Google Workspace-Logs erfassen

Unterstützt in:

Google SecOps SIEM

In diesem Dokument wird beschrieben, wie Sie Google Workspace-Protokolle mithilfe von Google Security Operations-Feed und Zuordnung von Protokollfeldern zu Google Security Operations Unified Datenmodell-Felder (UDM) In diesem Dokument werden auch die unterstützten Logtypen und Ereignisse aufgeführt Typen für Google Workspace.

Weitere Informationen finden Sie unter Datenaufnahme in Google Security Operations.

Eine typische Bereitstellung umfasst Google Workspace und die Feed, der für das Senden von Protokollen an Google Security Operations konfiguriert ist. Jede Kundenimplementierung kann sich unterscheiden und komplexer sein.

Das Deployment enthält die folgenden Komponenten:

• Google Workspace Die Google Workspace-Plattform, von der Sie Protokolle erfassen.

• Google Security Operations-Feed Der Google Security Operations-Feed, der Protokolle abruft und schreibt Protokolle in Google Security Operations.

• Google Security Operations Google Security Operations speichert und analysiert die Logs Google Workspace

Ein Aufnahmelabel gibt den Parser an, der Logrohdaten normalisiert in das strukturierte UDM-Format. Die Informationen in diesem Dokument gelten für Google Workspace-Parser mit den folgenden Aufnahmelabels:

• WORKSPACE_ACTIVITY
• WORKSPACE_ALERTS
• WORKSPACE_CHROMEOS
• WORKSPACE_GROUPS
• WORKSPACE_MOBILE
• WORKSPACE_PRIVILEGES
• WORKSPACE_USERS

Hinweise

• Sie müssen Google Workspace Business Standard oder Business Plus verwenden, da der Google Workspace-Parser beide Versionen unterstützt.

• Sie benötigen ein Google Workspace-Administratorkonto.

• Aktivieren Sie die folgenden APIs in Ihrem Google Cloud-Projekt:

  • Google Workspace Admin SDK
  • Alert Center API

• Erstellen Sie zum Authentifizieren von Google Workspace APIs ein Dienstkonto in Ihrer Google Cloud Projekt erstellen und notieren Sie sich die eindeutige numerische ID und die E-Mail-Adresse des Dienstkontos. Weitere Informationen zum Erstellen eines Dienstkontos finden Sie unter Dienstkonten erstellen und verwalten.

• Erstellen Sie einen Nutzer, der die Identität des Dienstkontos übernimmt, und gewähren Sie ihm dann Berechtigungen:

  1. Melden Sie sich in der Admin-Konsole an.
  2. Wählen Sie Verzeichnis > Nutzer aus und klicken Sie dann auf Neuen Nutzer hinzufügen.
  3. Geben Sie die Nutzerdetails ein.
  4. Klicken Sie auf Neuen Nutzer hinzufügen.
  5. Klicken Sie auf den Link zum neu erstellten Nutzer und dann auf Administratorrollen und -berechtigungen.
  6. Klicken Sie auf Weniger maximieren.
  7. Klicken Sie auf Benutzerdefinierte Rolle erstellen.
  8. Klicke auf Neue Rolle erstellen und gib dieser Rolle einen Namen.
  9. Gewähren Sie der Rolle die folgenden Berechtigungen:
     • Berechtigungen > Berichte
     • Berechtigungen > Dienste > Benachrichtigungszentrale > Vollzugriff > Lesezugriff
     • Berechtigungen > Dienste > Mobilgeräteverwaltung > Geräte und Einstellungen verwalten
     • Berechtigungen > Dienste > Chrome Management > Einstellungen
     • Admin API > Berechtigungen > Nutzer > Gelesen
     • Admin API > Berechtigungen > Gruppen > Gelesen
  10. Klicken Sie auf Weiter und dann auf Rolle erstellen.
  11. Klicken Sie auf Nutzer zuweisen.
  12. Wählen Sie den Nutzer aus, dem Sie die Rolle zuweisen möchten.
  13. Klicken Sie auf Rolle zuweisen.

• Erstellen Sie Anmeldedaten für den Zugriff. Weitere Informationen zum Erstellen von Anmeldedaten Siehe Dienstkontoschlüssel erstellen.

  Hinweis: Dienstkontoschlüssel stellen ein Sicherheitsrisiko dar, wenn sie nicht ordnungsgemäß verwaltet werden. Sie sind für die Sicherheit des privaten Schlüssels und für andere Vorgänge verantwortlich, die unter Best Practices für die Verwaltung von Dienstkontoschlüsseln beschrieben werden. Wenn Sie keinen Dienstkontoschlüssel erstellen können, ist das Erstellen von Dienstkontoschlüsseln für Ihre Organisation möglicherweise deaktiviert. Weitere Informationen finden Sie unter Standardmäßig sichere Organisationsressourcen verwalten.

• Autorisieren Sie für den Zugriff auf Daten die domainweite Delegierung für das Dienstkonto mit die folgenden Bereiche:

  • https://www.googleapis.com/auth/admin.reports.audit.readonly
  • https://www.googleapis.com/auth/apps.alerts
  • https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly
  • https://www.googleapis.com/auth/admin.directory.group.readonly
  • https://www.googleapis.com/auth/admin.directory.device.mobile.readonly
  • https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly
  • https://www.googleapis.com/auth/admin.directory.user.readonly

• Sie finden die Google Workspace-Kundennummer in der Admin-Konsole. Wählen Sie Konto > Kontoeinstellungen > Profil aus.

• Achten Sie darauf, dass alle Systeme in der Bereitstellungsarchitektur konfiguriert sind in der Zeitzone UTC angegeben.

• Prüfen Sie die Logtypen, die der Google Security Operations-Parser unterstützt. Informationen zu unterstützten Google Workspace-Logs finden Sie unter Unterstützte Google Workspace-Logtypen.

Konfigurieren Sie einen Feed in Google Security Operations, um Google Workspace-Protokolle aufzunehmen

1. Wählen Sie in der Navigationsleiste Einstellungen > SIEM-Einstellungen > Feeds:
2. Klicken Sie auf Add new (Neuen Eintrag hinzufügen).
3. Wählen Sie als Source Type (Quelltyp) die Option Third Party API aus.
4. Um einen Feed für Arbeitsbereichsaktivitäten zu erstellen, wählen Sie Workspace Activity (Arbeitsbereichsaktivitäten) als Log Type (Protokolltyp) aus.
5. Klicken Sie auf Weiter.

6. Geben Sie Werte basierend auf der von Ihnen erstellten Google Workspace-Konfiguration an für die folgenden Felder:

   • OAuth-JWT-Endpunkt. Der Endpunkt, der das OAuth JSON Web Token enthält. Geben Sie den Wert token_uri aus dem JSON-Schlüssel des Dienstkontos an.
   • Aussteller von JWT-Anforderungen. Das ist die Kunden-ID. client_email-Wert angeben aus dem JSON-Schlüssel des Dienstkontos. Zum Beispiele [e-mail]
   • Betreff der JWT-Anforderungen. Geben Sie die E-Mail-Adresse des Nutzers an, den Sie in der Google Workspace-Admin-Konsole erstellt haben.
   • Zielgruppe mit JWT-Anforderungen. Geben Sie den Wert token_uri aus dem JSON-Schlüssel des Dienstkontos an.

   • Privater RSA-Schlüssel: Ein privater RSA-Schlüssel im PEM-Format. Der PEM-Schlüssel ist verfügbar in der Schlüsseldatei des Dienstkontos. Geben Sie bei der Eingabe des privaten Schlüssels den Parameter BEGIN PRIVATE KEY- und die END PRIVATE KEY-Fußzeile und ersetzen alle Instanzen des \n-Tokens mit einem tatsächlichen Enter-Tastenanschlag im Textfeld.

   • Kundennummer. Für alle Logtypen mit Ausnahme des Logtyps „Benachrichtigungen“ die Kundennummer erfordert ein vorangestelltes "C". Zeichen. Wenn im Feld für die Kundennummer ein vorangestelltes "C" und stellen Sie dem Wert dann ein "C" voran. Zeichen.

   • Anwendungen. Das Feld Applications (Anwendungen) ist nur erforderlich, wenn Sie einen Feed für Workspace-Aktivitäten.

7. Klicken Sie auf Weiter und dann auf Senden.

8. Nachdem Sie die Schritte zum Erstellen eines Feeds für Workspace-Aktivitäten abgeschlossen haben, wiederholen Sie den Vorgang. die Schritte zum Erstellen eines separaten Feeds für jeden der folgenden Logtypen.

   • Workspace Alerts
   • Workspace ChromeOS Devices
   • Workspace Groups
   • Workspace Mobile Devices
   • Workspace Privileges
   • Workspace Users

Weitere Informationen zu Google Security Operations-Feeds finden Sie in der Dokumentation zu Google Security Operations-Feeds. Informationen zu den Anforderungen für die einzelnen finden Sie unter Feedkonfiguration nach Typ.

Wenn beim Erstellen von Feeds Probleme auftreten, wenden Sie sich an den Google Security Operations-Support.

Unterstützte Google Workspace-Protokolltypen

In den folgenden Abschnitten sind die Logtypen aufgeführt, die vom Google Workspace-Parser unterstützt werden:

WORKSPACE_ACTIVITY

In der folgenden Tabelle sind die unterstützten Anwendungsnamen und Ereignistypen für WORKSPACE_ACTIVITY aufgeführt Logtyp.

Name der Anwendung	Ereignistyp
access_transparency	GSUITE_RESOURCE
chrome	CHROME_OS_ADD_REMOVE_USER_TYPE
	DEVICE_BOOT_STATE_CHANGE_TYPE
	CHROME_OS_LOGIN_LOGOUT_TYPE
	CHROME_OS_REPORTING_DATA_LOST_TYPE
	SAFE_BROWSING_PASSWORD_ALERT
	DLP_EVENTS_TYPE
	CONTENT_TRANSFER_TYPE
	CONTENT_UNSCANNED_TYPE
	EXTENSION_REQUEST_TYPE
	LOGIN_EVENT_TYPE
	MALWARE_TRANSFER_TYPE
	PASSWORD_BREACH_TYPE
	SENSITIVE_DATA_TRANSFER_TYPE
	UNSAFE_SITE_VISIT_TYPE
context_aware_access	CONTEXT_AWARE_ACCESS_USER_EVENT
gplus	comment_change
	plusone_change
	poll_vote_change
	post_change
data_studio	ACCESS
	ACL_CHANGE
mobile	device_applications
	device_updates
	suspicious_activity
groups_enterprise	moderator_action
calendar	calendar_change
	notification
	subscription_change
	event_change
	interop
chat	user_action
gcp	CLOUD_OSLOGIN
drive	access
	acl_change
	pooled_quota_metadata
groups	acl_change
	moderator_action
keep	user_action
meet	call
token	auth
rules	action_complete_type
	rule_match_type
	rule_trigger_type
saml	login
user_accounts	2sv_change
	password_change
	recovery_info_change
	titanium_change
	email_forwarding_change
login	2sv_change
	password_change
	recovery_info_change
	account_warning
	titanium_change
	email_forwarding_change
jamboard	administrative_action
	setting_change
	status_change
admin	USER_SETTINGS

Weitere Informationen zu den von Google Security Operations unterstützten Google Workspace-Anwendungen Siehe Google Workspace-Anwendungen.

WORKSPACE_ALERTS

Im Folgenden sind die unterstützten Benachrichtigungstypen aufgeführt:

• Customer takeout initiated
• Malware reclassification
• Misconfigured whitelist
• Phishing reclassification
• Suspicious message reported
• User reported phishing
• User reported spam spike
• Leaked password
• Suspicious login
• Suspicious login (less secure app)
• Suspicious programmatic login
• User suspended
• User suspended (spam)
• User suspended (spam through relay)
• User suspended (suspicious activity)
• Google Operations
• Configuration problem
• Government attack warning
• Device compromised
• Suspicious activity
• AppMaker Default Cloud SQL setup
• Activity Rule
• Data Loss Prevention
• Apps outage
• Primary admin changed
• SSO profile added
• SSO profile updated
• SSO profile deleted
• Super admin password reset

WORKSPACE_CHROMEOS

Informationen zum unterstützten ChromeOS-Protokollschema finden Sie unter ChromeOS-Geräte.

WORKSPACE_GROUPS

Informationen zum unterstützten Gruppenprotokollschema finden Sie unter group.

WORKSPACE_MOBILE

Informationen zum unterstützten Protokollschema für Mobilgeräte finden Sie unter mobile.

WORKSPACE_PRIVILEGES

Informationen zum unterstützten Logschema für Berechtigungen finden Sie unter Berechtigungen.

WORKSPACE_USERS

Informationen zum unterstützten Protokollschema für Nutzer finden Sie unter Nutzer.

Feldzuordnungsreferenz

In den folgenden Abschnitten wird erläutert, wie der Google Security Operations-Parser Google Workspace ordnet. Protokollfeldern in Google Security Operations Unified Data Model-Felder (UDM) ein. Die Feldzuordnungen dieses Parsers bleiben für die feedbasierte Aufnahme und die native Aufnahme gleich.

Referenz für die Feldzuordnung: Protokolltypen für WORKSPACE_ACTIVITY zum UDM-Ereignistyp

Hinweis :Wenn Sie Logs der gmail-Anwendung (WORKSPACE_ACTIVITY) aufnehmen möchten, verknüpfen Sie Google Workspace mit Ihrer Google Security Operations-Instanz. Sie können die Feedverwaltung nicht verwenden, um gmail-Anwendungslogs aufzunehmen.

In der folgenden Tabelle sind die WORKSPACE_ACTIVITY-Logtypen und die zugehörigen UDM-Ereignistypen aufgeführt.

