantee_email target.user.email_addresses If the event.name log field value is equal to one of the following values, then the grantee_email log field is mapped to the target.user.email_addresses UDM field:
    • change_calendar_acls
    • transfer_event_requested
    calendar interop_error_code security_result.action_details If the event.name log field value is equal to one of the following values, then the interop_error_code log field is mapped to the security_result.action_details UDM field:
    • interop_exchange_resource_list_lookup_successful
    • interop_freebusy_lookup_outbound_unsuccessful
    • interop_freebusy_lookup_inbound_unsuccessful
    • interop_exchange_resource_availability_lookup_unsuccessful
    • interop_exchange_resource_list_lookup_unsuccessful
    calendar notification_message_id target.resource.attribute.labels [notification_message_id] If the event.name log field value is equal to one of the following values, then the notification_message_id log field is mapped to the target.resource.attribute.labels UDM field:
    • notification_triggered
    • create_event
    • delete_event
    • add_event_guest
    • remove_event_guest
    • change_event_guest_response
    • change_event
    • restore_event
    • change_event_start_time
    • change_event_title
    calendar notification_method target.resource.attribute.labels [notification_method] If the event.name log field value is equal to one of the following values, then the notification_method log field is mapped to the target.resource.attribute.labels UDM field:
    • notification_triggered
    • add_subscription
    • delete_subscription
    calendar notification_type target.resource.resource_subtype If the event.name log field value is equal to one of the following values, then the notification_type log field is mapped to the target.resource.resource_subtype UDM field:
    • notification_triggered
    • add_subscription
    • delete_subscription
    calendar organizer_calendar_id principal.user.attribute.labels[organizer_calendar_id] If the event.name log field value is equal to one of the following values, then the organizer_calendar_id log field is mapped to the principal.user.attribute.labels[organizer_calendar_id] UDM field:
    • create_event
    • delete_event
    • add_event_guest
    • change_event_guest_response_auto
    • remove_event_guest
    • change_event_guest_response
    • change_event
    • remove_event_from_trash
    • restore_event
    • change_event_start_time
    • change_event_title
    • transfer_event_requested
    • transfer_event_completed
    calendar recipient_email principal.user.email_addresses If the event.name log field value is equal to one of the following values, then the recipient_email log field is mapped to the principal.user.email_addresses UDM field:
    • notification_triggered
    • create_event
    • delete_event
    • add_event_guest
    • remove_event_guest
    • change_event_guest_response
    • change_event
    • restore_event
    • change_event_start_time
    • change_event_title
    calendar remote_ews_url security_result.about.labels [remote_ews_url] (deprecated)
    calendar remote_ews_url additional.fields [remote_ews_url]
    calendar requested_period_end security_result.about.labels [requested_period_end] (deprecated)
    calendar requested_period_end additional.fields [requested_period_end]
    calendar requested_period_start security_result.about.labels [requested_period_start] (deprecated)
    calendar requested_period_start additional.fields [requested_period_start]
    calendar subscriber_calendar_id principal.user.attribute.labels[subscriber_calendar_id]
    calendar user_agent network.http.user_agent
    calendar target_calendar_id target.resource.attribute.labels [target_calendar_id]
    calendar user_agent network.http.user_agent
    calendar target_calendar_id target.resource.attribute.labels [target_calendar_id]
    calendar client_side_encrypted target.resource.attribute.labels [client_side_encrypted]
    calendar is_recurring target.resource.attribute.labels [is_recurring]
    calendar recurring target.resource.attribute.labels [recurring]
    chat actor principal.user.email_addresses The event.name log field is mapped to the principal.user.email_addresses UDM field if the following conditions are met:
    • The actor log field value is not equal to actor.email.
    • The event.name log field value is equal to one of the following values:
      • add_room_member
      • attachment_download
      • attachment_upload
      • block_room
      • block_user
      • direct_message_started
      • invite_accept
      • invite_decline
      • invite_send
      • message_edited
      • message_posted
      • message_reported
      • remove_room_member
      • room_created
      • reaction_added
      • message_deleted
    chat attachment_hash target.file.sha256 If the event.name log field value is equal to one of the following values, then the attachment_hash log field is mapped to the target.file.sha256 UDM field:
    • attachment_download
    • attachment_upload
    • message_edited
    • message_posted
    chat attachment_name target.file.names If the event.name log field value is equal to one of the following values, then the attachment_name log field is mapped to the target.file.names UDM field:
    • attachment_download
    • attachment_upload
    • message_edited
    • message_posted
    chat attachment_url target.file.full_path If the event.name log field value is equal to attachment_download, then the attachment_url log field is mapped to the target.file.full_path UDM field.
    chat dlp_scan_status security_result.action_details If the event.name log field value is equal to one of the following values, then the dlp_scan_status log field is mapped to the security_result.action_details UDM field:
    • attachment_upload
    • direct_message_started
    • message_edited
    • message_posted
    chat message_id target.resource.product_object_id If the event.name log field value is equal to one of the following values, then the message_id log field is mapped to the target.resource.product_object_id UDM field:
    • message_edited
    • message_posted
    • message_reported
    • reaction_added
    • message_deleted
    chat conference_id target.resource.product_object_id If the event.name log field value is equal to one of the following values, then the message_id log field is mapped to the target.resource.product_object_id UDM field:
    • call_ended
    • presentation_started
    • invitation_sent
    chat target.resource.resource_subtype If the event.name log field value is equal to one of the following values, then the target.resource.resource_subtype UDM field is set to Google Chat - Message:
    • message_edited
    • message_posted
    • message_reported
    chat report_type target.resource.attribute.labels [report_type]
    chat room_id target.group.product_object_id If the event.name log field value is equal to one of the following values, then the room_id log field is mapped to the target.group.product_object_id UDM field:
    • add_room_member
    • attachment_download
    • attachment_upload
    • block_room
    • block_user
    • direct_message_started
    • invite_accept
    • invite_decline
    • invite_send
    • message_edited
    • message_posted
    • message_reported
    • remove_room_member
    • room_created
    • reaction_added
    • message_deleted
    chat dm_id about.labels [dm_id] (deprecated) If the event.name log field value is equal to direct_message_started, then the about.labels UDM field is set to dm_id.
    chat dm_id additional.fields [dm_id] If the event.name log field value is equal to direct_message_started, then the additional.fields UDM field is set to dm_id.
    chat target_users target.user.email_addresses If the event.name log field value is equal to one of the following values, then the target_users log field is mapped to the target.user.email_addresses UDM field:
    • add_room_member
    • block_user
    • invite_send
    • message_reported
    • remove_room_member
    chat retention_state target.user.attribute.labels[retention_state]
    chat room_name target.group.group_display_name
    chat timestamp_ms target.resource.attribute.labels [timestamp_ms]
    chat external_room about.labels[external_room] (deprecated)
    chat external_room additional.fields[external_room]
    chat device_type principal.asset.attribute.labels [device_type]
    chat identifier_type principal.user.attribute.labels [identifier_type]
    chat location_region principal.user.attribute.labels [location_region]
    chat identifier principal.user.userid
    chat display_name principal.user.user_display_name
    chat location_country principal.location.country_or_region
    chat product_type principal.resource.resource_subtype
    chat ip_address target.ip
    chat target_user_count target.user.attribute.labels[target_user_count]
    chat duration_seconds target.resource.attribute.labels [duration_seconds]
    chat meeting_code target.resource.attribute.labels[meeting_code]
    chat organizer_email about.user.email_addresses
    chat network_estimated_upload_kbps_mean additional.fields [network_estimated_upload_kbps_mean]
    chat video_recv_fps_mean additional.fields [video_recv_fps_mean]
    chat screencast_send_fps_mean additional.fields [screencast_send_fps_mean]
    chat audio_recv_packet_loss_max additional.fields [audio_recv_packet_loss_max]
    chat video_send_long_side_median_pixels additional.fields [video_send_long_side_median_pixels]
    chat screencast_recv_packet_loss_mean additional.fields [screencast_recv_packet_loss_mean]
    chat video_recv_packet_loss_mean additional.fields [video_recv_packet_loss_mean]
    chat video_recv_long_side_median_pixels additional.fields [video_recv_long_side_median_pixels]
    chat video_send_packet_loss_mean additional.fields [video_send_packet_loss_mean]
    chat audio_send_packet_loss_max additional.fields [audio_send_packet_loss_max]
    chat video_recv_short_side_median_pixels additional.fields [video_recv_short_side_median_pixels]
    chat screencast_recv_bitrate_kbps_mean additional.fields [screencast_recv_bitrate_kbps_mean]
    chat calendar_event_id additional.fields [calendar_event_id]
    video_send_fps_mean additional.fields [video_send_fps_mean] target
    chat audio_recv_packet_loss_mean additional.fields [audio_recv_packet_loss_mean]
    chat video_recv_seconds additional.fields [video_recv_seconds]
    chat video_send_packet_loss_max additional.fields [video_send_packet_loss_max]
    chat network_recv_jitter_msec_max additional.fields [network_recv_jitter_msec_max]
    chat network_recv_jitter_msec_mean additional.fields [network_recv_jitter_msec_mean]
    chat audio_send_seconds additional.fields [audio_send_seconds]
    chat screencast_send_long_side_median_pixels additional.fields [screencast_send_long_side_median_pixels]
    chat screencast_recv_seconds additional.fields [screencast_recv_seconds]
    chat screencast_recv_long_side_median_pixels additional.fields [screencast_recv_long_side_median_pixels]
    chat screencast_send_bitrate_kbps_mean additional.fields [screencast_send_bitrate_kbps_mean]
    chat screencast_send_packet_loss_max additional.fields [screencast_send_packet_loss_max]
    chat video_send_bitrate_kbps_mean additional.fields [video_send_bitrate_kbps_mean]
    chat screencast_send_seconds additional.fields [screencast_send_seconds]
    chat audio_send_bitrate_kbps_mean additional.fields [audio_send_bitrate_kbps_mean]
    chat screencast_recv_fps_mean additional.fields [screencast_recv_fps_mean]
    chat audio_recv_seconds additional.fields [audio_recv_seconds]
    chat video_recv_packet_loss_max additional.fields [video_recv_packet_loss_max]
    chat screencast_send_packet_loss_mean additional.fields [screencast_send_packet_loss_mean]
    chat network_transport_protocol additional.fields [network_transport_protocol]
    chat screencast_recv_short_side_median_pixels additional.fields [screencast_recv_short_side_median_pixels]
    chat screencast_send_short_side_median_pixels additional.fields [screencast_send_short_side_median_pixels]
    chat screencast_recv_packet_loss_max additional.fields [screencast_recv_packet_loss_max]
    chat is_external additional.fields [is_external]
    chat video_send_short_side_median_pixels additional.fields [video_send_short_side_median_pixels]
    chat endpoint_id additional.fields [endpoint_id]
    chat network_estimated_download_kbps_mean additional.fields [network_estimated_download_kbps_mean]
    chat network_send_jitter_msec_mean additional.fields [network_send_jitter_msec_mean]
    chat video_send_seconds additional.fields [video_send_seconds]
    chat network_rtt_msec_mean additional.fields [network_rtt_msec_mean]
    chat network_congestion additional.fields [network_congestion]
    chat audio_send_packet_loss_mean additional.fields [audio_send_packet_loss_mean]
    chat action_time additional.fields [action_time]
    gcp USER_EMAIL principal.user.email_addresses If the actor.email log field value is empty, then the USER_EMAIL log field is mapped to the principal.user.email_addresses UDM field.
    drive actor_is_collaborator_account about.labels [actor_is_collaborator_account] (deprecated)
    drive actor_is_collaborator_account additional.fields [actor_is_collaborator_account]
    drive added_role target.user.attribute.roles.name If the event.name log field value is equal to shared_drive_membership_change, then the added_role log field is mapped to the target.user.attribute.roles.name UDM field.
    drive requested_role target.user.attribute.roles.name If the event.name log field value is equal to request_access, then the requested_role log field is mapped to the target.user.attribute.roles.name UDM field.
    drive billable about.labels [billable] (deprecated)
    drive billable additional.fields [billable]
    drive copy_type about.labels [copy_type] (deprecated)
    drive copy_type additional.fields [copy_type]
    drive destination_folder_id target.resource.product_object_id If the event.name log field value is equal to one of the following values, then the destination_folder_id log field is mapped to the target.resource.product_object_id UDM field:
    • add_to_folder
    • move
    • unmovable_item_reparented
    drive doc_id target.resource.product_object_id If the event.name log field value is equal to one of the following values, then the doc_id log field is mapped to the target.resource.product_object_id UDM field:
    • add_to_folder
    • approval_canceled
    • approval_comment_added
    • approval_completed
    • approval_decisions_reset
    • approval_due_time_change
    • approval_requested
    • approval_reviewer_change
    • approval_reviewer_responded
    • copy
    • create
    • delete
    • download
    • email_as_attachment
    • edit
    • label_added
    • label_added_by_item_create
    • label_field_changed
    • label_removed
    • add_lock
    • move
    • preview
    • print
    • remove_from_folder
    • rename
    • untrash
    • sheets_import_range
    • source_copy
    • trash
    • remove_lock
    • unmovable_item_reparented
    • upload
    • view
    • apply_security_update
    • shared_drive_apply_security_update
    • shared_drive_remove_security_update
    • publish_change
    • change_acl_editors
    • change_document_access_scope
    • change_document_access_scope_hierarchy_reconciled
    • change_document_visibility
    • change_document_visibility_hierarchy_reconciled
    • remove_security_update
    • shared_drive_membership_change
    • shared_drive_settings_change
    • sheets_import_range_access_change
    • change_user_access
    • change_user_access_hierarchy_reconciled
    • connected_sheets_query
    • create_comment
    • accept_suggestion
    • change_owner
    • create_suggestion
    • delete_comment
    • delete_suggestion
    • edit_comment
    • expire_access_request
    • reassign_comment
    • reject_suggestion
    • reopen_comment
    • request_access
    • resolve_comment
    • download_forms_response
    • email_collaborators
    drive destination_folder_title target.resource.name If the event.name log field value is equal to one of the following values, then the destination_folder_title log field is mapped to the target.resource.name UDM field:
    • add_to_folder
    • move
    • unmovable_item_reparented
    drive doc_title target.resource.name If the event.name log field value is equal to one of the following values, then the doc_title log field is mapped to the target.resource.name UDM field:
    • add_to_folder
    • approval_canceled
    • approval_comment_added
    • approval_completed
    • approval_decisions_reset
    • approval_due_time_change
    • approval_requested
    • approval_reviewer_change
    • approval_reviewer_responded
    • copy
    • create
    • delete
    • download
    • email_as_attachment
    • edit
    • label_added
    • label_added_by_item_create
    • label_field_changed
    • label_removed
    • add_lock
    • move
    • preview
    • print
    • remove_from_folder
    • rename
    • untrash
    • sheets_import_range
    • source_copy
    • trash
    • remove_lock
    • unmovable_item_reparented
    • upload
    • view
    • apply_security_update
    • shared_drive_apply_security_update
    • shared_drive_remove_security_update
    • publish_change
    • change_acl_editors
    • change_document_access_scope
    • change_document_access_scope_hierarchy_reconciled
    • change_document_visibility
    • change_document_visibility_hierarchy_reconciled
    • remove_security_update
    • shared_drive_membership_change
    • shared_drive_settings_change
    • sheets_import_range_access_change
    • change_user_access
    • change_user_access_hierarchy_reconciled
    • connected_sheets_query
    • create_comment
    • accept_suggestion
    • change_owner
    • create_suggestion
    • delete_comment
    • delete_suggestion
    • edit_comment
    • expire_access_request
    • reassign_comment
    • reject_suggestion
    • reopen_comment
    • request_access
    • resolve_comment
    • download_forms_response
    • email_collaborators
    drive doc_id src.resource.product_object_id If the event.name log field value is equal to one of the following values, then the doc_id log field is mapped to the src.resource.product_object_id UDM field:
    • add_to_folder
    • move
    • unmovable_item_reparented
    drive doc_title src.resource.name If the event.name log field value is equal to one of the following values, then the doc_title log field is mapped to the src.resource.name UDM field:
    • add_to_folder
    • move
    • unmovable_item_reparented
    drive doc_type target.resource.attribute.labels[doc_type] If the event.name log field value is equal to one of the following values, then the doc_type log field is mapped to the target.resource.attribute.labels[doc_type] UDM field:
    • add_to_folder
    • approval_canceled
    • approval_comment_added
    • approval_completed
    • approval_decisions_reset
    • approval_due_time_change
    • approval_requested
    • approval_reviewer_change
    • approval_reviewer_responded
    • copy
    • create
    • delete
    • download
    • email_as_attachment
    • edit
    • label_added
    • label_added_by_item_create
    • label_field_changed
    • label_removed
    • add_lock
    • move
    • preview
    • print
    • remove_from_folder
    • rename
    • untrash
    • sheets_import_range
    • source_copy
    • trash
    • remove_lock
    • unmovable_item_reparented
    • upload
    • view
    • apply_security_update
    • shared_drive_apply_security_update
    • shared_drive_remove_security_update
    • publish_change
    • change_acl_editors
    • change_document_access_scope
    • change_document_access_scope_hierarchy_reconciled
    • change_document_visibility
    • change_document_visibility_hierarchy_reconciled
    • remove_security_update
    • shared_drive_membership_change
    • shared_drive_settings_change
    • sheets_import_range_access_change
    • change_user_access
    • change_user_access_hierarchy_reconciled
    • connected_sheets_query
    • create_comment
    • accept_suggestion
    • change_owner
    • create_suggestion
    • delete_comment
    • delete_suggestion
    • edit_comment
    • expire_access_request
    • reassign_comment
    • reject_suggestion
    • reopen_comment
    • request_access
    • resolve_comment
    • download_forms_response
    • email_collaborators
    drive doc_type src.resource.attribute.labels [doc_type] If the event.name log field value is equal to one of the following values, then the doc_type log field is mapped to the src.resource.attribute.labels [doc_type] UDM field:
    • add_to_folder
    • move
    • unmovable_item_reparented
    drive field target.resource.attribute.labels [field]
    drive field_id target.resource.attribute.labels [field_id]
    drive is_encrypted target.labels [is_encrypted] (deprecated)
    drive is_encrypted additional.fields [is_encrypted]
    drive label target.resource.attribute.labels [label]
    drive label_title target.resource.attribute.labels [label_title]
    drive membership_change_type about.labels [membership_change_type] (deprecated)
    drive membership_change_type additional.fields [membership_change_type]
    drive new_publish_visibility target.resource.attribute.labels [new_publish_visibility]
    drive new_value target.resource.attribute.labels [new_value]
    drive new_value_id target.resource.attribute.labels [new_value_id]
    drive new_settings_state about.labels [new_settings_state] (deprecated)
    drive new_settings_state additional.fields [new_settings_state]
    drive old_settings_state about.labels [old_settings_state] (deprecated)
    drive old_settings_state additional.fields [old_settings_state]
    drive old_publish_visibility target.resource.attribute.labels [old_publish_visibility]
    drive old_value target.resource.attribute.labels [old_value]
    drive old_value_id target.resource.attribute.labels [old_value_id]
    drive old_visibility target.resource.attribute.labels [old_visibility]
    drive originating_app_id about.labels [originating_app_id] (deprecated)
    drive originating_app_id additional.fields [originating_app_id]
    drive owner target.resource.attribute.labels[owner]
    drive owner_is_shared_drive target.resource.attribute.labels [owner_is_shared_drive]
    drive primary_event about.labels [primary_event] (deprecated)
    drive primary_event additional.fields [primary_event]
    drive reason security_result.summary If the event.name log field value is equal to one of the following values, then the reason log field is mapped to the security_result.summary UDM field:
    • label_added
    • label_added_by_item_create
    • label_field_changed
    • label_removed
    drive removed_role target.user.attribute.labels [removed_role] and
    target.user.roles.description
    If the removed_role log field value is equal to commenter, then the target.user.roles.description UDM field is set to Team Drive role Commenter.

    If the removed_role log field value is equal to content_manager, then the target.user.roles.description UDM field is set to Team Drive role Content manager.

    If the removed_role log field value is equal to editor, then the target.user.roles.description UDM field is set to Team Drive role Contributor.

    If the removed_role log field value is equal to none, then the target.user.roles.description UDM field is set to No role in Team Drive.

    If the removed_role log field value is equal to organizer, then the target.user.roles.description UDM field is set to Team Drive role Manager.

    If the removed_role log field value is equal to viewer, then the target.user.roles.description UDM field is set to Team Drive role Viewer.
    drive target_domain target.domain.name If the event.name log field value is equal to one of the following values, then the target_domain log field is mapped to the target.domain.name UDM field:
    • change_document_access_scope
    • change_document_access_scope_hierarchy_reconciled
    • change_document_visibility
    • change_document_visibility_hierarchy_reconciled
    drive target_user target.user.email_addresses If the event.name log field value is equal to one of the following values, then the target_user log field is mapped to the target.user.email_addresses UDM field:
    • change_user_access
    • change_user_access_hierarchy_reconciled
    • expire_access_request
    • request_access
    drive target_user additional.fields[target_user]
    drive new_owner target.user.email_addresses The new_owner log field is mapped to the target.user.email_addresses UDM field if the following conditions are met:
    • The event.name log field value matches the regular expression pattern ^.+@.+$.
    • The event.name log field value is equal to change_owner.


    Else, the new_owner log field is mapped to the target.user.attribute.labels UDM field.
    drive target target.user.email_addresses If the event.name log field value matches the regular expression pattern ^.+@.+$, then the target log field is mapped to the target.user.email_addresses UDM field.
    drive target target.user.attribute.labels[target] If the event.name log field value does not match the regular expression pattern ^.+@.+$, then the target log field is mapped to the target.user.attribute.labels[target] UDM field.
    drive recipients target.user.email_addresses If the event.name log field value is equal to email_collaborators, then the recipients log field is mapped to the target.user.email_addresses UDM field.
    drive shared_drive_id target.resource_ancestors.product_object_id
    drive shared_drive_settings_change_type about.labels [shared_drive_settings_change_type] (deprecated)
    drive shared_drive_settings_change_type additional.fields [shared_drive_settings_change_type]
    drive sheets_import_range_recipient_doc target.resource.attribute.labels [sheets_import_range_recipient_doc]
    drive source_folder_id principal.resource.id If the event.name log field value is equal to one of the following values, then the source_folder_id log field is mapped to the principal.resource.id UDM field:
    • unmovable_item_reparented
    • remove_from_folder
    • move
    drive source_folder_title principal.resource.name If the event.name log field value is equal to one of the following values, then the source_folder_title log field is mapped to the principal.resource.name UDM field:
    • move
    • remove_from_folder
    • unmovable_item_reparented
    drive storage_entity_id about.labels [storage_entity_id] (deprecated)
    drive storage_entity_id additional.fields [storage_entity_id]
    drive storage_usage_in_bytes about.labels [storage_usage_in_bytes] (deprecated)
    drive storage_usage_in_bytes additional.fields [storage_usage_in_bytes]
    drive visibility target.resource.attribute.labels [visibility]
    drive visibility_change target.resource.attribute.labels [visibility_change]
    drive team_drive_id target.group.product_object_id
    drive owner_is_team_drive target.resource.attribute.labels [owner_is_team_drive]
    drive data_connection_id about.labels[data_connection_id] (deprecated)
    drive data_connection_id additional.fields[data_connection_id]
    drive delegating_principal about.user.email_addresses If the actor.email log field value is not equal to delegating_principal, then the delegating_principal log field is mapped to about.user.email_addresses UDM field.
    drive execution_id about.labels[execution_id] (deprecated)
    drive execution_id additional.fields[execution_id]
    drive execution_trigger about.labels[execution_trigger] (deprecated)
    drive execution_trigger additional.fields[execution_trigger]
    drive query_type about.labels[query_type] (deprecated)
    drive query_type additional.fields[query_type]
    drive owner_team_drive_id target.resource.attribute.labels[owner_team_drive_id]
    drive new_owner_is_team_drive target.resource.attribute.labels [new_owner_is_team_drive]
    drive new_owner_team_drive_id target.resource.attribute.labels[new_owner_team_drive_id]
    drive owner_shared_drive_id target.resource.attribute.labels[owner_shared_drive_id]
    drive dlp_info target.resource.attribute.labels[dlp_info]
    drive team_drive_settings_change_type target.resource.attribute.labels[team_drive_settings_change_type]
    drive accessed_url target.url
    drive script_id additional.fields[script_id]
    drive additional.fields[script_id] additional.fields[api_method]
    keep attachment_name target.resource.attribute.labels [attachment_name] If the event.name log field value is equal to one of the following values, then the attachment_name log field is mapped to the target.resource.attribute.labels UDM field:
    • deleted_attachment
    • uploaded_attachment
    keep note_name target.url If the event.name log field value is equal to one of the following values, then the note_name log field is mapped to the target.url UDM field:
    • deleted_attachment
    • uploaded_attachment
    • edited_note_content
    • created_note
    • deleted_note
    • modified_acl
    keep owner_email principal.user.email_addresses If the actor.email log field value is empty, then the owner_email log field is mapped to the principal.user.email_addresses UDM field.
    keep target.resource_subtype The target.resource_subtype UDM field is set to keep.
    meet action_description security_result.action_details If the event.name log field value is equal to abuse_report_submitted, then the action_description log field is mapped to the security_result.action_details UDM field.
    meet action_reason security_result.summary
    meet conference_id target.resource.product_object_id If the event.name log field value is equal to one of the following values, then the conference_id log field is mapped to the target.resource.product_object_id UDM field:
    • abuse_report_submitted
    • call_ended
    • livestream_watched
    • knocking_accepted
    • knocking_denied
    • presentation_started
    • presentation_stopped
    • recording_activity
    • invitation_sent
    meet calendar_event_id target.labels [calendar_event_id] (deprecated)
    meet calendar_event_id additional.fields [calendar_event_id]
    meet device_type principal.asset.attribute.labels [device_type]
    meet display_name principal.user.user_display_name If the event.name log field value is equal to one of the following values, then the display_name log field is mapped to the principal.user.user_display_name UDM field:
    • abuse_report_submitted
    • call_ended
    • livestream_watched
    meet target_display_names target.user.user_display_name If the event.name log field value is equal to abuse_report_submitted, then the target_display_name log field is mapped to the target.user.user_display_name UDM field.
    meet duration_seconds target.resource.attribute.labels [duration_seconds]
    meet end_of_call_rating target.resource.attribute.labels [end_of_call_rating]
    meet endpoint_id security_result.about.labels [endpoint_id] (deprecated)
    meet endpoint_id additional.fields [endpoint_id]
    meet identifier principal.user.userid If the event.name log field value is equal to one of the following values, then the identifier log field is mapped to the principal.user.userid UDM field:
    • abuse_report_submitted
    • call_ended
    • knocking_accepted
    • knocking_denied
    • presentation_started
    • presentation_stopped
    • invitation_sent
    meet identifier_type principal.user.attribute.labels [identifier_type]
    meet ip_address target.ip If the ipAddress log field value is empty, then the ip_address log field is mapped to the target.ip UDM field.
    meet is_external principal.labels [is_external] (deprecated)
    meet is_external additional.fields [is_external]
    meet livestream_view_page_id target.resource.attribute.labels [livestream_view_page_id]
    meet location_country principal.location.country_or_region If the event.name log field value is equal to call_ended, then the location_country log field is mapped to the principal.location.country_or_region UDM field.
    meet location_region principal.user.attribute.labels [location_region] If the event.name log field value is equal to call_ended, then the location_region log field is mapped to the principal.location.country_or_region UDM field.
    meet meeting_code target.resource.product_object_id If the event.name log field value is equal to one of the following values, then the meeting_code log field is mapped to the target.resource.product_object_id UDM field:
    • abuse_report_submitted
    • call_ended
    • livestream_watched
    • knocking_accepted
    • knocking_denied
    • presentation_started
    • presentation_stopped
    • invitation_sent
    meet organizer_email about.user.email_addresses If the event.name log field value is equal to one of the following values, then the organizer_email log field is mapped to the about.user.email_addresses UDM field:
    • abuse_report_submitted
    • call_ended
    • livestream_watched
    meet product_type principal.resource.resource_subtype If the event.name log field value is equal to one of the following values, then the product_type log field is mapped to the principal.resource.resource_subtype UDM field:
    • abuse_report_submitted
    • call_ended
    • livestream_watched
    meet target_email target.user.email_addresses If the event.name log field value is equal to abuse_report_submitted, then the target_email log field is mapped to the target.user.email_addresses UDM field.
    meet target_phone_number target.user.phone_numbers If the event.name log field value is equal to abuse_report_submitted, then the target_phone_number log field is mapped to the target.user.phone_numbers UDM field.
    meet audio_recv_packet_loss_max about.labels [audio_recv_packet_loss_max] (deprecated)
    meet audio_recv_packet_loss_max additional.fields [audio_recv_packet_loss_max]
    meet audio_recv_packet_loss_mean about.labels [audio_recv_packet_loss_mean] (deprecated)
    meet audio_recv_packet_loss_mean additional.fields [audio_recv_packet_loss_mean]
    meet audio_recv_seconds about.labels [audio_recv_seconds] (deprecated)
    meet audio_recv_seconds additional.fields [audio_recv_seconds]
    meet audio_send_bitrate_kbps_mean about.labels [audio_send_bitrate_kbps_mean] (deprecated)
    meet audio_send_bitrate_kbps_mean additional.fields [audio_send_bitrate_kbps_mean]
    meet audio_send_packet_loss_max about.labels [audio_send_packet_loss_max] (deprecated)
    meet audio_send_packet_loss_max additional.fields [audio_send_packet_loss_max]
    meet audio_send_packet_loss_mean about.labels [audio_send_packet_loss_mean] (deprecated)
    meet audio_send_packet_loss_mean additional.fields [audio_send_packet_loss_mean]
    meet audio_send_seconds about.labels [audio_send_seconds] (deprecated)
    meet audio_send_seconds additional.fields [audio_send_seconds]
    meet network_congestion about.labels [network_congestion] (deprecated)
    meet network_congestion additional.fields [network_congestion]
    meet network_estimated_download_kbps_mean about.labels [network_estimated_download_kbps_mean] (deprecated)
    meet network_estimated_download_kbps_mean additional.fields [network_estimated_download_kbps_mean]
    meet network_estimated_upload_kbps_mean about.labels [network_estimated_upload_kbps_mean] (deprecated)
    meet network_estimated_upload_kbps_mean additional.fields [network_estimated_upload_kbps_mean]
    meet network_recv_jitter_msec_max about.labels [network_recv_jitter_msec_max] (deprecated)
    meet network_recv_jitter_msec_max additional.fields [network_recv_jitter_msec_max]
    meet network_recv_jitter_msec_mean about.labels [network_recv_jitter_msec_mean] (deprecated)
    meet network_recv_jitter_msec_mean additional.fields [network_recv_jitter_msec_mean]
    meet network_rtt_msec_mean about.labels [network_rtt_msec_mean] (deprecated)
    meet network_rtt_msec_mean additional.fields [network_rtt_msec_mean]
    meet network_send_jitter_msec_mean about.labels [network_send_jitter_msec_mean] (deprecated)
    meet network_send_jitter_msec_mean additional.fields [network_send_jitter_msec_mean]
    meet network_transport_protocol about.labels [network_transport_protocol] (deprecated)
    meet network_transport_protocol additional.fields [network_transport_protocol]
    meet screencast_recv_bitrate_kbps_mean about.labels [screencast_recv_bitrate_kbps_mean] (deprecated)
    meet screencast_recv_bitrate_kbps_mean additional.fields [screencast_recv_bitrate_kbps_mean]
    meet screencast_recv_fps_mean about.labels [screencast_recv_fps_mean] (deprecated)
    meet screencast_recv_fps_mean additional.fields [screencast_recv_fps_mean]
    meet screencast_recv_long_side_median_pixels about.labels [screencast_recv_long_side_median_pixels] (deprecated)
    meet screencast_recv_long_side_median_pixels additional.fields [screencast_recv_long_side_median_pixels]
    meet screencast_recv_packet_loss_max about.labels [screencast_recv_packet_loss_max] (deprecated)
    meet screencast_recv_packet_loss_max additional.fields [screencast_recv_packet_loss_max]
    meet screencast_recv_packet_loss_mean about.labels [screencast_recv_packet_loss_mean] (deprecated)
    meet screencast_recv_packet_loss_mean additional.fields [screencast_recv_packet_loss_mean]
    meet screencast_recv_seconds about.labels [screencast_recv_seconds] (deprecated)
    meet screencast_recv_seconds additional.fields [screencast_recv_seconds]
    meet screencast_recv_short_side_median_pixels about.labels [screencast_recv_short_side_median_pixels] (deprecated)
    meet screencast_recv_short_side_median_pixels additional.fields [screencast_recv_short_side_median_pixels]
    meet screencast_send_bitrate_kbps_mean about.labels [screencast_send_bitrate_kbps_mean] (deprecated)
    meet screencast_send_bitrate_kbps_mean additional.fields [screencast_send_bitrate_kbps_mean]
    meet screencast_send_fps_mean about.labels [screencast_send_fps_mean] (deprecated)
    meet screencast_send_fps_mean additional.fields [screencast_send_fps_mean]
    meet screencast_send_long_side_median_pixels about.labels [screencast_send_long_side_median_pixels] (deprecated)
    meet screencast_send_long_side_median_pixels additional.fields [screencast_send_long_side_median_pixels]
    meet screencast_send_packet_loss_max about.labels [screencast_send_packet_loss_max] (deprecated)
    meet screencast_send_packet_loss_max additional.fields [screencast_send_packet_loss_max]
    meet screencast_send_packet_loss_mean about.labels [screencast_send_packet_loss_mean] (deprecated)
    meet screencast_send_packet_loss_mean additional.fields [screencast_send_packet_loss_mean]
    meet screencast_send_seconds about.labels [screencast_send_seconds] (deprecated)
    meet screencast_send_seconds additional.fields [screencast_send_seconds]
    meet screencast_send_short_side_median_pixels about.labels [screencast_send_short_side_median_pixels] (deprecated)
    meet screencast_send_short_side_median_pixels additional.fields [screencast_send_short_side_median_pixels]
    meet video_recv_fps_mean about.labels [video_recv_fps_mean] (deprecated)
    meet video_recv_fps_mean additional.fields [video_recv_fps_mean]
    meet video_recv_long_side_median_pixels about.labels [video_recv_long_side_median_pixels] (deprecated)
    meet video_recv_long_side_median_pixels additional.fields [video_recv_long_side_median_pixels]
    meet video_recv_packet_loss_max about.labels [video_recv_packet_loss_max] (deprecated)
    meet video_recv_packet_loss_max additional.fields [video_recv_packet_loss_max]
    meet video_recv_packet_loss_mean about.labels [video_recv_packet_loss_mean] (deprecated)
    meet video_recv_packet_loss_mean additional.fields [video_recv_packet_loss_mean]
    meet video_recv_seconds about.labels [video_recv_seconds] (deprecated)
    meet video_recv_seconds additional.fields [video_recv_seconds]
    meet video_recv_short_side_median_pixels about.labels [video_recv_short_side_median_pixels] (deprecated)
    meet video_recv_short_side_median_pixels additional.fields [video_recv_short_side_median_pixels]
    meet video_send_bitrate_kbps_mean about.labels [video_send_bitrate_kbps_mean] (deprecated)
    meet video_send_bitrate_kbps_mean additional.fields [video_send_bitrate_kbps_mean]
    meet video_send_fps_mean about.labels [video_send_fps_mean] (deprecated)
    meet video_send_fps_mean additional.fields [video_send_fps_mean]
    meet video_send_long_side_median_pixels about.labels [video_send_long_side_median_pixels] (deprecated)
    meet video_send_long_side_median_pixels additional.fields [video_send_long_side_median_pixels]
    meet video_send_packet_loss_max about.labels [video_send_packet_loss_max] (deprecated)
    meet video_send_packet_loss_max additional.fields [video_send_packet_loss_max]
    meet video_send_packet_loss_mean about.labels [video_send_packet_loss_mean] (deprecated)
    meet video_send_packet_loss_mean additional.fields [video_send_packet_loss_mean]
    meet video_send_seconds about.labels [video_send_seconds] (deprecated)
    meet video_send_seconds additional.fields [video_send_seconds]
    meet video_send_short_side_median_pixels about.labels [video_send_short_side_median_pixels] (deprecated)
    meet video_send_short_side_median_pixels additional.fields [video_send_short_side_median_pixels]
    meet action_time about.labels[action_time] (deprecated)
    meet action_time additional.fields[action_time]
    meet target_user_count target.user.attribute.labels[target_user_count]
    meet streaming_session_state about.labels[streaming_session_state] (deprecated)
    meet streaming_session_state additional.fields[streaming_session_state]
    login affected_email_address target.user.email_addresses If the event.name log field value is equal to one of the following values, then the affected_email_address log field is mapped to the target.user.email_addresses UDM field:
    • account_disabled_password_leak
    • suspicious_login
    • suspicious_login_less_secure_app
    • suspicious_programmatic_login
    • account_disabled_generic
    • account_disabled_spamming_through_relay
    • account_disabled_spamming
    • account_disabled_hijacked
    • blocked_sender
    login login_timestamp security_result.detection_fields [login_timestamp]
    login is_second_factor about.labels[is_2sv] (deprecated)
    login is_second_factor additional.fields[is_2sv]
    login is_suspicious about.labels[is_suspicious] (deprecated)
    login is_suspicious additional.fields[is_suspicious]
    login login_failure_type scurity_result.summary
    login login_challenge_status about.labels[login_challenge_status] (deprecated)
    login login_challenge_status additional.fields[login_challenge_status]
    login login_challenge_method security_result.detection_fields [login_challenge_method]
    login login_challenge_method security_result.detection_fields [login_challenge_method_attempts_count]
    login login_type security_result.detection_fields [login_type]
    login sensitive_action_name security_result.action_details [sensitive_action_name]
    login extensions.auth.mechanism If the param.value log field value is equal to google_password, then the extensions.auth.mechanism UDM field is set to USERNAME_PASSWORD.