Workspace application	Event identifier	Event type
access_transparency	ACCESS	USER_RESOURCE_ACCESS
chrome	CHROME_OS_ADD_USER	USER_CREATION
chrome	CHROME_OS_REMOVE_USER	USER_DELETION
chrome	DEVICE_BOOT_STATE_CHANGE	SETTING_MODIFICATION
chrome	CHROME_OS_LOGIN_FAILURE_EVENT	USER_LOGIN
chrome	CHROME_OS_LOGIN_LOGOUT_EVENT	USER_LOGIN
chrome	CHROME_OS_LOGIN_EVENT	USER_LOGIN
chrome	CHROME_OS_LOGOUT_EVENT	USER_LOGOUT
chrome	CHROME_OS_REPORTING_DATA_LOST	STATUS_UPDATE
chrome	PASSWORD_CHANGED	USER_CHANGE_PASSWORD
chrome	PASSWORD_REUSE	USER_UNCATEGORIZED
chrome	DLP_EVENT	USER_UNCATEGORIZED
chrome	CONTENT_TRANSFER	STATUS_UNCATEGORIZED
chrome	CONTENT_UNSCANNED	SCAN_UNCATEGORIZED
chrome	EXTENSION_REQUEST	USER_UNCATEGORIZED
chrome	LOGIN_EVENT	USER_LOGIN
chrome	MALWARE_TRANSFER	SCAN_UNCATEGORIZED. The security category is SOFTWARE_MALICIOUS.
chrome	PASSWORD_BREACH	USER_RESOURCE_ACCESS. The security category is PHISHING.
chrome	SENSITIVE_DATA_TRANSFER	SCAN_UNCATEGORIZED
chrome	UNSAFE_SITE_VISIT	NETWORK_UNCATEGORIZED. The security category is NETWORK_SUSPICIOUS.
chrome	BROWSER_CRASH	STATUS_UNCATEGORIZED
chrome	BROWSER_EXTENSION_INSTALL	USER_RESOURCE_UPDATE_CONTENT
chrome	CHROMEOS_AFFILIATED_LOCK_SUCCESS	USER_LOGOUT
chrome	CHROMEOS_AFFILIATED_UNLOCK_FAILURE	USER_LOGIN
chrome	CHROMEOS_AFFILIATED_UNLOCK_SUCCESS	USER_LOGIN
chrome	CHROMEOS_PERIPHERAL_ADDED	USER_RESOURCE_ACCESS
chrome	CHROMEOS_PERIPHERAL_REMOVED	USER_RESOURCE_DELETION
chrome	CHROMEOS_PERIPHERAL_STATUS_UPDATED	USER_RESOURCE_UPDATE_CONTENT
chrome	CHROMEOS_UPDATE_FAILURE	STATUS_UNCATEGORIZED
chrome	CHROMEOS_UPDATE_SUCCESS	STATUS_UNCATEGORIZED
chrome	CHROME_OS_CRD_CLIENT_CONNECTED	USER_LOGIN
chrome	CHROME_OS_CRD_HOST_ENDED	STATUS_STARTUP
chrome	CHROME_OS_CRD_HOST_STARTED	STATUS_STARTUP
chrome	URL_FILTERING_INTERSTITIAL	STATUS_UNCATEGORIZED
context_aware_access	ACCESS_DENY_EVENT	USER_RESOURCE_ACCESS
context_aware_access	ACCESS_DENY_INTERNAL_ERROR_EVENT	USER_RESOURCE_ACCESS
context_aware_access	MONITOR_MODE_ACCESS_DENY_EVENT	USER_RESOURCE_ACCESS
gplus	create_comment	USER_RESOURCE_CREATION
gplus	delete_comment	USER_RESOURCE_DELETION
gplus	edit_comment	USER_RESOURCE_UPDATE_CONTENT
gplus	add_plusone	STATUS_UPDATE
gplus	remove_plusone	STATUS_UPDATE
gplus	add_poll_vote	STATUS_UPDATE
gplus	remove_poll_vote	STATUS_UPDATE
gplus	create_post	USER_RESOURCE_CREATION
gplus	delete_post	USER_RESOURCE_DELETION
gplus	content_manager_delete_post	USER_RESOURCE_DELETION
gplus	edit_post	USER_RESOURCE_UPDATE_CONTENT
data_studio	ADD_REPORT_EMAIL_DELIVERY	USER_UNCATEGORIZED
data_studio	CREATE	USER_RESOURCE_CREATION
data_studio	DATA_EXPORT	USER_RESOURCE_ACCESS
data_studio	DELETE	USER_RESOURCE_DELETION
data_studio	DOWNLOAD_REPORT	USER_UNCATEGORIZED
data_studio	EDIT	USER_RESOURCE_UPDATE_CONTENT
data_studio	RESTORE	USER_RESOURCE_CREATION
data_studio	STOP_REPORT_EMAIL_DELIVERY	USER_UNCATEGORIZED
data_studio	TRASH	USER_RESOURCE_DELETION
data_studio	UPDATE_REPORT_EMAIL_DELIVERY	USER_UNCATEGORIZED
data_studio	VIEW	USER_RESOURCE_ACCESS
data_studio	CHANGE_DATA_SOURCE_ACCESS_TYPE	USER_RESOURCE_UPDATE_PERMISSIONS
data_studio	CHANGE_ASSET_LINK_SHARING_ACCESS_TYPE	USER_RESOURCE_UPDATE_PERMISSIONS
data_studio	CHANGE_ASSET_LINK_SHARING_VISIBILITY	USER_RESOURCE_UPDATE_PERMISSIONS
data_studio	CHANGE_USER_ACCESS	USER_CHANGE_PERMISSIONS
mobile	APPLICATION_EVENT	USER_RESOURCE_UPDATE_CONTENT
mobile	APPLICATION_REPORT_EVENT	STATUS_UPDATE
mobile	DEVICE_REGISTER_UNREGISTER_EVENT	USER_RESOURCE_UPDATE_PERMISSIONS
mobile	ADVANCED_POLICY_SYNC_EVENT	STATUS_UPDATE
mobile	DEVICE_ACTION_EVENT	USER_RESOURCE_UPDATE_CONTENT
mobile	DEVICE_COMPLIANCE_CHANGED_EVENT	STATUS_UPDATE
mobile	OS_UPDATED_EVENT	USER_RESOURCE_UPDATE_CONTENT
mobile	DEVICE_OWNERSHIP_CHANGE_EVENT	STATUS_UPDATE
mobile	DEVICE_SETTINGS_UPDATED_EVENT	SETTING_MODIFICATION
mobile	APPLE_DEP_DEVICE_UPDATE_ON_APPLE_PORTAL_EVENT	STATUS_UPDATE
mobile	DEVICE_SYNC_EVENT	USER_RESOURCE_UPDATE_CONTENT
mobile	RISK_SIGNAL_UPDATED_EVENT	STATUS_UPDATE
mobile	ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT	STATUS_UPDATE
mobile	DEVICE_COMPROMISED_EVENT	STATUS_UPDATE
mobile	FAILED_PASSWORD_ATTEMPTS_EVENT	STATUS_UPDATE
mobile	SUSPICIOUS_ACTIVITY_EVENT	STATUS_UPDATE
groups_enterprise	accept_invitation	USER_UNCATEGORIZED
groups_enterprise	add_info_setting	GROUP_MODIFICATION
groups_enterprise	add_member	GROUP_MODIFICATION
groups_enterprise	add_member_role	USER_CHANGE_PERMISSIONS
groups_enterprise	add_security_setting	GROUP_MODIFICATION
groups_enterprise	add_service_account_permission	USER_CHANGE_PERMISSIONS
groups_enterprise	approve_join_request	USER_UNCATEGORIZED
groups_enterprise	ban_member_with_moderation	GROUP_MODIFICATION
groups_enterprise	change_info_setting	GROUP_MODIFICATION
groups_enterprise	change_security_setting	GROUP_MODIFICATION
groups_enterprise	create_group	GROUP_CREATION
groups_enterprise	create_namespace	GROUP_UNCATEGORIZED
groups_enterprise	delete_group	GROUP_DELETION
groups_enterprise	delete_namespace	GROUP_UNCATEGORIZED
groups_enterprise	add_dynamic_group_query	GROUP_UNCATEGORIZED
groups_enterprise	change_dynamic_group_query	GROUP_MODIFICATION
groups_enterprise	invite_member	GROUP_UNCATEGORIZED
groups_enterprise	join	GROUP_MODIFICATION
groups_enterprise	add_membership_expiry	GROUP_MODIFICATION
groups_enterprise	remove_membership_expiry	GROUP_MODIFICATION
groups_enterprise	update_membership_expiry	GROUP_MODIFICATION
groups_enterprise	reject_invitation	USER_UNCATEGORIZED
groups_enterprise	reject_join_request	USER_UNCATEGORIZED
groups_enterprise	remove_info_setting	GROUP_MODIFICATION
groups_enterprise	remove_member	GROUP_MODIFICATION
groups_enterprise	remove_member_role	GROUP_MODIFICATION
groups_enterprise	remove_security_setting	GROUP_MODIFICATION
groups_enterprise	remove_service_account_permission	GROUP_MODIFICATION
groups_enterprise	request_to_join	USER_UNCATEGORIZED
groups_enterprise	revoke_invitation	USER_UNCATEGORIZED
groups_enterprise	unban_member	GROUP_MODIFICATION
calendar	change_calendar_acls	USER_CHANGE_PERMISSIONS
calendar	change_calendar_country	USER_RESOURCE_UPDATE_CONTENT
calendar	create_calendar	USER_RESOURCE_CREATION
calendar	delete_calendar	USER_RESOURCE_DELETION
calendar	change_calendar_description	USER_RESOURCE_UPDATE_CONTENT
calendar	change_calendar_location	USER_RESOURCE_UPDATE_CONTENT
calendar	change_calendar_timezone	USER_RESOURCE_UPDATE_CONTENT
calendar	change_calendar_title	USER_RESOURCE_UPDATE_CONTENT
calendar	notification_triggered	USER_UNCATEGORIZED
calendar	add_subscription	USER_UNCATEGORIZED
calendar	delete_subscription	STATUS_UPDATE
calendar	create_event	USER_RESOURCE_UPDATE_CONTENT
calendar	delete_event	USER_RESOURCE_UPDATE_CONTENT
calendar	add_event_guest	USER_RESOURCE_UPDATE_CONTENT
calendar	change_event_guest_response_auto	USER_UNCATEGORIZED
calendar	remove_event_guest	USER_RESOURCE_UPDATE_CONTENT
calendar	change_event_guest_response	USER_RESOURCE_UPDATE_CONTENT
calendar	change_event	USER_RESOURCE_UPDATE_CONTENT
calendar	remove_event_from_trash	USER_RESOURCE_UPDATE_CONTENT
calendar	restore_event	USER_RESOURCE_UPDATE_CONTENT
calendar	change_event_start_time	USER_RESOURCE_UPDATE_CONTENT
calendar	change_event_title	USER_RESOURCE_UPDATE_CONTENT
calendar	transfer_event_requested	USER_UNCATEGORIZED
calendar	transfer_event_completed	USER_UNCATEGORIZED
calendar	interop_freebusy_lookup_outbound_successful	USER_RESOURCE_ACCESS
calendar	interop_freebusy_lookup_inbound_successful	USER_RESOURCE_ACCESS
calendar	interop_exchange_resource_availability_lookup_successful	USER_RESOURCE_ACCESS
calendar	interop_exchange_resource_list_lookup_successful	USER_RESOURCE_ACCESS
calendar	interop_freebusy_lookup_outbound_unsuccessful	USER_RESOURCE_ACCESS
calendar	interop_freebusy_lookup_inbound_unsuccessful	USER_RESOURCE_ACCESS
calendar	interop_exchange_resource_availability_lookup_unsuccessful	USER_RESOURCE_ACCESS
calendar	interop_exchange_resource_list_lookup_unsuccessful	USER_RESOURCE_ACCESS
chat	add_room_member	GROUP_MODIFICATION
chat	attachment_download	FILE_UNCATEGORIZED
chat	attachment_upload	FILE_UNCATEGORIZED
chat	block_room	GROUP_UNCATEGORIZED
chat	block_user	USER_UNCATEGORIZED
chat	direct_message_started	USER_UNCATEGORIZED
chat	invite_accept	USER_UNCATEGORIZED
chat	invite_decline	USER_UNCATEGORIZED
chat	invite_send	USER_UNCATEGORIZED
chat	message_edited	USER_RESOURCE_UPDATE_CONTENT
chat	message_posted	USER_RESOURCE_CREATION
chat	message_reported	USER_UNCATEGORIZED
chat	message_deleted	USER_RESOURCE_DELETION
chat	remove_room_member	GROUP_MODIFICATION
chat	room_created	GROUP_CREATED
chat	reaction_added	USER_UNCATEGORIZED
chat	call_ended	USER_UNCATEGORIZED
chat	presentation_started	STATUS_UNCATEGORIZED
chat	invitation_sent	STATUS_UNCATEGORIZED
chat	presentation_stopped	STATUS_UNCATEGORIZED
gcp	IMPORT_SSH_PUBLIC_KEY	USER_UNCATEGORIZED
gcp	DELETE_POSIX_ACCOUNT	USER_UNCATEGORIZED
gcp	DELETE_SSH_PUBLIC_KEY	USER_UNCATEGORIZED
gcp	GET_SSH_PUBLIC_KEY	USER_UNCATEGORIZED
gcp	GET_LOGIN_PROFILE	USER_UNCATEGORIZED
gcp	UPDATE_SSH_PUBLIC_KEY	USER_UNCATEGORIZED
drive	add_to_folder	USER_RESOURCE_CREATION
drive	approval_canceled	USER_UNCATEGORIZED
drive	approval_comment_added	USER_UNCATEGORIZED
drive	approval_completed	USER_UNCATEGORIZED
drive	approval_decisions_reset	USER_UNCATEGORIZED
drive	approval_due_time_change	USER_UNCATEGORIZED
drive	approval_requested	USER_UNCATEGORIZED
drive	approval_reviewer_change	USER_UNCATEGORIZED
drive	approval_reviewer_responded	USER_UNCATEGORIZED
drive	copy	USER_RESOURCE_CREATION
drive	create	USER_RESOURCE_CREATION
drive	delete	USER_RESOURCE_DELETION
drive	download	USER_RESOURCE_ACCESS
drive	email_as_attachment	EMAIL_TRANSACTION
drive	edit	USER_RESOURCE_UPDATE_CONTENT
drive	label_added	USER_UNCATEGORIZED
drive	label_added_by_item_create	USER_UNCATEGORIZED
drive	label_field_changed	USER_UNCATEGORIZED
drive	label_removed	USER_UNCATEGORIZED
drive	add_lock	USER_UNCATEGORIZED
drive	move	USER_UNCATEGORIZED
drive	preview	USER_RESOURCE_ACCESS
drive	print	USER_UNCATEGORIZED
drive	remove_from_folder	USER_RESOURCE_DELETION
drive	rename	USER_RESOURCE_UPDATE_CONTENT
drive	untrash	USER_RESOURCE_CREATION
drive	sheets_import_range	USER_RESOURCE_ACCESS
drive	source_copy	USER_RESOURCE_UPDATE_CONTENT
drive	trash	USER_RESOURCE_DELETION
drive	remove_lock	USER_UNCATEGORIZED
drive	unmovable_item_reparented	USER_UNCATEGORIZED
drive	upload	USER_RESOURCE_CREATION
drive	view	USER_RESOURCE_ACCESS
drive	connected_sheets_query	USER_RESOURCE_ACCESS
drive	accept_suggestion	USER_RESOURCE_UPDATE_CONTENT
drive	create_comment	USER_RESOURCE_CREATION
drive	create_suggestion	USER_RESOURCE_CREATION
drive	delete_comment	USER_RESOURCE_DELETION
drive	delete_suggestion	USER_RESOURCE_DELETION
drive	edit_comment	USER_RESOURCE_UPDATE_CONTENT
drive	expire_access_request	USER_RESOURCE_UPDATE_PERMISSIONS
drive	reassign_comment	USER_RESOURCE_UPDATE_CONTENT
drive	reject_suggestion	USER_RESOURCE_UPDATE_CONTENT
drive	reopen_comment	USER_RESOURCE_UPDATE_CONTENT
drive	request_access	USER_RESOURCE_UPDATE_PERMISSIONS
drive	resolve_comment	USER_RESOURCE_UPDATE_CONTENT
drive	deny_access_request	USER_UNCATEGORIZED
drive	download_forms_response	USER_RESOURCE_ACCESS
drive	email_collaborators	EMAIL_UNCATEGORIZED
drive	access_url	USER_RESOURCE_ACCESS
drive	access_item_content	USER_RESOURCE_ACCESS
drive	sheets_import_url	USER_UNCATEGORIZED
drive	apply_security_update	USER_RESOURCE_UPDATE_PERMISSIONS
drive	shared_drive_apply_security_update	USER_RESOURCE_UPDATE_PERMISSIONS
drive	shared_drive_remove_security_update	USER_RESOURCE_UPDATE_PERMISSIONS
drive	publish_change	USER_RESOURCE_UPDATE_PERMISSIONS
drive	change_acl_editors	USER_RESOURCE_UPDATE_PERMISSIONS
drive	change_document_access_scope	USER_RESOURCE_UPDATE_PERMISSIONS
drive	change_document_access_scope_hierarchy_reconciled	USER_RESOURCE_UPDATE_PERMISSIONS
drive	change_document_visibility	USER_RESOURCE_UPDATE_PERMISSIONS
drive	change_document_visibility_hierarchy_reconciled	USER_RESOURCE_UPDATE_PERMISSIONS
drive	remove_security_update	USER_RESOURCE_UPDATE_PERMISSIONS
drive	shared_drive_membership_change	USER_RESOURCE_UPDATE_PERMISSIONS
drive	shared_drive_settings_change	USER_RESOURCE_UPDATE_PERMISSIONS
drive	sheets_import_range_access_change	USER_RESOURCE_UPDATE_PERMISSIONS
drive	change_user_access	USER_CHANGE_PERMISSIONS
drive	change_user_access_hierarchy_reconciled	USER_CHANGE_PERMISSIONS
drive	change_owner	USER_CHANGE_PERMISSIONS
drive	publish_new_version	USER_UNCATEGORIZED
drive	change_owner_hierarchy_reconciled	USER_CHANGE_PERMISSIONS
drive	team_drive_membership_change	USER_CHANGE_PERMISSIONS
drive	team_drive_settings_change	USER_CHANGE_PERMISSIONS
drive	storage_usage_update	USER_RESOURCE_ACCESS
groups	change_acl_permission	GROUP_MODIFICATION
groups	accept_invitation	USER_UNCATEGORIZED
groups	approve_join_request	USER_UNCATEGORIZED
groups	join	GROUP_MODIFICATION
groups	request_to_join	USER_UNCATEGORIZED
groups	change_basic_setting	GROUP_MODIFICATION
groups	create_group	GROUP_CREATION
groups	delete_group	GROUP_DELETION
groups	change_identity_setting	GROUP_MODIFICATION
groups	add_info_setting	GROUP_MODIFICATION
groups	change_info_setting	GROUP_MODIFICATION
groups	remove_info_setting	GROUP_MODIFICATION
groups	change_new_members_restrictions_setting	GROUP_UNCATEGORIZED
groups	change_post_replies_setting	GROUP_MODIFICATION
groups	change_spam_moderation_setting	GROUP_MODIFICATION
groups	change_topic_setting	GROUP_MODIFICATION
groups	moderate_message	GROUP_MODIFICATION
groups	always_post_from_user	USER_UNCATEGORIZED
groups	add_user	GROUP_MODIFICATION
groups	ban_user_with_moderation	GROUP_MODIFICATION
groups	revoke_invitation	USER_UNCATEGORIZED
groups	invite_user	USER_UNCATEGORIZED
groups	reject_join_request	USER_UNCATEGORIZED
groups	reinvite_user	USER_UNCATEGORIZED
groups	remove_user	GROUP_MODIFICATION
groups	change_email_subscription_type	GROUP_MODIFICATION
groups	unsubscribe_via_mail	USER_UNCATEGORIZED
keep	deleted_attachment	USER_UNCATEGORIZED
keep	uploaded_attachment	USER_UNCATEGORIZED
keep	edited_note_content	USER_RESOURCE_UPDATE_CONTENT
keep	created_note	USER_RESOURCE_CREATION
keep	deleted_note	USER_RESOURCE_DELETION
keep	modified_acl	USER_RESOURCE_UPDATE_PERMISSIONS
meet	abuse_report_submitted	USER_UNCATEGORIZED
meet	call_ended	USER_UNCATEGORIZED
meet	livestream_watched	USER_COMMUNICATION
meet	invitation_sent	STATUS_UNCATEGORIZED
meet	presentation_started	STATUS_UNCATEGORIZED
meet	presentation_stopped	STATUS_UNCATEGORIZED
meet	knocking_denied	STATUS_UNCATEGORIZED
meet	knocking_accepted	STATUS_UNCATEGORIZED
meet	recording_activity	STATUS_UNCATEGORIZED
meet	dialed_out	STATUS_UNCATEGORIZED
token	activity	USER_RESOURCE_ACCESS
token	authorize	USER_RESOURCE_ACCESS
token	revoke	USER_RESOURCE_UPDATE_PERMISSIONS
rules	action_complete	USER_RESOURCE_ACCESS
rules	rule_match	USER_RESOURCE_ACCESS
rules	rule_trigger	USER_RESOURCE_ACCESS
rules	label_field_value_changed	USER_RESOURCE_UPDATE_CONTENT
rules	label_applied	USER_RESOURCE_UPDATE_CONTENT
rules	sharing_blocked	USER_RESOURCE_UPDATE_CONTENT
rules	content_matched	USER_RESOURCE_ACCESS
rules	content_unmatched	USER_RESOURCE_ACCESS
saml	login_failure	USER_LOGIN
saml	login_success	USER_LOGIN
user_accounts	2sv_disable	USER_UNCATEGORIZED
user_accounts	2sv_enroll	USER_UNCATEGORIZED
user_accounts	password_edit	USER_UNCATEGORIZED
user_accounts	recovery_email_edit	USER_UNCATEGORIZED
user_accounts	recovery_phone_edit	USER_UNCATEGORIZED
user_accounts	recovery_secret_qa_edit	USER_UNCATEGORIZED
user_accounts	titanium_enroll	USER_UNCATEGORIZED
user_accounts	titanium_unenroll	USER_UNCATEGORIZED
user_accounts	email_forwarding_out_of_domain	USER_UNCATEGORIZED
jamboard	DEVICE_LICENSE_ENROLLMENT_CHANGE	SETTING_MODIFICATION
jamboard	DEVICE_OTA_UPDATE_REQUESTED	SETTING_MODIFICATION
jamboard	DEVICE_PROVISIONING_CHANGE	SETTING_MODIFICATION
jamboard	DEVICE_REBOOT_REQUESTED	USER_UNCATEGORIZED
jamboard	EXPORT_JAMBOARD_FLEET	USER_UNCATEGORIZED
jamboard	ADB_ENABLED_STATE_CHANGE	SETTING_MODIFICATION
jamboard	DEVICE_ADDITIONAL_IMES_CHANGE	SETTING_MODIFICATION
jamboard	DEVICE_LOGGING_CHANGE	SETTING_MODIFICATION
jamboard	DEMO_MODE_AVAILABILITY_CHANGE	SETTING_MODIFICATION
jamboard	DEMO_MODE_CHANGE	SETTING_MODIFICATION
jamboard	FINGER_ERASING_CHANGE	SETTING_MODIFICATION
jamboard	DEVICE_LANGUAGE_CHANGE	SETTING_MODIFICATION
jamboard	DEVICE_LOCATION_CHANGE	STATUS_UPDATE
jamboard	DEVICE_NAME_CHANGE	STATUS_UPDATE
jamboard	DEVICE_NOTE_CHANGE	STATUS_UPDATE
jamboard	DEVICE_PAIRING_CHANGE	SETTING_MODIFICATION
jamboard	SCREENSAVER_TIMEOUT_CHANGE	SETTING_MODIFICATION
jamboard	DEVICE_SETTING_LOCKED	SETTING_MODIFICATION
jamboard	DEVICE_SETTING_UNLOCKED	SETTING_MODIFICATION
jamboard	VIDEOCONF_ENABLED_CHANGE	SETTING_MODIFICATION
jamboard	DEVICE_UPDATE	STATUS_UPDATE
login	2sv_disable	SERVICE_STOP
login	2sv_enroll	SERVICE_START
login	password_edit	USER_CHANGE_PASSWORD
login	recovery_email_edit	USER_UNCATEGORIZED
login	recovery_phone_edit	USER_UNCATEGORIZED
login	recovery_secret_qa_edit	USER_UNCATEGORIZED
login	account_disabled_password_leak	USER_UNCATEGORIZED
login	suspicious_login	USER_LOGIN
login	suspicious_login_less_secure_app	USER_LOGIN
login	suspicious_programmatic_login	USER_LOGIN
login	account_disabled_generic	USER_UNCATEGORIZED
login	account_disabled_spamming_through_relay	USER_UNCATEGORIZED
login	account_disabled_spamming	USER_UNCATEGORIZED
login	account_disabled_hijacked	USER_UNCATEGORIZED
login	titanium_enroll	USER_UNCATEGORIZED
login	titanium_unenroll	USER_UNCATEGORIZED
login	gov_attack_warning	STATUS_UNCATEGORIZED
login	email_forwarding_out_of_domain	USER_UNCATEGORIZED
login	login_failure	USER_LOGIN. The security category is AUTH_VIOLATION.
login	login_challenge	USER_LOGIN
login	login_verification	USER_LOGIN
login	logout	USER_LOGOUT
login	login_success	USER_LOGIN
login	risky_sensitive_action_allowed	USER_LOGIN
login	risky_sensitive_action_blocked	USER_LOGIN
login	blocked_sender	STATUS_UNCATEGORIZED
admin	DELETE_2SV_SCRATCH_CODES	USER_RESOURCE_DELETION
admin	GENERATE_2SV_SCRATCH_CODES	USER_RESOURCE_CREATION
admin	REVOKE_3LO_DEVICE_TOKENS	USER_RESOURCE_ACCESS
admin	REVOKE_3LO_TOKEN	USER_RESOURCE_ACCESS
admin	ADD_RECOVERY_EMAIL	USER_RESOURCE_CREATION
admin	ADD_RECOVERY_PHONE	USER_RESOURCE_CREATION
admin	GRANT_ADMIN_PRIVILEGE	USER_CHANGE_PERMISSIONS
admin	REVOKE_ADMIN_PRIVILEGE	USER_CHANGE_PERMISSIONS
admin	REVOKE_ASP	USER_CHANGE_PERMISSIONS
admin	TOGGLE_AUTOMATIC_CONTACT_SHARING	SETTING_MODIFICATION
admin	BULK_UPLOAD	USER_RESOURCE_CREATION
admin	BULK_UPLOAD_NOTIFICATION_SENT	USER_UNCATEGORIZED
admin	CANCEL_USER_INVITE	USER_UNCATEGORIZED
admin	CHANGE_USER_CUSTOM_FIELD	USER_UNCATEGORIZED
admin	CHANGE_USER_EXTERNAL_ID	USER_UNCATEGORIZED
admin	CHANGE_USER_GENDER	USER_UNCATEGORIZED
admin	CHANGE_USER_IM	USER_UNCATEGORIZED
admin	ENABLE_USER_IP_WHITELIST	USER_UNCATEGORIZED
admin	CHANGE_USER_KEYWORD	USER_UNCATEGORIZED
admin	CHANGE_USER_LANGUAGE	USER_UNCATEGORIZED
admin	CHANGE_USER_LOCATION	USER_UNCATEGORIZED
admin	CHANGE_USER_ORGANIZATION	USER_UNCATEGORIZED
admin	CHANGE_USER_PHONE_NUMBER	USER_UNCATEGORIZED
admin	CHANGE_RECOVERY_EMAIL	USER_UNCATEGORIZED
admin	CHANGE_RECOVERY_PHONE	USER_UNCATEGORIZED
admin	CHANGE_USER_RELATION	USER_UNCATEGORIZED
admin	CHANGE_USER_ADDRESS	USER_UNCATEGORIZED
admin	CREATE_EMAIL_MONITOR	SERVICE_CREATION
admin	CREATE_DATA_TRANSFER_REQUEST	USER_UNCATEGORIZED
admin	GRANT_DELEGATED_ADMIN_PRIVILEGES	USER_CHANGE_PERMISSIONS
admin	DELETE_ACCOUNT_INFO_DUMP	USER_RESOURCE_DELETION
admin	DELETE_EMAIL_MONITOR	SERVICE_DELETION
admin	DELETE_MAILBOX_DUMP	USER_RESOURCE_DELETION
admin	DELETE_PROFILE_PHOTO	USER_RESOURCE_DELETION
admin	CHANGE_DISPLAY_NAME	USER_UNCATEGORIZED
admin	CHANGE_FIRST_NAME	USER_UNCATEGORIZED
admin	GMAIL_RESET_USER	USER_UNCATEGORIZED
admin	CHANGE_LAST_NAME	USER_UNCATEGORIZED
admin	MAIL_ROUTING_DESTINATION_ADDED	USER_RESOURCE_CREATION
admin	MAIL_ROUTING_DESTINATION_REMOVED	USER_RESOURCE_DELETION
admin	ADD_NICKNAME	USER_UNCATEGORIZED
admin	REMOVE_NICKNAME	USER_UNCATEGORIZED
admin	CHANGE_PASSWORD	USER_CHANGE_PASSWORD
admin	CHANGE_PASSWORD_ON_NEXT_LOGIN	USER_CHANGE_PASSWORD
admin	DOWNLOAD_PENDING_INVITES_LIST	STATUS_UNCATEGORIZED
admin	REMOVE_RECOVERY_EMAIL	USER_RESOURCE_DELETION
admin	REMOVE_RECOVERY_PHONE	USER_RESOURCE_DELETION
admin	REQUEST_ACCOUNT_INFO	USER_UNCATEGORIZED
admin	REQUEST_MAILBOX_DUMP	USER_UNCATEGORIZED
admin	RESEND_USER_INVITE	USER_UNCATEGORIZED
admin	RESET_SIGNIN_COOKIES	USER_RESOURCE_UPDATE_CONTENT
admin	SECURITY_KEY_REGISTERED_FOR_USER	USER_RESOURCE_CREATION
admin	REVOKE_SECURITY_KEY	USER_RESOURCE_UPDATE_PERMISSIONS
admin	USER_INVITE	USER_UNCATEGORIZED
admin	VIEW_TEMP_PASSWORD	USER_UNCATEGORIZED
admin	TURN_OFF_2_STEP_VERIFICATION	USER_RESOURCE_UPDATE_PERMISSIONS
admin	UNBLOCK_USER_SESSION	USER_UNCATEGORIZED
admin	UNMANAGED_USERS_BULK_UPLOAD	USER_RESOURCE_CREATION
admin	DOWNLOAD_UNMANAGED_USERS_LIST	USER_UNCATEGORIZED
admin	UPDATE_PROFILE_PHOTO	USER_RESOURCE_UPDATE_CONTENT
admin	UNENROLL_USER_FROM_TITANIUM	USER_UNCATEGORIZED
admin	ARCHIVE_USER	USER_UNCATEGORIZED
admin	UPDATE_BIRTHDATE	USER_UNCATEGORIZED
admin	CREATE_USER	USER_CREATION
admin	DELETE_USER	USER_DELETION
admin	DOWNGRADE_USER_FROM_GPLUS	USER_CHANGE_PERMISSIONS
admin	USER_ENROLLED_IN_TWO_STEP_VERIFICATION	USER_UNCATEGORIZED
admin	DOWNLOAD_USERLIST_CSV	STATUS_UNCATEGORIZED
admin	MOVE_USER_TO_ORG_UNIT	USER_UNCATEGORIZED
admin	USER_PUT_IN_TWO_STEP_VERIFICATION_GRACE_PERIOD	USER_UNCATEGORIZED
admin	RENAME_USER	USER_RESOURCE_UPDATE_CONTENT
admin	UNENROLL_USER_FROM_STRONG_AUTH	USER_UNCATEGORIZED
admin	SUSPEND_USER	USER_UNCATEGORIZED
admin	UNARCHIVE_USER	USER_UNCATEGORIZED
admin	UNDELETE_USER	USER_UNCATEGORIZED
admin	UNSUSPEND_USER	USER_UNCATEGORIZED
admin	UPGRADE_USER_TO_GPLUS	USER_CHANGE_PERMISSIONS
admin	USERS_BULK_UPLOAD	USER_RESOURCE_CREATION
admin	USERS_BULK_UPLOAD_NOTIFICATION_SENT	USER_UNCATEGORIZED
admin	ASSIGN_ROLE	USER_RESOURCE_UPDATE_PERMISSIONS
admin	CREATE_ROLE	USER_RESOURCE_CREATION
admin	UNASSIGN_ROLE	USER_RESOURCE_UPDATE_PERMISSIONS
admin	AUTHORIZE_API_CLIENT_ACCESS	USER_RESOURCE_ACCESS
admin	ADD_TRUSTED_DOMAINS	USER_RESOURCE_UPDATE_CONTENT
admin	CHANGE_DOMAIN_DEFAULT_TIMEZONE	USER_RESOURCE_UPDATE_CONTENT
admin	CHANGE_DOMAIN_DEFAULT_LOCALE	USER_RESOURCE_UPDATE_CONTENT
admin	CREATE_ALERT	USER_RESOURCE_CREATION
admin	REMOVE_APPLICATION	USER_RESOURCE_DELETION
admin	ADD_APPLICATION	USER_RESOURCE_CREATION
admin	REMOVE_API_CLIENT_ACCESS	USER_RESOURCE_DELETION
admin	CHANGE_SSO_SETTINGS	SETTING_MODIFICATION
admin	ALERT_CENTER_VIEW	STATUS_UNCATEGORIZED
admin	ALERT_CENTER_LIST_FEEDBACK	STATUS_UNCATEGORIZED
admin	ALERT_CENTER_GET_SIT_LINK	STATUS_UNCATEGORIZED
admin	ALERT_CENTER_LIST_CHANGE	STATUS_UNCATEGORIZED
admin	ALERT_CENTER_LIST_RELATED_ALERTS	STATUS_UNCATEGORIZED
admin	EMAIL_LOG_SEARCH	EMAIL_UNCATEGORIZED
admin	CHANGE_EMAIL_SETTING	SETTING_MODIFICATION
admin	CREATE_GMAIL_SETTING	SETTING_MODIFICATION
admin	CHANGE_GMAIL_SETTING	SETTING_MODIFICATION
admin	DELETE_GMAIL_SETTING	SETTING_MODIFICATION
admin	RELEASE_FROM_QUARANTINE	EMAIL_UNCATEGORIZED
admin	SECURITY_INVESTIGATION_QUERY	STATUS_UNCATEGORIZED
admin	SECURITY_INVESTIGATION_ACTION	STATUS_UNCATEGORIZED
admin	SECURITY_INVESTIGATION_OBJECT_CREATE_DRAFT_INVESTIGATION	STATUS_UNCATEGORIZED
admin	SECURITY_INVESTIGATION_ACTION_COMPLETION	STATUS_UNCATEGORIZED
admin	SECURITY_INVESTIGATION_EXPORT_QUERY	STATUS_UNCATEGORIZED
admin	SECURITY_INVESTIGATION_ACTION_CANCELLATION	STATUS_UNCATEGORIZED
admin	CHANGE_GROUP_SETTING	GROUP_MODIFICATION
admin	ADD_GROUP_MEMBER	GROUP_MODIFICATION
admin	CREATE_GROUP	GROUP_CREATION
admin	REMOVE_GROUP_MEMBER	GROUP_MODIFICATION
admin	UPDATE_GROUP_MEMBER_DELIVERY_SETTINGS	GROUP_MODIFICATION
admin	UPDATE_GROUP_MEMBER	GROUP_MODIFICATION
admin	DELETE_GROUP	GROUP_DELETION
admin	USER_LICENSE_ASSIGNMENT	USER_RESOURCE_UPDATE_PERMISSIONS
admin	USER_LICENSE_REVOKE	USER_RESOURCE_UPDATE_PERMISSIONS
admin	SECURITY_CHART_DRILLDOWN	STATUS_UNCATEGORIZED
admin	SYSTEM_DEFINED_RULE_UPDATED	SETTING_MODIFICATION
admin	CUSTOMER_USER_DEVICE_DELETION_EVENT	USER_RESOURCE_DELETION
admin	ADD_MOBILE_APPLICATION_TO_WHITELIST	USER_RESOURCE_UPDATE_CONTENT
admin	REMOVE_MOBILE_APPLICATION_FROM_WHITELIST	USER_RESOURCE_UPDATE_CONTENT
admin	CHANGE_MOBILE_APPLICATION_SETTINGS	SETTING_MODIFICATION
admin	ACTION_REQUESTED	USER_UNCATEGORIZED
admin	CREATE_APPLICATION_SETTING	SETTING_CREATION
admin	CHANGE_APPLICATION_SETTING	SETTING_MODIFICATION
admin	CREATE_SAML2_SERVICE_PROVIDER_CONFIG	SETTING_CREATION
admin	DELETE_SAML2_SERVICE_PROVIDER_CONFIG	SETTING_DELETION
admin	TOGGLE_SERVICE_ENABLED	SETTING_MODIFICATION
admin	CREATE_ORG_UNIT	USER_RESOURCE_CREATION
admin	MOVE_ORG_UNIT	USER_RESOURCE_UPDATE_CONTENT
admin	EDIT_ORG_UNIT_NAME	USER_RESOURCE_UPDATE_CONTENT
admin	REMOVE_ORG_UNIT	USER_RESOURCE_DELETION
admin	UNASSIGN_CUSTOM_LOGO	USER_RESOURCE_UPDATE_CONTENT
admin	ASSIGN_CUSTOM_LOGO	USER_RESOURCE_UPDATE_CONTENT
admin	EDIT_ORG_UNIT_DESCRIPTION	USER_RESOURCE_UPDATE_CONTENT
admin	CHANGE_DOCS_SETTING	SETTING_MODIFICATION
admin	CHANGE_CALENDAR_SETTING	SETTING_MODIFICATION
admin	SESSION_CONTROL_SETTINGS_CHANGE	SETTING_MODIFICATION
admin	DISALLOW_SERVICE_FOR_OAUTH2_ACCESS	SETTING_MODIFICATION
admin	ALLOW_STRONG_AUTHENTICATION	SETTING_MODIFICATION
admin	ENFORCE_STRONG_AUTHENTICATION	SETTING_MODIFICATION
admin	CHANGE_TWO_STEP_VERIFICATION_FREQUENCY	SETTING_MODIFICATION
admin	CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION	SETTING_MODIFICATION
admin	CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION	SETTING_MODIFICATION
admin	CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS	SETTING_MODIFICATION
admin	CHANGE_TWO_STEP_VERIFICATION_START_DATE	SETTING_MODIFICATION
admin	WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED	SETTING_MODIFICATION
admin	ADD_TO_BLOCKED_OAUTH2_APPS	STATUS_UPDATE
admin	ADD_TO_TRUSTED_OAUTH2_APPS	STATUS_UPDATE
admin	GENERATE_CERTIFICATE	USER_RESOURCE_CREATION
admin	ENABLE_DIRECTORY_SYNC	SETTING_MODIFICATION
admin	CHANGE_DEVICE_STATE	STATUS_UPDATE
admin	UPDATE_ACCESS_LEVEL_V2	USER_RESOURCE_UPDATE_PERMISSIONS
admin	UPDATE_AUTO_PROVISIONED_USER	STATUS_UPDATE
admin	SECURITY_CENTER_RULE_THRESHOLD_TRIGGER	STATUS_UPDATE
gmail		EMAIL_TRANSACTION

Referenz für die Feldzuordnung: WORKSPACE_ACTIVITY – Gemeinsame Felder

In der folgenden Tabelle sind allgemeine Felder des Logtyps WORKSPACE_ACTIVITY und die entsprechenden UDM-Felder aufgeführt.

Eingestellt:

Die folgenden labels-Felder für UDM-Nomen wurden eingestellt: about.labels, intermediary.labels, observer.labels, principal.labels, src.labels, security_result.about.labels und target.labels. Bei vorhandenen Parsern werden die Logfelder zusätzlich zu diesen UDM-Feldern auch den Schlüssel/Wert-additional.fields-UDM-Feldern zugeordnet. Bei neuen Parsern werden die Schlüssel/Wert-Einstellungen in den UDM-Feldern additional.fields anstelle der verworfenen UDM-Felder labels verwendet. Wir empfehlen, die vorhandenen Regeln so zu aktualisieren, dass die Schlüssel/Wert-Einstellungen in den UDM-Feldern „additional.fields“ anstelle der verworfenen UDM-Felder labels verwendet werden.

Log field	UDM mapping	Logic
actor.callerType	target.user.attribute.labels[caller_type]	If the event.name log field value is equal to one of the following values, then the actor.callerType log field is mapped to the target.user.attribute.labels UDM field: CHROME_OS_LOGIN_FAILURE_EVENT CHROME_OS_LOGIN_LOGOUT_EVENT CHROME_OS_LOGIN_EVENT LOGIN_EVENT login_failure login_success suspicious_login suspicious_login_less_secure_app suspicious_programmatic_login login_failure login_challenge login_verification login_success risky_sensitive_action_allowed logout CHROME_OS_LOGOUT_EVENT risky_sensitive_action_blocked
actor.callerType	principal.user.attribute.labels[caller_type]	If the event.name log field value is not equal to one of the following values, then the actor.callerType log field is mapped to the principal.user.attribute.labels UDM field: CHROME_OS_LOGIN_FAILURE_EVENT CHROME_OS_LOGIN_LOGOUT_EVENT CHROME_OS_LOGIN_EVENT LOGIN_EVENT login_failure login_success suspicious_login suspicious_login_less_secure_app suspicious_programmatic_login login_failure login_challenge login_verification login_success risky_sensitive_action_allowed logout CHROME_OS_LOGOUT_EVENT risky_sensitive_action_blocked If the id.applicationName log field value is equal to gmail, then principal.user.attribute.labels.key UDM field is set to actor_caller_type and actor.callerType log field is mapped to principal.user.attribute.labels.value UDM field.
actor.email	target.user.email_addresses	If the event.name log field value is equal to one of the following values, then the actor.email log field is mapped to the target.user.email_addresses UDM field: CHROME_OS_LOGIN_FAILURE_EVENT CHROME_OS_LOGIN_LOGOUT_EVENT CHROME_OS_LOGIN_EVENT LOGIN_EVENT login_failure login_success suspicious_login suspicious_login_less_secure_app suspicious_programmatic_login login_failure login_challenge login_verification login_success risky_sensitive_action_allowed logout CHROME_OS_LOGOUT_EVENT risky_sensitive_action_blocked If the id.applicationName log field value is equal to gmail, then actor.email log field is mapped to principal.user.email_addresses UDM field.
actor.email	principal.user.email_addresses	If the event.name log field value is not equal to one of the following values, then the actor.email log field is mapped to the principal.user.email_addresses UDM field: CHROME_OS_LOGIN_FAILURE_EVENT CHROME_OS_LOGIN_LOGOUT_EVENT CHROME_OS_LOGIN_EVENT LOGIN_EVENT login_failure login_success suspicious_login suspicious_login_less_secure_app suspicious_programmatic_login login_failure login_challenge login_verification login_success risky_sensitive_action_allowed logout CHROME_OS_LOGOUT_EVENT risky_sensitive_action_blocked
actor.email	security_result.about.email
actor.key	target.user.attribute.labels[actor_key]	If the event.name log field value is equal to one of the following values, then the actor.key log field is mapped to the target.user.attribute.labels[actor_key] UDM field: CHROME_OS_LOGIN_FAILURE_EVENT CHROME_OS_LOGIN_LOGOUT_EVENT CHROME_OS_LOGIN_EVENT LOGIN_EVENT login_failure login_success suspicious_login suspicious_login_less_secure_app suspicious_programmatic_login login_failure login_challenge login_verification login_success risky_sensitive_action_allowed logout CHROME_OS_LOGOUT_EVENT risky_sensitive_action_blocked
actor.key	principal.user.attribute.labels[actor_key]	If the event.name log field value is not equal to one of the following values, then the actor.key log field is mapped to the principal.user.attribute.labels[actor_key] UDM field: CHROME_OS_LOGIN_FAILURE_EVENT CHROME_OS_LOGIN_LOGOUT_EVENT CHROME_OS_LOGIN_EVENT LOGIN_EVENT login_failure login_success suspicious_login suspicious_login_less_secure_app suspicious_programmatic_login login_failure login_challenge login_verification login_success risky_sensitive_action_allowed logout CHROME_OS_LOGOUT_EVENT risky_sensitive_action_blocked
actor.key	target.user.userid	The actor.key log field is mapped to the target.user.userid UDM field if the following conditions are met: The actor.callerType log field value is equal to KEY. The event.name log field value is equal to one of the following values: CHROME_OS_LOGIN_FAILURE_EVENT CHROME_OS_LOGIN_LOGOUT_EVENT CHROME_OS_LOGIN_EVENT LOGIN_EVENT login_failure login_success suspicious_login suspicious_login_less_secure_app suspicious_programmatic_login login_failure login_challenge login_verification login_success risky_sensitive_action_allowed logout CHROME_OS_LOGOUT_EVENT risky_sensitive_action_blocked
actor.key	principal.user.userid	The actor.key log field is mapped to the principal.user.userid UDM field if the following conditions are met: The actor.callerType log field value is equal to KEY. If the event.name log field value is not equal to one of the following values: CHROME_OS_LOGIN_FAILURE_EVENT CHROME_OS_LOGIN_LOGOUT_EVENT CHROME_OS_LOGIN_EVENT LOGIN_EVENT login_failure login_success suspicious_login suspicious_login_less_secure_app suspicious_programmatic_login login_failure login_challenge login_verification login_success risky_sensitive_action_allowed logout CHROME_OS_LOGOUT_EVENT risky_sensitive_action_blocked
actor.profileId	target.user.product_object_id	If the event.name log field value is equal to one of the following values, then the actor.profileId log field is mapped to the target.user.product_object_id UDM field: CHROME_OS_LOGIN_FAILURE_EVENT CHROME_OS_LOGIN_LOGOUT_EVENT CHROME_OS_LOGIN_EVENT LOGIN_EVENT login_failure login_success suspicious_login suspicious_login_less_secure_app suspicious_programmatic_login login_failure login_challenge login_verification login_success risky_sensitive_action_allowed logout CHROME_OS_LOGOUT_EVENT risky_sensitive_action_blocked
actor.profileId	principal.user.product_object_id	If the event.name log field value is not equal to one of the following values, then the actor.profileId log field is mapped to the principal.user.product_object_id UDM field: CHROME_OS_LOGIN_FAILURE_EVENT CHROME_OS_LOGIN_LOGOUT_EVENT CHROME_OS_LOGIN_EVENT LOGIN_EVENT login_failure login_success suspicious_login suspicious_login_less_secure_app suspicious_programmatic_login login_failure login_challenge login_verification login_success risky_sensitive_action_allowed logout CHROME_OS_LOGOUT_EVENT risky_sensitive_action_blocked
etag	metadata.product_log_id
events.name	metadata.product_event_type
events.type	security_result.category_details
id.applicationName	metadata.product_name
id.customerId	about.resource.product_object_id
id.time	metadata.event_timestamp
id.uniqueQualifier	metadata.product_log_id
ipAddress	principal.ip
kind	about.labels[kind] (deprecated)
kind	additional.fields[kind]
ownerDomain	target.administrative_domain	If the target.resource log field value is not empty, then the ownerDomain log field is mapped to the target.administrative_domain UDM field. If the principal.resource log field value is not empty, then the ownerDomain log field is mapped to the principal.administrative_domain If the id.applicationName log field value is equal to gmail, then ownerDomain log field is mapped to principal.administrative_domain UDM field.
	about.resource.resource_type	The about.resource.resource_type UDM field is set to CLOUD_ORGANIZATION.
	metadata.vendor_name	The metadata.vendor_name UDM field is set to GOOGLE.
actor.gaiaId	principal.user.product_object_id	If the event.name log field value is not equal to one of the following values, then the actor.gaiaId log field is mapped to the principal.user.product_object_id UDM field: CHROME_OS_LOGIN_FAILURE_EVENT CHROME_OS_LOGIN_LOGOUT_EVENT CHROME_OS_LOGIN_EVENT LOGIN_EVENT login_failure login_success suspicious_login suspicious_login_less_secure_app suspicious_programmatic_login login_failure login_challenge login_verification login_success risky_sensitive_action_allowed logout CHROME_OS_LOGOUT_EVENT risky_sensitive_action_blocked
actor.gaiaId	target.user.product_object_id	If the event.name log field value is equal to one of the following values, then the actor.gaiaId log field is mapped to the target.user.product_object_id UDM field: CHROME_OS_LOGIN_FAILURE_EVENT CHROME_OS_LOGIN_LOGOUT_EVENT CHROME_OS_LOGIN_EVENT LOGIN_EVENT login_failure login_success suspicious_login suspicious_login_less_secure_app suspicious_programmatic_login login_failure login_challenge login_verification login_success risky_sensitive_action_allowed logout CHROME_OS_LOGOUT_EVENT risky_sensitive_action_blocked
actor.orgunitPath	principal.user.attribute.labels[org_unit_path]	If the event.name log field value is not equal to one of the following values, then the actor.orgunitPath log field is mapped to the principal.user.attribute.labels[org_unit_path] UDM field: CHROME_OS_LOGIN_FAILURE_EVENT CHROME_OS_LOGIN_LOGOUT_EVENT CHROME_OS_LOGIN_EVENT LOGIN_EVENT login_failure login_success suspicious_login suspicious_login_less_secure_app suspicious_programmatic_login login_failure login_challenge login_verification login_success risky_sensitive_action_allowed logout CHROME_OS_LOGOUT_EVENT risky_sensitive_action_blocked
actor.orgunitPath	target.user.attribute.labels[org_unit_path]	If the event.name log field value is equal to one of the following values, then the actor.orgunitPath log field is mapped to the target.user.attribute.labels[org_unit_path] UDM field: CHROME_OS_LOGIN_FAILURE_EVENT CHROME_OS_LOGIN_LOGOUT_EVENT CHROME_OS_LOGIN_EVENT LOGIN_EVENT login_failure login_success suspicious_login suspicious_login_less_secure_app suspicious_programmatic_login login_failure login_challenge login_verification login_success risky_sensitive_action_allowed logout CHROME_OS_LOGOUT_EVENT risky_sensitive_action_blocked
actor.groupId	principal.user.group_identifiers	If the event.name log field value is not equal to one of the following values, then the actor.groupId log field is mapped to the principal.user.group_identifiers UDM field: CHROME_OS_LOGIN_FAILURE_EVENT CHROME_OS_LOGIN_LOGOUT_EVENT CHROME_OS_LOGIN_EVENT LOGIN_EVENT login_failure login_success suspicious_login suspicious_login_less_secure_app suspicious_programmatic_login login_failure login_challenge login_verification login_success risky_sensitive_action_allowed logout CHROME_OS_LOGOUT_EVENT risky_sensitive_action_blocked
actor.groupId	target.user.group_identifiers	If the event.name log field value is equal to one of the following values, then the actor.groupId log field is mapped to the target.user.group_identifiers UDM field: CHROME_OS_LOGIN_FAILURE_EVENT CHROME_OS_LOGIN_LOGOUT_EVENT CHROME_OS_LOGIN_EVENT LOGIN_EVENT login_failure login_success suspicious_login suspicious_login_less_secure_app suspicious_programmatic_login login_failure login_challenge login_verification login_success risky_sensitive_action_allowed logout CHROME_OS_LOGOUT_EVENT risky_sensitive_action_blocked

Feldzuordnungsreferenz: WORKSPACE_ACTIVITY

In der folgenden Tabelle sind die Logfelder des Logtyps WORKSPACE_ACTIVITY und die entsprechenden UDM-Felder.

Hinweis :Wenn Sie Logs der gmail-Anwendung (WORKSPACE_ACTIVITY) aufnehmen möchten, verknüpfen Sie Google Workspace mit Ihrer Google Security Operations-Instanz. Sie können die Feedverwaltung nicht zum Aufnehmen von gmail-Anwendungsprotokollen verwenden.

Eingestellt:

Die folgenden labels-Felder für UDM-Nomen wurden eingestellt: about.labels, intermediary.labels, observer.labels, principal.labels, src.labels, security_result.about.labels und target.labels. Bei vorhandenen Parsern werden die Logfelder zusätzlich zu diesen UDM-Feldern auch den Schlüssel/Wert-additional.fields-UDM-Feldern zugeordnet. Bei neuen Parsern werden die Schlüssel/Wert-Einstellungen in den UDM-Feldern additional.fields anstelle der verworfenen UDM-Felder labels verwendet. Wir empfehlen, die vorhandenen Regeln so zu aktualisieren, dass die Schlüssel/Wert-Einstellungen in den additional.fields-UDM-Feldern anstelle der veralteten labels-UDM-Felder verwendet werden.

Workspace application	Log field	UDM mapping	Logic
access_transparency	ACCESS_APPROVAL_REQUEST_IDS	about.labels [access_approval_request_ids] (deprecated)
access_transparency	ACCESS_APPROVAL_REQUEST_IDS	additional.fields [access_approval_request_ids]
access_transparency	ACCESS_MANAGEMENT_POLICY	about.labels [access_management_policy] (deprecated)
access_transparency	ACCESS_MANAGEMENT_POLICY	additional.fields [access_management_policy]
access_transparency	ACTOR_HOME_OFFICE	principal.user.office_address.country_or_region	If the event.name log field value is equal to ACCESS, then the ACTOR_HOME_OFFICE log field is mapped to the principal.user.office_address.country_or_region UDM field.
access_transparency	GSUITE_PRODUCT_NAME	target.application	If the event.name log field value is equal to ACCESS, then the GSUITE_PRODUCT_NAME log field is mapped to the target.application UDM field.
access_transparency	JUSTIFICATIONS	about.labels [justifications] (deprecated)	If the event.name log field value is equal to ACCESS, then the JUSTIFICATIONS log field is mapped to the about.labels UDM field.
access_transparency	JUSTIFICATIONS	additional.fields [justifications]	If the event.name log field value is equal to ACCESS, then the JUSTIFICATIONS log field is mapped to the additional.fields UDM field.
access_transparency	LOG_ID	about.labels [logid] (deprecated)	If the event.name log field value is equal to ACCESS, then the LOG_ID log field is mapped to the about.labels UDM field.
access_transparency	LOG_ID	additional.fields [logid]	If the event.name log field value is equal to ACCESS, then the LOG_ID log field is mapped to the additional.fields UDM field.
access_transparency	ON_BEHALF_OF	about.labels [on_behalf_of] (deprecated)	If the event.name log field value is equal to ACCESS, then the ON_BEHALF_OF log field is mapped to the about.labels UDM field.
access_transparency	ON_BEHALF_OF	additional.fields [on_behalf_of]	If the event.name log field value is equal to ACCESS, then the ON_BEHALF_OF log field is mapped to the additional.fields UDM field.
access_transparency	OWNER_EMAIL	target.user.email_addresses	If the event.name log field value is equal to ACCESS, then the OWNER_EMAIL log field is mapped to the target.user.email_addresses UDM field.
access_transparency	RESOURCE_NAME	target.resource.name	If the event.name log field value is equal to ACCESS, then the RESOURCE_NAME log field is mapped to the target.resource.name UDM field.
access_transparency	TICKETS	about.labels [tickets] (deprecated)
access_transparency	TICKETS	additional.fields [tickets]
chrome	DEVICE_NAME	target.asset.attribute.labels [device_name]	If the event.name log field value is equal to one of the following values, then the DEVICE_NAME log field is mapped to the target.asset.attribute.labels UDM field: CHROME_OS_ADD_USER CHROME_OS_REMOVE_USER DEVICE_BOOT_STATE_CHANGE CHROME_OS_LOGIN_FAILURE_EVENT CHROME_OS_LOGIN_LOGOUT_EVENT CHROME_OS_LOGIN_EVENT CHROME_OS_LOGOUT_EVENT CHROME_OS_REPORTING_DATA_LOST PASSWORD_CHANGED PASSWORD_REUSE DLP_EVENT CONTENT_TRANSFER CONTENT_UNSCANNED EXTENSION_REQUEST LOGIN_EVENT MALWARE_TRANSFER PASSWORD_BREACH SENSITIVE_DATA_TRANSFER UNSAFE_SITE_VISIT BROWSER_EXTENSION_INSTALL CHROMEOS_AFFILIATED_LOCK_SUCCESS CHROMEOS_AFFILIATED_UNLOCK_FAILURE CHROMEOS_AFFILIATED_UNLOCK_SUCCESS CHROMEOS_PERIPHERAL_ADDED CHROMEOS_PERIPHERAL_REMOVED CHROMEOS_PERIPHERAL_STATUS_UPDATED CHROMEOS_UPDATE_FAILURE CHROMEOS_UPDATE_SUCCESS CHROME_OS_CRD_CLIENT_CONNECTED CHROME_OS_CRD_HOST_ENDED CHROME_OS_CRD_HOST_STARTED URL_FILTERING_INTERSTITIAL BROWSER_CRASH
chrome	DEVICE_PLATFORM	target.asset.platform_software.platform	If the DEVICE_PLATFORM log field value matches windows, then the target.asset.platform_software.platform UDM field is set to WINDOWS. If the DEVICE_PLATFORM log field value matches mac, then the target.asset.platform_software.platform UDM field is set to MAC. If the DEVICE_PLATFORM log field value matches linux, then the target.asset.platform_software.platform UDM field is set to LINUX. Else, the target.asset.platform_software.platform UDM field is set to UNKNOWN_PLATFORM.
chrome	DEVICE_USER	principal.user.user_display_name	If the event.name log field value is equal to LOGIN_EVENT, then the DEVICE_USER log field is mapped to the principal.user.user_display_name UDM field.
chrome	LOGIN_USER_NAME	target.user.user_display_name	If the event.name log field value is equal to LOGIN_EVENT, then the LOGIN_USER_NAME log field is mapped to the target.user.user_display_name UDM field.
chrome	DEVICE_USER	target.user.user_display_name	If the event.name log field value is equal to one of the following values, then the DEVICE_USER log field is mapped to the target.user.user_display_name UDM field: CHROME_OS_ADD_USER CHROME_OS_REMOVE_USER CHROME_OS_LOGIN_FAILURE_EVENT CHROME_OS_LOGIN_LOGOUT_EVENT CHROME_OS_LOGIN_EVENT CHROME_OS_LOGOUT_EVENT PASSWORD_CHANGED PASSWORD_REUSE DLP_EVENT CONTENT_TRANSFER CONTENT_UNSCANNED EXTENSION_REQUEST LOGIN_EVENT MALWARE_TRANSFER PASSWORD_BREACH SENSITIVE_DATA_TRANSFER UNSAFE_SITE_VISIT BROWSER_EXTENSION_INSTALL CHROMEOS_AFFILIATED_LOCK_SUCCESS CHROMEOS_AFFILIATED_UNLOCK_FAILURE CHROMEOS_AFFILIATED_UNLOCK_SUCCESS CHROMEOS_PERIPHERAL_ADDED CHROMEOS_PERIPHERAL_REMOVED CHROMEOS_PERIPHERAL_STATUS_UPDATED CHROMEOS_UPDATE_FAILURE CHROMEOS_UPDATE_SUCCESS CHROME_OS_CRD_CLIENT_CONNECTED CHROME_OS_CRD_HOST_ENDED CHROME_OS_CRD_HOST_STARTED URL_FILTERING_INTERSTITIAL BROWSER_CRASH If the event.name log field value is equal to LOGIN_EVENT, then the LOGIN_USER_NAME log field is mapped to the target.user.user_display_name UDM field.
chrome	PROFILE_USER_NAME	target.user.attribute.labels [profile_user_name]	If the event.name log field value is equal to one of the following values, then the PROFILE_USER_NAME log field is mapped to the target.user.attribute.labels UDM field: PASSWORD_CHANGED PASSWORD_REUSE CONTENT_TRANSFER CONTENT_UNSCANNED LOGIN_EVENT MALWARE_TRANSFER PASSWORD_BREACH SENSITIVE_DATA_TRANSFER UNSAFE_SITE_VISIT URL_FILTERING_INTERSTITIAL
chrome	DIRECTORY_DEVICE_ID	about.labels [directory_device_id] (deprecated)	If the event.name log field value is equal to one of the following values, then the DIRECTORY_DEVICE_ID log field is mapped to the about.labels UDM field: CHROME_OS_ADD_USER CHROME_OS_REMOVE_USER DEVICE_BOOT_STATE_CHANGE CHROME_OS_LOGIN_FAILURE_EVENT CHROME_OS_LOGIN_LOGOUT_EVENT CHROME_OS_LOGIN_EVENT CHROME_OS_LOGOUT_EVENT CHROME_OS_REPORTING_DATA_LOST PASSWORD_CHANGED PASSWORD_REUSE CONTENT_TRANSFER CONTENT_UNSCANNED EXTENSION_REQUEST LOGIN_EVENT MALWARE_TRANSFER PASSWORD_BREACH SENSITIVE_DATA_TRANSFER UNSAFE_SITE_VISIT BROWSER_EXTENSION_INSTALL CHROMEOS_AFFILIATED_LOCK_SUCCESS CHROMEOS_AFFILIATED_UNLOCK_FAILURE CHROMEOS_AFFILIATED_UNLOCK_SUCCESS CHROMEOS_PERIPHERAL_ADDED CHROMEOS_PERIPHERAL_REMOVED CHROMEOS_PERIPHERAL_STATUS_UPDATED CHROMEOS_UPDATE_FAILURE CHROMEOS_UPDATE_SUCCESS CHROME_OS_CRD_CLIENT_CONNECTED CHROME_OS_CRD_HOST_ENDED CHROME_OS_CRD_HOST_STARTED URL_FILTERING_INTERSTITIAL BROWSER_CRASH
chrome	DIRECTORY_DEVICE_ID	additional.fields [directory_device_id]	If the event.name log field value is equal to one of the following values, then the DIRECTORY_DEVICE_ID log field is mapped to the additional.fields UDM field: CHROME_OS_ADD_USER CHROME_OS_REMOVE_USER DEVICE_BOOT_STATE_CHANGE CHROME_OS_LOGIN_FAILURE_EVENT CHROME_OS_LOGIN_LOGOUT_EVENT CHROME_OS_LOGIN_EVENT CHROME_OS_LOGOUT_EVENT CHROME_OS_REPORTING_DATA_LOST PASSWORD_CHANGED PASSWORD_REUSE CONTENT_TRANSFER CONTENT_UNSCANNED EXTENSION_REQUEST LOGIN_EVENT MALWARE_TRANSFER PASSWORD_BREACH SENSITIVE_DATA_TRANSFER UNSAFE_SITE_VISIT BROWSER_EXTENSION_INSTALL CHROMEOS_AFFILIATED_LOCK_SUCCESS CHROMEOS_AFFILIATED_UNLOCK_FAILURE CHROMEOS_AFFILIATED_UNLOCK_SUCCESS CHROMEOS_PERIPHERAL_ADDED CHROMEOS_PERIPHERAL_REMOVED CHROMEOS_PERIPHERAL_STATUS_UPDATED CHROMEOS_UPDATE_FAILURE CHROMEOS_UPDATE_SUCCESS CHROME_OS_CRD_CLIENT_CONNECTED CHROME_OS_CRD_HOST_ENDED CHROME_OS_CRD_HOST_STARTED URL_FILTERING_INTERSTITIAL BROWSER_CRASH
chrome	DEVICE_ID	target.asset.asset_id	If the event.name log field value is equal to one of the following values, then the DEVICE_ID log field is mapped to the target.asset.asset_id UDM field: CONTENT_TRANSFER CONTENT_UNSCANNED MALWARE_TRANSFER SENSITIVE_DATA_TRANSFER UNSAFE_SITE_VISIT
chrome	VIRTUAL_DEVICE_ID	about.labels [virtual_device_id] (deprecated)	If the event.name log field value is equal to one of the following values, then the VIRTUAL_DEVICE_ID log field is mapped to the about.labels UDM field: PASSWORD_CHANGED PASSWORD_REUSE CONTENT_TRANSFER CONTENT_UNSCANNED LOGIN_EVENT MALWARE_TRANSFER PASSWORD_BREACH SENSITIVE_DATA_TRANSFER UNSAFE_SITE_VISIT BROWSER_EXTENSION_INSTALL URL_FILTERING_INTERSTITIAL BROWSER_CRASH
chrome	VIRTUAL_DEVICE_ID	additional.fields [virtual_device_id]	If the event.name log field value is equal to one of the following values, then the VIRTUAL_DEVICE_ID log field is mapped to the additional.fields UDM field: PASSWORD_CHANGED PASSWORD_REUSE CONTENT_TRANSFER CONTENT_UNSCANNED LOGIN_EVENT MALWARE_TRANSFER PASSWORD_BREACH SENSITIVE_DATA_TRANSFER UNSAFE_SITE_VISIT BROWSER_EXTENSION_INSTALL URL_FILTERING_INTERSTITIAL BROWSER_CRASH
chrome	EVENT_REASON	security_result.summary	If the event.name log field value is equal to one of the following values, then the EVENT_REASON log field is mapped to the security_result.summary UDM field: CHROME_OS_ADD_USER CHROME_OS_REMOVE_USER DEVICE_BOOT_STATE_CHANGE CHROME_OS_LOGIN_FAILURE_EVENT CHROME_OS_LOGIN_LOGOUT_EVENT CHROME_OS_LOGIN_EVENT CHROME_OS_LOGOUT_EVENT CHROME_OS_REPORTING_DATA_LOST PASSWORD_REUSE DLP_EVENT CONTENT_UNSCANNED LOGIN_EVENT MALWARE_TRANSFER PASSWORD_BREACH UNSAFE_SITE_VISIT BROWSER_EXTENSION_INSTALL CHROMEOS_AFFILIATED_LOCK_SUCCESS CHROMEOS_AFFILIATED_UNLOCK_FAILURE CHROMEOS_AFFILIATED_UNLOCK_SUCCESS CHROMEOS_PERIPHERAL_ADDED CHROMEOS_PERIPHERAL_REMOVED CHROMEOS_PERIPHERAL_STATUS_UPDATED CHROMEOS_UPDATE_FAILURE CHROMEOS_UPDATE_SUCCESS CHROME_OS_CRD_CLIENT_CONNECTED CHROME_OS_CRD_HOST_ENDED CHROME_OS_CRD_HOST_STARTED BROWSER_CRASH
chrome	EVENT_RESULT	security_result.action_details	If the event.name log field value is equal to one of the following values, then the EVENT_RESULT log field is mapped to the security_result.action_details UDM field: PASSWORD_REUSE DLP_EVENT CONTENT_TRANSFER CONTENT_UNSCANNED MALWARE_TRANSFER PASSWORD_BREACH SENSITIVE_DATA_TRANSFER UNSAFE_SITE_VISIT URL_FILTERING_INTERSTITIAL BROWSER_CRASH
chrome		security_result.action	The security_result.action UDM field is set to ALLOW.
chrome	TIMESTAMP	about.labels [timestamp] (deprecated)	If the event.name log field value is equal to one of the following values, then the TIMESTAMP log field is mapped to the about.labels UDM field: CHROME_OS_ADD_USER CHROME_OS_REMOVE_USER DEVICE_BOOT_STATE_CHANGE CHROME_OS_LOGIN_FAILURE_EVENT CHROME_OS_LOGIN_LOGOUT_EVENT CHROME_OS_LOGIN_EVENT CHROME_OS_LOGOUT_EVENT CHROME_OS_REPORTING_DATA_LOST PASSWORD_CHANGED PASSWORD_REUSE DLP_EVENT CONTENT_TRANSFER CONTENT_UNSCANNED EXTENSION_REQUEST LOGIN_EVENT MALWARE_TRANSFER PASSWORD_BREACH SENSITIVE_DATA_TRANSFER UNSAFE_SITE_VISIT BROWSER_EXTENSION_INSTALL CHROMEOS_AFFILIATED_LOCK_SUCCESS CHROMEOS_AFFILIATED_UNLOCK_FAILURE CHROMEOS_AFFILIATED_UNLOCK_SUCCESS CHROMEOS_PERIPHERAL_ADDED CHROMEOS_PERIPHERAL_REMOVED CHROMEOS_PERIPHERAL_STATUS_UPDATED CHROMEOS_UPDATE_FAILURE CHROMEOS_UPDATE_SUCCESS CHROME_OS_CRD_CLIENT_CONNECTED CHROME_OS_CRD_HOST_ENDED CHROME_OS_CRD_HOST_STARTED URL_FILTERING_INTERSTITIAL BROWSER_CRASH
chrome	TIMESTAMP	additional.fields [timestamp]	If the event.name log field value is equal to one of the following values, then the TIMESTAMP log field is mapped to the additional.fields UDM field: CHROME_OS_ADD_USER CHROME_OS_REMOVE_USER DEVICE_BOOT_STATE_CHANGE CHROME_OS_LOGIN_FAILURE_EVENT CHROME_OS_LOGIN_LOGOUT_EVENT CHROME_OS_LOGIN_EVENT CHROME_OS_LOGOUT_EVENT CHROME_OS_REPORTING_DATA_LOST PASSWORD_CHANGED PASSWORD_REUSE DLP_EVENT CONTENT_TRANSFER CONTENT_UNSCANNED EXTENSION_REQUEST LOGIN_EVENT MALWARE_TRANSFER PASSWORD_BREACH SENSITIVE_DATA_TRANSFER UNSAFE_SITE_VISIT BROWSER_EXTENSION_INSTALL CHROMEOS_AFFILIATED_LOCK_SUCCESS CHROMEOS_AFFILIATED_UNLOCK_FAILURE CHROMEOS_AFFILIATED_UNLOCK_SUCCESS CHROMEOS_PERIPHERAL_ADDED CHROMEOS_PERIPHERAL_REMOVED CHROMEOS_PERIPHERAL_STATUS_UPDATED CHROMEOS_UPDATE_FAILURE CHROMEOS_UPDATE_SUCCESS CHROME_OS_CRD_CLIENT_CONNECTED CHROME_OS_CRD_HOST_ENDED CHROME_OS_CRD_HOST_STARTED URL_FILTERING_INTERSTITIAL BROWSER_CRASH
chrome	BROWSER_VERSION	target.resource.attribute.labels [browser_version]	If the event.name log field value is equal to one of the following values, then the BROWSER_VERSION log field is mapped to the target.resource.attribute.labels UDM field: PASSWORD_CHANGED PASSWORD_REUSE DLP_EVENT CONTENT_TRANSFER CONTENT_UNSCANNED LOGIN_EVENT MALWARE_TRANSFER PASSWORD_BREACH SENSITIVE_DATA_TRANSFER UNSAFE_SITE_VISIT BROWSER_EXTENSION_INSTALL URL_FILTERING_INTERSTITIAL BROWSER_CRASH
chrome	LOGIN_FAILURE_REASON	security_result.description
chrome	USER_AGENT	network.http.user_agent	If the event.name log field value is equal to one of the following values, then the USER_AGENT log field is mapped to the network.http.user_agent UDM field: PASSWORD_CHANGED PASSWORD_REUSE DLP_EVENT CONTENT_TRANSFER CONTENT_UNSCANNED LOGIN_EVENT MALWARE_TRANSFER PASSWORD_BREACH SENSITIVE_DATA_TRANSFER UNSAFE_SITE_VISIT BROWSER_EXTENSION_INSTALL URL_FILTERING_INTERSTITIAL BROWSER_CRASH
chrome	URL	target.url	If the event.name log field value is equal to one of the following values, then the URL log field is mapped to the about.url UDM field: PASSWORD_REUSE DLP_EVENT CONTENT_TRANSFER CONTENT_UNSCANNED LOGIN_EVENT MALWARE_TRANSFER PASSWORD_BREACH SENSITIVE_DATA_TRANSFER UNSAFE_SITE_VISIT URL_FILTERING_INTERSTITIAL
chrome	SCAN_ID	about.labels [scan_id] (deprecated)	If the event.name log field value is equal to one of the following values, then the SCAN_ID log field is mapped to the about.labels UDM field: CONTENT_TRANSFER MALWARE_TRANSFER SENSITIVE_DATA_TRANSFER
chrome	SCAN_ID	additional.fields [scan_id]	If the event.name log field value is equal to one of the following values, then the SCAN_ID log field is mapped to the additional.fields UDM field: CONTENT_TRANSFER MALWARE_TRANSFER SENSITIVE_DATA_TRANSFER
chrome	REMOVE_USER_REASON	security_result.detection_fields [remove_user_reason]	If the event.name log field value is equal to CHROME_OS_REMOVE_USER, then the REMOVE_USER_REASON log field is mapped to the security_result.detection_fields UDM field.
chrome	NEW_BOOT_MODE	target.asset.attribute.labels [new_boot_mode]
chrome	PREVIOUS_BOOT_MODE	target.asset.attribute.labels [previous_boot_mode]
chrome	CLIENT_TYPE	target.resource.attribute.labels [client_type]
chrome	TRIGGER_USER	security_result.about.labels [trigger_user] (deprecated)
chrome	TRIGGER_USER	additional.fields [trigger_user]
chrome	TRIGGER_DESTINATION	security_result.about.labels [trigger_destination] (deprecated)
chrome	TRIGGER_DESTINATION	additional.fields [trigger_destination]
chrome	TRIGGER_SOURCE	security_result.about.labels [trigger_source] (deprecated)
chrome	TRIGGER_SOURCE	additional.fields [trigger_source]
chrome	TRIGGER_TYPE	security_result.about.labels [trigger_type] (deprecated)
chrome	TRIGGER_TYPE	additional.fields [trigger_type]
chrome	TRIGGERED_RULES_REASON	security_result.about.labels [triggered_rules_reason] (deprecated)
chrome	TRIGGERED_RULES_REASON	additional.fields [triggered_rules_reason]
chrome	CONTENT_HASH	about.labels [content_hash] (deprecated)
chrome	CONTENT_HASH	additional.fields [content_hash]
chrome	CONTENT_NAME	about.labels [content_name] (deprecated)
chrome	CONTENT_NAME	additional.fields [content_name]
chrome	CONTENT_SIZE	about.labels [content_size] (deprecated)
chrome	CONTENT_SIZE	additional.fields [content_size]
chrome	CONTENT_TYPE	about.labels [content_type] (deprecated)
chrome	CONTENT_TYPE	additional.fields [content_type]
chrome	APP_NAME	target.application	If the event.name log field value is equal to one of the following values, then the APP_NAME log field is mapped to the target.application UDM field: EXTENSION_REQUEST BROWSER_EXTENSION_INSTALL
chrome	PRODUCT_NAME	target.application	If the event.name log field value is equal to one of the following values, then the PRODUCT_NAME log field is mapped to the target.application UDM field: CHROMEOS_PERIPHERAL_ADDED CHROMEOS_PERIPHERAL_REMOVED CHROMEOS_PERIPHERAL_STATUS_UPDATED Else, the PRODUCT_NAME log field is mapped to the target.labels UDM field.
chrome	PRODUCT_NAME	target.labels [product_name] (deprecated)	If the event.name log field value is equal to one of the following values, then the PRODUCT_NAME log field is mapped to the target.application UDM field: CHROMEOS_PERIPHERAL_ADDED CHROMEOS_PERIPHERAL_REMOVED CHROMEOS_PERIPHERAL_STATUS_UPDATED Else, the PRODUCT_NAME log field is mapped to the target.labels UDM field.
chrome	PRODUCT_NAME	additional.fields [product_name]	If the event.name log field value is equal to one of the following values, then the PRODUCT_NAME log field is mapped to the target.application UDM field: CHROMEOS_PERIPHERAL_ADDED CHROMEOS_PERIPHERAL_REMOVED CHROMEOS_PERIPHERAL_STATUS_UPDATED Else, the PRODUCT_NAME log field is mapped to the additional.fields UDM field.
chrome	ORG_UNIT_NAME	about.labels [org_unit_name] (deprecated)	If the event.name log field value is equal to EXTENSION_REQUEST, then the ORG_UNIT_NAME log field is mapped to the about.labels UDM field.
chrome	ORG_UNIT_NAME	additional.fields [org_unit_name]	If the event.name log field value is equal to EXTENSION_REQUEST, then the ORG_UNIT_NAME log field is mapped to the additional.fields UDM field.
chrome	USER_JUSTIFICATION	principal.user.attribute.labels [user_justification]
chrome	FEDERATED_ORIGIN	security_result.about.labels [federated_origin] (deprecated)
chrome	FEDERATED_ORIGIN	additional.fields [federated_origin]
chrome	IS_FEDERATED	security_result.about.labels [is_federated] (deprecated)
chrome	IS_FEDERATED	additional.fields [is_federated]
chrome	EVIDENCE_LOCKER_FILEPATH	security_result.about.labels [evidence_locker_filepath] (deprecated)
chrome	EVIDENCE_LOCKER_FILEPATH	additional.fields [evidence_locker_filepath]
Google Chrome	CONNECTION_TYPE	about.labels[connection_type] (deprecated)
Google Chrome	CONNECTION_TYPE	additional.fields[connection_type]
Google Chrome	PREVIOUS_OS_VERSION	target.asset.attribute.labels[previous_os_version]
Google Chrome	VENDOR_ID	src.labels[vendor_id] (deprecated)
Google Chrome	VENDOR_ID	additional.fields[vendor_id]
Google Chrome	LOCALIZED_URL_CATEGORY	about.labels[localized_url_category] (deprecated)
Google Chrome	LOCALIZED_URL_CATEGORY	additional.fields[localized_url_category]
Google Chrome	VENDOR_NAME	src.labels[vendor_name] (deprecated)
Google Chrome	VENDOR_NAME	additional.fields[vendor_name]
Google Chrome	SESSION_ID	network.session_id
Google Chrome	APP_ID	target.resource.product_object_id	If the event.name log field value is equal to BROWSER_EXTENSION_INSTALL, then the APP_ID log field is mapped to the target.resource.product_object_id UDM field.
Google Chrome	CURRENT_OS_VERSION	target.asset.platform_software.platform_version
Google Chrome	PRODUCT_ID	target.resource.product_object_id	If the events.name log field value contains one of the following values, then the PRODUCT_ID log field is mapped to the target.resource.product_object_id UDM field. CHROMEOS_PERIPHERAL_ADDED CHROMEOS_PERIPHERAL_REMOVED CHROMEOS_PERIPHERAL_STATUS_UPDATED Else, the PRODUCT_ID log field is mapped to the target.labels UDM field.
Google Chrome	PRODUCT_ID	target.labels[product_id] (deprecated)	If the events.name log field value contains one of the following values, then the PRODUCT_ID log field is mapped to the target.resource.product_object_id UDM field. CHROMEOS_PERIPHERAL_ADDED CHROMEOS_PERIPHERAL_REMOVED CHROMEOS_PERIPHERAL_STATUS_UPDATED Else, the PRODUCT_ID log field is mapped to the target.labels UDM field.
Google Chrome	PRODUCT_ID	additional.fields[product_id]	If the events.name log field value contains one of the following values, then the PRODUCT_ID log field is mapped to the target.resource.product_object_id UDM field. CHROMEOS_PERIPHERAL_ADDED CHROMEOS_PERIPHERAL_REMOVED CHROMEOS_PERIPHERAL_STATUS_UPDATED Else, the PRODUCT_ID log field is mapped to the additional.fields UDM field.
Google Chrome	UNLOCK_TYPE	target.labels[unlock_type] (deprecated)
Google Chrome	UNLOCK_TYPE	additional.fields[unlock_type]
Google Chrome	REPORT_ID	target.labels[report_id] (deprecated)
Google Chrome	REPORT_ID	additional.fields[report_id]
Google Chrome	CHANNEL	target.labels[channel] (deprecated)
Google Chrome	CHANNEL	additional.fields[channel]
Google Chrome	TAB_URL	additional.fields[tab_url]
context_aware_access	CAA_ACCESS_LEVEL_APPLIED	security_result.about.labels [caa_access_level_applied] (deprecated)	If the event.name log field value is equal to ACCESS_DENY_EVENT, then the CAA_ACCESS_LEVEL_APPLIED log field is mapped to the security_result.about.labels UDM field.
context_aware_access	CAA_ACCESS_LEVEL_APPLIED	additional.fields [caa_access_level_applied]	If the event.name log field value is equal to ACCESS_DENY_EVENT, then the CAA_ACCESS_LEVEL_APPLIED log field is mapped to the additional.fields UDM field.
context_aware_access	CAA_ACCESS_LEVEL_SATISFIED	security_result.about.labels [caa_access_level_satisfied] (deprecated)	If the event.name log field value is equal to ACCESS_DENY_EVENT, then the CAA_ACCESS_LEVEL_SATISFIED log field is mapped to the security_result.about.labels UDM field.
context_aware_access	CAA_ACCESS_LEVEL_SATISFIED	additional.fields [caa_access_level_satisfied]	If the event.name log field value is equal to ACCESS_DENY_EVENT, then the CAA_ACCESS_LEVEL_SATISFIED log field is mapped to the additional.fields UDM field.
context_aware_access	CAA_ACCESS_LEVEL_UNSATISFIED	security_result.about.labels [caa_access_level_unsatisfied] (deprecated)	If the event.name log field value is equal to ACCESS_DENY_EVENT, then the CAA_ACCESS_LEVEL_UNSATISFIED log field is mapped to the security_result.about.labels UDM field.
context_aware_access	CAA_ACCESS_LEVEL_UNSATISFIED	additional.fields [caa_access_level_unsatisfied]	If the event.name log field value is equal to ACCESS_DENY_EVENT, then the CAA_ACCESS_LEVEL_UNSATISFIED log field is mapped to the additional.fields UDM field.
context_aware_access	CAA_APPLICATION	target.resource.name	If the event.name log field value is equal to ACCESS_DENY_EVENT, then the CAA_APPLICATION log field is mapped to the target.resource.name UDM field.
context_aware_access		target.resource.resource_type	If the event.name log field value is equal to DEVICE_SETTINGS_UPDATED_EVENT, then the target.resource.resource_type UDM field is set to SETTING. Else, the target.resource.resource_type UDM field is set to DEVICE.
context_aware_access	CAA_DEVICE_ID	principal.asset.asset_id	If the event.name log field value is equal to ACCESS_DENY_EVENT, then the CAA_DEVICE_ID log field is mapped to the principal.asset.asset_id UDM field.
context_aware_access	CAA_DEVICE_STATE	principal.labels [caa_device_state] (deprecated)	If the event.name log field value is equal to ACCESS_DENY_EVENT, then the CAA_DEVICE_STATE log field is mapped to the principal.labels UDM field.
context_aware_access	CAA_DEVICE_STATE	additional.fields [caa_device_state]	If the event.name log field value is equal to ACCESS_DENY_EVENT, then the CAA_DEVICE_STATE log field is mapped to the additional.fields UDM field.
context_aware_access	BLOCKED_API_ACCESS	additional.fields [blocked_api_access]
gplus	attachment_type	target.resource.attribute.labels [attachment_type]	If the event.name log field value is equal to one of the following values, then the attachment_type log field is mapped to the target.resource.attribute.labels UDM field: create_comment edit_comment create_post edit_post
gplus	comment_resource_name	target.resource.product_object_id	If the event.name log field value is equal to one of the following values, then the comment_resource_name log field is mapped to the target.resource.product_object_id UDM field: create_comment delete_comment edit_comment add_plusone remove_plusone
gplus	post_resource_name	target.resource_ancestors.product_object_id	If the event.name log field value is equal to one of the following values, then the post_resource_name log field is mapped to the target.resource_ancestors.product_object_id UDM field: create_comment delete_comment edit_comment add_plusone remove_plusone add_poll_vote remove_poll_vote create_post delete_post content_manager_delete_post edit_post
gplus	post_permalink	target.resource_ancestors.attribute.labels [post_permalink]
gplus	post_visibility	target.resource_ancestors.attribute.labels [post_visibility]
gplus	plusone_context	target.resource_ancestors.attribute.labels [plusone_context]
gplus	post_author_name	target.user.user_display_name	If the event.name log field value is equal to content_manager_delete_post, then the post_resource_name log field is mapped to the target.user.user_display_name UDM field.
data_studio	ASSET_ID	principal.resource.product_object_id	If the ASSET_TYPE log field value is equal to DATA_SOURCE, then the ASSET_ID log field is mapped to the principal.resource.product_object_id UDM field. Else, the ASSET_ID log field is mapped to the target.resource.product_object_id UDM field.
data_studio	ASSET_NAME	principal.resource.name	If the ASSET_TYPE log field value is equal to DATA_SOURCE, then the ASSET_NAME log field is mapped to the principal.resource.name UDM field. Else, the ASSET_NAME log field is mapped to the target.resource.name UDM field.
data_studio	ASSET_TYPE	principal.resource.resource_subtype	If the ASSET_TYPE log field value is equal to DATA_SOURCE, then the ASSET_TYPE log field is mapped to the principal.resource.resource_subtype UDM field. Else, the ASSET_TYPE log field is mapped to the target.resource.resource_subtype UDM field.
data_studio	ASSET_ID	target.resource.product_object_id	If the ASSET_TYPE log field value is equal to DATA_SOURCE, then the ASSET_ID log field is mapped to the principal.resource.product_object_id UDM field. Else, the ASSET_ID log field is mapped to the target.resource.product_object_id UDM field.
data_studio	ASSET_NAME	target.resource.name	If the ASSET_TYPE log field value is equal to DATA_SOURCE, then the ASSET_NAME log field is mapped to the principal.resource.name UDM field. Else, the ASSET_NAME log field is mapped to the target.resource.name UDM field.
data_studio	ASSET_TYPE	target.resource.resource_subtype	If the ASSET_TYPE log field value is equal to DATA_SOURCE, then the ASSET_TYPE log field is mapped to the principal.resource.resource_subtype UDM field. Else, the ASSET_TYPE log field is mapped to the target.resource.resource_subtype UDM field.
data_studio	CONNECTOR_TYPE	target.resource.attribute.labels[connector_type]
data_studio	EMBEDDED_IN_REPORT_ID	target.resource.attribute.labels[embedded_in_report_id]
data_studio	OWNER_EMAIL	principal.user.email_addresses	If the actor.email log field value is not equal to the OWNER_EMAIL, then the OWNER_EMAIL log field is mapped to the principal.user.email_addresses UDM field.
data_studio	TARGET_USER_EMAIL	target.user.email_addresses
data_studio	PRIOR_VISIBILITY	target.resource.attribute.labels [prior_visibility]
data_studio	VISIBILITY	target.resource.attribute.labels [visibility]
data_studio	NEW_VALUE	target.resource.attribute.labels [new_value]
data_studio	OLD_VALUE	target.resource.attribute.labels [old_value]
data_studio	TARGET_DOMAIN	target.domain.name [ target_domain]
data_studio	DATA_EXPORT_TYPE	target.resource.attribute.labels [data_export_type]
mobile		target.resource.resource_type	The target.resource.resource_type UDM field is set to DEVICE.
mobile	ACCOUNT_STATE	target.resource.attribute.labels [account_state]
mobile	ACTION_EXECUTION_STATUS	target.resource.attribute.labels [account_execution_status]
mobile	ACTION_ID	target.resource.attribute.labels [action_id]
mobile	ACTION_TYPE	target.resource.attribute.labels [action_type]
mobile	APK_SHA256_HASH	target.resource.attribute.labels [apk_sha256_hash]
mobile	APPLICATION_ID	target.resource.attribute.labels [application_id]
mobile	APPLICATION_MESSAGE	target.resource.attribute.labels [application_message]
mobile	APPLICATION_REPORT_KEY	target.resource.attribute.labels [application_report_key]
mobile	APPLICATION_REPORT_SEVERITY	target.resource.attribute.labels [application_report_severity]
mobile	APPLICATION_STATE	target.resource.attribute.labels [application_state]
mobile	APPLICATION_REPORT_TIMESTAMP	target.resource.attribute.labels [application_report_timestamp]
mobile	BASIC_INTEGRITY	target.resource.attribute.labels [basic_integrity]
mobile	CTS_PROFILE_MATCH	target.resource.attribute.labels [cts_profile_match]
mobile	DEVICE_COMPLIANCE	target.resource.attribute.labels [device_compliance]
mobile	DEVICE_COMPROMISED_STATE	about.target.resource.attribute.labels [device_compromised_state]
mobile	DEVICE_DEACTIVATION_REASON	target.resource.attribute.labels [device_deactivation_reason]
mobile	DEVICE_ID	target.resource.product_object_id	If the event.name log field value is equal to one of the following values, then the DEVICE_ID log field is mapped to the target.resource.product_object_id UDM field: APPLICATION_EVENT APPLICATION_REPORT_EVENT DEVICE_REGISTER_UNREGISTER_EVENT ADVANCED_POLICY_SYNC_EVENT DEVICE_ACTION_EVENT DEVICE_COMPLIANCE_CHANGED_EVENT OS_UPDATED_EVENT DEVICE_OWNERSHIP_CHANGE_EVENT DEVICE_SETTINGS_UPDATED_EVENT DEVICE_SYNC_EVENT RISK_SIGNAL_UPDATED_EVENT ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT DEVICE_COMPROMISED_EVENT FAILED_PASSWORD_ATTEMPTS_EVENT SUSPICIOUS_ACTIVITY_EVENT
mobile	NEW_DEVICE_ID	target.resource.attribute.labels [new_device_id]	If the NEW_DEVICE_ID log field value is not empty, then the NEW_DEVICE_ID log field is mapped to the target.resource.product_object_id UDM field.
mobile	DEVICE_MODEL	target.resource.attribute.labels [device_model]
mobile	DEVICE_OWNERSHIP	target.resource.attribute.labels [device_ownership]
mobile	DEVICE_PROPERTY	target.resource.attribute.labels [device_property]
mobile	DEVICE_SETTING	target.resource.attribute.labels [device_setting]
mobile	DEVICE_STATUS_ON_APPLE_PORTAL	target.resource.attribute.labels [device_status_on_apple_portal]
mobile	DEVICE_TYPE	target.resource.resource_subtype	If the event.name log field value is equal to one of the following values, then the DEVICE_TYPE log field is mapped to the target.resource.resource_subtype UDM field: APPLICATION_EVENT APPLICATION_REPORT_EVENT DEVICE_REGISTER_UNREGISTER_EVENT ADVANCED_POLICY_SYNC_EVENT DEVICE_ACTION_EVENT DEVICE_COMPLIANCE_CHANGED_EVENT OS_UPDATED_EVENT DEVICE_OWNERSHIP_CHANGE_EVENT DEVICE_SETTINGS_UPDATED_EVENT DEVICE_SYNC_EVENT RISK_SIGNAL_UPDATED_EVENT ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT DEVICE_COMPROMISED_EVENT FAILED_PASSWORD_ATTEMPTS_EVENT SUSPICIOUS_ACTIVITY_EVENT
mobile	FAILED_PASSWD_ATTEMPTS	target.resource.attribute.labels [failed_passwd_attempts]
mobile	IOS_VENDOR_ID	target.resource.attribute.labels [ios_vendor_id]
mobile	NEW_VALUE	target.resource.attribute.labels [new_value]
mobile	OLD_VALUE	target.resource.attribute.labels [old_value]
mobile	OS_EDITION	target.resource.attribute.labels [os_edition]
mobile	OS_PROPERTY	target.resource.attribute.labels [os_property]
mobile	OS_VERSION	target.resource.attribute.labels [os_version]
mobile	PHA_CATEGORY	security_results.detection_fields
mobile	POLICY_NAME	security_result.about.labels [policy_name] (deprecated)
mobile	POLICY_NAME	additional.fields [policy_name]
mobile	POLICY_SYNC_RESULT	security_result.about.labels [policy_sync_result] (deprecated)
mobile	POLICY_SYNC_RESULT	additional.fields [policy_sync_result]
mobile	POLICY_SYNC_TYPE	security_result.about.labels [policy_sync_type] (deprecated)
mobile	POLICY_SYNC_TYPE	additional.fields [policy_sync_type]
mobile	RESOURCE_ID	target.resource.attribute.labels	If the event.name log field value is equal to one of the following values, then the RESOURCE_ID log field is mapped to the target.resource.attribute.labels UDM field: APPLICATION_EVENT APPLICATION_REPORT_EVENT DEVICE_REGISTER_UNREGISTER_EVENT ADVANCED_POLICY_SYNC_EVENT DEVICE_ACTION_EVENT DEVICE_COMPLIANCE_CHANGED_EVENT OS_UPDATED_EVENT DEVICE_OWNERSHIP_CHANGE_EVENT DEVICE_SETTINGS_UPDATED_EVENT DEVICE_SYNC_EVENT RISK_SIGNAL_UPDATED_EVENT ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT DEVICE_COMPROMISED_EVENT FAILED_PASSWORD_ATTEMPTS_EVENT SUSPICIOUS_ACTIVITY_EVENT
mobile	REGISTER_PRIVILEGE	security_result.about.labels [register_privilege] (deprecated)
mobile	REGISTER_PRIVILEGE	additional.fields
mobile	RISK_SIGNAL	security_result.about.labels [risk_signal] (deprecated)
mobile	RISK_SIGNAL	additional.fields [risk_signal]
mobile	SECURITY_EVENT_ID	security_result.about.labels [security_event_id] (deprecated)	If the event.name log field value is equal to APPLICATION_EVENT, then the SECURITY_EVENT_ID log field is mapped to the security_result.about.labels UDM field.
mobile	SECURITY_EVENT_ID	additional.fields	If the event.name log field value is equal to APPLICATION_EVENT, then the SECURITY_EVENT_ID log field is mapped to the additional.fields UDM field.
mobile	SECURITY_PATCH_LEVEL	security_result.about.labels [security_patch_level] (deprecated)	If the event.name log field value is equal to one of the following values, then the SECURITY_PATCH_LEVEL log field is mapped to the security_result.about.labels UDM field: DEVICE_SYNC_EVENT DEVICE_REGISTER_UNREGISTER_EVENT
mobile	SECURITY_PATCH_LEVEL	additional.fields [security_patch_level]	If the event.name log field value is equal to one of the following values, then the SECURITY_PATCH_LEVEL log field is mapped to the additional.fields UDM field: DEVICE_SYNC_EVENT DEVICE_REGISTER_UNREGISTER_EVENT
mobile	SERIAL_NUMBER	target.resource.attribute.labels [serial_number]
mobile	USER_EMAIL	target.user.email_addresses	If the event.name log field value is equal to one of the following values, then the USER_EMAIL log field is mapped to the target.user.email_addresses UDM field: APPLICATION_EVENT APPLICATION_REPORT_EVENT DEVICE_REGISTER_UNREGISTER_EVENT ADVANCED_POLICY_SYNC_EVENT DEVICE_ACTION_EVENT DEVICE_COMPLIANCE_CHANGED_EVENT OS_UPDATED_EVENT DEVICE_OWNERSHIP_CHANGE_EVENT DEVICE_SETTINGS_UPDATED_EVENT DEVICE_SYNC_EVENT RISK_SIGNAL_UPDATED_EVENT ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT DEVICE_COMPROMISED_EVENT FAILED_PASSWORD_ATTEMPTS_EVENT SUSPICIOUS_ACTIVITY_EVENT
mobile	VALUE	security_result.about.labels [value] (deprecated)
mobile	VALUE	additional.fields [value]
mobile	WINDOWS_SYNCML_POLICY_STATUS_CODE	security_result.about.labels [windows_syncml_policy_status_code] (deprecated)
mobile	WINDOWS_SYNCML_POLICY_STATUS_CODE	additional.fields [windows_syncml_policy_status_code]
mobile	LAST_SYNC_AUDIT_DATE	target.resource.attribute.labels[LAST_SYNC_AUDIT_DATE]
groups_enterprise	dynamic_group_query	target.group.attribute.labels [dynamic_group_query]
groups_enterprise	group_id	target.user.group_identifiers	If the event.name log field value is equal to one of the following values, then the group_id log field is mapped to the target.user.group_identifiers UDM field: accept_invitation add_info_setting add_member add_member_role add_security_setting approve_join_request ban_member_with_moderation change_info_setting change_security_setting create_group delete_group add_dynamic_group_query change_dynamic_group_query invite_member join add_membership_expiry remove_membership_expiry update_membership_expiry reject_invitation reject_join_request remove_info_setting remove_member remove_member_role remove_security_setting request_to_join revoke_invitation unban_member
groups_enterprise	info_setting	target.group.attribute.labels [info_setting]
groups_enterprise	member_id	target.user.email_addresses	If the event.name log field value is equal to one of the following values, then the member_id log field is mapped to the target.user.email_addresses UDM field: add_member add_member_role add_service_account_permission approve_join_request ban_member_with_moderation invite_member add_membership_expiry remove_membership_expiry update_membership_expiry reject_join_request remove_member remove_member_role remove_service_account_permission revoke_invitation unban_member
groups_enterprise	member_role	target.user.attribute.roles.name	If the event.name log field value is equal to one of the following values, then the member_role log field is mapped to the target.user.attribute.roles.name UDM field: add_member add_member_role add_service_account_permission remove_member_role remove_service_account_permission
groups_enterprise	member_type	target.user.attribute.labels[member_type]
groups_enterprise	membership_expiry	target.group.attribute.labels [membership_query]
groups_enterprise	namespace	target.group.group_display_name
groups_enterprise	new_value	target.group.attribute.labels [new_value]
groups_enterprise	old_value	target.group.attribute.labels [old_value]
groups_enterprise	value	target.group.attribute.labels [value]
groups_enterprise	security_setting	target.group.attribute.labels [security_setting]
calendar	access_level	security_result.about.labels [access_level] (deprecated)
calendar	access_level	additional.fields [access_level]
calendar	api_kind	target.resource.attribute.labels [api_kind]
calendar	calendar_country	target.resource.attribute.labels [calendar_country]	If the event.name log field value is equal to change_calendar_country, then the calendar_country log field is mapped to the target.resource.attribute.labels UDM field.
calendar	calendar_description	target.resource.attribute.labels [calendar_description]
calendar	calendar_id	target.resource.product_object_id	If the event.name log field value is equal to one of the following values, then the calendar_id log field is mapped to the target.resource.product_object_id UDM field: change_calendar_acls change_calendar_country create_calendar delete_calendar change_calendar_description change_calendar_location change_calendar_timezone change_calendar_title notification_triggered add_subscription delete_subscription create_event delete_event add_event_guest change_event_guest_response_auto remove_event_guest change_event_guest_response change_event remove_event_from_trash restore_event change_event_start_time change_event_title interop_freebusy_lookup_outbound_successful interop_freebusy_lookup_inbound_successful interop_exchange_resource_availability_lookup_successful interop_freebusy_lookup_outbound_unsuccessful interop_freebusy_lookup_inbound_unsuccessful interop_exchange_resource_availability_lookup_unsuccessful transfer_event_requested transfer_event_completed
calendar	calendar_location	target.resource.attribute.labels [calendar_location]
calendar	calendar_timezone	target.resource.attribute.labels [calendar_timezone]
calendar	calendar_title	target.resource.name	If the event.name log field value is equal to change_calendar_title, then the calendar_title log field is mapped to the target.resource.name UDM field.
calendar	end_time	target.resource.attribute.labels [end_time]
calendar	start_time	target.resource.attribute.labels [start_time]
calendar	event_guest	target.labels [event_guest] (deprecated)
calendar	event_guest	additional.fields [event_guest]
calendar	event_id	target.resource.attribute.labels [event_id]	If the event.name log field value is equal to one of the following values, then the event_id log field is mapped to the target.resource.attribute.labels UDM field: notification_triggered add_subscription delete_subscription create_event delete_event add_event_guest change_event_guest_response_auto remove_event_guest change_event_guest_response change_event remove_event_from_trash restore_event change_event_start_time change_event_title transfer_event_requested transfer_event_completed
calendar	event_response_status	target.resource.attribute.labels [event_response_status]
calendar	event_title	target.resource.attribute.labels [event_title]	If the event.name log field value is equal to one of the following values, then the event_title log field is mapped to the target.resource.attribute.labels UDM field: create_event delete_event add_event_guest change_event_guest_response_auto remove_event_guest change_event_guest_response change_event remove_event_from_trash restore_event change_event_start_time change_event_title transfer_event_requested transfer_event_completed
calendar	old_event_title	target.resource.attribute.labels [old_event_title]
calendar	grantee_email	target.user.email_addresses	If the event.name log field value is equal to one of the following values, then the grantee_email log field is mapped to the target.user.email_addresses UDM field: change_calendar_acls transfer_event_requested
calendar	interop_error_code	security_result.action_details	If the event.name log field value is equal to one of the following values, then the interop_error_code log field is mapped to the security_result.action_details UDM field: interop_exchange_resource_list_lookup_successful interop_freebusy_lookup_outbound_unsuccessful interop_freebusy_lookup_inbound_unsuccessful interop_exchange_resource_availability_lookup_unsuccessful interop_exchange_resource_list_lookup_unsuccessful
calendar	notification_message_id	target.resource.attribute.labels [notification_message_id]	If the event.name log field value is equal to one of the following values, then the notification_message_id log field is mapped to the target.resource.attribute.labels UDM field: notification_triggered create_event delete_event add_event_guest remove_event_guest change_event_guest_response change_event restore_event change_event_start_time change_event_title
calendar	notification_method	target.resource.attribute.labels [notification_method]	If the event.name log field value is equal to one of the following values, then the notification_method log field is mapped to the target.resource.attribute.labels UDM field: notification_triggered add_subscription delete_subscription
calendar	notification_type	target.resource.resource_subtype	If the event.name log field value is equal to one of the following values, then the notification_type log field is mapped to the target.resource.resource_subtype UDM field: notification_triggered add_subscription delete_subscription
calendar	organizer_calendar_id	principal.user.attribute.labels[organizer_calendar_id]	If the event.name log field value is equal to one of the following values, then the organizer_calendar_id log field is mapped to the principal.user.attribute.labels[organizer_calendar_id] UDM field: create_event delete_event add_event_guest change_event_guest_response_auto remove_event_guest change_event_guest_response change_event remove_event_from_trash restore_event change_event_start_time change_event_title transfer_event_requested transfer_event_completed
calendar	recipient_email	principal.user.email_addresses	If the event.name log field value is equal to one of the following values, then the recipient_email log field is mapped to the principal.user.email_addresses UDM field: notification_triggered create_event delete_event add_event_guest remove_event_guest change_event_guest_response change_event restore_event change_event_start_time change_event_title
calendar	remote_ews_url	security_result.about.labels [remote_ews_url] (deprecated)
calendar	remote_ews_url	additional.fields [remote_ews_url]
calendar	requested_period_end	security_result.about.labels [requested_period_end] (deprecated)
calendar	requested_period_end	additional.fields [requested_period_end]
calendar	requested_period_start	security_result.about.labels [requested_period_start] (deprecated)
calendar	requested_period_start	additional.fields [requested_period_start]
calendar	subscriber_calendar_id	principal.user.attribute.labels[subscriber_calendar_id]
calendar	user_agent	network.http.user_agent
calendar	target_calendar_id	target.resource.attribute.labels [target_calendar_id]
calendar	user_agent	network.http.user_agent
calendar	target_calendar_id	target.resource.attribute.labels [target_calendar_id]
calendar	client_side_encrypted	target.resource.attribute.labels [client_side_encrypted]
calendar	is_recurring	target.resource.attribute.labels [is_recurring]
calendar	recurring	target.resource.attribute.labels [recurring]
chat	actor	principal.user.email_addresses	The event.name log field is mapped to the principal.user.email_addresses UDM field if the following conditions are met: The actor log field value is not equal to actor.email. The event.name log field value is equal to one of the following values: add_room_member attachment_download attachment_upload block_room block_user direct_message_started invite_accept invite_decline invite_send message_edited message_posted message_reported remove_room_member room_created reaction_added message_deleted
chat	attachment_hash	target.file.sha256	If the event.name log field value is equal to one of the following values, then the attachment_hash log field is mapped to the target.file.sha256 UDM field: attachment_download attachment_upload message_edited message_posted
chat	attachment_name	target.file.names	If the event.name log field value is equal to one of the following values, then the attachment_name log field is mapped to the target.file.names UDM field: attachment_download attachment_upload message_edited message_posted
chat	attachment_url	target.file.full_path	If the event.name log field value is equal to attachment_download, then the attachment_url log field is mapped to the target.file.full_path UDM field.
chat	dlp_scan_status	security_result.action_details	If the event.name log field value is equal to one of the following values, then the dlp_scan_status log field is mapped to the security_result.action_details UDM field: attachment_upload direct_message_started message_edited message_posted
chat	message_id	target.resource.product_object_id	If the event.name log field value is equal to one of the following values, then the message_id log field is mapped to the target.resource.product_object_id UDM field: message_edited message_posted message_reported reaction_added message_deleted
chat	conference_id	target.resource.product_object_id	If the event.name log field value is equal to one of the following values, then the message_id log field is mapped to the target.resource.product_object_id UDM field: call_ended presentation_started invitation_sent
chat		target.resource.resource_subtype	If the event.name log field value is equal to one of the following values, then the target.resource.resource_subtype UDM field is set to Google Chat - Message: message_edited message_posted message_reported
chat	report_type	target.resource.attribute.labels [report_type]