    Else, the extensions.auth.mechanism UDM field is set to MECHANISM_UNSPECIFIED.
    login extensions.auth.type If the param.value log field value is equal to google_password, then the extensions.auth.type UDM field is set to SSO.
    login security_result.action If the event.name log field value is equal to one of the following values, then the security_result.action UDM field is set to BLOCK:
    • login_failure
    • risky_sensitive_action_blocked
    token api_name about.resource.attribute.labels [api_name]
    token app_name target.resource.name If the event.name log field value is equal to one of the following values, then the app_name log field is mapped to the target.resource.name UDM field:
    • activity
    • authorize
    • revoke
    token client_id principal.asset.attribute.labels [client_id] If the event.name log field value is equal to one of the following values, then the client_id log field is mapped to the principal.asset.attribute.labels UDM field:
    • activity
    • authorize
    • revoke
    token client_type principal.asset.attribute.labels [client_type]
    token method_name target.resource.attribute.labels [method_name]
    token num_response_bytes target.resource.attribute.labels [num_response_bytes]
    token product_bucket target.resource.attribute.labels product_bucket]
    token scope target.resource.attribute.labels [scope]
    token scope_data target.resource.attribute.labels [scope_data]
    token rejection_type target.resource.attribute.labels [rejection_type]
    rules actions security_result.action_details [actions]
    rules triggered_actions security_result.action_details [actions]
    rules actor_ip_address principal.ip If the ipAddress log field value is equal to empty, then the actor_ip_address log field is mapped to the principal.ip UDM field.
    rules application target.resource.attribute.labels[application]
    rules conference_id target.resource.attribute.labels [conference_id]
    rules data_source security_result.detection_fields [data_source]
    rules device_id target.asset.asset_id If the event.name log field value is equal to one of the following values, then the device_id log field is mapped to the target.asset.asset_id UDM field:
    • action_complete
    • label_field_value_changed
    • label_applied
    rules device_type target.asset.attribute.labels[device_type]
    rules drive_shared_drive_id target.resource.attribute.labels[drive_shared_drive_id]
    rules evaluation_context about.labels [evaluation_context] (deprecated)
    rules evaluation_context additional.fields [evaluation_context]
    rules has_alert security_result.about.labels [has_alert] (deprecated)
    rules has_alert additional.fields [has_alert]
    rules has_content_match security_result.about.labels [has_content_match] (deprecated)
    rules has_content_match additional.fields [has_content_match]
    rules matched_detectors security_result.detection_fields [matched_detectors]
    rules matched_templates security_result.detection_fields [matched_templates]
    rules matched_threshold security_result.detection_fields [matched_threshold]
    rules matched_trigger security_result.detection_fields [matched_trigger]
    rules mobile_device_type target.asset.category If the event.name log field value is equal to rule_match, then the mobile_device_type log field is mapped to the target.asset.category UDM field.
    rules mobile_ios_vendor_id target.asset.attribute.labels [mobile_ios_vendor_id]
    rules resource_id target.resource.product_object_id If the event.name log field value is equal to one of the following values, then the resource_id log field is mapped to the target.resource.product_object_id UDM field:
    • action_complete
    • rule_match
    • label_field_value_changed
    • label_applied
    rules resource_name target.resource.name If the event.name log field value is equal to rule_match, then the resource_name log field is mapped to the target.resource.name UDM field.
    rules resource_title target.labels [resource_title] (deprecated)
    rules resource_title additional.fields [resource_title]
    rules resource_owner_email principal.user.email_addresses If the actor.email log field value is not equal to resource_owner_email, then the principal.user.email_addresses UDM field is set to resource_owner_email.
    rules resource_recipients principal.user.email_addresses If the actor.email log field value is not equal to resource_recipients, then the principal.user.email_addresses UDM field is set to resource_recipients.
    rules resource_recipients_omitted_count target.labels [resource_recipients_omitted_count] (deprecated)
    rules resource_recipients_omitted_count additional.fields [resource_recipients_omitted_count]
    rules resource_type target.resource.resource_subtype If the event.name log field value is equal to one of the following values, then the resource_type log field is mapped to the target.resource.resource_subtype UDM field:
    • action_complete
    • label_field_value_changed
    • label_applied
    • sharing_blocked
    rules rule_name security_result.rule_name If the event.name log field value is equal to one of the following values, then the rule_name log field is mapped to the security_result.rule_name UDM field:
    • action_complete
    • rule_match
    • rule_trigger
    • label_field_value_changed
    • label_applied
    rules rule_id security_result.rule_id If the event.name log field value is equal to rule_match, then the rule_id log field is mapped to the security_result.rule_id UDM field.
    rules rule_resource_name security_result.rule_labels [rule_resource_name]
    rules rule_type security_result.rule_type If the event.name log field value is equal to one of the following values, then the rule_type log field is mapped to the security_result.rule_type UDM field:
    • action_complete
    • rule_trigger
    • label_field_value_changed
    • sharing_blocked
    rules rule_update_time_usec security_result.rule_labels [rule_update_time_usec]
    rules scan_type security_result.about.labels [scan_type] (deprecated)
    rules scan_type additional.fields [scan_type]
    rules severity security_result.severity If the event.name log field value is equal to one of the following values, then the severity log field is mapped to the security_result.severity UDM field:
    • action_complete
    • rule_trigger
    rules space_id target.resource.attribute.labels [space_id]
    rules space_type target.resource.attribute.labels [space_type]
    rules suppressed_actions security_result.about.labels [suppressed_actions] (deprecated)
    rules suppressed_actions additional.fields [suppressed_actions]
    rules label_field target.resource.attribute.labels [label_field]
    rules label_title target.resource.attribute.labels [label_title]
    rules new_value target.resource.attribute.labels [new_value]
    rules old_value target.resource.attribute.labels [old_value]
    rules blocked_recipients target.user.email_addresses
    rules snippets target.resource.attribute.labels [snippets]
    saml application_name target.application If the event.name log field value is equal to one of the following values, then the application_name log field is mapped to the target.application UDM field:
    • login_failure
    • login_success
    saml device_id principal.asset.asset_id If the event.name log field value is equal to one of the following values, then the device_id log field is mapped to the principal.asset.assetid UDM field:
    • login_failure
    • login_success
    saml failure_type security_result.summary If the event.name log field value is equal to login_failure, then the failure_type log field is mapped to the security_result.summary UDM field.
    saml initiated_by security_result.detection_fields[initiated_by] If the event.name log field value is equal to one of the following values, then the initiated_by log field is mapped to the security_result.detection_fields UDM field:
    • login_failure
    • login_success
    saml orgunit_path target.user.attribute.labels [orgunit_path] If the event.name log field value is equal to one of the following values, then the orgunit_path log field is mapped to the target.user.attribute.labels UDM field:
    • login_failure
    • login_success
    saml saml_second_level_status_code security_result.about.labels [saml_second_level_status_code] (deprecated)
    saml saml_second_level_status_code additional.fields [saml_second_level_status_code]
    saml saml_status_code security_result.about.labels [saml_status_code] (deprecated)
    saml saml_status_code additional.fields [saml_status_code]
    saml security_result.action If the event.name log field value is equal to login_failure, then the security_result.action UDM field is set to BLOCK.
    user_accounts email_forwarding_destination_address target.user.email_addresses
    groups acl_permission target.group.attribute.roles.name If the event.name log field value is equal to change_acl_permission, then the acl_permission log field is mapped to the target.group.attribute.roles.name UDM field.
    groups basic_setting target.group.attribute.labels [basic_setting]
    groups group_email target.group.email_addresses If the event.name log field value is equal to one of the following values, then the group_email log field is mapped to the target.group.email_addresses UDM field:
    • change_acl_permission
    • accept_invitation
    • approve_join_request
    • join
    • request_to_join
    • change_basic_setting
    • create_group
    • delete_group
    • change_identity_setting
    • add_info_setting
    • change_info_setting
    • remove_info_setting
    • change_new_members_restrictions_setting
    • change_post_replies_setting
    • change_spam_moderation_setting
    • change_topic_setting
    • moderate_message
    • always_post_from_user
    • add_user
    • ban_user_with_moderation
    • revoke_invitation
    • invite_user
    • reject_join_request
    • reinvite_user
    • remove_user
    • change_email_subscription_type
    • unsubscribe_via_mail
    groups identity_setting target.group.attribute.labels [identity_setting]
    groups info_setting target.group.attribute.labels [info_setting]
    groups message_id network.email.mail_id If the event.name log field value is equal to moderate_message, then the message_id log field is mapped to the network.email.mail_id UDM field.
    groups message_moderation_action target.group.attribute.labels [message_moderation_action]
    groups member_role target.user.attribute.roles.name If the event.name log field value is equal to add_user, then the member_role log field is mapped to the target.user.attribute.roles.name UDM field.
    groups new_members_restrictions_setting target.group.attribute.labels [new_members_restrictions_setting]
    groups new_value target.group.attribute.labels [new_value]
    groups new_value_repeated target.group.attribute.labels [new_value_repeated]
    groups old_value target.group.attribute.labels [old_value]
    groups old_value_repeated target.group.attribute.labels [old_value_repeated]
    groups post_replies_setting target.group.attribute.labels [post_replies_setting]
    groups spam_moderation_setting target.group.attribute.labels [spam_moderation_setting]
    groups status target.group.attribute.labels[status]
    groups topic_setting target.group.attribute.labels [topic_setting]
    groups user_email target.user.email_addresses If the event.name log field value is equal to one of the following values, then the user_email log field is mapped to the target.user.email_addresses UDM field:
    • approve_join_request
    • always_post_from_user
    • add_user
    • ban_user_with_moderation
    • revoke_invitation
    • invite_user
    • reject_join_request
    • reinvite_user
    • remove_user
    • change_email_subscription_type
    groups user_email principal.user.email_addresses If the event.name log field value is equal to unsubscribe_via_mail and the actor.email log field value is not equal to the user_email, then the user_email log field is mapped to the principal.user.email_addresses UDM field.
    groups value target.group.attribute.labels [value_of_info_setting]
    admin USER_EMAIL src.user.email_addresses If the event.name log field value is equal to CREATE_DATA_TRANSFER_REQUEST, then the USER_EMAIL log field is mapped to the src.user.email_addresses UDM field.
    admin USER_EMAIL target.user.email_addresses If the event.name log field value is equal to one of the following values, then the USER_EMAIL log field is mapped to the target.user.email_addresses UDM field:
    • DELETE_2SV_SCRATCH_CODES
    • GENERATE_2SV_SCRATCH_CODES
    • REVOKE_3LO_TOKEN
    • REVOKE_3LO_DEVICE_TOKENS
    • ADD_RECOVERY_EMAIL
    • ADD_RECOVERY_PHONE
    • GRANT_ADMIN_PRIVILEGE
    • REVOKE_ADMIN_PRIVILEGE
    • REVOKE_ASP
    • TOGGLE_AUTOMATIC_CONTACT_SHARING
    • BULK_UPLOAD_NOTIFICATION_SENT
    • CANCEL_USER_INVITE
    • CHANGE_USER_CUSTOM_FIELD
    • CHANGE_USER_EXTERNAL_ID
    • CHANGE_USER_GENDER
    • CHANGE_USER_IM
    • ENABLE_USER_IP_WHITELIST
    • CHANGE_USER_KEYWORD
    • CHANGE_USER_LANGUAGE
    • CHANGE_USER_LOCATION
    • CHANGE_USER_ORGANIZATION
    • CHANGE_USER_PHONE_NUMBER
    • CHANGE_RECOVERY_EMAIL
    • CHANGE_RECOVERY_PHONE
    • CHANGE_USER_RELATION
    • CHANGE_USER_ADDRESS
    • CREATE_EMAIL_MONITOR
    • CREATE_DATA_TRANSFER_REQUEST
    • CREATE_DATA_TRANSFER_REQUEST
    • CHANGE_PASSWORD
    • DELETE_ACCOUNT_INFO_DUMP
    • DELETE_EMAIL_MONITOR
    • DELETE_MAILBOX_DUMP
    • DELETE_PROFILE_PHOTO
    • CHANGE_FIRST_NAME
    • xyz_RESET_USER
    • CHANGE_LAST_NAME
    • MAIL_ROUTING_DESTINATION_ADDED
    • MAIL_ROUTING_DESTINATION_REMOVED
    • ADD_NICKNAME
    • REMOVE_NICKNAME
    • CHANGE_PASSWORD_ON_NEXT_LOGIN
    • REMOVE_RECOVERY_EMAIL
    • REMOVE_RECOVERY_PHONE
    • REQUEST_ACCOUNT_INFO
    • REQUEST_MAILBOX_DUMP
    • RESEND_USER_INVITE
    • RESEND_USER_INVITE
    • RESET_SIGNIN_COOKIES
    • SECURITY_KEY_REGISTERED_FOR_USER
    • REVOKE_SECURITY_KEY
    • USER_INVITE
    • VIEW_TEMP_PASSWORD
    • TURN_OFF_2_STEP_VERIFICATION
    • UNBLOCK_USER_SESSION
    • UPDATE_PROFILE_PHOTO
    • UNENROLL_USER_FROM_TITANIUM
    • ARCHIVE_USER
    • UPDATE_BIRTHDATE
    • CREATE_USER
    • DELETE_USER
    • DOWNGRADE_USER_FROM_GPLUS
    • USER_ENROLLED_IN_TWO_STEP_VERIFICATION
    • MOVE_USER_TO_ORG_UNIT
    • USER_PUT_IN_TWO_STEP_VERIFICATION_GRACE_PERIOD
    • RENAME_USER
    • UNENROLL_USER_FROM_STRONG_AUTH
    • SUSPEND_USER
    • UNARCHIVE_USER
    • UNDELETE_USER
    • UNSUSPEND_USER
    • UPGRADE_USER_TO_GPLUS
    • USERS_BULK_UPLOAD_NOTIFICATION_SENT
    • ASSIGN_ROLE
    • USER_LICENSE_ASSIGNMENT
    • USER_LICENSE_REVOKE
    • ADD_GROUP_MEMBER
    • REMOVE_GROUP_MEMBER
    • UNASSIGN_ROLE
    • ACTION_REQUESTED
    admin DESTINATION_USER_EMAIL target.user.email_addresses
    admin DEVICE_ID target.asset.asset_id If the event.name log field value is equal to one of the following values, then the DEVICE_ID log field is mapped to the target.asset.asset_id UDM field:
    • REVOKE_3LO_DEVICE_TOKENS
    • ACTION_REQUESTED
    admin DEVICE_TYPE target.platform If the DEVICE_TYPE log field value matches the regular expression pattern (?i)windows, then the target.platform UDM field is set to WINDOWS.

    Else, if the DEVICE_TYPE log field value matches the regular expression pattern (?i)mac, then the target.platform UDM field is set to MAC.

    Else, if the DEVICE_TYPE log field value matches the regular expression pattern (?i)linux, then the target.platform UDM field is set to LINUX.

    Else, if the DEVICE_TYPE log field value matches the regular expression pattern (?i)ios, then the target.platform UDM field is set to IOS.

    Else, if the DEVICE_TYPE log field value matches the regular expression pattern (?i)android, then the target.platform UDM field is set to ANDROID.

    Else, if the DEVICE_TYPE log field value matches the regular expression pattern (?i)chrome, then the target.platform UDM field is set to CHROME_OS.
    admin APP_ID target.resource.name If the event.name log field value is equal to one of the following values, then the APP_ID log field is mapped to the target.resource.name UDM field:
    • REVOKE_3LO_TOKEN
    • REMOVE_APPLICATION
    • ADD_APPLICATION
    admin NEW_VALUE target.resource.name If the event.name log field value is equal to MAIL_ROUTING_DESTINATION_ADDED, then the NEW_VALUE log field is mapped to the target.resource.name UDM field.
    admin SETTING_NAME target.resource.name If the event.name log field value is equal to one of the following values, then the SETTING_NAME log field is mapped to the target.resource.name UDM field:
    • CHANGE_GROUP_SETTING
    • CHANGE_EMAIL_SETTING
    • CREATE_APPLICATION_SETTING
    • CHANGE_APPLICATION_SETTING
    • CHANGE_DOCS_SETTING
    • ENFORCE_STRONG_AUTHENTICATION
    • CHANGE_GMAIL_SETTING
    • DELETE_GMAIL_SETTING
    • CREATE_GMAIL_SETTING
    admin CERTIFICATE_NAME target.resource.name If the event.name log field value is equal to GENERATE_CERTIFICATE, then the CERTIFICATE_NAME log field is mapped to the target.resource.name UDM field.
    admin ACCESS_LEVEL_NAME target.resource.name If the event.name log field value is equal to UPDATE_ACCESS_LEVEL_V2, then the ACCESS_LEVEL_NAME log field is mapped to the target.resource.name UDM field.
    admin ASP_ID target.labels [asp_id] (deprecated)
    admin ASP_ID additional.fields [asp_id]
    admin NEW_VALUE target.resource.attribute.labels [new_value] If the event.name log field value is equal to one of the following values, then the NEW_VALUE log field is mapped to the target.resource.attribute.labels UDM field:
    • CHANGE_MOBILE_APPLICATION_SETTINGS
    • CREATE_APPLICATION_SETTING
    • CHANGE_APPLICATION_SETTING
    • CHANGE_DOCS_SETTING
    • CHANGE_CALENDAR_SETTING
    admin NEW_VALUE target.labels [new_value] (deprecated) If the event.name log field value is equal to one of the following values, then the NEW_VALUE log field is mapped to the target.labels UDM field:
    • CHANGE_DOMAIN_DEFAULT_TIMEZONE
    • CHANGE_DOMAIN_DEFAULT_LOCALE
    • TOGGLE_SERVICE_ENABLED
    • MOVE_ORG_UNIT
    • EDIT_ORG_UNIT_NAME
    • ALLOW_STRONG_AUTHENTICATION
    • CHANGE_TWO_STEP_VERIFICATION_FREQUENCY
    • CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION
    • CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION
    • CHANGE_TWO_STEP_VERIFICATION_START_DATE
    • WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED
    • ENFORCE_STRONG_AUTHENTICATION
    admin NEW_VALUE additional.fields [new_value] If the event.name log field value is equal to one of the following values, then the NEW_VALUE log field is mapped to the additional.fields UDM field:
    • CHANGE_DOMAIN_DEFAULT_TIMEZONE
    • CHANGE_DOMAIN_DEFAULT_LOCALE
    • TOGGLE_SERVICE_ENABLED
    • MOVE_ORG_UNIT
    • EDIT_ORG_UNIT_NAME
    • ALLOW_STRONG_AUTHENTICATION
    • CHANGE_TWO_STEP_VERIFICATION_FREQUENCY
    • CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION
    • CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION
    • CHANGE_TWO_STEP_VERIFICATION_START_DATE
    • WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED
    • ENFORCE_STRONG_AUTHENTICATION
    admin NEW_VALUE target.user.attribute.labels [new_value]
    admin NEW_VALUE target.user.user_display_name If the event.name log field value is equal to one of the following values, then the NEW_VALUE log field is mapped to the target.user.user_display_name UDM field:
    • CHANGE_DISPLAY_NAME
    • RENAME_USER
    admin NEW_VALUE target.user.first_name If the event.name log field value is equal to CHANGE_FIRST_NAME, then the NEW_VALUE log field is mapped to the target.user.first_name UDM field.
    admin NEW_VALUE target.user.last_name If the event.name log field value is equal to CHANGE_LAST_NAME, then the NEW_VALUE log field is mapped to the target.user.last_name UDM field.
    admin OLD_VALUE target.resource.attribute.labels [old_value] If the event.name log field value is equal to one of the following values, then the OLD_VALUE log field is mapped to the target.resource.attribute.labels UDM field:
    • CHANGE_MOBILE_APPLICATION_SETTINGS
    • CREATE_APPLICATION_SETTING
    • CHANGE_APPLICATION_SETTING
    • CHANGE_DOCS_SETTING
    • CHANGE_CALENDAR_SETTING
    admin OLD_VALUE target.labels [old_value] (deprecated) If the event.name log field value is equal to one of the following values, then the OLD_VALUE log field is mapped to the target.labels UDM field:
    • CHANGE_DOMAIN_DEFAULT_TIMEZONE
    • CHANGE_DOMAIN_DEFAULT_LOCALE
    • TOGGLE_SERVICE_ENABLED
    • MOVE_ORG_UNIT
    • EDIT_ORG_UNIT_NAME
    • ALLOW_STRONG_AUTHENTICATION
    • CHANGE_TWO_STEP_VERIFICATION_FREQUENCY
    • CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION
    • CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION
    • CHANGE_TWO_STEP_VERIFICATION_START_DATE
    • WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED
    • ENFORCE_STRONG_AUTHENTICATION
    admin OLD_VALUE additional.fields [old_value] If the event.name log field value is equal to one of the following values, then the OLD_VALUE log field is mapped to the additional.fields UDM field:
    • CHANGE_DOMAIN_DEFAULT_TIMEZONE
    • CHANGE_DOMAIN_DEFAULT_LOCALE
    • TOGGLE_SERVICE_ENABLED
    • MOVE_ORG_UNIT
    • EDIT_ORG_UNIT_NAME
    • ALLOW_STRONG_AUTHENTICATION
    • CHANGE_TWO_STEP_VERIFICATION_FREQUENCY
    • CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION
    • CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION
    • CHANGE_TWO_STEP_VERIFICATION_START_DATE
    • WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED
    • ENFORCE_STRONG_AUTHENTICATION
    admin OLD_VALUE target.user.attribute.labels [old_value]
    admin BULK_UPLOAD_FAIL_USERS_NUMBER target.user.attribute.labels [bulk_upload_fail_users_number]
    admin BULK_UPLOAD_TOTAL_USERS_NUMBER target.user.attribute.labels [bulk_upload_total_users_number]
    admin SYSTEM_DEFINED_RULE_NAME security_result.rule_name If the event.name log field value is equal to SYSTEM_DEFINED_RULE_UPDATED, then the SYSTEM_DEFINED_RULE_NAME log field is mapped to the security_result.rule_name UDM field.
    admin ALERT_NAME security_result.rule_name
    admin SECURITY_CENTER_RULE_NAME security_result.rule_name
    admin DOMAIN_NAME target.domain.name
    admin USER_CUSTOM_FIELD target.user.attribute.labels [user_custom_field]
    admin BEGIN_DATE_TIME target.resource.attribute.labels [begin_date_time]
    admin EMAIL_MONITOR_DEST_EMAIL target.resource.attribute.labels [email_monitor_dest_email]
    admin EMAIL_MONITOR_LEVEL_CHAT target.resource.attribute.labels [email_monitor_level_chat]
    admin EMAIL_MONITOR_LEVEL_DRAFT_EMAIL target.resource.attribute.labels [email_monitor_level_draft_email]
    admin EMAIL_MONITOR_LEVEL_INCOMING_EMAIL target.resource.attribute.labels [email_monitor_level_incoming_email]
    admin EMAIL_MONITOR_LEVEL_OUTGOING_EMAIL target.resource.attribute.labels [email_monitor_level_outgoing_email]
    admin END_DATE_TIME target.resource.attribute.labels [end_date_time]
    admin APPLICATION_NAME target.application If the event.name log field value is equal to one of the following values, then the APPLICATION_NAME log field is mapped to the target.application UDM field:
    • CREATE_EMAIL_MONITOR
    • DELETE_EMAIL_MONITOR
    • REMOVE_APPLICATION
    • ADD_APPLICATION
    • CREATE_APPLICATION_SETTING
    admin SERVICE_NAME target.application If the event.name log field value is equal to TOGGLE_SERVICE_ENABLED, then the SERVICE_NAME log field is mapped to the target.application UDM field.
    admin REAUTH_APPLICATION target.application If the event.name log field value is equal to SESSION_CONTROL_SETTINGS_CHANGE, then the REAUTH_APPLICATION log field is mapped to the target.application UDM field.
    admin OAUTH2_SERVICE_NAME target.application If the event.name log field value is equal to DISALLOW_SERVICE_FOR_OAUTH2_ACCESS, then the OAUTH2_SERVICE_NAME log field is mapped to the target.application UDM field.
    admin OAUTH2_APP_NAME target.application If the event.name log field value is equal to one of the following values, then the OAUTH2_APP_NAME log field is mapped to the target.application UDM field:
    • ADD_TO_TRUSTED_OAUTH2_APPS
    • ADD_TO_BLOCKED_OAUTH2_APPS
    admin REQUEST_ID target.labels [request_id] (deprecated)
    admin REQUEST_ID additional.fields [request_id]
    admin GMAIL_RESET_REASON security_result.summary
    admin USER_NICKNAME target.user.attribute.labels[nickname]
    admin EMAIL_EXPORT_INCLUDE_DELETED target.resource.attribute.labels [email_export_include_deleted]
    admin EMAIL_EXPORT_PACKAGE_CONTENT target.resource.attribute.labels [email_export_package_content]
    admin SEARCH_QUERY_FOR_DUMP target.resource.attribute.labels [search_query_for_dump]
    admin BIRTHDATE target.user.attribute.labels [birthdate]
    admin ORG_UNIT_NAME target.labels[org_unit_name] (deprecated) If the event.name log field value is equal to one of the following values, then the ORG_UNIT_NAME log field is mapped to the target.labels UDM field:
    • TOGGLE_SERVICE_ENABLED
    • CREATE_ORG_UNIT
    • MOVE_ORG_UNIT
    • EDIT_ORG_UNIT_NAME
    • REMOVE_ORG_UNIT
    • UNASSIGN_CUSTOM_LOGO
    • ASSIGN_CUSTOM_LOGO
    • EDIT_ORG_UNIT_DESCRIPTION
    • CHANGE_TWO_STEP_VERIFICATION_FREQUENCY
    • CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION
    • CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION
    • CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS
    • CHANGE_TWO_STEP_VERIFICATION_START_DATE
    • WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED
    admin ORG_UNIT_NAME additional.fields[org_unit_name] If the event.name log field value is equal to one of the following values, then the ORG_UNIT_NAME log field is mapped to the additional.fields UDM field:
    • TOGGLE_SERVICE_ENABLED
    • CREATE_ORG_UNIT
    • MOVE_ORG_UNIT
    • EDIT_ORG_UNIT_NAME
    • REMOVE_ORG_UNIT
    • UNASSIGN_CUSTOM_LOGO
    • ASSIGN_CUSTOM_LOGO
    • EDIT_ORG_UNIT_DESCRIPTION
    • CHANGE_TWO_STEP_VERIFICATION_FREQUENCY
    • CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION
    • CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION
    • CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS
    • CHANGE_TWO_STEP_VERIFICATION_START_DATE
    • WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED
    admin ORG_UNIT_NAME about.labels[org_unit_name] (deprecated)
    admin ORG_UNIT_NAME additional.fields[org_unit_name]
    admin ROLE_ID target.resource.attribute.labels[role_id]
    admin ROLE_NAME target.resource.attribute.roles.name
    admin API_SCOPES target.user.attribute.labels[api_scopes]
    admin API_CLIENT_NAME target.user.userid If the API_CLIENT_NAME log field value matches the regular expression ^(.){1,256}$, then the API_CLIENT_NAME log field is mapped to the target.user.userid UDM field.
    admin API_CLIENT_NAME target.user.attribute.labels[api_client_name] If the API_CLIENT_NAME log field value doesn't match the regular expression ^(.){1,256}$, then the API_CLIENT_NAME log field is mapped to the target.user.attribute.labels[api_client_name] UDM field.
    admin EMAIL_LOG_SEARCH_END_DATE about.labels[email_log_search_end_date] (deprecated)
    admin EMAIL_LOG_SEARCH_END_DATE additional.fields[email_log_search_end_date]
    admin EMAIL_LOG_SEARCH_MSG_ID network.email.mail_id
    admin EMAIL_LOG_SEARCH_RECIPIENT network.email.to
    admin EMAIL_LOG_SEARCH_SENDER network.email.from
    admin EMAIL_LOG_SEARCH_SMTP_RECIPIENT_IP about.labels[email_log_search_smtp_recipient_ip] (deprecated)
    admin EMAIL_LOG_SEARCH_SMTP_RECIPIENT_IP additional.fields[email_log_search_smtp_recipient_ip]
    admin EMAIL_LOG_SEARCH_SMTP_SENDER_IP about.labels[email_log_search_smtp_sender_ip] (deprecated)
    admin EMAIL_LOG_SEARCH_SMTP_SENDER_IP additional.fields[email_log_search_smtp_sender_ip]
    admin EMAIL_LOG_SEARCH_START_DATE about.labels[email_log_search_start_date] (deprecated)
    admin EMAIL_LOG_SEARCH_START_DATE additional.fields[email_log_search_start_date]
    admin ALERT_ID security_result.detection_fields[alert_id]
    admin INVESTIGATION_DATA_SOURCE security_result.detection_fields[investigation_data_source]
    admin INVESTIGATION_QUERY security_result.detection_fields[investigation_query]
    admin GROUP_EMAIL target.group.email_addresses
    admin PRODUCT_NAME target.resource.attribute.labels[product_name]
    admin INVESTIGATION_ACTION security_result.detection_fields[investigation_action]
    admin INVESTIGATION_ENTITY_IDS security_result.detection_fields[investigation_entity_ids]
    admin INVESTIGATION_OBJECT_IDENTIFIER security_result.detection_fields[investigation_object_identifier]
    admin INVESTIGATION_URL_DISPLAY_TEXT security_result.detection_fields[investigation_display_text]
    admin CHART_NAME about.labels [chart_name] (deprecated)
    admin CHART_NAME additional.fields [chart_name]
    admin CHART_FILTERS about.labels [chart_filters] (deprecated)
    admin CHART_FILTERS additional.fields [chart_filters]
    admin START_DATE about.labels [start_date] (deprecated)
    admin START_DATE additional.fields [start_date]
    admin END_DATE about.labels [end_date] (deprecated)
    admin END_DATE additional.fields [end_date]
    admin target.resource.resource_type If the event.name log field value is not equal to one of the following values, then the target.resource.resource_type UDM field is set to SETTING:
    • EMAIL_LOG_SEARCH
    • ALERT_CENTER_LIST_FEEDBACK
    • ALERT_CENTER_GET_SIT_LINK
    • ALERT_CENTER_LIST_RELATED_ALERTS
    • ALERT_CENTER_LIST_CHANGE
    • SECURITY_INVESTIGATION_QUERY
    • SECURITY_INVESTIGATION_ACTION
    • SECURITY_INVESTIGATION_OBJECT_CREATE_DRAFT_INVESTIGATION
    • SECURITY_CHART_DRILLDOWN
    • CHANGE_DEVICE_STATE
    • SECURITY_INVESTIGATION_ACTION_COMPLETION