chat	room_id	target.group.product_object_id	If the event.name log field value is equal to one of the following values, then the room_id log field is mapped to the target.group.product_object_id UDM field: add_room_member attachment_download attachment_upload block_room block_user direct_message_started invite_accept invite_decline invite_send message_edited message_posted message_reported remove_room_member room_created reaction_added message_deleted
chat	dm_id	about.labels [dm_id] (deprecated)	If the event.name log field value is equal to direct_message_started, then the about.labels UDM field is set to dm_id.
chat	dm_id	additional.fields [dm_id]	If the event.name log field value is equal to direct_message_started, then the additional.fields UDM field is set to dm_id.
chat	target_users	target.user.email_addresses	If the event.name log field value is equal to one of the following values, then the target_users log field is mapped to the target.user.email_addresses UDM field: add_room_member block_user invite_send message_reported remove_room_member
chat	retention_state	target.user.attribute.labels[retention_state]
chat	room_name	target.group.group_display_name
chat	timestamp_ms	target.resource.attribute.labels [timestamp_ms]
chat	external_room	about.labels[external_room] (deprecated)
chat	external_room	additional.fields[external_room]
chat	device_type	principal.asset.attribute.labels [device_type]
chat	identifier_type	principal.user.attribute.labels [identifier_type]
chat	location_region	principal.user.attribute.labels [location_region]
chat	identifier	principal.user.userid
chat	display_name	principal.user.user_display_name
chat	location_country	principal.location.country_or_region
chat	product_type	principal.resource.resource_subtype
chat	ip_address	target.ip
chat	target_user_count	target.user.attribute.labels[target_user_count]
chat	duration_seconds	target.resource.attribute.labels [duration_seconds]
chat	meeting_code	target.resource.attribute.labels[meeting_code]
chat	organizer_email	about.user.email_addresses
chat	network_estimated_upload_kbps_mean	additional.fields [network_estimated_upload_kbps_mean]
chat	video_recv_fps_mean	additional.fields [video_recv_fps_mean]
chat	screencast_send_fps_mean	additional.fields [screencast_send_fps_mean]
chat	audio_recv_packet_loss_max	additional.fields [audio_recv_packet_loss_max]
chat	video_send_long_side_median_pixels	additional.fields [video_send_long_side_median_pixels]
chat	screencast_recv_packet_loss_mean	additional.fields [screencast_recv_packet_loss_mean]
chat	video_recv_packet_loss_mean	additional.fields [video_recv_packet_loss_mean]
chat	video_recv_long_side_median_pixels	additional.fields [video_recv_long_side_median_pixels]
chat	video_send_packet_loss_mean	additional.fields [video_send_packet_loss_mean]
chat	audio_send_packet_loss_max	additional.fields [audio_send_packet_loss_max]
chat	video_recv_short_side_median_pixels	additional.fields [video_recv_short_side_median_pixels]
chat	screencast_recv_bitrate_kbps_mean	additional.fields [screencast_recv_bitrate_kbps_mean]
chat	calendar_event_id	additional.fields [calendar_event_id]
video_send_fps_mean	additional.fields [video_send_fps_mean]	target
chat	audio_recv_packet_loss_mean	additional.fields [audio_recv_packet_loss_mean]
chat	video_recv_seconds	additional.fields [video_recv_seconds]
chat	video_send_packet_loss_max	additional.fields [video_send_packet_loss_max]
chat	network_recv_jitter_msec_max	additional.fields [network_recv_jitter_msec_max]
chat	network_recv_jitter_msec_mean	additional.fields [network_recv_jitter_msec_mean]
chat	audio_send_seconds	additional.fields [audio_send_seconds]
chat	screencast_send_long_side_median_pixels	additional.fields [screencast_send_long_side_median_pixels]
chat	screencast_recv_seconds	additional.fields [screencast_recv_seconds]
chat	screencast_recv_long_side_median_pixels	additional.fields [screencast_recv_long_side_median_pixels]
chat	screencast_send_bitrate_kbps_mean	additional.fields [screencast_send_bitrate_kbps_mean]
chat	screencast_send_packet_loss_max	additional.fields [screencast_send_packet_loss_max]
chat	video_send_bitrate_kbps_mean	additional.fields [video_send_bitrate_kbps_mean]
chat	screencast_send_seconds	additional.fields [screencast_send_seconds]
chat	audio_send_bitrate_kbps_mean	additional.fields [audio_send_bitrate_kbps_mean]
chat	screencast_recv_fps_mean	additional.fields [screencast_recv_fps_mean]
chat	audio_recv_seconds	additional.fields [audio_recv_seconds]
chat	video_recv_packet_loss_max	additional.fields [video_recv_packet_loss_max]
chat	screencast_send_packet_loss_mean	additional.fields [screencast_send_packet_loss_mean]
chat	network_transport_protocol	additional.fields [network_transport_protocol]
chat	screencast_recv_short_side_median_pixels	additional.fields [screencast_recv_short_side_median_pixels]
chat	screencast_send_short_side_median_pixels	additional.fields [screencast_send_short_side_median_pixels]
chat	screencast_recv_packet_loss_max	additional.fields [screencast_recv_packet_loss_max]
chat	is_external	additional.fields [is_external]
chat	video_send_short_side_median_pixels	additional.fields [video_send_short_side_median_pixels]
chat	endpoint_id	additional.fields [endpoint_id]
chat	network_estimated_download_kbps_mean	additional.fields [network_estimated_download_kbps_mean]
chat	network_send_jitter_msec_mean	additional.fields [network_send_jitter_msec_mean]
chat	video_send_seconds	additional.fields [video_send_seconds]
chat	network_rtt_msec_mean	additional.fields [network_rtt_msec_mean]
chat	network_congestion	additional.fields [network_congestion]
chat	audio_send_packet_loss_mean	additional.fields [audio_send_packet_loss_mean]
chat	action_time	additional.fields [action_time]
gcp	USER_EMAIL	principal.user.email_addresses	If the actor.email log field value is empty, then the USER_EMAIL log field is mapped to the principal.user.email_addresses UDM field.
drive	actor_is_collaborator_account	about.labels [actor_is_collaborator_account] (deprecated)
drive	actor_is_collaborator_account	additional.fields [actor_is_collaborator_account]
drive	added_role	target.user.attribute.roles.name	If the event.name log field value is equal to shared_drive_membership_change, then the added_role log field is mapped to the target.user.attribute.roles.name UDM field.
drive	requested_role	target.user.attribute.roles.name	If the event.name log field value is equal to request_access, then the requested_role log field is mapped to the target.user.attribute.roles.name UDM field.
drive	billable	about.labels [billable] (deprecated)
drive	billable	additional.fields [billable]
drive	copy_type	about.labels [copy_type] (deprecated)
drive	copy_type	additional.fields [copy_type]
drive	destination_folder_id	target.resource.product_object_id	If the event.name log field value is equal to one of the following values, then the destination_folder_id log field is mapped to the target.resource.product_object_id UDM field: add_to_folder move unmovable_item_reparented
drive	doc_id	target.resource.product_object_id	If the event.name log field value is equal to one of the following values, then the doc_id log field is mapped to the target.resource.product_object_id UDM field: add_to_folder approval_canceled approval_comment_added approval_completed approval_decisions_reset approval_due_time_change approval_requested approval_reviewer_change approval_reviewer_responded copy create delete download email_as_attachment edit label_added label_added_by_item_create label_field_changed label_removed add_lock move preview print remove_from_folder rename untrash sheets_import_range source_copy trash remove_lock unmovable_item_reparented upload view apply_security_update shared_drive_apply_security_update shared_drive_remove_security_update publish_change change_acl_editors change_document_access_scope change_document_access_scope_hierarchy_reconciled change_document_visibility change_document_visibility_hierarchy_reconciled remove_security_update shared_drive_membership_change shared_drive_settings_change sheets_import_range_access_change change_user_access change_user_access_hierarchy_reconciled connected_sheets_query create_comment accept_suggestion change_owner create_suggestion delete_comment delete_suggestion edit_comment expire_access_request reassign_comment reject_suggestion reopen_comment request_access resolve_comment download_forms_response email_collaborators
drive	destination_folder_title	target.resource.name	If the event.name log field value is equal to one of the following values, then the destination_folder_title log field is mapped to the target.resource.name UDM field: add_to_folder move unmovable_item_reparented
drive	doc_title	target.resource.name	If the event.name log field value is equal to one of the following values, then the doc_title log field is mapped to the target.resource.name UDM field: add_to_folder approval_canceled approval_comment_added approval_completed approval_decisions_reset approval_due_time_change approval_requested approval_reviewer_change approval_reviewer_responded copy create delete download email_as_attachment edit label_added label_added_by_item_create label_field_changed label_removed add_lock move preview print remove_from_folder rename untrash sheets_import_range source_copy trash remove_lock unmovable_item_reparented upload view apply_security_update shared_drive_apply_security_update shared_drive_remove_security_update publish_change change_acl_editors change_document_access_scope change_document_access_scope_hierarchy_reconciled change_document_visibility change_document_visibility_hierarchy_reconciled remove_security_update shared_drive_membership_change shared_drive_settings_change sheets_import_range_access_change change_user_access change_user_access_hierarchy_reconciled connected_sheets_query create_comment accept_suggestion change_owner create_suggestion delete_comment delete_suggestion edit_comment expire_access_request reassign_comment reject_suggestion reopen_comment request_access resolve_comment download_forms_response email_collaborators
drive	doc_id	src.resource.product_object_id	If the event.name log field value is equal to one of the following values, then the doc_id log field is mapped to the src.resource.product_object_id UDM field: add_to_folder move unmovable_item_reparented
drive	doc_title	src.resource.name	If the event.name log field value is equal to one of the following values, then the doc_title log field is mapped to the src.resource.name UDM field: add_to_folder move unmovable_item_reparented
drive	doc_type	target.resource.attribute.labels[doc_type]	If the event.name log field value is equal to one of the following values, then the doc_type log field is mapped to the target.resource.attribute.labels[doc_type] UDM field: add_to_folder approval_canceled approval_comment_added approval_completed approval_decisions_reset approval_due_time_change approval_requested approval_reviewer_change approval_reviewer_responded copy create delete download email_as_attachment edit label_added label_added_by_item_create label_field_changed label_removed add_lock move preview print remove_from_folder rename untrash sheets_import_range source_copy trash remove_lock unmovable_item_reparented upload view apply_security_update shared_drive_apply_security_update shared_drive_remove_security_update publish_change change_acl_editors change_document_access_scope change_document_access_scope_hierarchy_reconciled change_document_visibility change_document_visibility_hierarchy_reconciled remove_security_update shared_drive_membership_change shared_drive_settings_change sheets_import_range_access_change change_user_access change_user_access_hierarchy_reconciled connected_sheets_query create_comment accept_suggestion change_owner create_suggestion delete_comment delete_suggestion edit_comment expire_access_request reassign_comment reject_suggestion reopen_comment request_access resolve_comment download_forms_response email_collaborators
drive	doc_type	src.resource.attribute.labels [doc_type]	If the event.name log field value is equal to one of the following values, then the doc_type log field is mapped to the src.resource.attribute.labels [doc_type] UDM field: add_to_folder move unmovable_item_reparented
drive	field	target.resource.attribute.labels [field]
drive	field_id	target.resource.attribute.labels [field_id]
drive	is_encrypted	target.labels [is_encrypted] (deprecated)
drive	is_encrypted	additional.fields [is_encrypted]
drive	label	target.resource.attribute.labels [label]
drive	label_title	target.resource.attribute.labels [label_title]
drive	membership_change_type	about.labels [membership_change_type] (deprecated)
drive	membership_change_type	additional.fields [membership_change_type]
drive	new_publish_visibility	target.resource.attribute.labels [new_publish_visibility]
drive	new_value	target.resource.attribute.labels [new_value]
drive	new_value_id	target.resource.attribute.labels [new_value_id]
drive	new_settings_state	about.labels [new_settings_state] (deprecated)
drive	new_settings_state	additional.fields [new_settings_state]
drive	old_settings_state	about.labels [old_settings_state] (deprecated)
drive	old_settings_state	additional.fields [old_settings_state]
drive	old_publish_visibility	target.resource.attribute.labels [old_publish_visibility]
drive	old_value	target.resource.attribute.labels [old_value]
drive	old_value_id	target.resource.attribute.labels [old_value_id]
drive	old_visibility	target.resource.attribute.labels [old_visibility]
drive	originating_app_id	about.labels [originating_app_id] (deprecated)
drive	originating_app_id	additional.fields [originating_app_id]
drive	owner	target.resource.attribute.labels[owner]
drive	owner_is_shared_drive	target.resource.attribute.labels [owner_is_shared_drive]
drive	primary_event	about.labels [primary_event] (deprecated)
drive	primary_event	additional.fields [primary_event]
drive	reason	security_result.summary	If the event.name log field value is equal to one of the following values, then the reason log field is mapped to the security_result.summary UDM field: label_added label_added_by_item_create label_field_changed label_removed
drive	removed_role	target.user.attribute.labels [removed_role] and target.user.roles.description	If the removed_role log field value is equal to commenter, then the target.user.roles.description UDM field is set to Team Drive role Commenter. If the removed_role log field value is equal to content_manager, then the target.user.roles.description UDM field is set to Team Drive role Content manager. If the removed_role log field value is equal to editor, then the target.user.roles.description UDM field is set to Team Drive role Contributor. If the removed_role log field value is equal to none, then the target.user.roles.description UDM field is set to No role in Team Drive. If the removed_role log field value is equal to organizer, then the target.user.roles.description UDM field is set to Team Drive role Manager. If the removed_role log field value is equal to viewer, then the target.user.roles.description UDM field is set to Team Drive role Viewer.
drive	target_domain	target.domain.name	If the event.name log field value is equal to one of the following values, then the target_domain log field is mapped to the target.domain.name UDM field: change_document_access_scope change_document_access_scope_hierarchy_reconciled change_document_visibility change_document_visibility_hierarchy_reconciled
drive	target_user	target.user.email_addresses	If the event.name log field value is equal to one of the following values, then the target_user log field is mapped to the target.user.email_addresses UDM field: change_user_access change_user_access_hierarchy_reconciled expire_access_request request_access
drive	target_user	additional.fields[target_user]
drive	new_owner	target.user.email_addresses	The new_owner log field is mapped to the target.user.email_addresses UDM field if the following conditions are met: The event.name log field value matches the regular expression pattern ^.+@.+$. The event.name log field value is equal to change_owner. Else, the new_owner log field is mapped to the target.user.attribute.labels UDM field.
drive	target	target.user.email_addresses	If the event.name log field value matches the regular expression pattern ^.+@.+$, then the target log field is mapped to the target.user.email_addresses UDM field.
drive	target	target.user.attribute.labels[target]	If the event.name log field value does not match the regular expression pattern ^.+@.+$, then the target log field is mapped to the target.user.attribute.labels[target] UDM field.
drive	recipients	target.user.email_addresses	If the event.name log field value is equal to email_collaborators, then the recipients log field is mapped to the target.user.email_addresses UDM field.
drive	shared_drive_id	target.resource_ancestors.product_object_id
drive	shared_drive_settings_change_type	about.labels [shared_drive_settings_change_type] (deprecated)
drive	shared_drive_settings_change_type	additional.fields [shared_drive_settings_change_type]
drive	sheets_import_range_recipient_doc	target.resource.attribute.labels [sheets_import_range_recipient_doc]
drive	source_folder_id	principal.resource.id	If the event.name log field value is equal to one of the following values, then the source_folder_id log field is mapped to the principal.resource.id UDM field: unmovable_item_reparented remove_from_folder move
drive	source_folder_title	principal.resource.name	If the event.name log field value is equal to one of the following values, then the source_folder_title log field is mapped to the principal.resource.name UDM field: move remove_from_folder unmovable_item_reparented
drive	storage_entity_id	about.labels [storage_entity_id] (deprecated)
drive	storage_entity_id	additional.fields [storage_entity_id]
drive	storage_usage_in_bytes	about.labels [storage_usage_in_bytes] (deprecated)
drive	storage_usage_in_bytes	additional.fields [storage_usage_in_bytes]
drive	visibility	target.resource.attribute.labels [visibility]
drive	visibility_change	target.resource.attribute.labels [visibility_change]
drive	team_drive_id	target.group.product_object_id
drive	owner_is_team_drive	target.resource.attribute.labels [owner_is_team_drive]
drive	data_connection_id	about.labels[data_connection_id] (deprecated)
drive	data_connection_id	additional.fields[data_connection_id]
drive	delegating_principal	about.user.email_addresses	If the actor.email log field value is not equal to delegating_principal, then the delegating_principal log field is mapped to about.user.email_addresses UDM field.
drive	execution_id	about.labels[execution_id] (deprecated)
drive	execution_id	additional.fields[execution_id]
drive	execution_trigger	about.labels[execution_trigger] (deprecated)
drive	execution_trigger	additional.fields[execution_trigger]
drive	query_type	about.labels[query_type] (deprecated)
drive	query_type	additional.fields[query_type]
drive	owner_team_drive_id	target.resource.attribute.labels[owner_team_drive_id]
drive	new_owner_is_team_drive	target.resource.attribute.labels [new_owner_is_team_drive]
drive	new_owner_team_drive_id	target.resource.attribute.labels[new_owner_team_drive_id]
drive	owner_shared_drive_id	target.resource.attribute.labels[owner_shared_drive_id]
drive	dlp_info	target.resource.attribute.labels[dlp_info]
drive	team_drive_settings_change_type	target.resource.attribute.labels[team_drive_settings_change_type]
drive	accessed_url	target.url
drive	script_id	additional.fields[script_id]
drive	additional.fields[script_id]	additional.fields[api_method]
keep	attachment_name	target.resource.attribute.labels [attachment_name]	If the event.name log field value is equal to one of the following values, then the attachment_name log field is mapped to the target.resource.attribute.labels UDM field: deleted_attachment uploaded_attachment
keep	note_name	target.url	If the event.name log field value is equal to one of the following values, then the note_name log field is mapped to the target.url UDM field: deleted_attachment uploaded_attachment edited_note_content created_note deleted_note modified_acl
keep	owner_email	principal.user.email_addresses	If the actor.email log field value is empty, then the owner_email log field is mapped to the principal.user.email_addresses UDM field.
keep		target.resource_subtype	The target.resource_subtype UDM field is set to keep.
meet	action_description	security_result.action_details	If the event.name log field value is equal to abuse_report_submitted, then the action_description log field is mapped to the security_result.action_details UDM field.
meet	action_reason	security_result.summary
meet	conference_id	target.resource.product_object_id	If the event.name log field value is equal to one of the following values, then the conference_id log field is mapped to the target.resource.product_object_id UDM field: abuse_report_submitted call_ended livestream_watched knocking_accepted knocking_denied presentation_started presentation_stopped recording_activity invitation_sent
meet	calendar_event_id	target.labels [calendar_event_id] (deprecated)
meet	calendar_event_id	additional.fields [calendar_event_id]
meet	device_type	principal.asset.attribute.labels [device_type]
meet	display_name	principal.user.user_display_name	If the event.name log field value is equal to one of the following values, then the display_name log field is mapped to the principal.user.user_display_name UDM field: abuse_report_submitted call_ended livestream_watched
meet	target_display_names	target.user.user_display_name	If the event.name log field value is equal to abuse_report_submitted, then the target_display_name log field is mapped to the target.user.user_display_name UDM field.
meet	duration_seconds	target.resource.attribute.labels [duration_seconds]
meet	end_of_call_rating	target.resource.attribute.labels [end_of_call_rating]
meet	endpoint_id	security_result.about.labels [endpoint_id] (deprecated)
meet	endpoint_id	additional.fields [endpoint_id]
meet	identifier	principal.user.userid	If the event.name log field value is equal to one of the following values, then the identifier log field is mapped to the principal.user.userid UDM field: abuse_report_submitted call_ended knocking_accepted knocking_denied presentation_started presentation_stopped invitation_sent
meet	identifier_type	principal.user.attribute.labels [identifier_type]
meet	ip_address	target.ip	If the ipAddress log field value is empty, then the ip_address log field is mapped to the target.ip UDM field.
meet	is_external	principal.labels [is_external] (deprecated)
meet	is_external	additional.fields [is_external]
meet	livestream_view_page_id	target.resource.attribute.labels [livestream_view_page_id]
meet	location_country	principal.location.country_or_region	If the event.name log field value is equal to call_ended, then the location_country log field is mapped to the principal.location.country_or_region UDM field.
meet	location_region	principal.user.attribute.labels [location_region]	If the event.name log field value is equal to call_ended, then the location_region log field is mapped to the principal.location.country_or_region UDM field.
meet	meeting_code	target.resource.product_object_id	If the event.name log field value is equal to one of the following values, then the meeting_code log field is mapped to the target.resource.product_object_id UDM field: abuse_report_submitted call_ended livestream_watched knocking_accepted knocking_denied presentation_started presentation_stopped invitation_sent
meet	organizer_email	about.user.email_addresses	If the event.name log field value is equal to one of the following values, then the organizer_email log field is mapped to the about.user.email_addresses UDM field: abuse_report_submitted call_ended livestream_watched
meet	product_type	principal.resource.resource_subtype	If the event.name log field value is equal to one of the following values, then the product_type log field is mapped to the principal.resource.resource_subtype UDM field: abuse_report_submitted call_ended livestream_watched
meet	target_email	target.user.email_addresses	If the event.name log field value is equal to abuse_report_submitted, then the target_email log field is mapped to the target.user.email_addresses UDM field.
meet	target_phone_number	target.user.phone_numbers	If the event.name log field value is equal to abuse_report_submitted, then the target_phone_number log field is mapped to the target.user.phone_numbers UDM field.
meet	audio_recv_packet_loss_max	about.labels [audio_recv_packet_loss_max] (deprecated)
meet	audio_recv_packet_loss_max	additional.fields [audio_recv_packet_loss_max]
meet	audio_recv_packet_loss_mean	about.labels [audio_recv_packet_loss_mean] (deprecated)
meet	audio_recv_packet_loss_mean	additional.fields [audio_recv_packet_loss_mean]
meet	audio_recv_seconds	about.labels [audio_recv_seconds] (deprecated)
meet	audio_recv_seconds	additional.fields [audio_recv_seconds]
meet	audio_send_bitrate_kbps_mean	about.labels [audio_send_bitrate_kbps_mean] (deprecated)
meet	audio_send_bitrate_kbps_mean	additional.fields [audio_send_bitrate_kbps_mean]
meet	audio_send_packet_loss_max	about.labels [audio_send_packet_loss_max] (deprecated)
meet	audio_send_packet_loss_max	additional.fields [audio_send_packet_loss_max]
meet	audio_send_packet_loss_mean	about.labels [audio_send_packet_loss_mean] (deprecated)
meet	audio_send_packet_loss_mean	additional.fields [audio_send_packet_loss_mean]
meet	audio_send_seconds	about.labels [audio_send_seconds] (deprecated)
meet	audio_send_seconds	additional.fields [audio_send_seconds]
meet	network_congestion	about.labels [network_congestion] (deprecated)
meet	network_congestion	additional.fields [network_congestion]
meet	network_estimated_download_kbps_mean	about.labels [network_estimated_download_kbps_mean] (deprecated)
meet	network_estimated_download_kbps_mean	additional.fields [network_estimated_download_kbps_mean]
meet	network_estimated_upload_kbps_mean	about.labels [network_estimated_upload_kbps_mean] (deprecated)
meet	network_estimated_upload_kbps_mean	additional.fields [network_estimated_upload_kbps_mean]
meet	network_recv_jitter_msec_max	about.labels [network_recv_jitter_msec_max] (deprecated)
meet	network_recv_jitter_msec_max	additional.fields [network_recv_jitter_msec_max]
meet	network_recv_jitter_msec_mean	about.labels [network_recv_jitter_msec_mean] (deprecated)
meet	network_recv_jitter_msec_mean	additional.fields [network_recv_jitter_msec_mean]
meet	network_rtt_msec_mean	about.labels [network_rtt_msec_mean] (deprecated)
meet	network_rtt_msec_mean	additional.fields [network_rtt_msec_mean]
meet	network_send_jitter_msec_mean	about.labels [network_send_jitter_msec_mean] (deprecated)
meet	network_send_jitter_msec_mean	additional.fields [network_send_jitter_msec_mean]
meet	network_transport_protocol	about.labels [network_transport_protocol] (deprecated)
meet	network_transport_protocol	additional.fields [network_transport_protocol]
meet	screencast_recv_bitrate_kbps_mean	about.labels [screencast_recv_bitrate_kbps_mean] (deprecated)
meet	screencast_recv_bitrate_kbps_mean	additional.fields [screencast_recv_bitrate_kbps_mean]
meet	screencast_recv_fps_mean	about.labels [screencast_recv_fps_mean] (deprecated)
meet	screencast_recv_fps_mean	additional.fields [screencast_recv_fps_mean]
meet	screencast_recv_long_side_median_pixels	about.labels [screencast_recv_long_side_median_pixels] (deprecated)
meet	screencast_recv_long_side_median_pixels	additional.fields [screencast_recv_long_side_median_pixels]
meet	screencast_recv_packet_loss_max	about.labels [screencast_recv_packet_loss_max] (deprecated)
meet	screencast_recv_packet_loss_max	additional.fields [screencast_recv_packet_loss_max]
meet	screencast_recv_packet_loss_mean	about.labels [screencast_recv_packet_loss_mean] (deprecated)
meet	screencast_recv_packet_loss_mean	additional.fields [screencast_recv_packet_loss_mean]
meet	screencast_recv_seconds	about.labels [screencast_recv_seconds] (deprecated)
meet	screencast_recv_seconds	additional.fields [screencast_recv_seconds]
meet	screencast_recv_short_side_median_pixels	about.labels [screencast_recv_short_side_median_pixels] (deprecated)
meet	screencast_recv_short_side_median_pixels	additional.fields [screencast_recv_short_side_median_pixels]
meet	screencast_send_bitrate_kbps_mean	about.labels [screencast_send_bitrate_kbps_mean] (deprecated)
meet	screencast_send_bitrate_kbps_mean	additional.fields [screencast_send_bitrate_kbps_mean]
meet	screencast_send_fps_mean	about.labels [screencast_send_fps_mean] (deprecated)
meet	screencast_send_fps_mean	additional.fields [screencast_send_fps_mean]
meet	screencast_send_long_side_median_pixels	about.labels [screencast_send_long_side_median_pixels] (deprecated)
meet	screencast_send_long_side_median_pixels	additional.fields [screencast_send_long_side_median_pixels]
meet	screencast_send_packet_loss_max	about.labels [screencast_send_packet_loss_max] (deprecated)
meet	screencast_send_packet_loss_max	additional.fields [screencast_send_packet_loss_max]
meet	screencast_send_packet_loss_mean	about.labels [screencast_send_packet_loss_mean] (deprecated)
meet	screencast_send_packet_loss_mean	additional.fields [screencast_send_packet_loss_mean]
meet	screencast_send_seconds	about.labels [screencast_send_seconds] (deprecated)
meet	screencast_send_seconds	additional.fields [screencast_send_seconds]
meet	screencast_send_short_side_median_pixels	about.labels [screencast_send_short_side_median_pixels] (deprecated)
meet	screencast_send_short_side_median_pixels	additional.fields [screencast_send_short_side_median_pixels]
meet	video_recv_fps_mean	about.labels [video_recv_fps_mean] (deprecated)
meet	video_recv_fps_mean	additional.fields [video_recv_fps_mean]
meet	video_recv_long_side_median_pixels	about.labels [video_recv_long_side_median_pixels] (deprecated)
meet	video_recv_long_side_median_pixels	additional.fields [video_recv_long_side_median_pixels]
meet	video_recv_packet_loss_max	about.labels [video_recv_packet_loss_max] (deprecated)
meet	video_recv_packet_loss_max	additional.fields [video_recv_packet_loss_max]
meet	video_recv_packet_loss_mean	about.labels [video_recv_packet_loss_mean] (deprecated)
meet	video_recv_packet_loss_mean	additional.fields [video_recv_packet_loss_mean]
meet	video_recv_seconds	about.labels [video_recv_seconds] (deprecated)
meet	video_recv_seconds	additional.fields [video_recv_seconds]
meet	video_recv_short_side_median_pixels	about.labels [video_recv_short_side_median_pixels] (deprecated)
meet	video_recv_short_side_median_pixels	additional.fields [video_recv_short_side_median_pixels]
meet	video_send_bitrate_kbps_mean	about.labels [video_send_bitrate_kbps_mean] (deprecated)
meet	video_send_bitrate_kbps_mean	additional.fields [video_send_bitrate_kbps_mean]
meet	video_send_fps_mean	about.labels [video_send_fps_mean] (deprecated)
meet	video_send_fps_mean	additional.fields [video_send_fps_mean]
meet	video_send_long_side_median_pixels	about.labels [video_send_long_side_median_pixels] (deprecated)
meet	video_send_long_side_median_pixels	additional.fields [video_send_long_side_median_pixels]
meet	video_send_packet_loss_max	about.labels [video_send_packet_loss_max] (deprecated)
meet	video_send_packet_loss_max	additional.fields [video_send_packet_loss_max]
meet	video_send_packet_loss_mean	about.labels [video_send_packet_loss_mean] (deprecated)
meet	video_send_packet_loss_mean	additional.fields [video_send_packet_loss_mean]
meet	video_send_seconds	about.labels [video_send_seconds] (deprecated)
meet	video_send_seconds	additional.fields [video_send_seconds]
meet	video_send_short_side_median_pixels	about.labels [video_send_short_side_median_pixels] (deprecated)
meet	video_send_short_side_median_pixels	additional.fields [video_send_short_side_median_pixels]
meet	action_time	about.labels[action_time] (deprecated)
meet	action_time	additional.fields[action_time]
meet	target_user_count	target.user.attribute.labels[target_user_count]
meet	streaming_session_state	about.labels[streaming_session_state] (deprecated)
meet	streaming_session_state	additional.fields[streaming_session_state]
login	affected_email_address	target.user.email_addresses	If the event.name log field value is equal to one of the following values, then the affected_email_address log field is mapped to the target.user.email_addresses UDM field: account_disabled_password_leak suspicious_login suspicious_login_less_secure_app suspicious_programmatic_login account_disabled_generic account_disabled_spamming_through_relay account_disabled_spamming account_disabled_hijacked blocked_sender
login	login_timestamp	security_result.detection_fields [login_timestamp]
login	is_second_factor	about.labels[is_2sv] (deprecated)
login	is_second_factor	additional.fields[is_2sv]
login	is_suspicious	about.labels[is_suspicious] (deprecated)
login	is_suspicious	additional.fields[is_suspicious]
login	login_failure_type	scurity_result.summary
login	login_challenge_status	about.labels[login_challenge_status] (deprecated)
login	login_challenge_status	additional.fields[login_challenge_status]
login	login_challenge_method	security_result.detection_fields [login_challenge_method]
login	login_challenge_method	security_result.detection_fields [login_challenge_method_attempts_count]
login	login_type	security_result.detection_fields [login_type]
login	sensitive_action_name	security_result.action_details [sensitive_action_name]
login		extensions.auth.mechanism	If the param.value log field value is equal to google_password, then the extensions.auth.mechanism UDM field is set to USERNAME_PASSWORD. Else, the extensions.auth.mechanism UDM field is set to MECHANISM_UNSPECIFIED.
login		extensions.auth.type	If the param.value log field value is equal to google_password, then the extensions.auth.type UDM field is set to SSO.
login		security_result.action	If the event.name log field value is equal to one of the following values, then the security_result.action UDM field is set to BLOCK: login_failure risky_sensitive_action_blocked
token	api_name	about.resource.attribute.labels [api_name]
token	app_name	target.resource.name	If the event.name log field value is equal to one of the following values, then the app_name log field is mapped to the target.resource.name UDM field: activity authorize revoke
token	client_id	principal.asset.attribute.labels [client_id]	If the event.name log field value is equal to one of the following values, then the client_id log field is mapped to the principal.asset.attribute.labels UDM field: activity authorize revoke
token	client_type	principal.asset.attribute.labels [client_type]
token	method_name	target.resource.attribute.labels [method_name]
token	num_response_bytes	target.resource.attribute.labels [num_response_bytes]
token	product_bucket	target.resource.attribute.labels product_bucket]
token	scope	target.resource.attribute.labels [scope]
token	scope_data	target.resource.attribute.labels [scope_data]
token	rejection_type	target.resource.attribute.labels [rejection_type]
rules	actions	security_result.action_details [actions]
rules	triggered_actions	security_result.action_details [actions]
rules	actor_ip_address	principal.ip	If the ipAddress log field value is equal to empty, then the actor_ip_address log field is mapped to the principal.ip UDM field.
rules	application	target.resource.attribute.labels[application]
rules	conference_id	target.resource.attribute.labels [conference_id]
rules	data_source	security_result.detection_fields [data_source]
rules	device_id	target.asset.asset_id	If the event.name log field value is equal to one of the following values, then the device_id log field is mapped to the target.asset.asset_id UDM field: action_complete label_field_value_changed label_applied
rules	device_type	target.asset.attribute.labels[device_type]
rules	drive_shared_drive_id	target.resource.attribute.labels[drive_shared_drive_id]
rules	evaluation_context	about.labels [evaluation_context] (deprecated)
rules	evaluation_context	additional.fields [evaluation_context]
rules	has_alert	security_result.about.labels [has_alert] (deprecated)
rules	has_alert	additional.fields [has_alert]
rules	has_content_match	security_result.about.labels [has_content_match] (deprecated)
rules	has_content_match	additional.fields [has_content_match]
rules	matched_detectors	security_result.detection_fields [matched_detectors]
rules	matched_templates	security_result.detection_fields [matched_templates]
rules	matched_threshold	security_result.detection_fields [matched_threshold]
rules	matched_trigger	security_result.detection_fields [matched_trigger]
rules	mobile_device_type	target.asset.category	If the event.name log field value is equal to rule_match, then the mobile_device_type log field is mapped to the target.asset.category UDM field.
rules	mobile_ios_vendor_id	target.asset.attribute.labels [mobile_ios_vendor_id]
rules	resource_id	target.resource.product_object_id	If the event.name log field value is equal to one of the following values, then the resource_id log field is mapped to the target.resource.product_object_id UDM field: action_complete rule_match label_field_value_changed label_applied
rules	resource_name	target.resource.name	If the event.name log field value is equal to rule_match, then the resource_name log field is mapped to the target.resource.name UDM field.
rules	resource_title	target.labels [resource_title] (deprecated)
rules	resource_title	additional.fields [resource_title]
rules	resource_owner_email	principal.user.email_addresses	If the actor.email log field value is not equal to resource_owner_email, then the principal.user.email_addresses UDM field is set to resource_owner_email.
rules	resource_recipients	principal.user.email_addresses	If the actor.email log field value is not equal to resource_recipients, then the principal.user.email_addresses UDM field is set to resource_recipients.
rules	resource_recipients_omitted_count	target.labels [resource_recipients_omitted_count] (deprecated)
rules	resource_recipients_omitted_count	additional.fields [resource_recipients_omitted_count]
rules	resource_type	target.resource.resource_subtype	If the event.name log field value is equal to one of the following values, then the resource_type log field is mapped to the target.resource.resource_subtype UDM field: action_complete label_field_value_changed label_applied sharing_blocked
rules	rule_name	security_result.rule_name	If the event.name log field value is equal to one of the following values, then the rule_name log field is mapped to the security_result.rule_name UDM field: action_complete rule_match rule_trigger label_field_value_changed label_applied
rules	rule_id	security_result.rule_id	If the event.name log field value is equal to rule_match, then the rule_id log field is mapped to the security_result.rule_id UDM field.
rules	rule_resource_name	security_result.rule_labels [rule_resource_name]
rules	rule_type	security_result.rule_type	If the event.name log field value is equal to one of the following values, then the rule_type log field is mapped to the security_result.rule_type UDM field: action_complete rule_trigger label_field_value_changed sharing_blocked
rules	rule_update_time_usec	security_result.rule_labels [rule_update_time_usec]
rules	scan_type	security_result.about.labels [scan_type] (deprecated)
rules	scan_type	additional.fields [scan_type]
rules	severity	security_result.severity	If the event.name log field value is equal to one of the following values, then the severity log field is mapped to the security_result.severity UDM field: action_complete rule_trigger
rules	space_id	target.resource.attribute.labels [space_id]
rules	space_type	target.resource.attribute.labels [space_type]
rules	suppressed_actions	security_result.about.labels [suppressed_actions] (deprecated)
rules	suppressed_actions	additional.fields [suppressed_actions]
rules	label_field	target.resource.attribute.labels [label_field]
rules	label_title	target.resource.attribute.labels [label_title]
rules	new_value	target.resource.attribute.labels [new_value]
rules	old_value	target.resource.attribute.labels [old_value]
rules	blocked_recipients	target.user.email_addresses
rules	snippets	target.resource.attribute.labels [snippets]
saml	application_name	target.application	If the event.name log field value is equal to one of the following values, then the application_name log field is mapped to the target.application UDM field: login_failure login_success
saml	device_id	principal.asset.asset_id	If the event.name log field value is equal to one of the following values, then the device_id log field is mapped to the principal.asset.assetid UDM field: login_failure login_success
saml	failure_type	security_result.summary	If the event.name log field value is equal to login_failure, then the failure_type log field is mapped to the security_result.summary UDM field.
saml	initiated_by	security_result.detection_fields[initiated_by]	If the event.name log field value is equal to one of the following values, then the initiated_by log field is mapped to the security_result.detection_fields UDM field: login_failure login_success
saml	orgunit_path	target.user.attribute.labels [orgunit_path]	If the event.name log field value is equal to one of the following values, then the orgunit_path log field is mapped to the target.user.attribute.labels UDM field: login_failure login_success
saml	saml_second_level_status_code	security_result.about.labels [saml_second_level_status_code] (deprecated)
saml	saml_second_level_status_code	additional.fields [saml_second_level_status_code]
saml	saml_status_code	security_result.about.labels [saml_status_code] (deprecated)
saml	saml_status_code	additional.fields [saml_status_code]
saml		security_result.action	If the event.name log field value is equal to login_failure, then the security_result.action UDM field is set to BLOCK.
user_accounts	email_forwarding_destination_address	target.user.email_addresses
groups	acl_permission	target.group.attribute.roles.name	If the event.name log field value is equal to change_acl_permission, then the acl_permission log field is mapped to the target.group.attribute.roles.name UDM field.
groups	basic_setting	target.group.attribute.labels [basic_setting]
groups	group_email	target.group.email_addresses	If the event.name log field value is equal to one of the following values, then the group_email log field is mapped to the target.group.email_addresses UDM field: change_acl_permission accept_invitation approve_join_request join request_to_join change_basic_setting create_group delete_group change_identity_setting add_info_setting change_info_setting remove_info_setting change_new_members_restrictions_setting change_post_replies_setting change_spam_moderation_setting change_topic_setting moderate_message always_post_from_user add_user ban_user_with_moderation revoke_invitation invite_user reject_join_request reinvite_user remove_user change_email_subscription_type unsubscribe_via_mail
groups	identity_setting	target.group.attribute.labels [identity_setting]
groups	info_setting	target.group.attribute.labels [info_setting]
groups	message_id	network.email.mail_id	If the event.name log field value is equal to moderate_message, then the message_id log field is mapped to the network.email.mail_id UDM field.
groups	message_moderation_action	target.group.attribute.labels [message_moderation_action]
groups	member_role	target.user.attribute.roles.name	If the event.name log field value is equal to add_user, then the member_role log field is mapped to the target.user.attribute.roles.name UDM field.
groups	new_members_restrictions_setting	target.group.attribute.labels [new_members_restrictions_setting]
groups	new_value	target.group.attribute.labels [new_value]
groups	new_value_repeated	target.group.attribute.labels [new_value_repeated]
groups	old_value	target.group.attribute.labels [old_value]
groups	old_value_repeated	target.group.attribute.labels [old_value_repeated]
groups	post_replies_setting	target.group.attribute.labels [post_replies_setting]
groups	spam_moderation_setting	target.group.attribute.labels [spam_moderation_setting]
groups	status	target.group.attribute.labels[status]
groups	topic_setting	target.group.attribute.labels [topic_setting]
groups	user_email	target.user.email_addresses	If the event.name log field value is equal to one of the following values, then the user_email log field is mapped to the target.user.email_addresses UDM field: approve_join_request always_post_from_user add_user ban_user_with_moderation revoke_invitation invite_user reject_join_request reinvite_user remove_user change_email_subscription_type
groups	user_email	principal.user.email_addresses	If the event.name log field value is equal to unsubscribe_via_mail and the actor.email log field value is not equal to the user_email, then the user_email log field is mapped to the principal.user.email_addresses UDM field.
groups	value	target.group.attribute.labels [value_of_info_setting]
admin	USER_EMAIL	src.user.email_addresses	If the event.name log field value is equal to CREATE_DATA_TRANSFER_REQUEST, then the USER_EMAIL log field is mapped to the src.user.email_addresses UDM field.
admin	USER_EMAIL	target.user.email_addresses	If the event.name log field value is equal to one of the following values, then the USER_EMAIL log field is mapped to the target.user.email_addresses UDM field: DELETE_2SV_SCRATCH_CODES GENERATE_2SV_SCRATCH_CODES REVOKE_3LO_TOKEN REVOKE_3LO_DEVICE_TOKENS ADD_RECOVERY_EMAIL ADD_RECOVERY_PHONE GRANT_ADMIN_PRIVILEGE REVOKE_ADMIN_PRIVILEGE REVOKE_ASP TOGGLE_AUTOMATIC_CONTACT_SHARING BULK_UPLOAD_NOTIFICATION_SENT CANCEL_USER_INVITE CHANGE_USER_CUSTOM_FIELD CHANGE_USER_EXTERNAL_ID CHANGE_USER_GENDER CHANGE_USER_IM ENABLE_USER_IP_WHITELIST CHANGE_USER_KEYWORD CHANGE_USER_LANGUAGE CHANGE_USER_LOCATION CHANGE_USER_ORGANIZATION CHANGE_USER_PHONE_NUMBER CHANGE_RECOVERY_EMAIL CHANGE_RECOVERY_PHONE CHANGE_USER_RELATION CHANGE_USER_ADDRESS CREATE_EMAIL_MONITOR CREATE_DATA_TRANSFER_REQUEST CREATE_DATA_TRANSFER_REQUEST CHANGE_PASSWORD DELETE_ACCOUNT_INFO_DUMP DELETE_EMAIL_MONITOR DELETE_MAILBOX_DUMP DELETE_PROFILE_PHOTO CHANGE_FIRST_NAME xyz_RESET_USER CHANGE_LAST_NAME MAIL_ROUTING_DESTINATION_ADDED MAIL_ROUTING_DESTINATION_REMOVED ADD_NICKNAME REMOVE_NICKNAME CHANGE_PASSWORD_ON_NEXT_LOGIN REMOVE_RECOVERY_EMAIL REMOVE_RECOVERY_PHONE REQUEST_ACCOUNT_INFO REQUEST_MAILBOX_DUMP RESEND_USER_INVITE RESEND_USER_INVITE RESET_SIGNIN_COOKIES SECURITY_KEY_REGISTERED_FOR_USER REVOKE_SECURITY_KEY USER_INVITE VIEW_TEMP_PASSWORD TURN_OFF_2_STEP_VERIFICATION UNBLOCK_USER_SESSION UPDATE_PROFILE_PHOTO UNENROLL_USER_FROM_TITANIUM ARCHIVE_USER UPDATE_BIRTHDATE CREATE_USER DELETE_USER DOWNGRADE_USER_FROM_GPLUS USER_ENROLLED_IN_TWO_STEP_VERIFICATION MOVE_USER_TO_ORG_UNIT USER_PUT_IN_TWO_STEP_VERIFICATION_GRACE_PERIOD RENAME_USER UNENROLL_USER_FROM_STRONG_AUTH SUSPEND_USER UNARCHIVE_USER UNDELETE_USER UNSUSPEND_USER UPGRADE_USER_TO_GPLUS USERS_BULK_UPLOAD_NOTIFICATION_SENT ASSIGN_ROLE USER_LICENSE_ASSIGNMENT USER_LICENSE_REVOKE ADD_GROUP_MEMBER REMOVE_GROUP_MEMBER UNASSIGN_ROLE ACTION_REQUESTED
admin	DESTINATION_USER_EMAIL	target.user.email_addresses
admin	DEVICE_ID	target.asset.asset_id	If the event.name log field value is equal to one of the following values, then the DEVICE_ID log field is mapped to the target.asset.asset_id UDM field: REVOKE_3LO_DEVICE_TOKENS ACTION_REQUESTED
admin	DEVICE_TYPE	target.platform	If the DEVICE_TYPE log field value matches the regular expression pattern (?i)windows, then the target.platform UDM field is set to WINDOWS. Else, if the DEVICE_TYPE log field value matches the regular expression pattern (?i)mac, then the target.platform UDM field is set to MAC. Else, if the DEVICE_TYPE log field value matches the regular expression pattern (?i)linux, then the target.platform UDM field is set to LINUX. Else, if the DEVICE_TYPE log field value matches the regular expression pattern (?i)ios, then the target.platform UDM field is set to IOS. Else, if the DEVICE_TYPE log field value matches the regular expression pattern (?i)android, then the target.platform UDM field is set to ANDROID. Else, if the DEVICE_TYPE log field value matches the regular expression pattern (?i)chrome, then the target.platform UDM field is set to CHROME_OS.
admin	APP_ID	target.resource.name	If the event.name log field value is equal to one of the following values, then the APP_ID log field is mapped to the target.resource.name UDM field: REVOKE_3LO_TOKEN REMOVE_APPLICATION ADD_APPLICATION
admin	NEW_VALUE	target.resource.name	If the event.name log field value is equal to MAIL_ROUTING_DESTINATION_ADDED, then the NEW_VALUE log field is mapped to the target.resource.name UDM field.
admin	SETTING_NAME	target.resource.name	If the event.name log field value is equal to one of the following values, then the SETTING_NAME log field is mapped to the target.resource.name UDM field: CHANGE_GROUP_SETTING CHANGE_EMAIL_SETTING CREATE_APPLICATION_SETTING CHANGE_APPLICATION_SETTING CHANGE_DOCS_SETTING ENFORCE_STRONG_AUTHENTICATION CHANGE_GMAIL_SETTING DELETE_GMAIL_SETTING CREATE_GMAIL_SETTING
admin	CERTIFICATE_NAME	target.resource.name	If the event.name log field value is equal to GENERATE_CERTIFICATE, then the CERTIFICATE_NAME log field is mapped to the target.resource.name UDM field.
admin	ACCESS_LEVEL_NAME	target.resource.name	If the event.name log field value is equal to UPDATE_ACCESS_LEVEL_V2, then the ACCESS_LEVEL_NAME log field is mapped to the target.resource.name UDM field.
admin	ASP_ID	target.labels [asp_id] (deprecated)
admin	ASP_ID	additional.fields [asp_id]
admin	NEW_VALUE	target.resource.attribute.labels [new_value]	If the event.name log field value is equal to one of the following values, then the NEW_VALUE log field is mapped to the target.resource.attribute.labels UDM field: CHANGE_MOBILE_APPLICATION_SETTINGS CREATE_APPLICATION_SETTING CHANGE_APPLICATION_SETTING CHANGE_DOCS_SETTING CHANGE_CALENDAR_SETTING
admin	NEW_VALUE	target.labels [new_value] (deprecated)	If the event.name log field value is equal to one of the following values, then the NEW_VALUE log field is mapped to the target.labels UDM field: CHANGE_DOMAIN_DEFAULT_TIMEZONE CHANGE_DOMAIN_DEFAULT_LOCALE TOGGLE_SERVICE_ENABLED MOVE_ORG_UNIT EDIT_ORG_UNIT_NAME ALLOW_STRONG_AUTHENTICATION CHANGE_TWO_STEP_VERIFICATION_FREQUENCY CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION CHANGE_TWO_STEP_VERIFICATION_START_DATE WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED ENFORCE_STRONG_AUTHENTICATION
admin	NEW_VALUE	additional.fields [new_value]	If the event.name log field value is equal to one of the following values, then the NEW_VALUE log field is mapped to the additional.fields UDM field: CHANGE_DOMAIN_DEFAULT_TIMEZONE CHANGE_DOMAIN_DEFAULT_LOCALE TOGGLE_SERVICE_ENABLED MOVE_ORG_UNIT EDIT_ORG_UNIT_NAME ALLOW_STRONG_AUTHENTICATION CHANGE_TWO_STEP_VERIFICATION_FREQUENCY CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION CHANGE_TWO_STEP_VERIFICATION_START_DATE WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED ENFORCE_STRONG_AUTHENTICATION
admin	NEW_VALUE	target.user.attribute.labels [new_value]
admin	NEW_VALUE	target.user.user_display_name	If the event.name log field value is equal to one of the following values, then the NEW_VALUE log field is mapped to the target.user.user_display_name UDM field: CHANGE_DISPLAY_NAME RENAME_USER
admin	NEW_VALUE	target.user.first_name	If the event.name log field value is equal to CHANGE_FIRST_NAME, then the NEW_VALUE log field is mapped to the target.user.first_name UDM field.
admin	NEW_VALUE	target.user.last_name	If the event.name log field value is equal to CHANGE_LAST_NAME, then the NEW_VALUE log field is mapped to the target.user.last_name UDM field.
admin	OLD_VALUE	target.resource.attribute.labels [old_value]	If the event.name log field value is equal to one of the following values, then the OLD_VALUE log field is mapped to the target.resource.attribute.labels UDM field: CHANGE_MOBILE_APPLICATION_SETTINGS CREATE_APPLICATION_SETTING CHANGE_APPLICATION_SETTING CHANGE_DOCS_SETTING CHANGE_CALENDAR_SETTING
admin	OLD_VALUE	target.labels [old_value] (deprecated)	If the event.name log field value is equal to one of the following values, then the OLD_VALUE log field is mapped to the target.labels UDM field: CHANGE_DOMAIN_DEFAULT_TIMEZONE CHANGE_DOMAIN_DEFAULT_LOCALE TOGGLE_SERVICE_ENABLED MOVE_ORG_UNIT EDIT_ORG_UNIT_NAME ALLOW_STRONG_AUTHENTICATION CHANGE_TWO_STEP_VERIFICATION_FREQUENCY CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION CHANGE_TWO_STEP_VERIFICATION_START_DATE WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED ENFORCE_STRONG_AUTHENTICATION
admin	OLD_VALUE	additional.fields [old_value]	If the event.name log field value is equal to one of the following values, then the OLD_VALUE log field is mapped to the additional.fields UDM field: CHANGE_DOMAIN_DEFAULT_TIMEZONE CHANGE_DOMAIN_DEFAULT_LOCALE TOGGLE_SERVICE_ENABLED MOVE_ORG_UNIT EDIT_ORG_UNIT_NAME ALLOW_STRONG_AUTHENTICATION CHANGE_TWO_STEP_VERIFICATION_FREQUENCY CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION CHANGE_TWO_STEP_VERIFICATION_START_DATE WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED ENFORCE_STRONG_AUTHENTICATION
admin	OLD_VALUE	target.user.attribute.labels [old_value]
admin	BULK_UPLOAD_FAIL_USERS_NUMBER	target.user.attribute.labels [bulk_upload_fail_users_number]
admin	BULK_UPLOAD_TOTAL_USERS_NUMBER	target.user.attribute.labels [bulk_upload_total_users_number]
admin	SYSTEM_DEFINED_RULE_NAME	security_result.rule_name	If the event.name log field value is equal to SYSTEM_DEFINED_RULE_UPDATED, then the SYSTEM_DEFINED_RULE_NAME log field is mapped to the security_result.rule_name UDM field.
admin	ALERT_NAME	security_result.rule_name
admin	SECURITY_CENTER_RULE_NAME	security_result.rule_name
admin	DOMAIN_NAME	target.domain.name
admin	USER_CUSTOM_FIELD	target.user.attribute.labels [user_custom_field]
admin	BEGIN_DATE_TIME	target.resource.attribute.labels [begin_date_time]
admin	EMAIL_MONITOR_DEST_EMAIL	target.resource.attribute.labels [email_monitor_dest_email]
admin	EMAIL_MONITOR_LEVEL_CHAT	target.resource.attribute.labels [email_monitor_level_chat]
admin	EMAIL_MONITOR_LEVEL_DRAFT_EMAIL	target.resource.attribute.labels [email_monitor_level_draft_email]
admin	EMAIL_MONITOR_LEVEL_INCOMING_EMAIL	target.resource.attribute.labels [email_monitor_level_incoming_email]
admin	EMAIL_MONITOR_LEVEL_OUTGOING_EMAIL	target.resource.attribute.labels [email_monitor_level_outgoing_email]
admin	END_DATE_TIME	target.resource.attribute.labels [end_date_time]
admin	APPLICATION_NAME	target.application	If the event.name log field value is equal to one of the following values, then the APPLICATION_NAME log field is mapped to the target.application UDM field: CREATE_EMAIL_MONITOR DELETE_EMAIL_MONITOR REMOVE_APPLICATION ADD_APPLICATION CREATE_APPLICATION_SETTING
admin	SERVICE_NAME	target.application	If the event.name log field value is equal to TOGGLE_SERVICE_ENABLED, then the SERVICE_NAME log field is mapped to the target.application UDM field.
admin	REAUTH_APPLICATION	target.application	If the event.name log field value is equal to SESSION_CONTROL_SETTINGS_CHANGE, then the REAUTH_APPLICATION log field is mapped to the target.application UDM field.
admin	OAUTH2_SERVICE_NAME	target.application	If the event.name log field value is equal to DISALLOW_SERVICE_FOR_OAUTH2_ACCESS, then the OAUTH2_SERVICE_NAME log field is mapped to the target.application UDM field.
admin	OAUTH2_APP_NAME	target.application	If the event.name log field value is equal to one of the following values, then the OAUTH2_APP_NAME log field is mapped to the target.application UDM field: ADD_TO_TRUSTED_OAUTH2_APPS ADD_TO_BLOCKED_OAUTH2_APPS
admin	REQUEST_ID	target.labels [request_id] (deprecated)
admin	REQUEST_ID	additional.fields [request_id]
admin	GMAIL_RESET_REASON	security_result.summary
admin	USER_NICKNAME	target.user.attribute.labels[nickname]
admin	EMAIL_EXPORT_INCLUDE_DELETED	target.resource.attribute.labels [email_export_include_deleted]
admin	EMAIL_EXPORT_PACKAGE_CONTENT	target.resource.attribute.labels [email_export_package_content]
admin	SEARCH_QUERY_FOR_DUMP	target.resource.attribute.labels [search_query_for_dump]
admin	BIRTHDATE	target.user.attribute.labels [birthdate]
admin	ORG_UNIT_NAME	target.labels[org_unit_name] (deprecated)	If the event.name log field value is equal to one of the following values, then the ORG_UNIT_NAME log field is mapped to the target.labels UDM field: TOGGLE_SERVICE_ENABLED CREATE_ORG_UNIT MOVE_ORG_UNIT EDIT_ORG_UNIT_NAME REMOVE_ORG_UNIT UNASSIGN_CUSTOM_LOGO ASSIGN_CUSTOM_LOGO EDIT_ORG_UNIT_DESCRIPTION CHANGE_TWO_STEP_VERIFICATION_FREQUENCY CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS CHANGE_TWO_STEP_VERIFICATION_START_DATE WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED
admin	ORG_UNIT_NAME	additional.fields[org_unit_name]	If the event.name log field value is equal to one of the following values, then the ORG_UNIT_NAME log field is mapped to the additional.fields UDM field: TOGGLE_SERVICE_ENABLED CREATE_ORG_UNIT MOVE_ORG_UNIT EDIT_ORG_UNIT_NAME REMOVE_ORG_UNIT UNASSIGN_CUSTOM_LOGO ASSIGN_CUSTOM_LOGO EDIT_ORG_UNIT_DESCRIPTION CHANGE_TWO_STEP_VERIFICATION_FREQUENCY CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS CHANGE_TWO_STEP_VERIFICATION_START_DATE WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED
admin	ORG_UNIT_NAME	about.labels[org_unit_name] (deprecated)
admin	ORG_UNIT_NAME	additional.fields[org_unit_name]
admin	ROLE_ID	target.resource.attribute.labels[role_id]
admin	ROLE_NAME	target.resource.attribute.roles.name
admin	API_SCOPES	target.user.attribute.labels[api_scopes]
admin	API_CLIENT_NAME	target.user.userid	If the API_CLIENT_NAME log field value matches the regular expression ^(.){1,256}$, then the API_CLIENT_NAME log field is mapped to the target.user.userid UDM field.
admin	API_CLIENT_NAME	target.user.attribute.labels[api_client_name]	If the API_CLIENT_NAME log field value doesn't match the regular expression ^(.){1,256}$, then the API_CLIENT_NAME log field is mapped to the target.user.attribute.labels[api_client_name] UDM field.
admin	EMAIL_LOG_SEARCH_END_DATE	about.labels[email_log_search_end_date] (deprecated)
admin	EMAIL_LOG_SEARCH_END_DATE	additional.fields[email_log_search_end_date]
admin	EMAIL_LOG_SEARCH_MSG_ID	network.email.mail_id
admin	EMAIL_LOG_SEARCH_RECIPIENT	network.email.to
admin	EMAIL_LOG_SEARCH_SENDER	network.email.from
admin	EMAIL_LOG_SEARCH_SMTP_RECIPIENT_IP	about.labels[email_log_search_smtp_recipient_ip] (deprecated)
admin	EMAIL_LOG_SEARCH_SMTP_RECIPIENT_IP	additional.fields[email_log_search_smtp_recipient_ip]
admin	EMAIL_LOG_SEARCH_SMTP_SENDER_IP	about.labels[email_log_search_smtp_sender_ip] (deprecated)
admin	EMAIL_LOG_SEARCH_SMTP_SENDER_IP	additional.fields[email_log_search_smtp_sender_ip]
admin	EMAIL_LOG_SEARCH_START_DATE	about.labels[email_log_search_start_date] (deprecated)
admin	EMAIL_LOG_SEARCH_START_DATE	additional.fields[email_log_search_start_date]
admin	ALERT_ID	security_result.detection_fields[alert_id]
admin	INVESTIGATION_DATA_SOURCE	security_result.detection_fields[investigation_data_source]
admin	INVESTIGATION_QUERY	security_result.detection_fields[investigation_query]
admin	GROUP_EMAIL	target.group.email_addresses
admin	PRODUCT_NAME	target.resource.attribute.labels[product_name]
admin	INVESTIGATION_ACTION	security_result.detection_fields[investigation_action]
admin	INVESTIGATION_ENTITY_IDS	security_result.detection_fields[investigation_entity_ids]
admin	INVESTIGATION_OBJECT_IDENTIFIER	security_result.detection_fields[investigation_object_identifier]
admin	INVESTIGATION_URL_DISPLAY_TEXT	security_result.detection_fields[investigation_display_text]
admin	CHART_NAME	about.labels [chart_name] (deprecated)
admin	CHART_NAME	additional.fields [chart_name]
admin	CHART_FILTERS	about.labels [chart_filters] (deprecated)
admin	CHART_FILTERS	additional.fields [chart_filters]
admin	START_DATE	about.labels [start_date] (deprecated)
admin	START_DATE	additional.fields [start_date]
admin	END_DATE	about.labels [end_date] (deprecated)
admin	END_DATE	additional.fields [end_date]
admin		target.resource.resource_type	If the event.name log field value is not equal to one of the following values, then the target.resource.resource_type UDM field is set to SETTING: EMAIL_LOG_SEARCH ALERT_CENTER_LIST_FEEDBACK ALERT_CENTER_GET_SIT_LINK ALERT_CENTER_LIST_RELATED_ALERTS ALERT_CENTER_LIST_CHANGE SECURITY_INVESTIGATION_QUERY SECURITY_INVESTIGATION_ACTION SECURITY_INVESTIGATION_OBJECT_CREATE_DRAFT_INVESTIGATION SECURITY_CHART_DRILLDOWN CHANGE_DEVICE_STATE SECURITY_INVESTIGATION_ACTION_COMPLETION If the event.name log field value is equal to GENERATE_CERTIFICATE, then the target.resource.resource_type UDM field is set to CREDENTIAL.
admin	SYSTEM_DEFINED_RULE_ACTION_STATUS_CHANGE	security_result.rule_labels[system_defined_rule_action_status_change]
admin	SYSTEM_DEFINED_RULE_ACTION_SEVERITY_CHANGE	security_result.rule_labels[system_defined_rule_action_severity_change]
admin	SYSTEM_DEFINED_RULE_ACTION_RECEIVERS_CHANGE	security_result.rule_labels[system_defined_rule_action_receivers_change]
admin	COMPANY_DEVICE_ID	target.asset_id
admin	APPLICATION_ENABLED	target.labels[application_enabled] (deprecated)
admin	APPLICATION_ENABLED	additional.fields[application_enabled]
admin	DISTRIBUTION_ENTITY_NAME	target.labels[distribution_entity_name] (deprecated)
admin	DISTRIBUTION_ENTITY_NAME	additional.fields[distribution_entity_name]
admin	DISTRIBUTION_ENTITY_TYPE	target.labels[distribution_entity_type] (deprecated)
admin	DISTRIBUTION_ENTITY_TYPE	additional.fields[distribution_entity_type]
admin	MOBILE_APP_PACKAGE_ID	target.labels[mobile_app_package_id] (deprecated)
admin	MOBILE_APP_PACKAGE_ID	additional.fields[mobile_app_package_id]
admin	APPLICATION_EDITION	target.labels[application_edition] (deprecated)
admin	APPLICATION_EDITION	additional.fields[application_edition]
admin	REAUTH_SETTING_NEW	target.labels[reauth_setting_new] (deprecated)
admin	REAUTH_SETTING_NEW	additional.fields[reauth_setting_new]
admin	REAUTH_SETTING_OLD	target.labels[reauth_setting_old] (deprecated)
admin	REAUTH_SETTING_OLD	additional.fields[reauth_setting_old]
admin	ALLOWED_TWO_STEP_VERIFICATION_METHOD	target.labels[allowed_2sv_method] (deprecated)
admin	ALLOWED_TWO_STEP_VERIFICATION_METHOD	additional.fields[allowed_2sv_method]
admin	CERTIFICATE_TYPE	target.resource.resource_subtype
admin	SAML2_SERVICE_PROVIDER_ENTITY_ID	about.labels[saml2_service_provider_entity_id] (deprecated)
admin	SAML2_SERVICE_PROVIDER_ENTITY_ID	additional.fields[saml2_service_provider_entity_id]
admin	SAML2_SERVICE_PROVIDER_NAME	about.labels[saml2_service_provider_name] (deprecated)
admin	SAML2_SERVICE_PROVIDER_NAME	additional.fields[saml2_service_provider_name]
admin	SERVICE_ACCOUNT_EMAIL	about.user.email_addresses
admin		about.user.account_type	If the event.name log field value is equal to ENABLE_DIRECTORY_SYNC and the SERVICE_ACCOUNT_EMAIL log field value is not empty, then the about.user.account_type UDM field is set to SERVICE_ACCOUNT_TYPE.
admin	DEVICE_NEW_STATE	target.asset.attribute.labels[device_new_state]
admin	DEVICE_PREVIOUS_STATE	target.asset.attribute.labels[device_previous_state]
admin	DEVICE_SERIAL_NUMBER	target.asset.hardware.serial_number
admin	INVESTIGATION_ACTION_NUM_ATTEMPTED	security_result.detection_fields[investigation_action_num_attempt]
admin	INVESTIGATION_ACTION_NUM_SUCCESS	security_result.detection_fields[investigation_action_num_success]
admin	INVESTIGATION_ACTION_NUM_FAILED	security_result.detection_fields[investigation_action_num_failed]
admin	INVESTIGATION_ACTION_IDENTIFIER	security_result.detection_fields[investigation_action_identifier]
admin	INVESTIGATION_ACTION_ID	security_result.detection_fields[investigation_action_id]
admin	SETTING_DESCRIPTION	target.resource.attribute.labels[setting_description]
admin	USER_DEFINED_SETTING_NAME	target.resource.attribute.labels[user_defined_setting_name]
admin	ACTION_TYPE	security_result.action_details
admin		security_result.action	If the ACTION_TYPE log field value is equal to BLOCK, then the security_result.action UDM field is set to BLOCK. Else, the security_result.action UDM field is set to ALLOW.
admin	ACTION_ID	security_result.detection_fields[action_id]
admin	OAUTH2_APP_ID	additional.fields [oauth2_app_id]
admin	OAUTH2_APP_TYPE	additional.fields [oauth2_app_type]
admin	ACCESS_LEVEL_TITLE	target.resource.attribute.labels [access_level_title]
admin	ACCESS_LEVEL_CURR_STATE	target.resource.attribute.labels [access_level_curr_state]
admin	ACCESS_LEVEL_PREV_STATE	target.resource.attribute.labels [access_level_prev_state]
admin	AUTH_PRINCIPLE_EMAIL	principal.user.email_addresses	If the actor.email log field value is not equal to the AUTH_PRINCIPLE_EMAIL, then the AUTH_PRINCIPLE_EMAIL log field is mapped to the principal.user.email_addresses UDM field.
admin	INVESTIGATION_ADMIN_EMAIL	principal.user.email_addresses	If the actor.email log field value is not equal to the INVESTIGATION_ADMIN_EMAIL, then the INVESTIGATION_ADMIN_EMAIL log field is mapped to the principal.user.email_addresses UDM field.
admin		target.resource.resource_type	If the event.name log field value is equal to UPDATE_ACCESS_LEVEL_V2, then the target.resource.resource_type UDM field is set to ACCESS_POLICY.
admin	APP_RESOURCE_ID	additional.fields [app_resource_id]
admin	SECURITY_CENTER_RULE_TRIGGER_WINDOW	security_result.rule_labels[security_center_rule_trigger_window]
admin	SECURITY_CENTER_RULE_CONDITION	security_result.rule_labels[security_center_rule_condition]
admin	SECURITY_CENTER_RULE_THRESHOLD	security_result.rule_labels[security_center_rule_threshold]
admin	SECURITY_CENTER_RULE_TIME_FRAME	security_result.rule_labels[security_center_rule_time_frame]
admin	SECURITY_CENTER_RULE_ACTION	security_result.rule_labels[security_center_rule_action]
admin	QUARANTINE_NAME	additional.fields[quarantine_name]
jamboard	CURRENT_JAMBOARD_NAME	target.asset.attribute.labels [current_jamboard_name]	If the event.name log field value is equal to one of the following values, then the CURRENT_JAMBOARD_NAME log field is mapped to the target.asset.attribute.labels UDM field: DEVICE_LICENSE_ENROLLMENT_CHANGE DEVICE_OTA_UPDATE_REQUESTED DEVICE_PROVISIONING_CHANGE DEVICE_REBOOT_REQUESTED ADB_ENABLED_STATE_CHANGE DEVICE_ADDITIONAL_IMES_CHANGE DEVICE_LOGGING_CHANGE DEMO_MODE_AVAILABILITY_CHANGE DEMO_MODE_CHANGE FINGER_ERASING_CHANGE DEVICE_LANGUAGE_CHANGE DEVICE_LOCATION_CHANGE DEVICE_NAME_CHANGE DEVICE_NOTE_CHANGE DEVICE_PAIRING_CHANGE SCREENSAVER_TIMEOUT_CHANGE DEVICE_SETTING_LOCKED DEVICE_SETTING_UNLOCKED VIDEOCONF_ENABLED_CHANGE DEVICE_UPDATE
jamboard	JAMBOARD_ID	target.asset.asset_id
jamboard	LICENSE_ENROLLMENT_STATE	target.asset.attribute.labels [license_enrollment_state]
jamboard	PROVISION_STATE	target.asset.attribute.labels [provision_state]
jamboard	ON_OFF	target.asset.attribute.labels [on_off]
jamboard	NEW_ADDITIONAL_IMES	target.asset.attribute.labels [new_additional_imes]
jamboard	OLD_ADDITIONAL_IMES	target.asset.attribute.labels [old_additional_imes]
jamboard	NEW_DEMO_MODE_AVAILABILITY	target.asset.attribute.labels [new_demo_mode_availability]
jamboard	OLD_DEMO_MODE_AVAILABILITY	target.asset.attribute.labels [old_demo_mode_availability]
jamboard	NEW_LANGUAGE	target.asset.attribute.labels [new_language]
jamboard	OLD_LANGUAGE	target.asset.attribute.labels [old_language]
jamboard	NEW_LOCATION	target.asset.location.name	If the event.name log field value is equal to DEVICE_LOCATION_CHANGE, then the NEW_LOCATION log field is mapped to the target.asset.location.name UDM field.
jamboard	OLD_LOCATION	target.asset.attribute.labels [old_location]
jamboard	OLD_JAMBOARD_NAME	target.asset.attribute.labels [old_jamboard_name]
jamboard	NEW_NOTE	target.resource.attribute.labels [new_note]
jamboard	OLD_NOTE	target.resource.attribute.labels [old_note]
jamboard	DEVICE_TYPE	target.asset.attribute.labels [device_type]
jamboard	NEW_DEVICE	target.asset.attribute.labels [new_device]
jamboard	OLD_DEVICE	target.asset.attribute.labels [old_device]
jamboard	NEW_TIMEOUT_VALUE	target.asset.attribute.labels [new_timeout_value]
jamboard	OLD_TIMEOUT_VALUE	target.asset.attribute.labels [old_timeout_value]
jamboard	JAMBOARD_SETTING	target.asset.attribute.labels [jamboard_setting]
jamboard	COMPONENT	target.asset.attribute.labels [component]
jamboard	NEW_VERSION	target.asset.software.version	If the event.name log field value is equal to DEVICE_UPDATE, then the NEW_VERSION log field is mapped to the target.asset.software.version UDM field.
jamboard	OLD_VERSION	target.asset.attribute.labels [old_version]
gmail	events.parameters[delivery].msgValue[message_info].parameter.value[description]	metadata.description
gmail	events.parameters[delivery].msgValue[event_info].parameter.intValue[timestamp_usec]	metadata.event_timestamp
gmail	events.parameters[delivery].msgValue[event_info].parameter.intValue[mail_event_type]	metadata.product_event_type
gmail	id.applicationName	metadata.product_name
gmail		metadata.vendor_name	The metadata.vendor_name UDM field is set to Google Workspace.
gmail	events.parameters[delivery].msgValue[message_info].parameter.value[rfc2822_message_id]	network.email.mail_id
gmail	events.parameters[delivery].msgValue[message_info].parameter.value[subject]	network.email.subject
gmail	events.parameters[delivery].msgValue[message_info].parameter.intValue[payload_size]	network.sent_bytes
gmail	events.parameters[delivery].msgValue[event_info].parameter.intValue[elapsed_time_usec]	network.session_duration
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_tls_state]	network.smtp.is_tls	If this log field value is equal to 0, then the network.smtp.is_tls UDM field is set to false. Else, if this log field value is equal to 1, then the network.smtp.is_tls UDM field is set to true.
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.value[address]	network.smtp.rcpt_to
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_response_reason]	network.smtp.server_response	If this log field value is equal to 1, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - Default reason messages are rejected or accepted. Else, if this log field value is equal to 3, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - Malware. Else, if this log field value is equal to 4, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - DMARC policy. Else, if this log field value is equal to 5, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - Unsupported attachment (by Gmail). Else, if this log field value is equal to 6, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - Receive limit exceeded. Else, if this log field value is equal to 7, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - Account over quota. Else, if this log field value is equal to 8, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - Bad PTR record. Else, if this log field value is equal to 9, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - Recipient doesn't exist. Else, if this log field value is equal to 10, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - Customer policy. Else, if this log field value is equal to 12, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - RFC violation. Else, if this log field value is equal to 13, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - Blatant spam. Else, if this log field value is equal to 14, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - Denial of service. Else, if this log field value is equal to 15, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - Malicious or spammy links. Else, if this log field value is equal to 16, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - Low IP reputation. Else, if this log field value is equal to 17, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - Low domain reputation. Else, if this log field value is equal to 18, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - IP listed in public Real-time Blackhole List (RBL). Else, if this log field value is equal to 19, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - Temporarily rejected due to DoS limits. Else, if this log field value is equal to 20, then the network.smtp.server_response UDM field is set to events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code] - Permanently rejected due to DoS limits.
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[smtp_tls_cipher]	network.tls.cipher
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[smtp_tls_version]	network.tls.version
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[client_host_zone]	principal.administrative_domain
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[source].parameter.value[service]	principal.application
gmail	events.parameters[delivery].msgValue[message_owner].parameter.value[customer_domain]	principal.domain.name
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[client_ip]	principal.ip
gmail	actor.gaiaId	principal.labels[actor_gaiaid] (deprecated)
gmail	actor.gaiaId	additional.fields[actor_gaiaid]
gmail	actor.orgunitPath	principal.labels[actor_orgunitpath] (deprecated)
gmail	actor.orgunitPath	additional.fields[actor_orgunitpath]
gmail	events.parameters[delivery].msgValue[message_owner].parameter.multiIntValue[gaia_ids]	principal.labels[message_owner_gaia_id] (deprecated)
gmail	events.parameters[delivery].msgValue[message_owner].parameter.multiIntValue[gaia_ids]	additional.fields[message_owner_gaia_id]
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[source].parameter.value[selector]	principal.labels[source_selector] (deprecated)
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[source].parameter.value[selector]	additional.fields[source_selector]
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[source].parameter.value[from_header_address],events.parameters[delivery].msgValue[message_owner].parameter.multiStrValue[addresses]	principal.user.email_addresses
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[source].parameter.value[address]	principal.user.email_addresses
gmail	events.parameters[delivery].msgValue[message_owner].parameter.multiStrValue[addresses]	principal.user.email_addresses
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[source].parameter.value[from_header_displayname]	principal.user.user_display_name
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[source].parameter.intValue[user_id]	principal.user.userid
gmail	events.parameters[delivery].msgValue[message_info].parameter.value[flattened_destinations]	target.labels[flattened_destinations] (deprecated)
gmail	events.parameters[delivery].msgValue[message_info].parameter.value[flattened_destinations]	additional.fields[flattened_destinations]
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.value[service]	target.application	This log field is mapped to target.application UDM field when index value in events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination] is equal to 0. For every other index value, this log field is mapped to the about.application.
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.intValue[rcpt_response]	target.labels[destination_rcpt_response] (deprecated)	This log field is mapped to target.labels.value UDM field and target.labels.key is set to destination_rcpt_response, when index value in events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination] is equal to 0. For every other index value, this log field is mapped to about.labels.value UDM field and about.labels.key is set to destination_rcpt_response.
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.intValue[rcpt_response]	additional.fields[destination_rcpt_response]
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.value[selector]	target.labels[destination_selector] (deprecated)	This log field is mapped to target.labels.value UDM field and target.labels.key is set to destination_selector, when index value in events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination] is equal to 0. For every other index value, this log field is mapped to about.labels.value UDM field and about.labels.key is set to destination_selector.
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.value[selector]	additional.fields[destination_selector]
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.boolValue[smime_decryption_success]	target.labels[destination_smime_decryption_success] (deprecated)	This log field is mapped to target.labels.value UDM field and target.labels.key is set to destination_smime_decryption_success, when index value in events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination] is equal to 0. For every other index value, this log field is mapped to about.labels.value UDM field and about.labels.key is set to destination_smime_decryption_success.
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.boolValue[smime_decryption_success]	additional.fields[destination_smime_decryption_success]
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.boolValue[smime_extraction_success]	target.labels[destination_smime_extraction_success] (deprecated)	This log field is mapped to target.labels.value UDM field and target.labels.key is set to destination_smime_extraction_success, when index value in events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination] is equal to 0. For every other index value, this log field is mapped to about.labels.value UDM field and about.labels.key is set to destination_smime_extraction_success.
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.boolValue[smime_extraction_success]	additional.fields[destination_smime_extraction_success]
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.boolValue[smime_parsing_success]	target.labels[destination_smime_parsing_success] (deprecated)	This log field is mapped to target.labels.value UDM field and target.labels.key is set to destination_smime_parsing_success, when index value in events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination] is equal to 0. For every other index value, this log field is mapped to about.labels.value UDM field and about.labels.key is set to destination_smime_parsing_success.
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.boolValue[smime_parsing_success]	additional.fields[destination_smime_parsing_success]
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.boolValue[smime_signature_verification_success]	target.labels[destination_smime_signature_verification_success] (deprecated)	This log field is mapped to target.labels.value UDM field and target.labels.key is set to destination_smime_signature_verification_success, when index value in events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination] is equal to 0. For every other index value, this log field is mapped to about.labels.value UDM field and about.labels.key is set to destination_smime_signature_verification_success.
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.boolValue[smime_signature_verification_success]	additional.fields[destination_smime_signature_verification_success]
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.value[address]	target.user.email_addresses	This log field is mapped to target.user.email_addresses UDM field when index value in events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination] is equal to 0. For every other index value, this log field is mapped to the about.user.email_addresses.
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.intValue[user_id]	target.user.userid	This log field is mapped to target.user.userid UDM field when index value in events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination] is equal to 0. For every other index value, this log field is mapped to the about.user.userid.
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[smtp_out_remote_host]	intermediary.hostname
gmail	events.parameters[delivery].msgValue[server_info].parameter.value[host_name]	intermediary.hostname
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[failed_smtp_out_connect_ip]	intermediary.ip
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[smtp_in_connect_ip]	intermediary.ip
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[smtp_out_connect_ip]	intermediary.ip
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[smtp_user_agent_ip]	intermediary.ip
gmail	events.parameters[delivery].msgValue[server_info].parameter.value[job_name]	intermediary.labels[job_name] (deprecated)
gmail	events.parameters[delivery].msgValue[server_info].parameter.value[job_name]	additional.fields[job_name]
gmail	events.parameters[delivery].msgValue[server_info].parameter.intValue[server_type]	intermediary.labels[server_type] (deprecated)
gmail	events.parameters[delivery].msgValue[server_info].parameter.intValue[server_type]	additional.fields[server_type]
gmail	events.parameters[delivery].msgValue[server_info].parameter.value[service_pool]	intermediary.labels[service_pool] (deprecated)
gmail	events.parameters[delivery].msgValue[server_info].parameter.value[service_pool]	additional.fields[service_pool]
gmail	events.parameters[delivery].msgValue[server_info].parameter.intValue[task_number]	intermediary.labels[task_number] (deprecated)
gmail	events.parameters[delivery].msgValue[server_info].parameter.intValue[task_number]	additional.fields[task_number]
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.value[policy_holder_address]	security_result.about.user.email_addresses	If this log field value doesn't match the regular expression ^.+@.+$, then it is mapped to the security_result.about.administrative_domain UDM field. Else, it is mapped to the security_result.about.administrative_domain UDM field.
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[consequence].parameter.value[policy_holder_email]	security_result.about.user.email_addresses
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[consequence].parameter.intValue[policy_holder_user_id]	security_result.about.user.userid
gmail		security_result.action	If the events.parameters[delivery].msgValue[event_info].parameter.boolValue[success] log field value is equal to true, then the security_result.action UDM field is set to ALLOW. Else, the security_result.action UDM field is set to BLOCK.
gmail	events.parameters[delivery].msgValue[event_info].parameter.boolValue[success]	security_result.action_details
gmail		security_result.category	If the events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[attachment].parameter.intValue[malware_family] log field value is not empty, then the security_result.category UDM field is set to SOFTWARE_MALICIOUS. If the events.parameters[delivery].msgValue[message_info].parameter.boolValue[is_spam] log field value is equal to true, then the security_result.category UDM field is set to MAIL_SPAM.
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[attachment].parameter.intValue[malware_family]	security_result.category_details	If this log field value is equal to 1, then the security_result.category_details UDM field is set to 1 - A known malicious program type of malware. Else, if this log field value is equal to 2, then the security_result.category_details UDM field is set to 2 - A virus or worm type of malware. Else, if this log field value is equal to 3, then the security_result.category_details UDM field is set to 3 - Possible harmful email content. Else, if this log field value is equal to 4, then the security_result.category_details UDM field is set to 4 - Possible unwanted email content. Else, if this log field value is equal to 5, then the security_result.category_details UDM field is set to 5 - Other type of malware.
gmail	events.parameters[delivery].msgValue[message_info].parameter.value[flattened_triggered_rule_info]	security_result.detection_fields[flattened_triggered_rule_info]
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[is_internal]	security_result.detection_fields[is_internal]
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[is_intra_domain]	security_result.detection_fields[is_intra_domain]
gmail	events.parameters[delivery].msgValue[message_info].parameter.boolValue[is_policy_check_for_sender]	security_result.detection_fields[is_policy_check_for_sender]
gmail	events.parameters[delivery].msgValue[message_info].parameter.boolValue[is_spam]	security_result.detection_fields[is_spam]
gmail	events.parameters[delivery].msgValue[message_info].parameter.intValue[smtp_replay_error]	security_result.detection_fields[smtp_replay_error]	If this log field value is equal to 1, then the security_result.detection_fields.key UDM field is set to smtp_replay_error and the security_result.detection_fields.value UDM field is set to 1 - Authentication error. Else, if this log field value is equal to 2, then the security_result.detection_fields.key UDM field is set to smtp_replay_error and the 2 - Daily rate limit was exceeded. log field is mapped to the security_result.detection_fields.value UDM field. Else, if this log field value is equal to 3, then the security_result.detection_fields.key UDM field is set to smtp_replay_error and the 3 - Peak rate limit was exceeded. log field is mapped to the security_result.detection_fields.value UDM field. Else, if this log field value is equal to 4, then the security_result.detection_fields.key UDM field is set to smtp_replay_error and the 4 - SMTP relay was abused. log field is mapped to the security_result.detection_fields.value UDM field. Else, if this log field value is equal to 5, then the security_result.detection_fields.key UDM field is set to smtp_replay_error and the 5 - Per-user rate limit was exceeded. log field is mapped to the security_result.detection_fields.value UDM field.
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.intValue[classification_reason]	security_result.detection_fields[spam_info_classification_reason]	If this log field value is equal to 1, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 1 - Default spam classification reason. Else, if this log field value is equal to 2, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 2 - Message classified because of sender's past actions. Else, if this log field value is equal to 3, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 3 - Suspicious content. Else, if this log field value is equal to 4, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 4 - Suspicious link. Else, if this log field value is equal to 5, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 5 - Suspicious attachment. Else, if this log field value is equal to 6, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 6 - Custom policy defined in Google Workspace Admin Console > Gmail settings. Else, if this log field value is equal to 7, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 7 - DMARC. Else, if this log field value is equal to 8, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 8 - Domain in public RBLs. Else, if this log field value is equal to 9, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 9 - RFC standards violation. Else, if this log field value is equal to 10, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 10 - Gmail policy violation. Else, if this log field value is equal to 11, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 11 - Machine learning verdict. Else, if this log field value is equal to 12, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 12 - Sender reputation. Else, if this log field value is equal to 13, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 13 - Blatant spam. Else, if this log field value is equal to 14, then the security_result.detection_fields.key UDM field is set to spam_info_classification_reason and the security_result.detection_fields.value UDM field is set to 14 - Advanced phishing and malware protection.
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.intValue[classification_timestamp_usec]	security_result.detection_fields[spam_info_classification_timestamp_usec]
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.boolValue[delayed_for_deepscan]	security_result.detection_fields[spam_info_delayed_for_deepscan]
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.intValue[disposition]	security_result.detection_fields[spam_info_disposition]	If this log field value is equal to 1, then the security_result.detection_fields.key UDM field is set to spam_info_disposition and the security_result.detection_fields.value UDM field is set to 1 - Message considered clean (not spam or malware). Else, if this log field value is equal to 2, then the security_result.detection_fields.key UDM field is set to spam_info_disposition and the security_result.detection_fields.value UDM field is set to 2 - Spam. Else, if this log field value is equal to 3, then the security_result.detection_fields.key UDM field is set to spam_info_disposition and the security_result.detection_fields.value UDM field is set to 3 - Phishing. Else, if this log field value is equal to 4, then the security_result.detection_fields.key UDM field is set to spam_info_disposition and the security_result.detection_fields.value UDM field is set to 4 - Suspicious. Else, if this log field value is equal to 5, then the security_result.detection_fields.key UDM field is set to spam_info_disposition and the security_result.detection_fields.value UDM field is set to 5 - Malware.
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.value[ip_whitelist_entry]	security_result.detection_fields[spam_info_ip_whitelist_entry]
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.multiMsgValue[safety_settings_info].parameter.intValue[safety_settings_action]	security_result.detection_fields[spam_info_safety_setting_action]
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.multiMsgValue[safety_settings_info].parameter.intValue[safety_settings_condition]	security_result.detection_fields[spam_info_safety_settings_condition]
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[string_match].parameter.value[attachment_name]	security_result.detection_fields[triggered_rule_info_string_match_attachment_name]
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[string_match].parameter.value[matched_string]	security_result.detection_fields[triggered_rule_info_string_match_matched_string]
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[string_match].parameter.intValue[source]	security_result.detection_fields[triggered_rule_info_string_match_source]	If this log field value is equal to 0, then the security_result.detection_fields.key UDM field is set to triggered_rule_info_string_match_source and the security_result.detection_fields.value UDM field is set to 0 - Unknown. Else, if this log field value is equal to 1, then the security_result.detection_fields.key UDM field is set to triggered_rule_info_string_match_source and the security_result.detection_fields.value UDM field is set to 1 - Message body or including text format attachments. Else, if this log field value is equal to 2, then the security_result.detection_fields.key UDM field is set to triggered_rule_info_string_match_source and the security_result.detection_fields.value UDM field is set to 2 - Binary format attachments. Else, if this log field value is equal to 3, then the security_result.detection_fields.key UDM field is set to triggered_rule_info_string_match_source and the security_result.detection_fields.value UDM field is set to 3 - Message headers. Else, if this log field value is equal to 4, then the security_result.detection_fields.key UDM field is set to triggered_rule_info_string_match_source and the security_result.detection_fields.value UDM field is set to 4 - Subject. Else, if this log field value is equal to 5, then the security_result.detection_fields.key UDM field is set to triggered_rule_info_string_match_source and the security_result.detection_fields.value UDM field is set to 5 - Sender header. Else, if this log field value is equal to 6, then the security_result.detection_fields.key UDM field is set to triggered_rule_info_string_match_source and the security_result.detection_fields.value UDM field is set to 6 - Recipient header. Else, if this log field value is equal to 7, then the security_result.detection_fields.key UDM field is set to triggered_rule_info_string_match_source and the security_result.detection_fields.value UDM field is set to 7 - Raw message.
gmail	events.parameters[delivery].msgValue[message_info].parameter.intValue[upload_error_category]	security_result.detection_fields[upload_error_category]	If this log field value is equal to 0, then the security_result.detection_fields.key UDM field is set to upload_error_category and the security_result.detection_fields.value UDM field is set to 0 - Uncategorized transient error. Else, if this log field value is equal to 1, then the security_result.detection_fields.key UDM field is set to upload_error_category and the security_result.detection_fields.value UDM field is set to 1 - Recipient account is too busy. Else, if this log field value is equal to 2, then the security_result.detection_fields.key UDM field is set to upload_error_category and the security_result.detection_fields.value UDM field is set to 2 - DNS error resolving recipient domain. Else, if this log field value is equal to 3, then the security_result.detection_fields.key UDM field is set to upload_error_category and the security_result.detection_fields.value UDM field is set to 3 - Recipient's server refused connection. Else, if this log field value is equal to 4, then the security_result.detection_fields.key UDM field is set to upload_error_category and the security_result.detection_fields.value UDM field is set to 4 - Recipient is out of storage.
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.intValue[rule_id]	security_result.rule_id
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[consequence].parameter.intValue[action]	security_result.rule_labels[triggered_rule_info_consequence_action]	If this log field value is equal to 0, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 0 - Consequence is a no-op. Else, if this log field value is equal to 3, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 3 - Put message in Admin Quarantine. Else, if this log field value is equal to 4, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 4 - Modify the primary delivery target. Else, if this log field value is equal to 5, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 5 - Add a delivery target. Else, if this log field value is equal to 6, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 6 - Added a message header. Else, if this log field value is equal to 7, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 7 - Overwrite the envelope recipient. Else, if this log field value is equal to 9, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 9 - Add message to specified message set. Else, if this log field value is equal to 10, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 10 - Modify the message labels. Else, if this log field value is equal to 11, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 11 - Prefix text to message subject. Else, if this log field value is equal to 12, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 12 - Add a footer to the message. Else, if this log field value is equal to 13, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 13 - Strip the message body. Else, if this log field value is equal to 14, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the 14 - Store a copy of the message in the user's mailbox or according to comprehensive mail storage setting. log field is mapped to the security_result.rule_labels.value UDM field. Else, if this log field value is equal to 15, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 15 - Replace attachment with canned text. Else, if this log field value is equal to 16, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 16 - Require secure message delivery. Else, if this log field value is equal to 17, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 17 - Message can't be delivered and bounced. Else, if this log field value is equal to 18, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 18 - Archive to Google Vault for recipients. Else, if this log field value is equal to 20, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the security_result.rule_labels.value UDM field is set to 20 - Encrypt outbound message using S/MIME. Else, if this log field value is equal to 21, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_action and the 21 - Change the recipient user when message is received at SMTP. log field is mapped to the security_result.rule_labels.value UDM field.