    If the event.name log field value is equal to GENERATE_CERTIFICATE, then the target.resource.resource_type UDM field is set to CREDENTIAL.
    admin SYSTEM_DEFINED_RULE_ACTION_STATUS_CHANGE security_result.rule_labels[system_defined_rule_action_status_change]
    admin SYSTEM_DEFINED_RULE_ACTION_SEVERITY_CHANGE security_result.rule_labels[system_defined_rule_action_severity_change]
    admin SYSTEM_DEFINED_RULE_ACTION_RECEIVERS_CHANGE security_result.rule_labels[system_defined_rule_action_receivers_change]
    admin COMPANY_DEVICE_ID target.asset_id
    admin APPLICATION_ENABLED target.labels[application_enabled] (deprecated)
    admin APPLICATION_ENABLED additional.fields[application_enabled]
    admin DISTRIBUTION_ENTITY_NAME target.labels[distribution_entity_name] (deprecated)
    admin DISTRIBUTION_ENTITY_NAME additional.fields[distribution_entity_name]
    admin DISTRIBUTION_ENTITY_TYPE target.labels[distribution_entity_type] (deprecated)
    admin DISTRIBUTION_ENTITY_TYPE additional.fields[distribution_entity_type]
    admin MOBILE_APP_PACKAGE_ID target.labels[mobile_app_package_id] (deprecated)
    admin MOBILE_APP_PACKAGE_ID additional.fields[mobile_app_package_id]
    admin APPLICATION_EDITION target.labels[application_edition] (deprecated)
    admin APPLICATION_EDITION additional.fields[application_edition]
    admin REAUTH_SETTING_NEW target.labels[reauth_setting_new] (deprecated)
    admin REAUTH_SETTING_NEW additional.fields[reauth_setting_new]
    admin REAUTH_SETTING_OLD target.labels[reauth_setting_old] (deprecated)
    admin REAUTH_SETTING_OLD additional.fields[reauth_setting_old]
    admin ALLOWED_TWO_STEP_VERIFICATION_METHOD target.labels[allowed_2sv_method] (deprecated)
    admin ALLOWED_TWO_STEP_VERIFICATION_METHOD additional.fields[allowed_2sv_method]
    admin CERTIFICATE_TYPE target.resource.resource_subtype
    admin SAML2_SERVICE_PROVIDER_ENTITY_ID about.labels[saml2_service_provider_entity_id] (deprecated)
    admin SAML2_SERVICE_PROVIDER_ENTITY_ID additional.fields[saml2_service_provider_entity_id]
    admin SAML2_SERVICE_PROVIDER_NAME about.labels[saml2_service_provider_name] (deprecated)
    admin SAML2_SERVICE_PROVIDER_NAME additional.fields[saml2_service_provider_name]
    admin SERVICE_ACCOUNT_EMAIL about.user.email_addresses
    admin about.user.account_type If the event.name log field value is equal to ENABLE_DIRECTORY_SYNC and the SERVICE_ACCOUNT_EMAIL log field value is not empty, then the about.user.account_type UDM field is set to SERVICE_ACCOUNT_TYPE.
    admin DEVICE_NEW_STATE target.asset.attribute.labels[device_new_state]
    admin DEVICE_PREVIOUS_STATE target.asset.attribute.labels[device_previous_state]
    admin DEVICE_SERIAL_NUMBER target.asset.hardware.serial_number
    admin INVESTIGATION_ACTION_NUM_ATTEMPTED security_result.detection_fields[investigation_action_num_attempt]
    admin INVESTIGATION_ACTION_NUM_SUCCESS security_result.detection_fields[investigation_action_num_success]
    admin INVESTIGATION_ACTION_NUM_FAILED security_result.detection_fields[investigation_action_num_failed]
    admin INVESTIGATION_ACTION_IDENTIFIER security_result.detection_fields[investigation_action_identifier]
    admin INVESTIGATION_ACTION_ID security_result.detection_fields[investigation_action_id]
    admin SETTING_DESCRIPTION target.resource.attribute.labels[setting_description]
    admin USER_DEFINED_SETTING_NAME target.resource.attribute.labels[user_defined_setting_name]
    admin ACTION_TYPE security_result.action_details
    admin security_result.action If the ACTION_TYPE log field value is equal to BLOCK, then the security_result.action UDM field is set to BLOCK.

    Else, the security_result.action UDM field is set to ALLOW.
    admin ACTION_ID security_result.detection_fields[action_id]
    admin OAUTH2_APP_ID additional.fields [oauth2_app_id]
    admin OAUTH2_APP_TYPE additional.fields [oauth2_app_type]
    admin ACCESS_LEVEL_TITLE target.resource.attribute.labels [access_level_title]
    admin ACCESS_LEVEL_CURR_STATE target.resource.attribute.labels [access_level_curr_state]
    admin ACCESS_LEVEL_PREV_STATE target.resource.attribute.labels [access_level_prev_state]
    admin AUTH_PRINCIPLE_EMAIL principal.user.email_addresses If the actor.email log field value is not equal to the AUTH_PRINCIPLE_EMAIL, then the AUTH_PRINCIPLE_EMAIL log field is mapped to the principal.user.email_addresses UDM field.
    admin INVESTIGATION_ADMIN_EMAIL principal.user.email_addresses If the actor.email log field value is not equal to the INVESTIGATION_ADMIN_EMAIL, then the INVESTIGATION_ADMIN_EMAIL log field is mapped to the principal.user.email_addresses UDM field.
    admin target.resource.resource_type If the event.name log field value is equal to UPDATE_ACCESS_LEVEL_V2, then the target.resource.resource_type UDM field is set to ACCESS_POLICY.
    admin APP_RESOURCE_ID additional.fields [app_resource_id]
    admin SECURITY_CENTER_RULE_TRIGGER_WINDOW security_result.rule_labels[security_center_rule_trigger_window]
    admin SECURITY_CENTER_RULE_CONDITION security_result.rule_labels[security_center_rule_condition]
    admin SECURITY_CENTER_RULE_THRESHOLD security_result.rule_labels[security_center_rule_threshold]
    admin SECURITY_CENTER_RULE_TIME_FRAME security_result.rule_labels[security_center_rule_time_frame]
    admin SECURITY_CENTER_RULE_ACTION security_result.rule_labels[security_center_rule_action]
    admin QUARANTINE_NAME additional.fields[quarantine_name]
    jamboard CURRENT_JAMBOARD_NAME target.asset.attribute.labels [current_jamboard_name] If the event.name log field value is equal to one of the following values, then the CURRENT_JAMBOARD_NAME log field is mapped to the target.asset.attribute.labels UDM field:
    • DEVICE_LICENSE_ENROLLMENT_CHANGE
    • DEVICE_OTA_UPDATE_REQUESTED
    • DEVICE_PROVISIONING_CHANGE
    • DEVICE_REBOOT_REQUESTED
    • ADB_ENABLED_STATE_CHANGE
    • DEVICE_ADDITIONAL_IMES_CHANGE
    • DEVICE_LOGGING_CHANGE
    • DEMO_MODE_AVAILABILITY_CHANGE
    • DEMO_MODE_CHANGE
    • FINGER_ERASING_CHANGE
    • DEVICE_LANGUAGE_CHANGE
    • DEVICE_LOCATION_CHANGE
    • DEVICE_NAME_CHANGE
    • DEVICE_NOTE_CHANGE
    • DEVICE_PAIRING_CHANGE
    • SCREENSAVER_TIMEOUT_CHANGE
    • DEVICE_SETTING_LOCKED
    • DEVICE_SETTING_UNLOCKED
    • VIDEOCONF_ENABLED_CHANGE
    • DEVICE_UPDATE
    jamboard JAMBOARD_ID target.asset.asset_id
    jamboard LICENSE_ENROLLMENT_STATE target.asset.attribute.labels [license_enrollment_state]
    jamboard PROVISION_STATE target.asset.attribute.labels [provision_state]
    jamboard ON_OFF target.asset.attribute.labels [on_off]
    jamboard NEW_ADDITIONAL_IMES target.asset.attribute.labels [new_additional_imes]
    jamboard OLD_ADDITIONAL_IMES target.asset.attribute.labels [old_additional_imes]
    jamboard NEW_DEMO_MODE_AVAILABILITY target.asset.attribute.labels [new_demo_mode_availability]
    jamboard OLD_DEMO_MODE_AVAILABILITY target.asset.attribute.labels [old_demo_mode_availability]
    jamboard NEW_LANGUAGE target.asset.attribute.labels [new_language]
    jamboard OLD_LANGUAGE target.asset.attribute.labels [old_language]
    jamboard NEW_LOCATION target.asset.location.name If the event.name log field value is equal to DEVICE_LOCATION_CHANGE, then the NEW_LOCATION log field is mapped to the target.asset.location.name UDM field.
    jamboard OLD_LOCATION target.asset.attribute.labels [old_location]
    jamboard OLD_JAMBOARD_NAME target.asset.attribute.labels [old_jamboard_name]
    jamboard NEW_NOTE target.resource.attribute.labels [new_note]
    jamboard OLD_NOTE target.resource.attribute.labels [old_note]
    jamboard DEVICE_TYPE target.asset.attribute.labels [device_type]
    jamboard NEW_DEVICE target.asset.attribute.labels [new_device]
    jamboard OLD_DEVICE target.asset.attribute.labels [old_device]
    jamboard NEW_TIMEOUT_VALUE target.asset.attribute.labels [new_timeout_value]
    jamboard OLD_TIMEOUT_VALUE target.asset.attribute.labels [old_timeout_value]
    jamboard JAMBOARD_SETTING target.asset.attribute.labels [jamboard_setting]
    jamboard COMPONENT target.asset.attribute.labels [component]
    jamboard NEW_VERSION target.asset.software.version If the event.name log field value is equal to DEVICE_UPDATE, then the NEW_VERSION log field is mapped to the target.asset.software.version UDM field.
    jamboard OLD_VERSION target.asset.attribute.labels [old_version]
    gmail events.parameters[delivery].msgValue[message_info].parameter.value[description] metadata.description
    gmail events.parameters[delivery].msgValue[event_info].parameter.intValue[timestamp_usec] metadata.event_timestamp
    gmail events.parameters[delivery].msgValue[event_info].parameter.intValue[mail_event_type] metadata.product_event_type
    gmail id.applicationName metadata.product_name
    gmail metadata.vendor_name The metadata.vendor_name UDM field is set to Google Workspace.
    gmail events.parameters[delivery].msgValue[message_info].parameter.value[rfc2822_message_id] network.email.mail_id
    gmail events.parameters[delivery].msgValue[message_info].parameter.value[subject] network.email.subject
    gmail events.parameters[delivery].msgValue[message_info].parameter.intValue[payload_size] network.sent_bytes
    gmail events.parameters[delivery].msgValue[event_info].parameter.intValue[elapsed_time_usec] network.session_duration
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_tls_state] network.smtp.is_tls If this log field value is equal to 0, then the network.smtp.is_tls UDM field is set to false.

    Else, if this log field value is equal to 1, then the network.smtp.is_tls UDM field is set to true.
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.value[address] network.smtp.rcpt_to
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_response_reason] network.smtp.server_response If this log field value is equal to 1, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - Default reason messages are rejected or accepted.

    Else, if this log field value is equal to 3, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - Malware.

    Else, if this log field value is equal to 4, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - DMARC policy.

    Else, if this log field value is equal to 5, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - Unsupported attachment (by Gmail).

    Else, if this log field value is equal to 6, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - Receive limit exceeded.

    Else, if this log field value is equal to 7, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - Account over quota.

    Else, if this log field value is equal to 8, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - Bad PTR record.

    Else, if this log field value is equal to 9, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - Recipient doesn't exist.

    Else, if this log field value is equal to 10, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - Customer policy.

    Else, if this log field value is equal to 12, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - RFC violation.

    Else, if this log field value is equal to 13, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - Blatant spam.

    Else, if this log field value is equal to 14, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - Denial of service.

    Else, if this log field value is equal to 15, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - Malicious or spammy links.

    Else, if this log field value is equal to 16, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - Low IP reputation.

    Else, if this log field value is equal to 17, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - Low domain reputation.

    Else, if this log field value is equal to 18, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - IP listed in public Real-time Blackhole List (RBL).

    Else, if this log field value is equal to 19, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - Temporarily rejected due to DoS limits.

    Else, if this log field value is equal to 20, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - Permanently rejected due to DoS limits.
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[smtp_tls_cipher] network.tls.cipher
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[smtp_tls_version] network.tls.version
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[client_host_zone] principal.administrative_domain
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[source].parameter.value[service] principal.application
    gmail events.parameters[delivery].msgValue[message_owner].parameter.value[customer_domain] principal.domain.name
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[client_ip] principal.ip
    gmail actor.gaiaId principal.labels[actor_gaiaid] (deprecated)
    gmail actor.gaiaId additional.fields[actor_gaiaid]
    gmail actor.orgunitPath principal.labels[actor_orgunitpath] (deprecated)
    gmail actor.orgunitPath additional.fields[actor_orgunitpath]
    gmail events.parameters[delivery].msgValue[message_owner].parameter.multiIntValue[gaia_ids] principal.labels[message_owner_gaia_id] (deprecated)
    gmail events.parameters[delivery].msgValue[message_owner].parameter.multiIntValue[gaia_ids] additional.fields[message_owner_gaia_id]
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[source].parameter.value[selector] principal.labels[source_selector] (deprecated)
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[source].parameter.value[selector] additional.fields[source_selector]
    gmail events.parameters[delivery].msgValue[message_owner].parameter.multiStrValue[addresses] principal.user.email_addresses
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[source].parameter.value[from_header_address] principal.network.email.from
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[source].parameter.value[address] principal.user.email_addresses
    gmail events.parameters[delivery].msgValue[message_owner].parameter.multiStrValue[addresses] principal.user.email_addresses
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[source].parameter.value[from_header_displayname] principal.user.user_display_name
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[source].parameter.intValue[user_id] principal.user.userid
    gmail events.parameters[delivery].msgValue[message_info].parameter.value[flattened_destinations] target.labels[flattened_destinations] (deprecated)
    gmail events.parameters[delivery].msgValue[message_info].parameter.value[flattened_destinations] additional.fields[flattened_destinations]
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.value[service] target.application This log field is mapped to target.application UDM field when index value in events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination] is equal to 0.

    For every other index value, this log field is mapped to the about.application.
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.intValue[rcpt_response] target.labels[destination_rcpt_response] (deprecated) This log field is mapped to target.labels.value UDM field and target.labels.key is set to destination_rcpt_response, when index value in events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination] is equal to 0.

    For every other index value, this log field is mapped to about.labels.value UDM field and about.labels.key is set to destination_rcpt_response.
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.intValue[rcpt_response] additional.fields[destination_rcpt_response]
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.value[selector] target.labels[destination_selector] (deprecated) This log field is mapped to target.labels.value UDM field and target.labels.key is set to destination_selector, when index value in events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination] is equal to 0.

    For every other index value, this log field is mapped to about.labels.value UDM field and about.labels.key is set to destination_selector.
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.value[selector] additional.fields[destination_selector]
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.boolValue[smime_decryption_success] target.labels[destination_smime_decryption_success] (deprecated) This log field is mapped to target.labels.value UDM field and target.labels.key is set to destination_smime_decryption_success, when index value in events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination] is equal to 0.

    For every other index value, this log field is mapped to about.labels.value UDM field and about.labels.key is set to destination_smime_decryption_success.
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.boolValue[smime_decryption_success] additional.fields[destination_smime_decryption_success]
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.boolValue[smime_extraction_success] target.labels[destination_smime_extraction_success] (deprecated) This log field is mapped to target.labels.value UDM field and target.labels.key is set to destination_smime_extraction_success, when index value in events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination] is equal to 0.

    For every other index value, this log field is mapped to about.labels.value UDM field and about.labels.key is set to destination_smime_extraction_success.
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.boolValue[smime_extraction_success] additional.fields[destination_smime_extraction_success]
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.boolValue[smime_parsing_success] target.labels[destination_smime_parsing_success] (deprecated) This log field is mapped to target.labels.value UDM field and target.labels.key is set to destination_smime_parsing_success, when index value in events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination] is equal to 0.

    For every other index value, this log field is mapped to about.labels.value UDM field and about.labels.key is set to destination_smime_parsing_success.
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.boolValue[smime_parsing_success] additional.fields[destination_smime_parsing_success]
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.boolValue[smime_signature_verification_success] target.labels[destination_smime_signature_verification_success] (deprecated) This log field is mapped to target.labels.value UDM field and target.labels.key is set to destination_smime_signature_verification_success, when index value in events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination] is equal to 0.

    For every other index value, this log field is mapped to about.labels.value UDM field and about.labels.key is set to destination_smime_signature_verification_success.
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.boolValue[smime_signature_verification_success] additional.fields[destination_smime_signature_verification_success]
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.value[address] target.user.email_addresses This log field is mapped to target.user.email_addresses UDM field when index value in events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination] is equal to 0.

    For every other index value, this log field is mapped to the about.user.email_addresses.
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.intValue[user_id] target.user.userid This log field is mapped to target.user.userid UDM field when index value in events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination] is equal to 0.

    For every other index value, this log field is mapped to the about.user.userid.
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[smtp_out_remote_host] intermediary.hostname
    gmail events.parameters[delivery].msgValue[server_info].parameter.value[host_name] intermediary.hostname
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[failed_smtp_out_connect_ip] intermediary.ip
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[smtp_in_connect_ip] intermediary.ip
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[smtp_out_connect_ip] intermediary.ip
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[smtp_user_agent_ip] intermediary.ip
    gmail events.parameters[delivery].msgValue[server_info].parameter.value[job_name] intermediary.labels[job_name] (deprecated)
    gmail events.parameters[delivery].msgValue[server_info].parameter.value[job_name] additional.fields[job_name]
    gmail events.parameters[delivery].msgValue[server_info].parameter.intValue[server_type] intermediary.labels[server_type] (deprecated)
    gmail events.parameters[delivery].msgValue[server_info].parameter.intValue[server_type] additional.fields[server_type]
    gmail events.parameters[delivery].msgValue[server_info].parameter.value[service_pool] intermediary.labels[service_pool] (deprecated)
    gmail events.parameters[delivery].msgValue[server_info].parameter.value[service_pool] additional.fields[service_pool]
    gmail events.parameters[delivery].msgValue[server_info].parameter.intValue[task_number] intermediary.labels[task_number] (deprecated)
    gmail events.parameters[delivery].msgValue[server_info].parameter.intValue[task_number] additional.fields[task_number]
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.value[policy_holder_address] security_result.about.user.email_addresses If this log field value doesn't match the regular expression ^.+@.+$, then it is mapped to the security_result.about.administrative_domain UDM field.

    Else, it is mapped to the security_result.about.administrative_domain UDM field.
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[consequence].parameter.value[policy_holder_email] security_result.about.user.email_addresses
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[consequence].parameter.intValue[policy_holder_user_id] security_result.about.user.userid
    gmail security_result.action If the events.parameters[delivery].msgValue[event_info].parameter.boolValue[success] log field value is equal to true, then the security_result.action UDM field is set to ALLOW.

    Else, the security_result.action UDM field is set to BLOCK.
    gmail events.parameters[delivery].msgValue[event_info].parameter.boolValue[success] security_result.action_details
    gmail security_result.category If the events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[attachment].parameter.intValue[malware_family] log field value is not empty, then the security_result.category UDM field is set to SOFTWARE_MALICIOUS.