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[consequence].parameter.value[reason]	security_result.rule_labels[triggered_rule_info_consequence_reason]
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[consequence].parameter.multiMsgValue[subconsequence].parameter.value[action]	security_result.rule_labels[triggered_rule_info_consequence_subconsequence_action]	If this log field value is equal to 0, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 0 - Consequence is a no-op. Else, if this log field value is equal to 3, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 3 - Put message in Admin Quarantine. Else, if this log field value is equal to 4, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 4 - Modify the primary delivery target. Else, if this log field value is equal to 5, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 5 - Add a delivery target. Else, if this log field value is equal to 6, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 6 - Added a message header. Else, if this log field value is equal to 7, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 7 - Overwrite the envelope recipient. Else, if this log field value is equal to 9, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 9 - Add message to specified message set. Else, if this log field value is equal to 10, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 10 - Modify the message labels. Else, if this log field value is equal to 11, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 11 - Prefix text to message subject. Else, if this log field value is equal to 12, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 12 - Add a footer to the message. Else, if this log field value is equal to 13, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 13 - Strip the message body. Else, if this log field value is equal to 14, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the 14 - Store a copy of the message in the user's mailbox or according to comprehensive mail storage setting. log field is mapped to the security_result.rule_labels.value UDM field. Else, if this log field value is equal to 15, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 15 - Replace attachment with canned text. Else, if this log field value is equal to 16, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 16 - Require secure message delivery. Else, if this log field value is equal to 17, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 17 - Message can't be delivered and bounced. Else, if this log field value is equal to 18, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 18 - Archive to Google Vault for recipients. Else, if this log field value is equal to 20, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the security_result.rule_labels.value UDM field is set to 20 - Encrypt outbound message using S/MIME. Else, if this log field value is equal to 21, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_consequence_subconsequence_action and the 21 - Change the recipient user when message is received at SMTP. log field is mapped to the security_result.rule_labels.value UDM field.
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[consequence].parameter.multiMsgValue[subconsequence].parameter.value[reason]	security_result.rule_labels[triggered_rule_info_consequence_subconsequence_reason]
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.intValue[policy_id]	security_result.rule_labels[triggered_rule_info_policy_id]
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.value[spam_label_modifier]	security_result.rule_labels[triggered_rule_info_spam_label_modifier]	If this log field value is equal to 0, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_spam_label_modifier and the 0 - No action—the rule honored the Gmail spam classification verdict. log field is mapped to the security_result.rule_labels.value UDM field. Else, if this log field value is equal to 1, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_spam_label_modifier and the 1 - Spam—the rule classified the message as spam. log field is mapped to the security_result.rule_labels.value UDM field. Else, if this log field value is equal to 2, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_spam_label_modifier and the 2 - Not spam—the rule classified the message as not spam. log field is mapped to the security_result.rule_labels.value UDM field.
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[string_match].parameter.value[match_expression]	security_result.rule_labels[triggered_rule_info_string_match_match_expression]
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[string_match].parameter.value[predefined_detector_name]	security_result.rule_labels[triggered_rule_info_string_match_predefined_detector_name]
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[string_match].parameter.intValue[type]	security_result.rule_labels[triggered_rule_info_string_match_type]	If this log field value is equal to 0, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_string_match_type and the security_result.rule_labels.value UDM field is set to 0 - Undefined. Else, if this log field value is equal to 1, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_string_match_type and the security_result.rule_labels.value UDM field is set to 1 - Regular expression match. Else, if this log field value is equal to 2, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_string_match_type and the security_result.rule_labels.value UDM field is set to 2 - Predefined detector match. Else, if this log field value is equal to 3, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_string_match_type and the security_result.rule_labels.value UDM field is set to 3 - Simple content match. Else, if this log field value is equal to 4, then the security_result.rule_labels.key UDM field is set to triggered_rule_info_string_match_type and the security_result.rule_labels.value UDM field is set to 4 - Non-ASCII match.
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.value[rule_name]	security_result.rule_name
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.intValue[rule_type]	security_result.rule_type	If this log field value is equal to 0, then the security_result.rule_type UDM field is set to 0 - Walled garden. Else, if this log field value is equal to 7, then the security_result.rule_type UDM field is set to 7 - Objectionable content. Else, if this log field value is equal to 8, then the security_result.rule_type UDM field is set to 8 - Content compliance. Else, if this log field value is equal to 10, then the security_result.rule_type UDM field is set to 10 - Received mail routing. Else, if this log field value is equal to 11, then the security_result.rule_type UDM field is set to 11 - Sent mail routing. Else, if this log field value is equal to 12, then the security_result.rule_type UDM field is set to 12 - Spam override. Else, if this log field value is equal to 14, then the security_result.rule_type UDM field is set to 14 - Blocked senders. Else, if this log field value is equal to 15, then the security_result.rule_type UDM field is set to 15 - Append footer. Else, if this log field value is equal to 16, then the security_result.rule_type UDM field is set to 16 - Attachment compliance. Else, if this log field value is equal to 17, then the security_result.rule_type UDM field is set to 17 - TLS compliance. Else, if this log field value is equal to 18, then the security_result.rule_type UDM field is set to 18 - Domain default routing. Else, if this log field value is equal to 19, then the security_result.rule_type UDM field is set to 19 - Inbound email journal acceptance in Vault. Else, if this log field value is equal to 20, then the security_result.rule_type UDM field is set to 20 - Outbound relay. Else, if this log field value is equal to 21, then the security_result.rule_type UDM field is set to 21 - Quarantine summary. Else, if this log field value is equal to 22, then the security_result.rule_type UDM field is set to 22 - Alternate secure route. Else, if this log field value is equal to 23, then the security_result.rule_type UDM field is set to 23 - Alias table. Else, if this log field value is equal to 24, then the security_result.rule_type UDM field is set to 24 - Comprehensive mail storage. Else, if this log field value is equal to 25, then the security_result.rule_type UDM field is set to 25 - Routing rule. Else, if this log field value is equal to 26, then the security_result.rule_type UDM field is set to 26 - Inbound gateway. Else, if this log field value is equal to 27, then the security_result.rule_type UDM field is set to 27 - S/MIME. Else, if this log field value is equal to 28, then the security_result.rule_type UDM field is set to 28 - Third-party email archiving. Else, if this log field value is equal to 31, then the security_result.rule_type UDM field is set to 31 - S/MIME restrict delivery.
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.multiMsgValue[authenticated_domain].parameter.value[name]	about.domain.name
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[attachment].parameter.value[file_extension_type]	about.file.file_type	FILE_TYPE_ string added before this log field value and converted it to uppercase, then If this log field value present in File.FileType then, this log field is mapped to about.file.file_type UDM field.
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[attachment].parameter.value[file_extension_type]	about.file.mime_type
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.multiMsgValue[detected_file_types].parameter.value[mime_type]	about.file.mime_type
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[attachment].parameter.value[sha256]	about.file.sha256
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[ip_geo_city]	about.ip_geo_artifact.location.city
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[ip_geo_country]	about.ip_geo_artifact.location.country_or_region
gmail	events.parameters[delivery].msgValue[message_info].parameter.intValue[action_type]	about.labels[action_type] (deprecated)	If this log field value is equal to 1, then the about.labels UDM field is set to 1 - Message received by inbound SMTP server. Else, if this log field value is equal to 2, then the about.labels UDM field is set to 2 - Message accepted by Gmail and prepared for delivery. Else, if this log field value is equal to 3, then the about.labels UDM field is set to 3 - Message was handled by Gmail. Else, if this log field value is equal to 10, then the about.labels UDM field is set to 10 - Message sent out by outbound SMTP server. Else, if this log field value is equal to 14, then the about.labels UDM field is set to 14 - A temporary error occurred when Gmail tried to deliver the message or and the message has been scheduled for retry. Else, if this log field value is equal to 18, then the about.labels UDM field is set to 18 - Message could not be delivered and bounced. Else, if this log field value is equal to 19, then the about.labels UDM field is set to 19 - Message was dropped by Gmail. Else, if this log field value is equal to 45, then the about.labels UDM field is set to 45 - Message was accepted for delivery by the Google Groups subsystem. Else, if this log field value is equal to 46, then the about.labels UDM field is set to 46 - Message's recipient address was a Google Group or and the recipient was expanded to each member of the Google Group that has message delivery enabled. Else, if this log field value is equal to 48, then the about.labels UDM field is set to 48 - Message received by inbound SMTP server for relay. Else, if this log field value is equal to 49, then the about.labels UDM field is set to 49 - Message sent through relay by outbound SMTP server. Else, if this log field value is equal to 51, then the about.labels UDM field is set to 51 - Message was written to Google Groups storage. Else, if this log field value is equal to 54, then the about.labels UDM field is set to 54 - Message was rejected by the Google Groups storage system. Else, if this log field value is equal to 55, then the about.labels UDM field is set to 55 - Message was re-inserted into Gmail by policies that modify the primary delivery route or envelope recipient. Else, if this log field value is equal to 68, then the about.labels UDM field is set to 68 - Message accepted by Gmail and prepared for delivery. Else, if this log field value is equal to 69, then the about.labels UDM field is set to 69 - A user changed the message's spam classification in Gmail. Else, if this log field value is equal to 70, then the about.labels UDM field is set to 70 - The message was reclassified as spam or phishing after it was delivered to Gmail. Else, if this log field value is equal to 71, then the about.labels UDM field is set to 71 - A user took an action in the inbox after receiving the message. Post-delivery actions include opening a message or clicking a link in a message or and downloading an attachment. BigQuery export doesn't provide details about the action.
gmail	events.parameters[delivery].msgValue[message_info].parameter.intValue[action_type]	additional.fields[action_type]	If this log field value is equal to 1, then the additional.fields UDM field is set to 1 - Message received by inbound SMTP server. Else, if this log field value is equal to 2, then the additional.fields UDM field is set to 2 - Message accepted by Gmail and prepared for delivery. Else, if this log field value is equal to 3, then the additional.fields UDM field is set to 3 - Message was handled by Gmail. Else, if this log field value is equal to 10, then the additional.fields UDM field is set to 10 - Message sent out by outbound SMTP server. Else, if this log field value is equal to 14, then the additional.fields UDM field is set to 14 - A temporary error occurred when Gmail tried to deliver the message or and the message has been scheduled for retry. Else, if this log field value is equal to 18, then the additional.fields UDM field is set to 18 - Message could not be delivered and bounced. Else, if this log field value is equal to 19, then the additional.fields UDM field is set to 19 - Message was dropped by Gmail. Else, if this log field value is equal to 45, then the additional.fields UDM field is set to 45 - Message was accepted for delivery by the Google Groups subsystem. Else, if this log field value is equal to 46, then the additional.fields UDM field is set to 46 - Message's recipient address was a Google Group or and the recipient was expanded to each member of the Google Group that has message delivery enabled. Else, if this log field value is equal to 48, then the additional.fields UDM field is set to 48 - Message received by inbound SMTP server for relay. Else, if this log field value is equal to 49, then the additional.fields UDM field is set to 49 - Message sent through relay by outbound SMTP server. Else, if this log field value is equal to 51, then the additional.fields UDM field is set to 51 - Message was written to Google Groups storage. Else, if this log field value is equal to 54, then the additional.fields UDM field is set to 54 - Message was rejected by the Google Groups storage system. Else, if this log field value is equal to 55, then the additional.fields UDM field is set to 55 - Message was re-inserted into Gmail by policies that modify the primary delivery route or envelope recipient. Else, if this log field value is equal to 68, then the additional.fields UDM field is set to 68 - Message accepted by Gmail and prepared for delivery. Else, if this log field value is equal to 69, then the additional.fields UDM field is set to 69 - A user changed the message's spam classification in Gmail. Else, if this log field value is equal to 70, then the additional.fields UDM field is set to 70 - The message was reclassified as spam or phishing after it was delivered to Gmail. Else, if this log field value is equal to 71, then the additional.fields UDM field is set to 71 - A user took an action in the inbox after receiving the message. Post-delivery actions include opening a message or clicking a link in a message or and downloading an attachment. BigQuery export doesn't provide details about the action.
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.multiMsgValue[authenticated_domain].parameter.intValue[type]	about.labels[authenticated_domain_type] (deprecated)	If this log field value is equal to 1, then the about.labels UDM field is set to 1 - SPF. Else, if this log field value is equal to 2, then the about.labels UDM field is set to 2 - DKIM. Else, if this log field value is equal to 3, then the about.labels UDM field is set to 3 - DKIM_PROXY. Else, if this log field value is equal to 4, then the about.labels UDM field is set to 4 - XOAR_SPF. Else, if this log field value is equal to 5, then the about.labels UDM field is set to 5 - XOAR_DKIM. Else, if this log field value is equal to 6, then the about.labels UDM field is set to 6 - ARC_SPF. Else, if this log field value is equal to 7, then the about.labels UDM field is set to 7 - ARC_DKIM.
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.multiMsgValue[authenticated_domain].parameter.intValue[type]	additional.fields[authenticated_domain_type]	If this log field value is equal to 1, then the additional.fields UDM field is set to 1 - SPF. Else, if this log field value is equal to 2, then the additional.fields UDM field is set to 2 - DKIM. Else, if this log field value is equal to 3, then the additional.fields UDM field is set to 3 - DKIM_PROXY. Else, if this log field value is equal to 4, then the additional.fields UDM field is set to 4 - XOAR_SPF. Else, if this log field value is equal to 5, then the additional.fields UDM field is set to 5 - XOAR_DKIM. Else, if this log field value is equal to 6, then the additional.fields UDM field is set to 6 - ARC_SPF. Else, if this log field value is equal to 7, then the additional.fields UDM field is set to 7 - ARC_DKIM.
gmail	events.parameters[delivery].msgValue[message_info].parameter.intValue[delivery_timestamp_usec]	about.labels[delivery_timestamp_usec] (deprecated)
gmail	events.parameters[delivery].msgValue[message_info].parameter.intValue[delivery_timestamp_usec]	additional.fields[delivery_timestamp_usec]
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.multiMsgValue[detected_file_types].parameter.intValue[category]	about.labels[detected_file_types_category] (deprecated)	If this log field value is equal to 1, then the about.labels UDM field is set to 1 - Unrecognized file type. Else, if this log field value is equal to 2, then the about.labels UDM field is set to 2 - Microsoft Office documents, including word processing, spreadsheet, presentation, and database documents. Includes PDF files. The file might or might not be encrypted. Else, if this log field value is equal to 3, then the about.labels UDM field is set to 3 - Video and multimedia, for example, MPEG, Quicktime, WMV. Else, if this log field value is equal to 4, then the about.labels UDM field is set to 4 - Music and audio, for example, MP3, AAC, WAV. Else, if this log field value is equal to 5, then the about.labels UDM field is set to 5 - Images, for example, JPEG, BMP, GIF. Else, if this log field value is equal to 6, then the about.labels UDM field is set to 6 - Archives, for example, ZIP, TAR, TGZ. Else, if this log field value is equal to 7, then the about.labels UDM field is set to 7 - Executables, for example EXE, COM, JS. Else, if this log field value is equal to 8, then the about.labels UDM field is set to 8 - Office documents that are encrypted. Else, if this log field value is equal to 9, then the about.labels UDM field is set to 9 - Office documents that are not encrypted.
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.multiMsgValue[detected_file_types].parameter.intValue[category]	additional.fields[detected_file_types_category]	If this log field value is equal to 1, then the additional.fields UDM field is set to 1 - Unrecognized file type. Else, if this log field value is equal to 2, then the additional.fields UDM field is set to 2 - Microsoft Office documents, including word processing, spreadsheet, presentation, and database documents. Includes PDF files. The file might or might not be encrypted. Else, if this log field value is equal to 3, then the additional.fields UDM field is set to 3 - Video and multimedia, for example, MPEG, Quicktime, WMV. Else, if this log field value is equal to 4, then the additional.fields UDM field is set to 4 - Music and audio, for example, MP3, AAC, WAV. Else, if this log field value is equal to 5, then the additional.fields UDM field is set to 5 - Images, for example, JPEG, BMP, GIF. Else, if this log field value is equal to 6, then the additional.fields UDM field is set to 6 - Archives, for example, ZIP, TAR, TGZ. Else, if this log field value is equal to 7, then the additional.fields UDM field is set to 7 - Executables, for example EXE, COM, JS. Else, if this log field value is equal to 8, then the additional.fields UDM field is set to 8 - Office documents that are encrypted. Else, if this log field value is equal to 9, then the additional.fields UDM field is set to 9 - Office documents that are not encrypted.
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[dkim_pass]	about.labels[dkim_pass] (deprecated)
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[dkim_pass]	additional.fields[dkim_pass]
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[dmarc_pass]	about.labels[dmarc_pass] (deprecated)
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[dmarc_pass]	additional.fields[dmarc_pass]
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[dmarc_published_domain]	about.labels[dmarc_published_domain] (deprecated)
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[dmarc_published_domain]	additional.fields[dmarc_published_domain]
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.msgValue[exchange_journal_info].parameter.multiStrValue[recipients]	about.labels[exchange_journal_info_recipients] (deprecated)
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.msgValue[exchange_journal_info].parameter.multiStrValue[recipients]	additional.fields[exchange_journal_info_recipients]
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.msgValue[exchange_journal_info].parameter.value[rfc822_message_id]	about.labels[exchange_journal_info_rfc822_message_id] (deprecated)
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.msgValue[exchange_journal_info].parameter.value[rfc822_message_id]	additional.fields[exchange_journal_info_rfc822_message_id]
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.msgValue[exchange_journal_info].parameter.intValue[timestamp]	about.labels[exchange_journal_info_timestamp] (deprecated)
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.msgValue[exchange_journal_info].parameter.intValue[timestamp]	additional.fields[exchange_journal_info_timestamp]
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.msgValue[exchange_journal_info].parameter.multiStrValue[unknown_recipients]	about.labels[exchange_journal_info_unknown_recipients] (deprecated)
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.msgValue[exchange_journal_info].parameter.multiStrValue[unknown_recipients]	additional.fields[exchange_journal_info_unknown_recipients]
gmail	events.parameters[delivery].msgValue[message_info].parameter.intValue[internal_message_id]	about.labels[internal_message_id] (deprecated)
gmail	events.parameters[delivery].msgValue[message_info].parameter.intValue[internal_message_id]	additional.fields[internal_message_id]
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiStrValue[link_domain]	about.labels[link_domain] (deprecated)
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiStrValue[link_domain]	additional.fields[link_domain]
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[message_set].parameter.intValue[type]	about.labels[message_set_type] (deprecated)	If this log field value is equal to 1, then the about.labels UDM field is set to 1 - Message is inbound (received from outside your domains). This message set doesn't appear with message set 10. Else, if this log field value is equal to 2, then the about.labels UDM field is set to 2 - Message is outbound (sent to a recipient outside your domains). This message set doesn't appear with message set 10. Else, if this log field value is equal to 4, then the about.labels UDM field is set to 4 - Message contains objectionable content, as defined by one of your policies. Else, if this log field value is equal to 6, then the about.labels UDM field is set to 6 - Message triggered the walled garden rule you configured that restricts messages to authorized addresses or domains. Else, if this log field value is equal to 7, then the about.labels UDM field is set to 7 - Gmail classified the message as spam. Else, if this log field value is equal to 8, then the about.labels UDM field is set to 8 - Message being sent (outgoing message). Else, if this log field value is equal to 9, then the about.labels UDM field is set to 9 - Message being received (incoming message). Else, if this log field value is equal to 10, then the about.labels UDM field is set to 10 - Message that is internal to your domains. Else, if this log field value is equal to 11, then the about.labels UDM field is set to 11 - Message has a sender or recipients outside your domains. Else, if this log field value is equal to 12, then the about.labels UDM field is set to 12 - Message has some recipients inside your domain and some recipients outside your domain. This message set might appear when: Else, if this log field value is equal to 13, then the about.labels UDM field is set to 13 - The type of the message set is unknown. Else, if this log field value is equal to 15, then the about.labels UDM field is set to 15 - The policy being checked against is tied to a Gmail user. Else, if this log field value is equal to 18, then the about.labels UDM field is set to 18 - Message doesn't have a default route. Else, if this log field value is equal to 19, then the about.labels UDM field is set to 19 - The address list you configured for domain default routing matches the correspondent of the message. Else, if this log field value is equal to 20, then the about.labels UDM field is set to 20 - Message is from an address in your blocked senders list. Else, if this log field value is equal to 21, then the about.labels UDM field is set to 21 - Message was sent over TLS and the SSL certificate is valid. Else, if this log field value is equal to 22, then the about.labels UDM field is set to 22 - Message was sent over TLS. Else, if this log field value is equal to 24, then the about.labels UDM field is set to 24 - The recipient of this message is unknown. Else, if this log field value is equal to 25, then the about.labels UDM field is set to 25 - Message is a non-delivery report responding to a message that was not delivered. Else, if this log field value is equal to 26, then the about.labels UDM field is set to 26 - Message triggered a rerouting rule, which you configured in domain default routing. Else, if this log field value is equal to 27, then the about.labels UDM field is set to 27 - Sender successfully passed SPF/DKIM/DMARC authentication. If the sender isn't authenticated, the sender domain is untrusted and the message is not considered internal. Else, if this log field value is equal to 28, then the about.labels UDM field is set to 28 - Exchange journal is archiving the message to Google Vault. Else, if this log field value is equal to 29, then the about.labels UDM field is set to 29 - Message was routed through SMTP relay. Else, if this log field value is equal to 30, then the about.labels UDM field is set to 30 - A recipient of the message matched one of the enumerated recipients (instead of a regular expression pattern) you configured for domain routing, or domain default routing. Else, if this log field value is equal to 31, then the about.labels UDM field is set to 31 - Message matched a domain default routing condition you configured. Else, if this log field value is equal to 32, then the about.labels UDM field is set to 32 - Message was created from an Exchange journal message for archiving to Google Vault. Else, if this log field value is equal to 33, then the about.labels UDM field is set to 33 - Message has to be transmitted through a secure connection, such as TLS. Else, if this log field value is equal to 34, then the about.labels UDM field is set to 34 - The policy being checked against is tied to a group instead of an individual Gmail user. Else, if this log field value is equal to 35, then the about.labels UDM field is set to 35 - Message could not be authenticated in SMTP relay because it has an empty SMTP envelope-from address or is possibly an Exchange Journal message. It will be checked later at SMTP RCPT command time. Else, if this log field value is equal to 36, then the about.labels UDM field is set to 36 - Message has aggressive spam filtering enabled. Else, if this log field value is equal to 37, then the about.labels UDM field is set to 37 - Message is authenticated for SMTP relay. Else, if this log field value is equal to 39, then the about.labels UDM field is set to 39 - Sender is from an authenticated domain for relay. Else, if this log field value is equal to 40, then the about.labels UDM field is set to 40 - Message is from a Google Workspace user in the domain being authenticated for relay. Else, if this log field value is equal to 41, then the about.labels UDM field is set to 41 - Sender has successfully authenticated with SMTP AUTH, and Gmail is trying to authenticate SMTP relay for the sender's domain. Else, if this log field value is equal to 42, then the about.labels UDM field is set to 42 - Message was sent from an address that isn't authenticated. Else, if this log field value is equal to 43, then the about.labels UDM field is set to 43 - Message was rerouted through an alias table. Else, if this log field value is equal to 44, then the about.labels UDM field is set to 44 - Message triggered a rule that changes the route of the mail flow. Else, if this log field value is equal to 45, then the about.labels UDM field is set to 45 - Message is to a catch-all account and is being relayed to an on-premise server. System-of-record policies won't be applied to it. Else, if this log field value is equal to 46, then the about.labels UDM field is set to 46 - Message bypassed the spam filter. Else, if this log field value is equal to 47, then the about.labels UDM field is set to 47 - Message was detected to be spam by tag-and-deliver information in the inbound gateway settings. Else, if this log field value is equal to 48, then the about.labels UDM field is set to 48 - Message was not checked for spam (by SMTP) due to a spam-override policy. Else, if this log field value is equal to 49, then the about.labels UDM field is set to 49 - Always override spam rejection for the message. Else, if this log field value is equal to 50, then the about.labels UDM field is set to 50 - Message matches a domain routing condition you configured. Else, if this log field value is equal to 51, then the about.labels UDM field is set to 51 - Message triggered a rerouting rule that you configured for domain routing. Else, if this log field value is equal to 55, then the about.labels UDM field is set to 55 - Message was created by the Exchange Journal generation setting. Else, if this log field value is equal to 57, then the about.labels UDM field is set to 57 - Message was received from an inbound gateway rule that you configured. Else, if this log field value is equal to 60, then the about.labels UDM field is set to 60 - Message is protected with Gmail confidential mode. Else, if this log field value is equal to 61, then the about.labels UDM field is set to 61 - Message was caught by Security sandbox. Else, if this log field value is equal to 62, then the about.labels UDM field is set to 62 - The address list you configured for domain default routing matches the SMTP envelope recipient instead of the correspondent of the message. Else, if this log field value is equal to 63, then the about.labels UDM field is set to 63 - Message triggered a domain-level rerouting rule, which you configured for domain routing, or domain default routing.
gmail	events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[message_set].parameter.intValue[type]	additional.fields[message_set_type]	If this log field value is equal to 1, then the additional.fields UDM field is set to 1 - Message is inbound (received from outside your domains). This message set doesn't appear with message set 10. Else, if this log field value is equal to 2, then the additional.fields UDM field is set to 2 - Message is outbound (sent to a recipient outside your domains). This message set doesn't appear with message set 10. Else, if this log field value is equal to 4, then the additional.fields UDM field is set to 4 - Message contains objectionable content, as defined by one of your policies. Else, if this log field value is equal to 6, then the additional.fields UDM field is set to 6 - Message triggered the walled garden rule you configured that restricts messages to authorized addresses or domains. Else, if this log field value is equal to 7, then the additional.fields UDM field is set to 7 - Gmail classified the message as spam. Else, if this log field value is equal to 8, then the additional.fields UDM field is set to 8 - Message being sent (outgoing message). Else, if this log field value is equal to 9, then the additional.fields UDM field is set to 9 - Message being received (incoming message). Else, if this log field value is equal to 10, then the additional.fields UDM field is set to 10 - Message that is internal to your domains. Else, if this log field value is equal to 11, then the additional.fields UDM field is set to 11 - Message has a sender or recipients outside your domains. Else, if this log field value is equal to 12, then the additional.fields UDM field is set to 12 - Message has some recipients inside your domain and some recipients outside your domain. This message set might appear when: Else, if this log field value is equal to 13, then the additional.fields UDM field is set to 13 - The type of the message set is unknown. Else, if this log field value is equal to 15, then the additional.fields UDM field is set to 15 - The policy being checked against is tied to a Gmail user. Else, if this log field value is equal to 18, then the additional.fields UDM field is set to 18 - Message doesn't have a default route. Else, if this log field value is equal to 19, then the additional.fields UDM field is set to 19 - The address list you configured for domain default routing matches the correspondent of the message. Else, if this log field value is equal to 20, then the additional.fields UDM field is set to 20 - Message is from an address in your blocked senders list. Else, if this log field value is equal to 21, then the additional.fields UDM field is set to 21 - Message was sent over TLS and the SSL certificate is valid. Else, if this log field value is equal to 22, then the additional.fields UDM field is set to 22 - Message was sent over TLS. Else, if this log field value is equal to 24, then the additional.fields UDM field is set to 24 - The recipient of this message is unknown. Else, if this log field value is equal to 25, then the additional.fields UDM field is set to 25 - Message is a non-delivery report responding to a message that was not delivered. Else, if this log field value is equal to 26, then the additional.fields UDM field is set to 26 - Message triggered a rerouting rule, which you configured in domain default routing. Else, if this log field value is equal to 27, then the additional.fields UDM field is set to 27 - Sender successfully passed SPF/DKIM/DMARC authentication. If the sender isn't authenticated, the sender domain is untrusted and the message is not considered internal. Else, if this log field value is equal to 28, then the additional.fields UDM field is set to 28 - Exchange journal is archiving the message to Google Vault. Else, if this log field value is equal to 29, then the additional.fields UDM field is set to 29 - Message was routed through SMTP relay. Else, if this log field value is equal to 30, then the additional.fields UDM field is set to 30 - A recipient of the message matched one of the enumerated recipients (instead of a regular expression pattern) you configured for domain routing, or domain default routing. Else, if this log field value is equal to 31, then the additional.fields UDM field is set to 31 - Message matched a domain default routing condition you configured. Else, if this log field value is equal to 32, then the additional.fields UDM field is set to 32 - Message was created from an Exchange journal message for archiving to Google Vault. Else, if this log field value is equal to 33, then the additional.fields UDM field is set to 33 - Message has to be transmitted through a secure connection, such as TLS. Else, if this log field value is equal to 34, then the additional.fields UDM field is set to 34 - The policy being checked against is tied to a group instead of an individual Gmail user. Else, if this log field value is equal to 35, then the additional.fields UDM field is set to 35 - Message could not be authenticated in SMTP relay because it has an empty SMTP envelope-from address or is possibly an Exchange Journal message. It will be checked later at SMTP RCPT command time. Else, if this log field value is equal to 36, then the additional.fields UDM field is set to 36 - Message has aggressive spam filtering enabled. Else, if this log field value is equal to 37, then the additional.fields UDM field is set to 37 - Message is authenticated for SMTP relay. Else, if this log field value is equal to 39, then the additional.fields UDM field is set to 39 - Sender is from an authenticated domain for relay. Else, if this log field value is equal to 40, then the additional.fields UDM field is set to 40 - Message is from a Google Workspace user in the domain being authenticated for relay. Else, if this log field value is equal to 41, then the additional.fields UDM field is set to 41 - Sender has successfully authenticated with SMTP AUTH, and Gmail is trying to authenticate SMTP relay for the sender's domain. Else, if this log field value is equal to 42, then the additional.fields UDM field is set to 42 - Message was sent from an address that isn't authenticated. Else, if this log field value is equal to 43, then the additional.fields UDM field is set to 43 - Message was rerouted through an alias table. Else, if this log field value is equal to 44, then the additional.fields UDM field is set to 44 - Message triggered a rule that changes the route of the mail flow. Else, if this log field value is equal to 45, then the additional.fields UDM field is set to 45 - Message is to a catch-all account and is being relayed to an on-premise server. System-of-record policies won't be applied to it. Else, if this log field value is equal to 46, then the additional.fields UDM field is set to 46 - Message bypassed the spam filter. Else, if this log field value is equal to 47, then the additional.fields UDM field is set to 47 - Message was detected to be spam by tag-and-deliver information in the inbound gateway settings. Else, if this log field value is equal to 48, then the additional.fields UDM field is set to 48 - Message was not checked for spam (by SMTP) due to a spam-override policy. Else, if this log field value is equal to 49, then the additional.fields UDM field is set to 49 - Always override spam rejection for the message. Else, if this log field value is equal to 50, then the additional.fields UDM field is set to 50 - Message matches a domain routing condition you configured. Else, if this log field value is equal to 51, then the additional.fields UDM field is set to 51 - Message triggered a rerouting rule that you configured for domain routing. Else, if this log field value is equal to 55, then the additional.fields UDM field is set to 55 - Message was created by the Exchange Journal generation setting. Else, if this log field value is equal to 57, then the additional.fields UDM field is set to 57 - Message was received from an inbound gateway rule that you configured. Else, if this log field value is equal to 60, then the additional.fields UDM field is set to 60 - Message is protected with Gmail confidential mode. Else, if this log field value is equal to 61, then the additional.fields UDM field is set to 61 - Message was caught by Security sandbox. Else, if this log field value is equal to 62, then the additional.fields UDM field is set to 62 - The address list you configured for domain default routing matches the SMTP envelope recipient instead of the correspondent of the message. Else, if this log field value is equal to 63, then the additional.fields UDM field is set to 63 - Message triggered a domain-level rerouting rule, which you configured for domain routing, or domain default routing.
gmail	events.parameters[delivery].msgValue[message_info].parameter.intValue[moderation_reason]	about.labels[moderation_reason] (deprecated)
gmail	events.parameters[delivery].msgValue[message_info].parameter.intValue[moderation_reason]	additional.fields[moderation_reason]
gmail	events.parameters[delivery].msgValue[message_info].parameter.intValue[moderation_status]	about.labels[moderation_status] (deprecated)
gmail	events.parameters[delivery].msgValue[message_info].parameter.intValue[moderation_status]	additional.fields[moderation_status]
gmail	events.parameters[delivery].msgValue[message_info].parameter.intValue[num_message_attachments]	about.labels[num_message_attachments] (deprecated)
gmail	events.parameters[delivery].msgValue[message_info].parameter.intValue[num_message_attachments]	additional.fields[num_message_attachments]
gmail	events.parameters[delivery].msgValue[message_info].parameter.intValue[sequence_number]	about.labels[sequence_number] (deprecated)
gmail	events.parameters[delivery].msgValue[message_info].parameter.intValue[sequence_number]	additional.fields[sequence_number]
gmail	events.parameters[delivery].msgValue[message_info].parameter.intValue[smime_content_type]	about.labels[smime_content_type] (deprecated)	If this log field value is equal to 0, then the about.labels UDM field is set to 0 - Message does not have a recognized S/MIME Content-Type. Else, if this log field value is equal to 1, then the about.labels UDM field is set to 1 - An S/MIME message with a detached signature Indicated by content type multipart/signed with parameter protocol=application/pkcs7-signature. Else, if this log field value is equal to 2, then the about.labels UDM field is set to 2 - An S/MIME message with an opaque signature Indicated by content type application/pkcs7-mime or application/x-pkcs7-mime with parameter smime-type=signed-data. Else, if this log field value is equal to 3, then the about.labels UDM field is set to 3 - An S/MIME message that is encrypted Indicated by content type application/pkcs7-mime or application/x-pkcs7-mime with parameter smime-type=enveloped-data. Else, if this log field value is equal to 4, then the about.labels UDM field is set to 4 - An S/MIME message that is compressed Indicated by content type application/pkcs7-mime or application/x-pkcs7-mime with parameter smime-type=compressed-data.
gmail	events.parameters[delivery].msgValue[message_info].parameter.intValue[smime_content_type]	additional.fields[smime_content_type]	If this log field value is equal to 0, then the additional.fields UDM field is set to 0 - Message does not have a recognized S/MIME Content-Type. Else, if this log field value is equal to 1, then the additional.fields UDM field is set to 1 - An S/MIME message with a detached signature Indicated by content type multipart/signed with parameter protocol=application/pkcs7-signature. Else, if this log field value is equal to 2, then the additional.fields UDM field is set to 2 - An S/MIME message with an opaque signature Indicated by content type application/pkcs7-mime or application/x-pkcs7-mime with parameter smime-type=signed-data. Else, if this log field value is equal to 3, then the additional.fields UDM field is set to 3 - An S/MIME message that is encrypted Indicated by content type application/pkcs7-mime or application/x-pkcs7-mime with parameter smime-type=enveloped-data. Else, if this log field value is equal to 4, then the additional.fields UDM field is set to 4 - An S/MIME message that is compressed Indicated by content type application/pkcs7-mime or application/x-pkcs7-mime with parameter smime-type=compressed-data.
gmail	events.parameters[delivery].msgValue[message_info].parameter.boolValue[smime_encrypt_message]	about.labels[smime_encrypt_message] (deprecated)
gmail	events.parameters[delivery].msgValue[message_info].parameter.boolValue[smime_encrypt_message]	additional.fields[smime_encrypt_message]
gmail	events.parameters[delivery].msgValue[message_info].parameter.boolValue[smime_extraction_success]	about.labels[smime_extraction_success] (deprecated)
gmail	events.parameters[delivery].msgValue[message_info].parameter.boolValue[smime_extraction_success]	additional.fields[smime_extraction_success]
gmail	events.parameters[delivery].msgValue[message_info].parameter.boolValue[smime_packaging_success]	about.labels[smime_packaging_success] (deprecated)
gmail	events.parameters[delivery].msgValue[message_info].parameter.boolValue[smime_packaging_success]	additional.fields[smime_packaging_success]
gmail	events.parameters[delivery].msgValue[message_info].parameter.boolValue[smime_sign_message]	about.labels[smime_sign_message] (deprecated)
gmail	events.parameters[delivery].msgValue[message_info].parameter.boolValue[smime_sign_message]	additional.fields[smime_sign_message]
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[spf_pass]	about.labels[spf_pass] (deprecated)
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[spf_pass]	additional.fields[spf_pass]
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[tls_required_but_unavailable]	about.labels[tls_required_but_unavailable] (deprecated)
gmail	events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[tls_required_but_unavailable]	additional.fields[tls_required_but_unavailable]

Referenz für die Feldzuordnung: Protokolltypen von WORKSPACE_ALERTS zu UDM-Ereignistyp

In der folgenden Tabelle sind die WORKSPACE_ALERTS-Logtypen und die zugehörigen UDM-Ereignistypen aufgeführt.

Event Identifier	Event Type	Security Category
Customer takeout initiated	STATUS_UPDATE
Malware reclassification	EMAIL_TRANSACTION	MAIL_PHISHING
Misconfigured whitelist	EMAIL_TRANSACTION	MAIL_PHISHING
Phishing reclassification	EMAIL_TRANSACTION	MAIL_PHISHING
Suspicious message reported	EMAIL_TRANSACTION	MAIL_PHISHING
User reported phishing	EMAIL_TRANSACTION	MAIL_PHISHING
User reported spam spike	EMAIL_TRANSACTION	MAIL_PHISHING
Leaked password	USER_LOGIN	ACL_VIOLATION
Suspicious login	USER_LOGIN	ACL_VIOLATION
Suspicious login (less secure app)	USER_LOGIN	ACL_VIOLATION
Suspicious programmatic login	USER_LOGIN	ACL_VIOLATION
User suspended	USER_UNCATEGORIZED	ACL_VIOLATION
User suspended (spam)	USER_UNCATEGORIZED	ACL_VIOLATION
User suspended (spam through relay)	USER_UNCATEGORIZED	ACL_VIOLATION
User suspended (suspicious activity)	USER_UNCATEGORIZED	ACL_VIOLATION
Google Operations	STATUS_UPDATE
Configuration problem	STATUS_UNCATEGORIZED
Government attack warning	STATUS_UNCATEGORIZED
Device compromised	GENERIC_EVENT
Suspicious activity	USER_UNCATEGORIZED
AppMaker Default Cloud SQL setup	USER_RESOURCE_ACCESS
Activity Rule	STATUS_UNCATEGORIZED / USER_UNCATEGORIZED / EMAIL_UNCATEGORIZED	POLICY_VIOLATION
Data Loss Prevention	USER_UNCATEGORIZED	POLICY_VIOLATION
Apps outage	STATUS_UPDATE
Primary admin changed	USER_UNCATEGORIZED
SSO profile added	USER_RESOURCE_CREATION
SSO profile updated	USER_RESOURCE_UPDATE_CONTENT
SSO profile deleted	USER_RESOURCE_DELETION
Super admin password reset	USER_CHANGE_PASSWORD
User deleted	USER_DELETION
New user added	USER_CREATION
User password changed	USER_CHANGE_PASSWORD
Users Admin privilege revoked	USER_CHANGE_PERMISSIONS
Suspended user made active	USER_UNCATEGORIZED
User granted Admin privilege	USER_CHANGE_PERMISSIONS
User suspended (Administrator email alert)	USER_UNCATEGORIZED
Drive settings changed	USER_RESOURCE_ACCESS
Calendar settings changed	USER_RESOURCE_ACCESS
Reporting Rule	STATUS_UPDATE