    If the events.parameters[delivery].msgValue[message_info].parameter.boolValue[is_spam] log field value is equal to true, then the security_result.category UDM field is set to MAIL_SPAM.
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[attachment].parameter.intValue[malware_family] security_result.category_details If this log field value is equal to 1, then the security_result.category_details UDM field is set to 1 - A known malicious program type of malware.

    Else, if this log field value is equal to 2, then the security_result.category_details UDM field is set to 2 - A virus or worm type of malware.

    Else, if this log field value is equal to 3, then the security_result.category_details UDM field is set to 3 - Possible harmful email content.

    Else, if this log field value is equal to 4, then the security_result.category_details UDM field is set to 4 - Possible unwanted email content.

    Else, if this log field value is equal to 5, then the security_result.category_details UDM field is set to 5 - Other type of malware.
    gmail events.parameters[delivery].msgValue[message_info].parameter.value[flattened_triggered_rule_info] security_result.detection_fields[flattened_triggered_rule_info]
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[is_internal] security_result.detection_fields[is_internal]
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[is_intra_domain] security_result.detection_fields[is_intra_domain]
    gmail events.parameters[delivery].msgValue[message_info].parameter.boolValue[is_policy_check_for_sender] security_result.detection_fields[is_policy_check_for_sender]
    gmail events.parameters[delivery].msgValue[message_info].parameter.boolValue[is_spam] security_result.detection_fields[is_spam]
    gmail events.parameters[delivery].msgValue[message_info].parameter.intValue[smtp_replay_error] security_result.detection_fields[smtp_replay_error] If this log field value is equal to 1, then the security_result.detection_fields.key UDM field is set to smtp_replay_error and the security_result.detection_fields.value UDM field is set to 1 - Authentication error.

    Else, if this log field value is equal to 2, then the security_result.detection_fields.key UDM field is set to smtp_replay_error and the 2 - Daily rate limit was exceeded. log field is mapped to the security_result.detection_fields.value UDM field.

    Else, if this log field value is equal to 3, then the security_result.detection_fields.key UDM field is set to smtp_replay_error and the 3 - Peak rate limit was exceeded. log field is mapped to the security_result.detection_fields.value UDM field.

    Else, if this log field value is equal to 4, then the security_result.detection_fields.key UDM field is set to smtp_replay_error and the 4 - SMTP relay was abused. log field is mapped to the security_result.detection_fields.value UDM field.

    Else, if this log field value is equal to 5, then the security_result.detection_fields.key UDM field is set to smtp_replay_error and the 5 - Per-user rate limit was exceeded. log field is mapped to the security_result.detection_fields.value UDM field.
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.intValue[classification_reason] security_result.detection_fields[spam_info_classification_reason] If this log field value is equal to 1, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 1 - Default spam classification reason.

    Else, if this log field value is equal to 2, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 2 - Message classified because of sender's past actions.

    Else, if this log field value is equal to 3, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 3 - Suspicious content.

    Else, if this log field value is equal to 4, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 4 - Suspicious link.

    Else, if this log field value is equal to 5, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 5 - Suspicious attachment.

    Else, if this log field value is equal to 6, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 6 - Custom policy defined in Google Workspace Admin Console > Gmail settings.

    Else, if this log field value is equal to 7, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 7 - DMARC.

    Else, if this log field value is equal to 8, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 8 - Domain in public RBLs.

    Else, if this log field value is equal to 9, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 9 - RFC standards violation.

    Else, if this log field value is equal to 10, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 10 - Gmail policy violation.

    Else, if this log field value is equal to 11, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 11 - Machine learning verdict.

    Else, if this log field value is equal to 12, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 12 - Sender reputation.

    Else, if this log field value is equal to 13, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 13 - Blatant spam.

    Else, if this log field value is equal to 14, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 14 - Advanced phishing and malware protection.
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.intValue[classification_timestamp_usec] security_result.detection_fields[spam_info_classification_timestamp_usec]
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.boolValue[delayed_for_deepscan] security_result.detection_fields[spam_info_delayed_for_deepscan]
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.intValue[disposition] security_result.detection_fields[spam_info_disposition] If this log field value is equal to 1, then the security_result.detection_fields.key UDM field is set to spam_info_disposition and the security_result.detection_fields.value UDM field is set to 1 - Message considered clean (not spam or malware).

    Else, if this log field value is equal to 2, then the security_result.detection_fields.key UDM field is set to spam_info_disposition and the security_result.detection_fields.value UDM field is set to 2 - Spam.

    Else, if this log field value is equal to 3, then the security_result.detection_fields.key UDM field is set to spam_info_disposition and the security_result.detection_fields.value UDM field is set to 3 - Phishing.

    Else, if this log field value is equal to 4, then the security_result.detection_fields.key UDM field is set to spam_info_disposition and the security_result.detection_fields.value UDM field is set to 4 - Suspicious.

    Else, if this log field value is equal to 5, then the security_result.detection_fields.key UDM field is set to spam_info_disposition and the security_result.detection_fields.value UDM field is set to 5 - Malware.
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.value[ip_whitelist_entry] security_result.detection_fields[spam_info_ip_whitelist_entry]
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.multiMsgValue[safety_settings_info].parameter.intValue[safety_settings_action] security_result.detection_fields[spam_info_safety_setting_action]
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.multiMsgValue[safety_settings_info].parameter.intValue[safety_settings_condition] security_result.detection_fields[spam_info_safety_settings_condition]
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[string_match].parameter.value[attachment_name] security_result.detection_fields[triggered_rule_info_string_match_attachment_name]
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[string_match].parameter.value[matched_string] security_result.detection_fields[triggered_rule_info_string_match_matched_string]
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[string_match].parameter.intValue[source] security_result.detection_fields[triggered_rule_info_string_match_source] If this log field value is equal to 0, then the security_result.detection_fields.key UDM field is set to triggered_rule_info_string_match_source and the security_result.detection_fields.value UDM field is set to 0 - Unknown.

    Else, if this log field value is equal to 1, then the security_result.detection_fields.key UDM field is set to triggered_rule_info_string_match_source and the security_result.detection_fields.value UDM field is set to 1 - Message body or including text format attachments.

    Else, if this log field value is equal to 2, then the security_result.detection_fields.key UDM field is set to triggered_rule_info_string_match_source and the security_result.detection_fields.value UDM field is set to 2 - Binary format attachments.

    Else, if this log field value is equal to 3, then the security_result.detection_fields.key UDM field is set to triggered_rule_info_string_match_source and the security_result.detection_fields.value UDM field is set to 3 - Message headers.

    Else, if this log field value is equal to 4, then the security_result.detection_fields.key UDM field is set to triggered_rule_info_string_match_source and the security_result.detection_fields.value UDM field is set to 4 - Subject.

    Else, if this log field value is equal to 5, then the security_result.detection_fields.key UDM field is set to triggered_rule_info_string_match_source and the security_result.detection_fields.value UDM field is set to 5 - Sender header.

    Else, if this log field value is equal to 6, then the security_result.detection_fields.key UDM field is set to triggered_rule_info_string_match_source and the security_result.detection_fields.value UDM field is set to 6 - Recipient header.

    Else, if this log field value is equal to 7, then the security_result.detection_fields.key UDM field is set to triggered_rule_info_string_match_source and the security_result.detection_fields.value UDM field is set to 7 - Raw message.
    gmail events.parameters[delivery].msgValue[message_info].parameter.intValue[upload_error_category] security_result.detection_fields[upload_error_category] If this log field value is equal to 0, then the security_result.detection_fields.key UDM field is set to upload_error_category and the security_result.detection_fields.value UDM field is set to 0 - Uncategorized transient error.

    Else, if this log field value is equal to 1, then the security_result.detection_fields.key UDM field is set to upload_error_category and the security_result.detection_fields.value UDM field is set to 1 - Recipient account is too busy.

    Else, if this log field value is equal to 2, then the security_result.detection_fields.key UDM field is set to upload_error_category and the security_result.detection_fields.value UDM field is set to 2 - DNS error resolving recipient domain.

    Else, if this log field value is equal to 3, then the security_result.detection_fields.key UDM field is set to upload_error_category and the security_result.detection_fields.value UDM field is set to 3 - Recipient's server refused connection.

    Else, if this log field value is equal to 4, then the security_result.detection_fields.key UDM field is set to upload_error_category and the security_result.detection_fields.value UDM field is set to 4 - Recipient is out of storage.
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.intValue[rule_id] security_result.rule_id
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[consequence].parameter.intValue[action] security_result.rule_labels[triggered_rule_info_consequence_action] If this log field value is equal to 0, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 0 - Consequence is a no-op.

    Else, if this log field value is equal to 3, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 3 - Put message in Admin Quarantine.

    Else, if this log field value is equal to 4, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 4 - Modify the primary delivery target.

    Else, if this log field value is equal to 5, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 5 - Add a delivery target.

    Else, if this log field value is equal to 6, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 6 - Added a message header.

    Else, if this log field value is equal to 7, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 7 - Overwrite the envelope recipient.

    Else, if this log field value is equal to 9, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 9 - Add message to specified message set.

    Else, if this log field value is equal to 10, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 10 - Modify the message labels.

    Else, if this log field value is equal to 11, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 11 - Prefix text to message subject.

    Else, if this log field value is equal to 12, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 12 - Add a footer to the message.

    Else, if this log field value is equal to 13, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 13 - Strip the message body.

    Else, if this log field value is equal to 14, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the 14 - Store a copy of the message in the user's mailbox or according to comprehensive mail storage setting. log field is mapped to the security_result.rule_labels.value UDM field.

    Else, if this log field value is equal to 15, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 15 - Replace attachment with canned text.

    Else, if this log field value is equal to 16, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 16 - Require secure message delivery.

    Else, if this log field value is equal to 17, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 17 - Message can't be delivered and bounced.

    Else, if this log field value is equal to 18, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 18 - Archive to Google Vault for recipients.

    Else, if this log field value is equal to 20, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 20 - Encrypt outbound message using S/MIME.

    Else, if this log field value is equal to 21, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the 21 - Change the recipient user when message is received at SMTP. log field is mapped to the security_result.rule_labels.value UDM field.
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[consequence].parameter.value[reason] security_result.rule_labels[triggered_rule_info_consequence_reason]
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[consequence].parameter.multiMsgValue[subconsequence].parameter.value[action] security_result.rule_labels[triggered_rule_info_consequence_subconsequence_action] If this log field value is equal to 0, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 0 - Consequence is a no-op.

    Else, if this log field value is equal to 3, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 3 - Put message in Admin Quarantine.

    Else, if this log field value is equal to 4, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 4 - Modify the primary delivery target.

    Else, if this log field value is equal to 5, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 5 - Add a delivery target.

    Else, if this log field value is equal to 6, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 6 - Added a message header.

    Else, if this log field value is equal to 7, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 7 - Overwrite the envelope recipient.

    Else, if this log field value is equal to 9, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 9 - Add message to specified message set.

    Else, if this log field value is equal to 10, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 10 - Modify the message labels.

    Else, if this log field value is equal to 11, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 11 - Prefix text to message subject.

    Else, if this log field value is equal to 12, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 12 - Add a footer to the message.

    Else, if this log field value is equal to 13, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 13 - Strip the message body.

    Else, if this log field value is equal to 14, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the 14 - Store a copy of the message in the user's mailbox or according to comprehensive mail storage setting. log field is mapped to the security_result.rule_labels.value UDM field.

    Else, if this log field value is equal to 15, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 15 - Replace attachment with canned text.

    Else, if this log field value is equal to 16, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 16 - Require secure message delivery.

    Else, if this log field value is equal to 17, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 17 - Message can't be delivered and bounced.

    Else, if this log field value is equal to 18, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 18 - Archive to Google Vault for recipients.

    Else, if this log field value is equal to 20, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 20 - Encrypt outbound message using S/MIME.

    Else, if this log field value is equal to 21, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the 21 - Change the recipient user when message is received at SMTP. log field is mapped to the security_result.rule_labels.value UDM field.
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[consequence].parameter.multiMsgValue[subconsequence].parameter.value[reason] security_result.rule_labels[triggered_rule_info_consequence_subconsequence_reason]
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.intValue[policy_id] security_result.rule_labels[triggered_rule_info_policy_id]
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.value[spam_label_modifier] security_result.rule_labels[triggered_rule_info_spam_label_modifier] If this log field value is equal to 0, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_spam_label_modifier and the 0 - No action—the rule honored the Gmail spam classification verdict. log field is mapped to the security_result.rule_labels.value UDM field.

    Else, if this log field value is equal to 1, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_spam_label_modifier and the 1 - Spam—the rule classified the message as spam. log field is mapped to the security_result.rule_labels.value UDM field.

    Else, if this log field value is equal to 2, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_spam_label_modifier and the 2 - Not spam—the rule classified the message as not spam. log field is mapped to the security_result.rule_labels.value UDM field.
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[string_match].parameter.value[match_expression] security_result.rule_labels[triggered_rule_info_string_match_match_expression]
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[string_match].parameter.value[predefined_detector_name] security_result.rule_labels[triggered_rule_info_string_match_predefined_detector_name]
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[string_match].parameter.intValue[type] security_result.rule_labels[triggered_rule_info_string_match_type] If this log field value is equal to 0, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_string_match_type and the security_result.rule_labels.value UDM field is set to 0 - Undefined.

    Else, if this log field value is equal to 1, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_string_match_type and the security_result.rule_labels.value UDM field is set to 1 - Regular expression match.

    Else, if this log field value is equal to 2, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_string_match_type and the security_result.rule_labels.value UDM field is set to 2 - Predefined detector match.

    Else, if this log field value is equal to 3, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_string_match_type and the security_result.rule_labels.value UDM field is set to 3 - Simple content match.

    Else, if this log field value is equal to 4, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_string_match_type and the security_result.rule_labels.value UDM field is set to 4 - Non-ASCII match.
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.value[rule_name] security_result.rule_name
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.intValue[rule_type] security_result.rule_type If this log field value is equal to 0, then the security_result.rule_type UDM field is set to 0 - Walled garden.

    Else, if this log field value is equal to 7, then the security_result.rule_type UDM field is set to 7 - Objectionable content.

    Else, if this log field value is equal to 8, then the security_result.rule_type UDM field is set to 8 - Content compliance.

    Else, if this log field value is equal to 10, then the security_result.rule_type UDM field is set to 10 - Received mail routing.

    Else, if this log field value is equal to 11, then the security_result.rule_type UDM field is set to 11 - Sent mail routing.

    Else, if this log field value is equal to 12, then the security_result.rule_type UDM field is set to 12 - Spam override.

    Else, if this log field value is equal to 14, then the security_result.rule_type UDM field is set to 14 - Blocked senders.

    Else, if this log field value is equal to 15, then the security_result.rule_type UDM field is set to 15 - Append footer.

    Else, if this log field value is equal to 16, then the security_result.rule_type UDM field is set to 16 - Attachment compliance.

    Else, if this log field value is equal to 17, then the security_result.rule_type UDM field is set to 17 - TLS compliance.

    Else, if this log field value is equal to 18, then the security_result.rule_type UDM field is set to 18 - Domain default routing.

    Else, if this log field value is equal to 19, then the security_result.rule_type UDM field is set to 19 - Inbound email journal acceptance in Vault.

    Else, if this log field value is equal to 20, then the security_result.rule_type UDM field is set to 20 - Outbound relay.

    Else, if this log field value is equal to 21, then the security_result.rule_type UDM field is set to 21 - Quarantine summary.

    Else, if this log field value is equal to 22, then the security_result.rule_type UDM field is set to 22 - Alternate secure route.

    Else, if this log field value is equal to 23, then the security_result.rule_type UDM field is set to 23 - Alias table.

    Else, if this log field value is equal to 24, then the security_result.rule_type UDM field is set to 24 - Comprehensive mail storage.

    Else, if this log field value is equal to 25, then the security_result.rule_type UDM field is set to 25 - Routing rule.

    Else, if this log field value is equal to 26, then the security_result.rule_type UDM field is set to 26 - Inbound gateway.

    Else, if this log field value is equal to 27, then the security_result.rule_type UDM field is set to 27 - S/MIME.

    Else, if this log field value is equal to 28, then the security_result.rule_type UDM field is set to 28 - Third-party email archiving.

    Else, if this log field value is equal to 31, then the security_result.rule_type UDM field is set to 31 - S/MIME restrict delivery.
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.multiMsgValue[authenticated_domain].parameter.value[name] about.domain.name
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[attachment].parameter.value[file_extension_type] about.file.file_type FILE_TYPE_ string added before this log field value and converted it to uppercase, then If this log field value present in File.FileType then, this log field is mapped to about.file.file_type UDM field.
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[attachment].parameter.value[file_extension_type] about.file.mime_type
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.multiMsgValue[detected_file_types].parameter.value[mime_type] about.file.mime_type
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[attachment].parameter.value[sha256] about.file.sha256
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[ip_geo_city] about.ip_geo_artifact.location.city
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[ip_geo_country] about.ip_geo_artifact.location.country_or_region
    gmail events.parameters[delivery].msgValue[message_info].parameter.intValue[action_type] about.labels[action_type] (deprecated) If this log field value is equal to 1, then the about.labels UDM field is set to 1 - Message received by inbound SMTP server.

    Else, if this log field value is equal to 2, then the about.labels UDM field is set to 2 - Message accepted by Gmail and prepared for delivery.

    Else, if this log field value is equal to 3, then the about.labels UDM field is set to 3 - Message was handled by Gmail.

    Else, if this log field value is equal to 10, then the about.labels UDM field is set to 10 - Message sent out by outbound SMTP server.

    Else, if this log field value is equal to 14, then the about.labels UDM field is set to 14 - A temporary error occurred when Gmail tried to deliver the message or and the message has been scheduled for retry.

    Else, if this log field value is equal to 18, then the about.labels UDM field is set to 18 - Message could not be delivered and bounced.

    Else, if this log field value is equal to 19, then the about.labels UDM field is set to 19 - Message was dropped by Gmail.

    Else, if this log field value is equal to 45, then the about.labels UDM field is set to 45 - Message was accepted for delivery by the Google Groups subsystem.

    Else, if this log field value is equal to 46, then the about.labels UDM field is set to 46 - Message's recipient address was a Google Group or and the recipient was expanded to each member of the Google Group that has message delivery enabled.

    Else, if this log field value is equal to 48, then the about.labels UDM field is set to 48 - Message received by inbound SMTP server for relay.

    Else, if this log field value is equal to 49, then the about.labels UDM field is set to 49 - Message sent through relay by outbound SMTP server.

    Else, if this log field value is equal to 51, then the about.labels UDM field is set to 51 - Message was written to Google Groups storage.

    Else, if this log field value is equal to 54, then the about.labels UDM field is set to 54 - Message was rejected by the Google Groups storage system.

    Else, if this log field value is equal to 55, then the about.labels UDM field is set to 55 - Message was re-inserted into Gmail by policies that modify the primary delivery route or envelope recipient.

    Else, if this log field value is equal to 68, then the about.labels UDM field is set to 68 - Message accepted by Gmail and prepared for delivery.

    Else, if this log field value is equal to 69, then the about.labels UDM field is set to 69 - A user changed the message's spam classification in Gmail.

    Else, if this log field value is equal to 70, then the about.labels UDM field is set to 70 - The message was reclassified as spam or phishing after it was delivered to Gmail.

    Else, if this log field value is equal to 71, then the about.labels UDM field is set to 71 - A user took an action in the inbox after receiving the message. Post-delivery actions include opening a message or clicking a link in a message or and downloading an attachment. BigQuery export doesn't provide details about the action.
    gmail events.parameters[delivery].msgValue[message_info].parameter.intValue[action_type] additional.fields[action_type] If this log field value is equal to 1, then the additional.fields UDM field is set to 1 - Message received by inbound SMTP server.

    Else, if this log field value is equal to 2, then the additional.fields UDM field is set to 2 - Message accepted by Gmail and prepared for delivery.

    Else, if this log field value is equal to 3, then the additional.fields UDM field is set to 3 - Message was handled by Gmail.

    Else, if this log field value is equal to 10, then the additional.fields UDM field is set to 10 - Message sent out by outbound SMTP server.

    Else, if this log field value is equal to 14, then the additional.fields UDM field is set to 14 - A temporary error occurred when Gmail tried to deliver the message or and the message has been scheduled for retry.

    Else, if this log field value is equal to 18, then the additional.fields UDM field is set to 18 - Message could not be delivered and bounced.

    Else, if this log field value is equal to 19, then the additional.fields UDM field is set to 19 - Message was dropped by Gmail.

    Else, if this log field value is equal to 45, then the additional.fields UDM field is set to 45 - Message was accepted for delivery by the Google Groups subsystem.

    Else, if this log field value is equal to 46, then the additional.fields UDM field is set to 46 - Message's recipient address was a Google Group or and the recipient was expanded to each member of the Google Group that has message delivery enabled.

    Else, if this log field value is equal to 48, then the additional.fields UDM field is set to 48 - Message received by inbound SMTP server for relay.

    Else, if this log field value is equal to 49, then the additional.fields UDM field is set to 49 - Message sent through relay by outbound SMTP server.

    Else, if this log field value is equal to 51, then the additional.fields UDM field is set to 51 - Message was written to Google Groups storage.

    Else, if this log field value is equal to 54, then the additional.fields UDM field is set to 54 - Message was rejected by the Google Groups storage system.

    Else, if this log field value is equal to 55, then the additional.fields UDM field is set to 55 - Message was re-inserted into Gmail by policies that modify the primary delivery route or envelope recipient.

    Else, if this log field value is equal to 68, then the additional.fields UDM field is set to 68 - Message accepted by Gmail and prepared for delivery.

    Else, if this log field value is equal to 69, then the additional.fields UDM field is set to 69 - A user changed the message's spam classification in Gmail.

    Else, if this log field value is equal to 70, then the additional.fields UDM field is set to 70 - The message was reclassified as spam or phishing after it was delivered to Gmail.

    Else, if this log field value is equal to 71, then the additional.fields UDM field is set to 71 - A user took an action in the inbox after receiving the message. Post-delivery actions include opening a message or clicking a link in a message or and downloading an attachment. BigQuery export doesn't provide details about the action.
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.multiMsgValue[authenticated_domain].parameter.intValue[type] about.labels[authenticated_domain_type] (deprecated) If this log field value is equal to 1, then the about.labels UDM field is set to 1 - SPF.

    Else, if this log field value is equal to 2, then the about.labels UDM field is set to 2 - DKIM.

    Else, if this log field value is equal to 3, then the about.labels UDM field is set to 3 - DKIM_PROXY.

    Else, if this log field value is equal to 4, then the about.labels UDM field is set to 4 - XOAR_SPF.

    Else, if this log field value is equal to 5, then the about.labels UDM field is set to 5 - XOAR_DKIM.

    Else, if this log field value is equal to 6, then the about.labels UDM field is set to 6 - ARC_SPF.

    Else, if this log field value is equal to 7, then the about.labels UDM field is set to 7 - ARC_DKIM.
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.multiMsgValue[authenticated_domain].parameter.intValue[type] additional.fields[authenticated_domain_type] If this log field value is equal to 1, then the additional.fields UDM field is set to 1 - SPF.

    Else, if this log field value is equal to 2, then the additional.fields UDM field is set to 2 - DKIM.

    Else, if this log field value is equal to 3, then the additional.fields UDM field is set to 3 - DKIM_PROXY.

    Else, if this log field value is equal to 4, then the additional.fields UDM field is set to 4 - XOAR_SPF.

    Else, if this log field value is equal to 5, then the additional.fields UDM field is set to 5 - XOAR_DKIM.

    Else, if this log field value is equal to 6, then the additional.fields UDM field is set to 6 - ARC_SPF.

    Else, if this log field value is equal to 7, then the additional.fields UDM field is set to 7 - ARC_DKIM.
    gmail events.parameters[delivery].msgValue[message_info].parameter.intValue[delivery_timestamp_usec] about.labels[delivery_timestamp_usec] (deprecated)
    gmail events.parameters[delivery].msgValue[message_info].parameter.intValue[delivery_timestamp_usec] additional.fields[delivery_timestamp_usec]
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.multiMsgValue[detected_file_types].parameter.intValue[category] about.labels[detected_file_types_category] (deprecated) If this log field value is equal to 1, then the about.labels UDM field is set to 1 - Unrecognized file type.

    Else, if this log field value is equal to 2, then the about.labels UDM field is set to 2 - Microsoft Office documents, including word processing, spreadsheet, presentation, and database documents. Includes PDF files. The file might or might not be encrypted.

    Else, if this log field value is equal to 3, then the about.labels UDM field is set to 3 - Video and multimedia, for example, MPEG, Quicktime, WMV.

    Else, if this log field value is equal to 4, then the about.labels UDM field is set to 4 - Music and audio, for example, MP3, AAC, WAV.

    Else, if this log field value is equal to 5, then the about.labels UDM field is set to 5 - Images, for example, JPEG, BMP, GIF.

    Else, if this log field value is equal to 6, then the about.labels UDM field is set to 6 - Archives, for example, ZIP, TAR, TGZ.

    Else, if this log field value is equal to 7, then the about.labels UDM field is set to 7 - Executables, for example EXE, COM, JS.

    Else, if this log field value is equal to 8, then the about.labels UDM field is set to 8 - Office documents that are encrypted.

    Else, if this log field value is equal to 9, then the about.labels UDM field is set to 9 - Office documents that are not encrypted.
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.multiMsgValue[detected_file_types].parameter.intValue[category] additional.fields[detected_file_types_category] If this log field value is equal to 1, then the additional.fields UDM field is set to 1 - Unrecognized file type.

    Else, if this log field value is equal to 2, then the additional.fields UDM field is set to 2 - Microsoft Office documents, including word processing, spreadsheet, presentation, and database documents. Includes PDF files. The file might or might not be encrypted.

    Else, if this log field value is equal to 3, then the additional.fields UDM field is set to 3 - Video and multimedia, for example, MPEG, Quicktime, WMV.

    Else, if this log field value is equal to 4, then the additional.fields UDM field is set to 4 - Music and audio, for example, MP3, AAC, WAV.

    Else, if this log field value is equal to 5, then the additional.fields UDM field is set to 5 - Images, for example, JPEG, BMP, GIF.

    Else, if this log field value is equal to 6, then the additional.fields UDM field is set to 6 - Archives, for example, ZIP, TAR, TGZ.

    Else, if this log field value is equal to 7, then the additional.fields UDM field is set to 7 - Executables, for example EXE, COM, JS.

    Else, if this log field value is equal to 8, then the additional.fields UDM field is set to 8 - Office documents that are encrypted.

    Else, if this log field value is equal to 9, then the additional.fields UDM field is set to 9 - Office documents that are not encrypted.
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[dkim_pass] about.labels[dkim_pass] (deprecated)
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[dkim_pass] additional.fields[dkim_pass]
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[dmarc_pass] about.labels[dmarc_pass] (deprecated)
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[dmarc_pass] additional.fields[dmarc_pass]
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[dmarc_published_domain] about.labels[dmarc_published_domain] (deprecated)
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[dmarc_published_domain] additional.fields[dmarc_published_domain]
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.msgValue[exchange_journal_info].parameter.multiStrValue[recipients] about.labels[exchange_journal_info_recipients] (deprecated)
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.msgValue[exchange_journal_info].parameter.multiStrValue[recipients] additional.fields[exchange_journal_info_recipients]
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.msgValue[exchange_journal_info].parameter.value[rfc822_message_id] about.labels[exchange_journal_info_rfc822_message_id] (deprecated)
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.msgValue[exchange_journal_info].parameter.value[rfc822_message_id] additional.fields[exchange_journal_info_rfc822_message_id]
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.msgValue[exchange_journal_info].parameter.intValue[timestamp] about.labels[exchange_journal_info_timestamp] (deprecated)
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.msgValue[exchange_journal_info].parameter.intValue[timestamp] additional.fields[exchange_journal_info_timestamp]
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.msgValue[exchange_journal_info].parameter.multiStrValue[unknown_recipients] about.labels[exchange_journal_info_unknown_recipients] (deprecated)
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.msgValue[exchange_journal_info].parameter.multiStrValue[unknown_recipients] additional.fields[exchange_journal_info_unknown_recipients]
    gmail events.parameters[delivery].msgValue[message_info].parameter.intValue[internal_message_id] about.labels[internal_message_id] (deprecated)
    gmail events.parameters[delivery].msgValue[message_info].parameter.intValue[internal_message_id] additional.fields[internal_message_id]
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiStrValue[link_domain] about.labels[link_domain] (deprecated)
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiStrValue[link_domain] additional.fields[link_domain]
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[message_set].parameter.intValue[type] about.labels[message_set_type] (deprecated) If this log field value is equal to 1, then the about.labels UDM field is set to 1 - Message is inbound (received from outside your domains). This message set doesn't appear with message set 10.

    Else, if this log field value is equal to 2, then the about.labels UDM field is set to 2 - Message is outbound (sent to a recipient outside your domains). This message set doesn't appear with message set 10.

    Else, if this log field value is equal to 4, then the about.labels UDM field is set to 4 - Message contains objectionable content, as defined by one of your policies.

    Else, if this log field value is equal to 6, then the about.labels UDM field is set to 6 - Message triggered the walled garden rule you configured that restricts messages to authorized addresses or domains.

    Else, if this log field value is equal to 7, then the about.labels UDM field is set to 7 - Gmail classified the message as spam.

    Else, if this log field value is equal to 8, then the about.labels UDM field is set to 8 - Message being sent (outgoing message).

    Else, if this log field value is equal to 9, then the about.labels UDM field is set to 9 - Message being received (incoming message).

    Else, if this log field value is equal to 10, then the about.labels UDM field is set to 10 - Message that is internal to your domains.

    Else, if this log field value is equal to 11, then the about.labels UDM field is set to 11 - Message has a sender or recipients outside your domains.

    Else, if this log field value is equal to 12, then the about.labels UDM field is set to 12 - Message has some recipients inside your domain and some recipients outside your domain. This message set might appear when:

    Else, if this log field value is equal to 13, then the about.labels UDM field is set to 13 - The type of the message set is unknown.

    Else, if this log field value is equal to 15, then the about.labels UDM field is set to 15 - The policy being checked against is tied to a Gmail user.

    Else, if this log field value is equal to 18, then the about.labels UDM field is set to 18 - Message doesn't have a default route.

    Else, if this log field value is equal to 19, then the about.labels UDM field is set to 19 - The address list you configured for domain default routing matches the correspondent of the message.

    Else, if this log field value is equal to 20, then the about.labels UDM field is set to 20 - Message is from an address in your blocked senders list.

    Else, if this log field value is equal to 21, then the about.labels UDM field is set to 21 - Message was sent over TLS and the SSL certificate is valid.

    Else, if this log field value is equal to 22, then the about.labels UDM field is set to 22 - Message was sent over TLS.

    Else, if this log field value is equal to 24, then the about.labels UDM field is set to 24 - The recipient of this message is unknown.

    Else, if this log field value is equal to 25, then the about.labels UDM field is set to 25 - Message is a non-delivery report responding to a message that was not delivered.

    Else, if this log field value is equal to 26, then the about.labels UDM field is set to 26 - Message triggered a rerouting rule, which you configured in domain default routing.

    Else, if this log field value is equal to 27, then the about.labels UDM field is set to 27 - Sender successfully passed SPF/DKIM/DMARC authentication. If the sender isn't authenticated, the sender domain is untrusted and the message is not considered internal.

    Else, if this log field value is equal to 28, then the about.labels UDM field is set to 28 - Exchange journal is archiving the message to Google Vault.

    Else, if this log field value is equal to 29, then the about.labels UDM field is set to 29 - Message was routed through SMTP relay.

    Else, if this log field value is equal to 30, then the about.labels UDM field is set to 30 - A recipient of the message matched one of the enumerated recipients (instead of a regular expression pattern) you configured for domain routing, or domain default routing.

    Else, if this log field value is equal to 31, then the about.labels UDM field is set to 31 - Message matched a domain default routing condition you configured.

    Else, if this log field value is equal to 32, then the about.labels UDM field is set to 32 - Message was created from an Exchange journal message for archiving to Google Vault.

    Else, if this log field value is equal to 33, then the about.labels UDM field is set to 33 - Message has to be transmitted through a secure connection, such as TLS.

    Else, if this log field value is equal to 34, then the about.labels UDM field is set to 34 - The policy being checked against is tied to a group instead of an individual Gmail user.

    Else, if this log field value is equal to 35, then the about.labels UDM field is set to 35 - Message could not be authenticated in SMTP relay because it has an empty SMTP envelope-from address or is possibly an Exchange Journal message. It will be checked later at SMTP RCPT command time.

    Else, if this log field value is equal to 36, then the about.labels UDM field is set to 36 - Message has aggressive spam filtering enabled.

    Else, if this log field value is equal to 37, then the about.labels UDM field is set to 37 - Message is authenticated for SMTP relay.

    Else, if this log field value is equal to 39, then the about.labels UDM field is set to 39 - Sender is from an authenticated domain for relay.

    Else, if this log field value is equal to 40, then the about.labels UDM field is set to 40 - Message is from a Google Workspace user in the domain being authenticated for relay.

    Else, if this log field value is equal to 41, then the about.labels UDM field is set to 41 - Sender has successfully authenticated with SMTP AUTH, and Gmail is trying to authenticate SMTP relay for the sender's domain.

    Else, if this log field value is equal to 42, then the about.labels UDM field is set to 42 - Message was sent from an address that isn't authenticated.

    Else, if this log field value is equal to 43, then the about.labels UDM field is set to 43 - Message was rerouted through an alias table.

    Else, if this log field value is equal to 44, then the about.labels UDM field is set to 44 - Message triggered a rule that changes the route of the mail flow.

    Else, if this log field value is equal to 45, then the about.labels UDM field is set to 45 - Message is to a catch-all account and is being relayed to an on-premise server. System-of-record policies won't be applied to it.

    Else, if this log field value is equal to 46, then the about.labels UDM field is set to 46 - Message bypassed the spam filter.

    Else, if this log field value is equal to 47, then the about.labels UDM field is set to 47 - Message was detected to be spam by tag-and-deliver information in the inbound gateway settings.

    Else, if this log field value is equal to 48, then the about.labels UDM field is set to 48 - Message was not checked for spam (by SMTP) due to a spam-override policy.

    Else, if this log field value is equal to 49, then the about.labels UDM field is set to 49 - Always override spam rejection for the message.

    Else, if this log field value is equal to 50, then the about.labels UDM field is set to 50 - Message matches a domain routing condition you configured.

    Else, if this log field value is equal to 51, then the about.labels UDM field is set to 51 - Message triggered a rerouting rule that you configured for domain routing.

    Else, if this log field value is equal to 55, then the about.labels UDM field is set to 55 - Message was created by the Exchange Journal generation setting.

    Else, if this log field value is equal to 57, then the about.labels UDM field is set to 57 - Message was received from an inbound gateway rule that you configured.

    Else, if this log field value is equal to 60, then the about.labels UDM field is set to 60 - Message is protected with Gmail confidential mode.

    Else, if this log field value is equal to 61, then the about.labels UDM field is set to 61 - Message was caught by Security sandbox.

    Else, if this log field value is equal to 62, then the about.labels UDM field is set to 62 - The address list you configured for domain default routing matches the SMTP envelope recipient instead of the correspondent of the message.

    Else, if this log field value is equal to 63, then the about.labels UDM field is set to 63 - Message triggered a domain-level rerouting rule, which you configured for domain routing, or domain default routing.
    gmail events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[message_set].parameter.intValue[type] additional.fields[message_set_type] If this log field value is equal to 1, then the additional.fields UDM field is set to 1 - Message is inbound (received from outside your domains). This message set doesn't appear with message set 10.

    Else, if this log field value is equal to 2, then the additional.fields UDM field is set to 2 - Message is outbound (sent to a recipient outside your domains). This message set doesn't appear with message set 10.

    Else, if this log field value is equal to 4, then the additional.fields UDM field is set to 4 - Message contains objectionable content, as defined by one of your policies.

    Else, if this log field value is equal to 6, then the additional.fields UDM field is set to 6 - Message triggered the walled garden rule you configured that restricts messages to authorized addresses or domains.

    Else, if this log field value is equal to 7, then the additional.fields UDM field is set to 7 - Gmail classified the message as spam.

    Else, if this log field value is equal to 8, then the additional.fields UDM field is set to 8 - Message being sent (outgoing message).

    Else, if this log field value is equal to 9, then the additional.fields UDM field is set to 9 - Message being received (incoming message).

    Else, if this log field value is equal to 10, then the additional.fields UDM field is set to 10 - Message that is internal to your domains.

    Else, if this log field value is equal to 11, then the additional.fields UDM field is set to 11 - Message has a sender or recipients outside your domains.

    Else, if this log field value is equal to 12, then the additional.fields UDM field is set to 12 - Message has some recipients inside your domain and some recipients outside your domain. This message set might appear when:

    Else, if this log field value is equal to 13, then the additional.fields UDM field is set to 13 - The type of the message set is unknown.

    Else, if this log field value is equal to 15, then the additional.fields UDM field is set to 15 - The policy being checked against is tied to a Gmail user.

    Else, if this log field value is equal to 18, then the additional.fields UDM field is set to 18 - Message doesn't have a default route.

    Else, if this log field value is equal to 19, then the additional.fields UDM field is set to 19 - The address list you configured for domain default routing matches the correspondent of the message.

    Else, if this log field value is equal to 20, then the additional.fields UDM field is set to 20 - Message is from an address in your blocked senders list.

    Else, if this log field value is equal to 21, then the additional.fields UDM field is set to 21 - Message was sent over TLS and the SSL certificate is valid.

    Else, if this log field value is equal to 22, then the additional.fields UDM field is set to 22 - Message was sent over TLS.

    Else, if this log field value is equal to 24, then the additional.fields UDM field is set to 24 - The recipient of this message is unknown.

    Else, if this log field value is equal to 25, then the additional.fields UDM field is set to 25 - Message is a non-delivery report responding to a message that was not delivered.

    Else, if this log field value is equal to 26, then the additional.fields UDM field is set to 26 - Message triggered a rerouting rule, which you configured in domain default routing.

    Else, if this log field value is equal to 27, then the additional.fields UDM field is set to 27 - Sender successfully passed SPF/DKIM/DMARC authentication. If the sender isn't authenticated, the sender domain is untrusted and the message is not considered internal.

    Else, if this log field value is equal to 28, then the additional.fields UDM field is set to 28 - Exchange journal is archiving the message to Google Vault.

    Else, if this log field value is equal to 29, then the additional.fields UDM field is set to 29 - Message was routed through SMTP relay.

    Else, if this log field value is equal to 30, then the additional.fields UDM field is set to 30 - A recipient of the message matched one of the enumerated recipients (instead of a regular expression pattern) you configured for domain routing, or domain default routing.

    Else, if this log field value is equal to 31, then the additional.fields UDM field is set to 31 - Message matched a domain default routing condition you configured.

    Else, if this log field value is equal to 32, then the additional.fields UDM field is set to 32 - Message was created from an Exchange journal message for archiving to Google Vault.

    Else, if this log field value is equal to 33, then the additional.fields UDM field is set to 33 - Message has to be transmitted through a secure connection, such as TLS.

    Else, if this log field value is equal to 34, then the additional.fields UDM field is set to 34 - The policy being checked against is tied to a group instead of an individual Gmail user.

    Else, if this log field value is equal to 35, then the additional.fields UDM field is set to 35 - Message could not be authenticated in SMTP relay because it has an empty SMTP envelope-from address or is possibly an Exchange Journal message. It will be checked later at SMTP RCPT command time.

    Else, if this log field value is equal to 36, then the additional.fields UDM field is set to 36 - Message has aggressive spam filtering enabled.

    Else, if this log field value is equal to 37, then the additional.fields UDM field is set to 37 - Message is authenticated for SMTP relay.

    Else, if this log field value is equal to 39, then the additional.fields UDM field is set to 39 - Sender is from an authenticated domain for relay.

    Else, if this log field value is equal to 40, then the additional.fields UDM field is set to 40 - Message is from a Google Workspace user in the domain being authenticated for relay.

    Else, if this log field value is equal to 41, then the additional.fields UDM field is set to 41 - Sender has successfully authenticated with SMTP AUTH, and Gmail is trying to authenticate SMTP relay for the sender's domain.

    Else, if this log field value is equal to 42, then the additional.fields UDM field is set to 42 - Message was sent from an address that isn't authenticated.

    Else, if this log field value is equal to 43, then the additional.fields UDM field is set to 43 - Message was rerouted through an alias table.

    Else, if this log field value is equal to 44, then the additional.fields UDM field is set to 44 - Message triggered a rule that changes the route of the mail flow.

    Else, if this log field value is equal to 45, then the additional.fields UDM field is set to 45 - Message is to a catch-all account and is being relayed to an on-premise server. System-of-record policies won't be applied to it.

    Else, if this log field value is equal to 46, then the additional.fields UDM field is set to 46 - Message bypassed the spam filter.

    Else, if this log field value is equal to 47, then the additional.fields UDM field is set to 47 - Message was detected to be spam by tag-and-deliver information in the inbound gateway settings.

    Else, if this log field value is equal to 48, then the additional.fields UDM field is set to 48 - Message was not checked for spam (by SMTP) due to a spam-override policy.

    Else, if this log field value is equal to 49, then the additional.fields UDM field is set to 49 - Always override spam rejection for the message.

    Else, if this log field value is equal to 50, then the additional.fields UDM field is set to 50 - Message matches a domain routing condition you configured.

    Else, if this log field value is equal to 51, then the additional.fields UDM field is set to 51 - Message triggered a rerouting rule that you configured for domain routing.

    Else, if this log field value is equal to 55, then the additional.fields UDM field is set to 55 - Message was created by the Exchange Journal generation setting.

    Else, if this log field value is equal to 57, then the additional.fields UDM field is set to 57 - Message was received from an inbound gateway rule that you configured.

    Else, if this log field value is equal to 60, then the additional.fields UDM field is set to 60 - Message is protected with Gmail confidential mode.

    Else, if this log field value is equal to 61, then the additional.fields UDM field is set to 61 - Message was caught by Security sandbox.

    Else, if this log field value is equal to 62, then the additional.fields UDM field is set to 62 - The address list you configured for domain default routing matches the SMTP envelope recipient instead of the correspondent of the message.

    Else, if this log field value is equal to 63, then the additional.fields UDM field is set to 63 - Message triggered a domain-level rerouting rule, which you configured for domain routing, or domain default routing.
    gmail events.parameters[delivery].msgValue[message_info].parameter.intValue[moderation_reason] about.labels[moderation_reason] (deprecated)
    gmail events.parameters[delivery].msgValue[message_info].parameter.intValue[moderation_reason] additional.fields[moderation_reason]
    gmail events.parameters[delivery].msgValue[message_info].parameter.intValue[moderation_status] about.labels[moderation_status] (deprecated)
    gmail events.parameters[delivery].msgValue[message_info].parameter.intValue[moderation_status] additional.fields[moderation_status]
    gmail events.parameters[delivery].msgValue[message_info].parameter.intValue[num_message_attachments] about.labels[num_message_attachments] (deprecated)
    gmail events.parameters[delivery].msgValue[message_info].parameter.intValue[num_message_attachments] additional.fields[num_message_attachments]
    gmail events.parameters[delivery].msgValue[message_info].parameter.intValue[sequence_number] about.labels[sequence_number] (deprecated)
    gmail events.parameters[delivery].msgValue[message_info].parameter.intValue[sequence_number] additional.fields[sequence_number]
    gmail events.parameters[delivery].msgValue[message_info].parameter.intValue[smime_content_type] about.labels[smime_content_type] (deprecated) If this log field value is equal to 0, then the about.labels UDM field is set to 0 - Message does not have a recognized S/MIME Content-Type.

    Else, if this log field value is equal to 1, then the about.labels UDM field is set to 1 - An S/MIME message with a detached signature Indicated by content type multipart/signed with parameter protocol=application/pkcs7-signature.

    Else, if this log field value is equal to 2, then the about.labels UDM field is set to 2 - An S/MIME message with an opaque signature Indicated by content type application/pkcs7-mime or application/x-pkcs7-mime with parameter smime-type=signed-data.

    Else, if this log field value is equal to 3, then the about.labels UDM field is set to 3 - An S/MIME message that is encrypted Indicated by content type application/pkcs7-mime or application/x-pkcs7-mime with parameter smime-type=enveloped-data.

    Else, if this log field value is equal to 4, then the about.labels UDM field is set to 4 - An S/MIME message that is compressed Indicated by content type application/pkcs7-mime or application/x-pkcs7-mime with parameter smime-type=compressed-data.
    gmail events.parameters[delivery].msgValue[message_info].parameter.intValue[smime_content_type] additional.fields[smime_content_type] If this log field value is equal to 0, then the additional.fields UDM field is set to 0 - Message does not have a recognized S/MIME Content-Type.

    Else, if this log field value is equal to 1, then the additional.fields UDM field is set to 1 - An S/MIME message with a detached signature Indicated by content type multipart/signed with parameter protocol=application/pkcs7-signature.

    Else, if this log field value is equal to 2, then the additional.fields UDM field is set to 2 - An S/MIME message with an opaque signature Indicated by content type application/pkcs7-mime or application/x-pkcs7-mime with parameter smime-type=signed-data.

    Else, if this log field value is equal to 3, then the additional.fields UDM field is set to 3 - An S/MIME message that is encrypted Indicated by content type application/pkcs7-mime or application/x-pkcs7-mime with parameter smime-type=enveloped-data.

    Else, if this log field value is equal to 4, then the additional.fields UDM field is set to 4 - An S/MIME message that is compressed Indicated by content type application/pkcs7-mime or application/x-pkcs7-mime with parameter smime-type=compressed-data.
    gmail events.parameters[delivery].msgValue[message_info].parameter.boolValue[smime_encrypt_message] about.labels[smime_encrypt_message] (deprecated)
    gmail events.parameters[delivery].msgValue[message_info].parameter.boolValue[smime_encrypt_message] additional.fields[smime_encrypt_message]
    gmail events.parameters[delivery].msgValue[message_info].parameter.boolValue[smime_extraction_success] about.labels[smime_extraction_success] (deprecated)
    gmail events.parameters[delivery].msgValue[message_info].parameter.boolValue[smime_extraction_success] additional.fields[smime_extraction_success]
    gmail events.parameters[delivery].msgValue[message_info].parameter.boolValue[smime_packaging_success] about.labels[smime_packaging_success] (deprecated)
    gmail events.parameters[delivery].msgValue[message_info].parameter.boolValue[smime_packaging_success] additional.fields[smime_packaging_success]
    gmail events.parameters[delivery].msgValue[message_info].parameter.boolValue[smime_sign_message] about.labels[smime_sign_message] (deprecated)
    gmail events.parameters[delivery].msgValue[message_info].parameter.boolValue[smime_sign_message] additional.fields[smime_sign_message]
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[spf_pass] about.labels[spf_pass] (deprecated)
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[spf_pass] additional.fields[spf_pass]
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[tls_required_but_unavailable] about.labels[tls_required_but_unavailable] (deprecated)
    gmail events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[tls_required_but_unavailable] additional.fields[tls_required_but_unavailable]

    Referência de mapeamento de campo: tipos de registro WORKSPACE_ALERTS para o tipo de evento do UDM

    A tabela a seguir lista os tipos de registro WORKSPACE_ALERTS e os tipos de evento do UDM correspondentes.

    Event Identifier Event Type Security Category
    Customer takeout initiated STATUS_UPDATE
    Malware reclassification EMAIL_TRANSACTION MAIL_PHISHING
    Misconfigured whitelist EMAIL_TRANSACTION MAIL_PHISHING
    Phishing reclassification EMAIL_TRANSACTION MAIL_PHISHING
    Suspicious message reported EMAIL_TRANSACTION MAIL_PHISHING
    User reported phishing EMAIL_TRANSACTION MAIL_PHISHING
    User reported spam spike EMAIL_TRANSACTION MAIL_PHISHING
    Leaked password USER_LOGIN ACL_VIOLATION
    Suspicious login USER_LOGIN ACL_VIOLATION
    Suspicious login (less secure app) USER_LOGIN ACL_VIOLATION
    Suspicious programmatic login USER_LOGIN ACL_VIOLATION
    User suspended USER_UNCATEGORIZED ACL_VIOLATION
    User suspended (spam) USER_UNCATEGORIZED ACL_VIOLATION
    User suspended (spam through relay) USER_UNCATEGORIZED ACL_VIOLATION
    User suspended (suspicious activity) USER_UNCATEGORIZED ACL_VIOLATION
    Google Operations STATUS_UPDATE
    Configuration problem STATUS_UNCATEGORIZED
    Government attack warning STATUS_UNCATEGORIZED
    Device compromised GENERIC_EVENT
    Suspicious activity USER_UNCATEGORIZED
    AppMaker Default Cloud SQL setup USER_RESOURCE_ACCESS
    Activity Rule STATUS_UNCATEGORIZED / USER_UNCATEGORIZED / EMAIL_UNCATEGORIZED POLICY_VIOLATION
    Data Loss Prevention USER_UNCATEGORIZED POLICY_VIOLATION
    Apps outage STATUS_UPDATE
    Primary admin changed USER_UNCATEGORIZED
    SSO profile added USER_RESOURCE_CREATION
    SSO profile updated USER_RESOURCE_UPDATE_CONTENT
    SSO profile deleted USER_RESOURCE_DELETION
    Super admin password reset USER_CHANGE_PASSWORD
    User deleted USER_DELETION
    New user added USER_CREATION
    User password changed USER_CHANGE_PASSWORD
    Users Admin privilege revoked USER_CHANGE_PERMISSIONS
    Suspended user made active USER_UNCATEGORIZED
    User granted Admin privilege USER_CHANGE_PERMISSIONS
    User suspended (Administrator email alert) USER_UNCATEGORIZED
    Drive settings changed USER_RESOURCE_ACCESS
    Calendar settings changed USER_RESOURCE_ACCESS
    Reporting Rule STATUS_UPDATE

    Referência de mapeamento de campo: WORKSPACE_ALERTS

    A tabela a seguir lista os campos de registro do tipo WORKSPACE_ALERTS e os campos correspondentes do UDM.

    Log field UDM mapping Logic
    data.domainId.customerPrimaryDomain about.administrative_domain
    data.messages.attachmentsSha256Hash about.file.sha256
    data.messages.attachmentsSha256Hash security_result.detection_fields[attachments_sha256_hash]
    data.mergeInfo.newAlertId about.labels[new_alert_id] (deprecated)
    data.mergeInfo.newAlertId additional.fields[new_alert_id]
    data.mergeInfo.newIncidentTrackingId about.labels[new_incident_tracking_id] (deprecated)
    data.mergeInfo.newIncidentTrackingId additional.fields[new_incident_tracking_id]
    data.nextUpdateTime about.labels[next_update_time] (deprecated)
    data.nextUpdateTime additional.fields[next_update_time]
    data.resolutionTime about.labels[resolution_time] (deprecated)
    data.resolutionTime additional.fields[resolution_time]
    data.status about.labels[status] (deprecated)
    data.status additional.fields[status]
    data.incidentTrackingId about.labels[tracking_id] (deprecated)
    data.incidentTrackingId additional.fields[tracking_id]
    customerId about.resource.product_object_id If the customerId log field value is not empty, then the customerId log field is mapped to the about.resource.product_object_id UDM field.

    Else, the metadata.customerId log field is mapped to the about.resource.product_object_id UDM field.
    metadata.customerId about.resource.product_object_id If the customerId log field value is not empty, then the customerId log field is mapped to the about.resource.product_object_id UDM field.

    Else, the metadata.customerId log field is mapped to the about.resource.product_object_id UDM field.
    about.resource.resource_type The about.resource.resource_type UDM field is set to CLOUD_ORGANIZATION.
    data.dashboardUri about.url
    data.attachmentData.csv.dataRows.entries additional.fields.entries
    data.attachmentData.csv.headers additional.fields.header
    event.idm.is_alert The event.idm.is_alert UDM field is set to TRUE.
    event.idm.is_significant If the data.@type log field value is equal to ActivityRule and the metadata.severity log field value is equal to HIGH, then the event.idm.is_significant UDM field is set to true.
    extensions.auth.mechanism If the data.@type log field value is equal to AccountWarning, then the extensions.auth.mechanism UDM field is set to USERNAME_PASSWORD.
    extensions.auth.type If the data.@type log field value is equal to AccountWarning, then the extensions.auth.type UDM field is set to SSO.
    data.description metadata.description
    createTime metadata.event_timestamp
    data.@type metadata.product_event_type
    etag metadata.product_log_id If the etag log field value is not empty, then the etag log field is mapped to the metadata.product_log_id UDM field.

    Else, the alertId log field is mapped to the metadata.product_log_id UDM field.
    metadata.etag metadata.product_log_id If the metadata.etag log field value is not empty, then the metadata.etag log field is mapped to the metadata.product_log_id UDM field.

    Else, the alertId log field is mapped to the metadata.product_log_id UDM field.
    metadata.product_name The metadata.product_name UDM field is set to WORKSPACE_ALERTS.
    metadata.vendor_name The metadata.vendor_name UDM field is set to GOOGLE.
    data.maliciousEntity.fromHeader network.email.from
    data.messages.messageId network.email.mail_id
    data.messages.messageId security_result.detection_fields[message_id]
    data.messages.subjectText network.email.subject
    data.messages.recipient network.email.to
    data.messages.recipient security_result.detection_fields[mail_recipient]
    data.ruleViolationInfo.recipients network.email.to If the data.ruleViolationInfo.recipients log field value matches the regular expression pattern ^.+@.+$, then the data.ruleViolationInfo.recipients log field is mapped to the network.email.to UDM field.
    data.ruleViolationInfo.recipients additional.fields[recipients] If the data.ruleViolationInfo.recipients log field value is equal to anyone, then the data.ruleViolationInfo.recipients log field is mapped to the additional.fields UDM field.
    data.ruleViolationInfo.recipients target.domain.name If the data.ruleViolationInfo.recipients log field value matches the regular expression pattern ^[a-zA-Z0-9][a-zA-Z0-9-]{1,61}[a-zA-Z0-9](?:\.[a-zA-Z]{2,})+$, then the first occurrence of the matching value in the data.ruleViolationInfo.recipients log field is mapped to the target.domain.name UDM field and the other occurrences are mapped to the additional.fields[domain_recipients] UDM field.
    data.sourceIp principal.ip
    data.loginDetails.ipAddress principal.ip
    data.maliciousEntity.displayName principal.labels[malicious_entity_display_name] (deprecated)
    data.maliciousEntity.displayName additional.fields[malicious_entity_display_name]
    data.requestInfo.appDeveloperEmail principal.user.email_addresses
    data.actorEmail principal.user.email_addresses
    data.ruleViolationInfo.triggeringUserEmail principal.user.email_addresses
    data.email principal.user.email_addresses
    data.domain security_result.about.administrative_domain
    metadata.assignee security_result.about.labels[assignee] (deprecated)
    metadata.assignee additional.fields[assignee]
    data.header security_result.about.labels[header] (deprecated)
    data.header additional.fields[header]
    data.ruleViolationInfo.suppressedActionTypes security_result.about.labels[suppressed_action_types] (deprecated)
    data.ruleViolationInfo.suppressedActionTypes additional.fields[suppressed_action_types]
    data.title security_result.about.labels[title] (deprecated)
    data.title additional.fields[title]
    alertId security_result.about.object_reference
    data.affectedUserEmails security_result.about.user.email_addresses
    data.ruleViolationInfo.triggeredActionTypes security_result.action_details
    security_result.action_type If the data.ruleViolationInfo.triggeredActionTypes log field value is equal to ACTION_TYPE_UNSPECIFIED, then the security_result.action_type UDM field is set to UNKNOWN_ACTION.

    If the data.ruleViolationInfo.triggeredActionTypes log field value is equal to DRIVE_BLOCK_EXTERNAL_SHARING, then the security_result.action_type UDM field is set to BLOCK.

    If the data.ruleViolationInfo.triggeredActionTypes log field value is equal to DRIVE_WARN_ON_EXTERNAL_SHARING or ALERT or RULE_ACTIVATE or RULE_DEACTIVATE, then the security_result.action_type UDM field is set to ALLOW.
    security_result.category If the source log field value is equal to Gmail Phishing, then the security_result.category UDM field is set to MAIL_PHISHING.

    If the source log field value is equal to Google Identity, then the security_result.category UDM field is set to ACL_VIOLATION.

    If the source log field value is equal to Security Center rules or Data Loss Prevention, then the security_result.category UDM field is set to POLICY_VIOLATION.
    source security_result.category_details
    data.actionNames security_result.detection_fields[action_names]
    data.alertDetails security_result.detection_fields[alert_details]
    data.createTime security_result.detection_fields[create_time]
    data.messages.date security_result.detection_fields[date] If the source log field value is equal to Gmail phishing, then the data.messages.date log field is mapped to the security_result.detection_fields UDM field.
    data.messages.sentTime security_result.detection_fields[sent_time]
    data.events.deviceCompromisedState security_result.detection_fields[device_compromised_state]
    data.displayName security_result.detection_fields[display_name]
    data.eventTime security_result.detection_fields[event_time]
    data.isInternal security_result.detection_fields[is_internal]
    data.loginDetails.loginTime security_result.detection_fields[login_time]
    data.messages.md5HashMessageBody security_result.detection_fields[md5_hash_message_body] If the source log field value is equal to Gmail phishing, then the data.messages.md5HashMessageBody log field is mapped to the security_result.detection_fields UDM field.
    data.messages.md5hashsubject security_result.detection_fields[md5_hash_subject] If the source log field value is equal to Gmail phishing, then the data.messages.md5hashsubject log field is mapped to the security_result.detection_fields UDM field.
    data.messages.messageBodySnippet security_result.detection_fields[message_body_snippet]
    metadata.status security_result.detection_fields[metadata_status]
    data.query security_result.detection_fields[query]
    securityInvestigationToolLink security_result.detection_fields[security_investigation_tool_link]
    startTime security_result.detection_fields[start_time]
    data.supersededAlerts security_result.detection_fields[superseded_alerts]
    data.supersedingAlert security_result.detection_fields[superseding_alert]
    data.systemActionType security_result.detection_fields[system_action_type]
    data.threshold security_result.detection_fields[threshold]
    data.triggerSource security_result.detection_fields[trigger_source]
    data.ruleViolationInfo.trigger security_result.detection_fields[trigger]
    data.updateTime security_result.detection_fields[update_time]
    data.windowSize security_result.detection_fields[windows_size]
    data.ruleViolationInfo.ruleInfo.resourceName security_result.rule_id
    data.ruleViolationInfo.matchInfo.userDefinedDetector.displayName security_result.rule_labels[detector_display_name]
    data.ruleViolationInfo.matchInfo.predefinedDetector.detectorName security_result.rule_labels[detector_name]
    data.ruleViolationInfo.matchInfo.userDefinedDetector.resourceName security_result.rule_labels[detector_resource_name]
    data.name security_result.rule_name
    data.ruleViolationInfo.ruleInfo.displayName security_result.rule_name
    metadata.severity security_result.severity
    type security_result.summary
    data.type security_result.summary If the type log field value is empty, then the data.type log field is mapped to the security_result.summary UDM field.
    security_result.alert_state The security_result.alert_state UDM field is set to ALERTING.
    data.requestInfo.appKey target.application
    data.events.deviceId target.asset.asset_id
    data.events.deviceProperty target.asset.attribute.labels[device_property]
    data.events.iosVendorId target.asset.attribute.labels[ios_vendor_id]
    data.events.newValue target.asset.attribute.labels[new_value]
    data.events.oldValue target.asset.attribute.labels[old_value]
    data.events.resourceId target.asset.attribute.labels[resource_id]
    data.events.deviceModel target.asset.hardware.model
    data.events.serialNumber target.asset.hardware.serial_number
    data.events.deviceType target.asset.type
    data.primaryAdminChangedEvent.domain target.domain.name
    data.ssoProfileUpdatedEvent.inboundSsoProfileChanges target.labels[inbound_sso_profile_changes] (deprecated)
    data.ssoProfileUpdatedEvent.inboundSsoProfileChanges additional.fields[inbound_sso_profile_changes]
    data.requestInfo.numberOfRequests target.labels[number_of_requests] (deprecated)
    data.requestInfo.numberOfRequests additional.fields[number_of_requests]
    data.primaryAdminChangedEvent.previousAdminEmail target.labels[previous_admin_email] (deprecated)
    data.primaryAdminChangedEvent.previousAdminEmail additional.fields[previous_admin_email]
    data.products target.labels[product] (deprecated)
    data.products additional.fields[product]
    data.ruleViolationInfo.resourceInfo.resourceTitle target.labels[resource_title] (deprecated)
    data.ruleViolationInfo.resourceInfo.resourceTitle additional.fields[resource_title]
    data.takeoutRequestId target.labels[takeout_request_id] (deprecated)
    data.takeoutRequestId additional.fields[takeout_request_id]
    data.ruleViolationInfo.dataSource target.resource.name
    data.ssoProfileCreatedEvent.inboundSsoProfileName target.resource.name
    data.ssoProfileUpdatedEvent.inboundSsoProfileName target.resource.name
    data.ssoProfileDeletedEvent.inboundSsoProfileName target.resource.name
    data.ruleViolationInfo.resourceInfo.documentId target.resource.product_object_id
    target.resource.resource_type If the data.@type log field value is equal to DlpRuleViolation, then the target.resource.resource_type UDM field is set to STORAGE_OBJECT.

    If the data.@type log field value is equal to AppMakerSqlSetupNotification, then the target.resource.resource_type UDM field is set to DATABASE.

    If the data.type log field value is equal to SSO profile added or SSO profile updated or SSO profile deleted, then the target.resource.resource_type UDM field is set to SETTING.
    data.maliciousEntity.entity.emailAddress target.user.email_addresses
    data.email target.user.email_addresses If the data.@type log field value is equal to StateSponsoredAttack, DeviceCompromised, or AccountWarning, then the data.email log field is mapped to the target.user.email_addresses UDM field.

    Else, the data.email log field is mapped to the principal.user.email_addresses UDM field.
    data.primaryAdminChangedEvent.updatedAdminEmail target.user.email_addresses
    data.superAdminPasswordResetEvent.userEmail target.user.email_addresses
    data.maliciousEntity.entity.displayName target.user.user_display_name
    data.ruleViolationInfo.triggeredActionInfo

    Referência de mapeamento de campo: WORKSPACE_GROUPS

    A tabela a seguir lista os campos de registro do tipo WORKSPACE_GROUPS e os campos correspondentes do UDM.

    Log field UDM mapping Logic
    adminCreated entity.group.attribute.labels[admin_created] If the adminCreated log field value is equal to true, then the admin_created.value UDM field is set to true.

    Else, the admin_created.value UDM field is set to false.
    description metadata.description
    directMembersCount entity.group.attribute.labels[direct_members_count]
    email entity.group.email_addresses
    nonEditableAliases entity.group.email_addresses
    aliases entity.group.email_addresses
    etag entity.labels[etag] (deprecated)
    etag additional.fields[etag]
    id entity.group.product_object_id
    kind entity.labels[kind] (deprecated)
    kind additional.fields[kind]
    name entity.group.group_display_name
    metadata.vendor_name The metadata.vendor_name UDM field is set to GOOGLE.
    metadata.product_name The metadata.product_name UDM field is set to WORKSPACE GROUPS.
    metadata.entity_type The metadata.entity_type UDM field is set to GROUP.

    Referência de mapeamento de campo: WORKSPACE_USERS

    A tabela a seguir lista os campos de registro do tipo WORKSPACE_USERS e os campos correspondentes do UDM.

    Log field UDM mapping Logic
    addresses.country entity.user.personal_address.country_or_region
    addresses.countryCode entity.user.attribute.labels[addresses_country_code]
    addresses.customType entity.user.attribute.labels[addresses_custom_type]
    addresses.extendedAddress entity.user.attribute.labels[addresses_extended_address]
    addresses.formatted entity.user.office_address.name The addresses.formatted log field is mapped to the user.office_address.name UDM field if the following conditions are met:
    • The message log field value matches the regular expression pattern addresses.*?formatted.
    • The addresses.type log field value is equal to work.
    • The addresses.formatted log field value is not empty.
    addresses.locality entity.user.attribute.labels[addresses_locality]
    addresses.poBox entity.user.attribute.labels[addresses_pobox]
    addresses.postalCode entity.user.attribute.labels[addresses_postal_code]
    addresses.primary entity.user.attribute.labels[addresses_primary]
    addresses.region entity.user.attribute.labels[addresses_region]
    addresses.sourceIsStructured entity.user.attribute.labels[addresses_source_is_structured]
    addresses.streetAddress entity.user.attribute.labels[addresses_street_address]
    addresses.type entity.user.attribute.labels[addresses_type]
    agreedToTerms entity.user.attribute.labels[agreed_to_terms]
    aliases entity.user.attribute.labels[aliases_email]
    changePasswordAtNextLogin entity.user.attribute.labels[change_password_at_next_login] If the changePasswordAtNextLogin log field value is equal to true, then the change_password_at_next_login.value UDM field is set to true.

    Else, the change_password_at_next_login.value UDM field is set to false.
    creationTime entity.user.attribute.creation_time
    customerId entity.user.attribute.labels[customer_id]
    deletionTime entity.user.attribute.labels[deletion_time]
    emails.customType entity.user.attribute.labels[email_acustom_type]
    emails.primary entity.user.attribute.labels[email_primary]
    emails.type entity.user.attribute.labels[email_type]
    etag entity.labels[etag] (deprecated)
    etag additional.fields[etag]
    externalIds.customType entity.user.attribute.labels[external_id_custom_type]
    externalIds.type entity.user.attribute.labels[external_id_type]
    externalIds.value entity.user.employee_id If the externalIds.type log field value is equal to organization, then the externalIds.value log field is mapped to the user.employee_id UDM field.
    gender.addressMeAs entity.user.attribute.labels[gender_address_me_as]
    gender.customGender entity.user.attribute.labels[custom_gender]
    gender.type entity.user.attribute.labels[gender]
    hashFunction entity.user.attribute.labels[hash_function]
    id entity.user.product_object_id
    ims.customProtocol entity.user.attribute.labels[ims_custom_protocol]
    ims.customType entity.user.attribute.labels[ims_custom_type]
    ims.im entity.user.attribute.labels[ims_im]
    ims.primary entity.user.attribute.labels[ims_primary]
    ims.protocol entity.user.attribute.labels[ims_protocol]
    ims.type entity.user.attribute.labels[ims_type]
    includeInGlobalAddressList entity.user.attribute.labels[included_in_global_address_list] If the includeInGlobalAddressList log field value is equal to true, then the included_in_global_address_list.value UDM field is set to true, else, then the included_in_global_address_list.value UDM field is set to false.
    ipWhitelisted entity.user.attribute.labels[ip_whitelisted]
    isAdmin entity.user.attribute.labels[is_admin]
    isDelegatedAdmin entity.user.attribute.labels[is_delegated_admin]
    user.attribute.roles.type If the isAdmin log field value or the isDelegatedAdmin log field value is equal to true, then the user.attribute.roles.type UDM field is set to ADMINISTRATOR.
    isEnforcedIn2Sv entity.user.attribute.labels[is_enforced_in_2sv] If the isEnforcedIn2Sv log field value is equal to true, then the is_enforced_in_2sv.value UDM field is set to true, else, then the is_enforced_in_2sv.value UDM field is set to false.
    isEnrolledIn2Sv entity.user.attribute.labels[is_enrolled_in_2sv] If the isEnrolledIn2Sv log field value is equal to true, then the is_enrolled_in_2sv.value UDM field is set to true, else, then the is_enrolled_in_2sv.value UDM field is set to false.
    isMailboxSetup entity.user.attribute.labels[is_mailbox_setup] If the isMailboxSetup log field value is equal to true, then the is_mail_box_setup.value UDM field is set to true, else, then the is_mail_box_setup.value UDM field is set to false.
    keywords.customType entity.user.attribute.labels[keywords_custom_type]
    keywords.type entity.user.attribute.labels[keywords_type]
    keywords.value entity.user.attribute.labels[keywords_value]
    kind entity.labels[kind] (deprecated)
    kind additional.fields[kind]
    languages.customLanguage entity.user.attribute.labels[language_custom_language]
    languages.languageCode entity.user.attribute.labels[language_code]
    languages.preference entity.user.attribute.labels[preferred_language]
    lastLoginTime entity.user.last_login_time
    locations.area entity.user.office_address.country_or_region
    locations.buildingId entity.user.attribute.labels[locations_buildingId]
    locations.customType entity.user.attribute.labels[locations_customType]
    locations.deskCode entity.user.officel_address.desk_name
    locations.floorName entity.user.office_address.floor_name
    locations.floorSection entity.user.attribute.labels[locations_floorSection]
    locations.type entity.user.attribute.labels[locations_type]
    name.familyName entity.user.last_name
    name.fullName entity.user.user_display_name
    name.givenName entity.user.first_name
    notes.contentType entity.user.attribute.labels[notes_content_type]
    notes.value entity.user.attribute.labels[notes_value]
    organizations.costCenter entity.user.attribute.labels[organization_cost_center]
    organizations.customType entity.user.attribute.labels[organization_custom_type]
    organizations.department entity.user.department The organizations.department log field is mapped to the user.department UDM field if the following conditions are met:
    • The message log field value matches the regular expression pattern organizations.*?department.
    • The org.department log field value is not empty.
    organizations.description entity.user.attribute.labels [organizations_description]
    organizations.domain entity.user.attribute.labels[organization_domain]
    organizations.fullTimeEquivalent entity.user.attribute.labels[organization_full_time_equivalent]
    organizations.location entity.user.attribute.labels[organization_location]
    organizations.name entity.user.attribute.labels[organization_name]
    organizations.primary entity.user.attribute.labels[organization_primary]
    organizations.symbol entity.user.attribute.labels[organization_symbol]
    organizations.title entity.user.title
    organizations.type entity.user.attribute.labels[organization_type]
    orgUnitPath entity.user.attribute.labels[org_unit_path]
    password entity.user.attribute.labels[password]
    phones.customType entity.user.attribute.labels[phone_custom_type]
    phones.primary entity.user.attribute.labels[phone_primary]
    phones.type entity.user.attribute.labels[phone_type]
    phones.value entity.user.phone_numbers If the phones.value log field value matches the regular expression pattern (^the +.0-9 log field value*), then the phones.value log field is mapped to the user.phone_numbers UDM field.
    recoveryPhone entity.user.phone_numbers
    posixAccounts.accountId entity.user.attribute.labels[posix_account_id]
    posixAccounts.gecos entity.user.attribute.labels[posix_account_gecos]
    posixAccounts.gid entity.user.group_identifiers
    posixAccounts.homeDirectory entity.user.attribute.labels[posix_account_home_directory]
    posixAccounts.operatingSystemType entity.platform If the posixAccounts.operatingSystemType log field value is equal to linux, then the entity.platform UDM field is set to LINUX.

    If the posixAccounts.operatingSystemType log field value is equal to windows, then the entity.platform UDM field is set to WINDOWS.

    Else, the entity.platform UDM field is set to UNKNOWN_PLATFORM.
    posixAccounts.primary entity.user.attribute.labels[posix_account_primary]
    posixAccounts.shell entity.user.attribute.labels[posix_account_shell]
    posixAccounts.systemId entity.asset.asset_id
    posixAccounts.uid entity.user.attribute.labels[posix_account_uid]
    posixAccounts.username entity.user.userid If the posixAccounts.username log field value is not empty, then the posixAccounts.username log field is mapped to the entity.user.userid UDM field.
    primaryEmail entity.user.email_addresses
    recoveryEmail entity.user.email_addresses
    nonEditableAliases entity.user.email_addresses
    emails.address entity.user.email_addresses If the emails.address log field value is not equal to primaryEmail, then the emails.address log field is mapped to the entity.user.email_addresses UDM field.
    relations.customType entity.user.attribute.labels[relations_custom_type]
    relations.type entity.user.attribute.labels[relation_type]
    relations.value entity.user.managers.email_addresses If the relation.type log field value is equal to manager, then the relations.value log field is mapped to the user.managers.email_addresses UDM field.

    Else, the relations.value log field is mapped to the user.attribute.labels UDM field.
    relations.value entity.user.attribute.labels[relations_type] If the relation.type log field value is equal to manager, then the relations.value log field is mapped to the user.managers.email_addresses UDM field.

    Else, the relations.value log field is mapped to the user.attribute.labels UDM field.
    sshPublicKeys.expirationTimeUsec entity.user.attribute.labels[ssh_key_expiration_timec]
    sshPublicKeys.fingerprint entity.user.attribute.labels[ssh_key_fingerprint]
    sshPublicKeys.key entity.user.attribute.labels[ssh_key]
    suspended entity.user.user_authentication_status If the suspended log field value is equal to true and the archived log field value is not equal to true, then the entity.user.user_authentication_status UDM field is set to SUSPENDED.

    If the archived log field value is equal to true, then the entity.user.user_authentication_status UDM field is set to DELETED.

    Else, the entity.user.user_authentication_status UDM field is set to ACTIVE.
    archived entity.user.user_authentication_status If the suspended log field value is equal to true and the archived log field value is not equal to true, then the entity.user.user_authentication_status UDM field is set to SUSPENDED.

    If the archived log field value is equal to true, then the entity.user.user_authentication_status UDM field is set to DELETED.

    Else, the entity.user.user_authentication_status UDM field is set to ACTIVE.
    suspensionReason entity.user.attribute.labels[suspension_reason]
    thumbnailPhotoEtag entity.user.attribute.labels[thumbnail_photo_etag]
    thumbnailPhotoUrl entity.url
    websites.customType entity.user.attribute.labels[websites_custom_type]
    websites.primary entity.user.attribute.labels[websites_primary]
    websites.type entity.user.attribute.labels[websites_type]
    websites.value entity.user.attribute.labels[websites_value]
    metadata.vendor_name The metadata.vendor_name UDM field is set to GOOGLE.
    metadata.product_name The metadata.product_name UDM field is set to Cloud Identity.
    metadata.entity_type The metadata.entity_type UDM field is set to USER.

    Referência de mapeamento de campo: WORKSPACE_MOBILE_DEVICES

    A tabela a seguir lista os campos de registro do tipo WORKSPACE_MOBILE_DEVICES e os campos correspondentes do UDM.

    Log field UDM mapping Logic
    adbStatus entity.asset.attribute.labels[abd status]
    applications.displayName entity.asset.software.name
    applications.packageName entity.asset.attribute.labels[application_package_name]
    applications.permission entity.asset.software.permissions.name
    applications.versionCode entity.asset.attribute.labels[application_version_code]
    applications.versionName entity.asset.software.version
    basebandVersion entity.asset.attribute.labels[baseband_version]
    bootloaderVersion entity.asset.attribute.labels[bootloader_version]
    brand entity.asset.attribute.labels[brand]
    buildNumber entity.asset.attribute.labels[build_number]
    defaultLanguage entity.asset.attribute.labels[default_language]
    developerOptionsStatus entity.asset.attribute.labels[developer_options_status]
    deviceCompromisedStatus entity.asset.attribute.labels[device_compromised_status]
    deviceId entity.asset.asset_id
    devicePasswordStatus entity.asset.attribute.labels[device_password_status]
    email entity.user.email_addresses
    encryptionStatus entity.asset.attribute.labels[encryption_status]
    etag entity.labels[etag] (deprecated)
    etag additional.fields[etag]
    firstSync entity.asset.attribute.labels[first_sync]
    hardware entity.asset.attribute.labels[hardware]
    hardwareId entity.asset.attribute.labels[hardware_id]
    imei entity.asset.asset_id
    deviceId entity.asset.asset_id If the imei log field value is empty, then the deviceId log field is mapped to the entity.asset.asset_id UDM field.
    kernelVersion entity.asset.attribute.labels[kernel_version]
    kind entity.labels[kind] (deprecated)
    kind additional.fields[kind]
    lastSync entity.asset.attribute.labels[last_sync]
    managedAccountIsOnOwnerProfile entity.asset.attribute.labels[managed_account_is_on_owner_profile]
    manufacturer entity.asset.hardware.manufacturer
    meid entity.asset.attribute.labels[meid]
    model entity.asset.hardware.model
    name entity.user.user_display_name
    networkOperator entity.asset.attribute.labels[network_operator]
    os entity.asset.platform_software.platform If the os log field value matches iOS, then the entity.asset.platform_software.platform UDM field is set to IOS.

    If the os log field value matches Android, then the entity.asset.platform_software.platform UDM field is set to ANDROID.

    Else, the entity.asset.platform_software.platform UDM field is set to UNKNOWN_PLATFORM.
    otherAccountsInfo[] entity.asset.attribute.labels[other_accounts_info]
    privilege entity.asset.attribute.labels[privilege]
    releaseVersion entity.asset.attribute.labels[release_version]
    resourceId entity.asset.product_object_id
    securityPatchLevel entity.asset.platform_software.platform_patch_level
    serialNumber entity.asset.hardware.serial_number
    status entity.user.user_authentication_status If the status log field value is equal to approved, then the entity.user.user_authentication_status UDM field is set to ACTIVE.

    If the status log field value is equal to unprovisined, then the entity.user.user_authentication_status UDM field is set to SUSPENDED.
    supportsWorkProfile entity.asset.attribute.labels[supports_work_profile]
    type entity.asset.attribute.labels[type]
    unknownSourcesStatus entity.asset.attribute.labels[unknown_sources_status]
    userAgent entity.asset.attribute.labels[user_agent]
    wifiMacAddress entity.asset.mac
    metadata.entity_type The metadata.entity_type UDM field is set to ASSET.
    metadata.product_name The metadata.product_name UDM field is set to WORKSPACE_MOBILE.
    metadata.vendor_name The metadata.vendor_name UDM field is set to GOOGLE.
    relations.entity_type The relations.entity_type UDM field is set to USER.
    relations.relationship The relations.relationship UDM field is set to MEMBER.

    Referência de mapeamento de campo: WORKSPACE_CHROMEOS

    A tabela a seguir lista os campos de registro do tipo WORKSPACE_CHROMEOS e os campos correspondentes do UDM.

    Log field UDM mapping Logic
    activeTimeRanges.activeTime entity.asset.attribute.labels[active_time]
    activeTimeRanges.date entity.asset.attribute.labels[active_time_range_date]
    annotatedAssetId entity.asset.asset_id If the annotatedAssetId log field value is not empty, then the ASSET ID: annotatedAssetId log field is mapped to the entity.asset.asset_id UDM field.
    deviceId entity.asset.asset_id If the annotatedAssetId log field value is empty, then the CHROMEOS:deviceId log field is mapped to the entity.asset.asset_id UDM field.
    annotatedLocation entity.asset.location.name
    annotatedUser relations.entity.user.user_display_name If the annotatedUser log field value is not empty and the annotatedUser log field value does not match the regular expression @, then the annotatedUser log field is mapped to the relations.entity.user.user_display_name UDM field.
    autoUpdateExpiration entity.asset.attribute.labels[auto_update_expiration]
    bootMode entity.asset.attribute.labels[boot_mode]
    cpuInfo.architecture entity.asset.attribute.labels[cpu_architecture]
    cpuInfo.logicalCpus.cStates.displayName entity.asset.attribute.labels[cpu_logical_cups_cstates_display_name]
    cpuInfo.logicalCpus.cStates.sessionDuration entity.asset.attribute.labels[cpu_logical_cups_cstates_session_duration]
    cpuInfo.logicalCpus.currentScalingFrequencyKhz entity.asset.attribute.labels[cpu_current_scaling_frequency]
    cpuInfo.logicalCpus.idleDuration entity.asset.attribute.labels[cpu_ideal_duration]
    cpuInfo.logicalCpus.maxScalingFrequencyKhz entity.asset.attribute.labels[cpu_max_scaling_frequency]
    cpuInfo.maxClockSpeedKhz entity.asset.attribute.labels[cpu_max_clock_speed]
    cpuInfo.model entity.asset.hardware.cpu_model
    cpuStatusReports.cpuTemperatureInfo.label entity.asset.attribute.labels[cpu_temperature_label]
    cpuStatusReports.cpuTemperatureInfo.temperature entity.asset.attribute.labels[cpu_temperature]
    cpuStatusReports.cpuUtilizationPercentageInfo entity.asset.attribute.labels[cpu_utilization_percentage_info]
    cpuStatusReports.reportTime entity.asset.attribute.labels[cpu_report_time]
    deviceFiles.createTime relations.entity.file.first_seen_time
    deviceFiles.downloadUrl relations.entity.file.full_path
    deviceFiles.name relations.entity.file.names
    deviceFiles.type relations.entity.file.mime_type
    relations.entity_type The relations.entity_type UDM field is set to FILE.
    relations.relationship The relations.relationship UDM field is set to MEMBER.
    deviceId entity.asset.product_object_id
    diskVolumeReports.volumeInfo.storageFree entity.asset.attribute.labels[volume_info_storage_free]
    diskVolumeReports.volumeInfo.storageTotal entity.asset.attribute.labels[volume_info_storage_total]
    diskVolumeReports.volumeInfo.volumeId entity.asset.attribute.labels[volume_id]
    dockMacAddress entity.asset.attribute.labels[dock_mac_address]
    etag entity.labels[etag] (deprecated)
    etag additional.fields[etag]
    ethernetMacAddress0 entity.asset.attribute.labels[ethernet_mac_address]
    firmwareVersion entity.asset.attribute.labels[firmware_version]
    kind entity.labels[kind] (deprecated)
    kind additional.fields[kind]
    lastEnrollmentTime entity.asset.last_discover_time
    lastKnownNetwork.ipAddress entity.asset.ip
    lastKnownNetwork.wanIpAddress entity.asset.nat_ip
    lastSync entity.asset.system_last_update_time
    macAddress entity.asset.mac
    ethernetMacAddress entity.asset.mac
    manufactureDate entity.asset.attribute.labels[manufacture_date]
    meid entity.asset.attribute.labels[meid]
    model entity.asset.hardware.model
    notes entity.asset.attribute.labels[notes]
    orderNumber entity.asset.attribute.labels[order_number]
    orgUnitId entity.asset.attribute.labels[org_unit_id]
    orgUnitPath entity.user.attribute.labels[org_unit_path]
    osVersion entity.asset.attribute.labels[os_version]
    platformVersion entity.asset.platform_software.platform_version
    annotatedUser entity.user.email_addresses If the annotatedUser log field value is not empty and the annotatedUser log field value matches the regular expression @, then the annotatedUser log field is mapped to the entity.user.email_addresses UDM field.
    recentUsers.email entity.user.email_addresses
    recentUsers.type relations.entity.user.attribute.roles.name
    relations.entity.user.attribute.roles.description If the recentUsers.type log field value is equal to USER_TYPE_MANAGED, then the relations.entity.user.attribute.roles.description UDM field is set to The user is managed by the domain.

    Else, if the recentUsers.type log field value is equal to USER_TYPE_UNMANAGED, then the relations.entity.user.attribute.roles.description UDM field is set to The user is not managed by the domain.
    screenshotFiles.createTime relations.entity.file.first_seen_time
    screenshotFiles.downloadUrl relations.entity.file.full_path
    screenshotFiles.name relations.entity.file.names
    screenshotFiles.type relations.entity.file.mime_type
    serialNumber entity.asset.hardware.serial_number
    status entity.asset.deployment_status If the status log field value is equal to DEPROVISIONED, then the entity.asset.deployment_status UDM field is set to DECOMMISSIONED.

    Else, the entity.asset.deployment_status UDM field is set to ACTIVE.
    supportEndDate entity.asset.attribute.labels[support_end_date]
    systemRamFreeReports.reportTime entity.asset.attribute.labels[system_ram_report_time]
    systemRamFreeReports.systemRamFreeInfo entity.asset.attribute.labels[system_ram_free_info]
    systemRamTotal entity.asset.hardware.ram
    tpmVersionInfo.family entity.asset.attribute.labels[tpm_ver_info_family]
    tpmVersionInfo.firmwareVersion entity.asset.attribute.labels[tpm_ver_info_firmware_version]
    tpmVersionInfo.manufacturer entity.asset.attribute.labels[tpm_ver_info_manufacturer]
    tpmVersionInfo.specLevel entity.asset.attribute.labels[tpm_ver_info_spec_level]
    tpmVersionInfo.tpmModel entity.asset.attribute.labels[tpm_ver_info_tpm_model]
    tpmVersionInfo.vendorSpecific entity.asset.attribute.labels[tpm_ver_info_vendor_specific]
    willAutoRenew entity.asset.attribute.labels[will_auto_renew]
    entity.asset.type The entity.asset.type UDM field is set to WORKSTATION.
    metadata.entity_type The metadata.entity_type UDM field is set to ASSET.
    metadata.product_name The metadata.product_name UDM field is set to ChromeOS.
    metadata.vendor_name The metadata.vendor_name UDM field is set to GOOGLE.
    relations.entity_type The relations.entity_type UDM field is set to USER.
    relations.relationship The relations.relationship UDM field is set to MEMBER.

    Referência de mapeamento de campo: WORKSPACE_PRIVILEGES

    A tabela a seguir lista os campos de registro do tipo WORKSPACE_PRIVILEGES e os campos correspondentes do UDM.

    Log field UDM mapping
    roleAssignments.assignedTo metadata.product_entity_id
    roleAssignments.roleAssignmentId entity.user.attribute.labels[role_assignment_id]
    roleAssignments.roleDetails.roleDescription entity.user.attribute.roles.description
    roleAssignments.roleDetails.roleId entity.user.attribute.labels[role_details_role_id]
    roleAssignments.roleDetails.roleName entity.user.attribute.roles.name
    roleAssignments.roleDetails.rolePrivileges.details.childPrivileges.etag
    roleAssignments.roleDetails.rolePrivileges.details.childPrivileges.isOuScopable
    roleAssignments.roleDetails.rolePrivileges.details.childPrivileges.kind
    roleAssignments.roleDetails.rolePrivileges.details.childPrivileges.privilegeName entity.user.attribute.labels[%{rolePrivilege.privilegeName}_CHILD_PRIVILEGES]
    roleAssignments.roleDetails.rolePrivileges.details.childPrivileges.serviceId
    roleAssignments.roleDetails.rolePrivileges.details.childPrivileges.serviceName
    roleAssignments.roleDetails.rolePrivileges.details.etag entity.labels[etag] (deprecated)
    roleAssignments.roleDetails.rolePrivileges.details.etag additional.fields[etag]
    roleAssignments.roleDetails.rolePrivileges.details.isOuScopable entity.user.attribute.labels[is_ou_scopable]
    roleAssignments.roleDetails.rolePrivileges.details.kind entity.labels[kind] (deprecated)
    roleAssignments.roleDetails.rolePrivileges.details.kind additional.fields[kind]
    roleAssignments.roleDetails.rolePrivileges.details.privilegeName
    roleAssignments.roleDetails.rolePrivileges.details.serviceId
    roleAssignments.roleDetails.rolePrivileges.details.serviceName entity.user.attribute.labels[service_name]
    roleAssignments.roleDetails.rolePrivileges.privilegeName entity.user.attribute.permissions.name
    roleAssignments.roleDetails.rolePrivileges.serviceId entity.user.attribute.permissions.description
    roleAssignments.roleId entity.user.attribute.labels[role_id]
    roleAssignments.scopeType entity.user.attribute.labels[scope_type]
    userId entity.user.userid
    metadata.vendor_name
    metadata.product_name
    metadata.entity_type

    A seguir