Referenz für die Feldzuordnung: WORKSPACE_ALERTS

In der folgenden Tabelle sind die Logfelder des Logtyps WORKSPACE_ALERTS und die zugehörigen UDM-Felder aufgeführt.

Eingestellt:

Die folgenden labels-Felder für UDM-Nomen wurden eingestellt: about.labels, intermediary.labels, observer.labels, principal.labels, src.labels, security_result.about.labels und target.labels. Bei vorhandenen Parsern werden die Logfelder zusätzlich zu diesen UDM-Feldern auch den Schlüssel/Wert-additional.fields-UDM-Feldern zugeordnet. Bei neuen Parsern werden die Schlüssel/Wert-Einstellungen in den UDM-Feldern additional.fields anstelle der verworfenen UDM-Felder labels verwendet. Wir empfehlen, die vorhandenen Regeln so zu aktualisieren, dass die Schlüssel/Wert-Einstellungen in den UDM-Feldern „additional.fields“ anstelle der verworfenen UDM-Felder labels verwendet werden.

Log field	UDM mapping	Logic
data.domainId.customerPrimaryDomain	about.administrative_domain
data.messages.attachmentsSha256Hash	about.file.sha256
data.mergeInfo.newAlertId	about.labels[new_alert_id] (deprecated)
data.mergeInfo.newAlertId	additional.fields[new_alert_id]
data.mergeInfo.newIncidentTrackingId	about.labels[new_incident_tracking_id] (deprecated)
data.mergeInfo.newIncidentTrackingId	additional.fields[new_incident_tracking_id]
data.nextUpdateTime	about.labels[next_update_time] (deprecated)
data.nextUpdateTime	additional.fields[next_update_time]
data.resolutionTime	about.labels[resolution_time] (deprecated)
data.resolutionTime	additional.fields[resolution_time]
data.status	about.labels[status] (deprecated)
data.status	additional.fields[status]
data.incidentTrackingId	about.labels[tracking_id] (deprecated)
data.incidentTrackingId	additional.fields[tracking_id]
customerId	about.resource.product_object_id	If the customerId log field value is not empty, then the customerId log field is mapped to the about.resource.product_object_id UDM field. Else, the metadata.customerId log field is mapped to the about.resource.product_object_id UDM field.
metadata.customerId	about.resource.product_object_id	If the customerId log field value is not empty, then the customerId log field is mapped to the about.resource.product_object_id UDM field. Else, the metadata.customerId log field is mapped to the about.resource.product_object_id UDM field.
	about.resource.resource_type	The about.resource.resource_type UDM field is set to CLOUD_ORGANIZATION.
data.dashboardUri	about.url
data.attachmentData.csv.dataRows.entries	additional.fields.entries
data.attachmentData.csv.headers	additional.fields.header
	event.idm.is_alert	The event.idm.is_alert UDM field is set to TRUE.
	event.idm.is_significant	If the data.@type log field value is equal to ActivityRule and the metadata.severity log field value is equal to HIGH, then the event.idm.is_significant UDM field is set to true.
	extensions.auth.mechanism	If the data.@type log field value is equal to AccountWarning, then the extensions.auth.mechanism UDM field is set to USERNAME_PASSWORD.
	extensions.auth.type	If the data.@type log field value is equal to AccountWarning, then the extensions.auth.type UDM field is set to SSO.
data.description	metadata.description
createTime	metadata.event_timestamp
data.@type	metadata.product_event_type
etag	metadata.product_log_id	If the etag log field value is not empty, then the etag log field is mapped to the metadata.product_log_id UDM field. Else, the alertId log field is mapped to the metadata.product_log_id UDM field.
metadata.etag	metadata.product_log_id	If the metadata.etag log field value is not empty, then the metadata.etag log field is mapped to the metadata.product_log_id UDM field. Else, the alertId log field is mapped to the metadata.product_log_id UDM field.
	metadata.product_name	The metadata.product_name UDM field is set to WORKSPACE_ALERTS.
	metadata.vendor_name	The metadata.vendor_name UDM field is set to GOOGLE.
data.maliciousEntity.fromHeader	network.email.from
data.messages.messageId	network.email.mail_id
data.messages.subjectText	network.email.subject
data.messages.recipient	network.email.to
data.ruleViolationInfo.recipients	network.email.to	If the data.ruleViolationInfo.recipients log field value matches the regular expression pattern ^.+@.+$, then the data.ruleViolationInfo.recipients log field is mapped to the network.email.to UDM field.
data.ruleViolationInfo.recipients	additional.fields[recipients]	If the data.ruleViolationInfo.recipients log field value is equal to anyone, then the data.ruleViolationInfo.recipients log field is mapped to the additional.fields UDM field.
data.ruleViolationInfo.recipients	target.domain.name	If the data.ruleViolationInfo.recipients log field value matches the regular expression pattern ^[a-zA-Z0-9][a-zA-Z0-9-]{1,61}[a-zA-Z0-9](?:\.[a-zA-Z]{2,})+$, then the first occurrence of the matching value in the data.ruleViolationInfo.recipients log field is mapped to the target.domain.name UDM field and the other occurrences are mapped to the additional.fields[domain_recipients] UDM field.
data.sourceIp	principal.ip
data.loginDetails.ipAddress	principal.ip
data.maliciousEntity.displayName	principal.labels[malicious_entity_display_name] (deprecated)
data.maliciousEntity.displayName	additional.fields[malicious_entity_display_name]
data.requestInfo.appDeveloperEmail	principal.user.email_addresses
data.actorEmail	principal.user.email_addresses
data.ruleViolationInfo.triggeringUserEmail	principal.user.email_addresses
data.email	principal.user.email_addresses
data.domain	security_result.about.administrative_domain
metadata.assignee	security_result.about.labels[assignee] (deprecated)
metadata.assignee	additional.fields[assignee]
data.header	security_result.about.labels[header] (deprecated)
data.header	additional.fields[header]
data.ruleViolationInfo.suppressedActionTypes	security_result.about.labels[suppressed_action_types] (deprecated)
data.ruleViolationInfo.suppressedActionTypes	additional.fields[suppressed_action_types]
data.title	security_result.about.labels[title] (deprecated)
data.title	additional.fields[title]
alertId	security_result.about.object_reference
data.affectedUserEmails	security_result.about.user.email_addresses
data.ruleViolationInfo.triggeredActionTypes	security_result.action_details
	security_result.action_type	If the data.ruleViolationInfo.triggeredActionTypes log field value is equal to ACTION_TYPE_UNSPECIFIED, then the security_result.action_type UDM field is set to UNKNOWN_ACTION. If the data.ruleViolationInfo.triggeredActionTypes log field value is equal to DRIVE_BLOCK_EXTERNAL_SHARING, then the security_result.action_type UDM field is set to BLOCK. If the data.ruleViolationInfo.triggeredActionTypes log field value is equal to DRIVE_WARN_ON_EXTERNAL_SHARING or ALERT or RULE_ACTIVATE or RULE_DEACTIVATE, then the security_result.action_type UDM field is set to ALLOW.
	security_result.category	If the source log field value is equal to Gmail Phishing, then the security_result.category UDM field is set to MAIL_PHISHING. If the source log field value is equal to Google Identity, then the security_result.category UDM field is set to ACL_VIOLATION. If the source log field value is equal to Security Center rules or Data Loss Prevention, then the security_result.category UDM field is set to POLICY_VIOLATION.
source	security_result.category_details
data.actionNames	security_result.detection_fields[action_names]
data.alertDetails	security_result.detection_fields[alert_details]
data.createTime	security_result.detection_fields[create_time]
data.messages.date	security_result.detection_fields[date]	If the source log field value is equal to Gmail phishing, then the data.messages.date log field is mapped to the security_result.detection_fields UDM field.
data.events.deviceCompromisedState	security_result.detection_fields[device_compromised_state]
data.displayName	security_result.detection_fields[display_name]
data.eventTime	security_result.detection_fields[event_time]
data.isInternal	security_result.detection_fields[is_internal]
data.loginDetails.loginTime	security_result.detection_fields[login_time]
data.messages.md5HashMessageBody	security_result.detection_fields[md5_hash_message_body]	If the source log field value is equal to Gmail phishing, then the data.messages.md5HashMessageBody log field is mapped to the security_result.detection_fields UDM field.
data.messages.md5hashsubject	security_result.detection_fields[md5_hash_subject]	If the source log field value is equal to Gmail phishing, then the data.messages.md5hashsubject log field is mapped to the security_result.detection_fields UDM field.
data.messages.messageBodySnippet	security_result.detection_fields[message_body_snippet]
metadata.status	security_result.detection_fields[metadata_status]
data.query	security_result.detection_fields[query]
securityInvestigationToolLink	security_result.detection_fields[security_investigation_tool_link]
startTime	security_result.detection_fields[start_time]
data.supersededAlerts	security_result.detection_fields[superseded_alerts]
data.supersedingAlert	security_result.detection_fields[superseding_alert]
data.systemActionType	security_result.detection_fields[system_action_type]
data.threshold	security_result.detection_fields[threshold]
data.triggerSource	security_result.detection_fields[trigger_source]
data.ruleViolationInfo.trigger	security_result.detection_fields[trigger]
data.updateTime	security_result.detection_fields[update_time]
data.windowSize	security_result.detection_fields[windows_size]
data.ruleViolationInfo.ruleInfo.resourceName	security_result.rule_id
data.ruleViolationInfo.matchInfo.userDefinedDetector.displayName	security_result.rule_labels[detector_display_name]
data.ruleViolationInfo.matchInfo.predefinedDetector.detectorName	security_result.rule_labels[detector_name]
data.ruleViolationInfo.matchInfo.userDefinedDetector.resourceName	security_result.rule_labels[detector_resource_name]
data.name	security_result.rule_name
data.ruleViolationInfo.ruleInfo.displayName	security_result.rule_name
metadata.severity	security_result.severity
type	security_result.summary
data.type	security_result.summary	If the type log field value is empty, then the data.type log field is mapped to the security_result.summary UDM field.
	security_result.alert_state	The security_result.alert_state UDM field is set to ALERTING.
data.requestInfo.appKey	target.application
data.events.deviceId	target.asset.asset_id
data.events.deviceProperty	target.asset.attribute.labels[device_property]
data.events.iosVendorId	target.asset.attribute.labels[ios_vendor_id]
data.events.newValue	target.asset.attribute.labels[new_value]
data.events.oldValue	target.asset.attribute.labels[old_value]
data.events.resourceId	target.asset.attribute.labels[resource_id]
data.events.deviceModel	target.asset.hardware.model
data.events.serialNumber	target.asset.hardware.serial_number
data.events.deviceType	target.asset.type
data.primaryAdminChangedEvent.domain	target.domain.name
data.ssoProfileUpdatedEvent.inboundSsoProfileChanges	target.labels[inbound_sso_profile_changes] (deprecated)
data.ssoProfileUpdatedEvent.inboundSsoProfileChanges	additional.fields[inbound_sso_profile_changes]
data.requestInfo.numberOfRequests	target.labels[number_of_requests] (deprecated)
data.requestInfo.numberOfRequests	additional.fields[number_of_requests]
data.primaryAdminChangedEvent.previousAdminEmail	target.labels[previous_admin_email] (deprecated)
data.primaryAdminChangedEvent.previousAdminEmail	additional.fields[previous_admin_email]
data.products	target.labels[product] (deprecated)
data.products	additional.fields[product]
data.ruleViolationInfo.resourceInfo.resourceTitle	target.labels[resource_title] (deprecated)
data.ruleViolationInfo.resourceInfo.resourceTitle	additional.fields[resource_title]
data.takeoutRequestId	target.labels[takeout_request_id] (deprecated)
data.takeoutRequestId	additional.fields[takeout_request_id]
data.ruleViolationInfo.dataSource	target.resource.name
data.ssoProfileCreatedEvent.inboundSsoProfileName	target.resource.name
data.ssoProfileUpdatedEvent.inboundSsoProfileName	target.resource.name
data.ssoProfileDeletedEvent.inboundSsoProfileName	target.resource.name
data.ruleViolationInfo.resourceInfo.documentId	target.resource.product_object_id
	target.resource.resource_type	If the data.@type log field value is equal to DlpRuleViolation, then the target.resource.resource_type UDM field is set to STORAGE_OBJECT. If the data.@type log field value is equal to AppMakerSqlSetupNotification, then the target.resource.resource_type UDM field is set to DATABASE. If the data.type log field value is equal to SSO profile added or SSO profile updated or SSO profile deleted, then the target.resource.resource_type UDM field is set to SETTING.
data.maliciousEntity.entity.emailAddress	target.user.email_addresses
data.email	target.user.email_addresses	If the data.@type log field value is equal to StateSponsoredAttack, DeviceCompromised, or AccountWarning, then the data.email log field is mapped to the target.user.email_addresses UDM field. Else, the data.email log field is mapped to the principal.user.email_addresses UDM field.
data.primaryAdminChangedEvent.updatedAdminEmail	target.user.email_addresses
data.superAdminPasswordResetEvent.userEmail	target.user.email_addresses
data.maliciousEntity.entity.displayName	target.user.user_display_name
data.ruleViolationInfo.triggeredActionInfo

Referenz für die Feldzuordnung: WORKSPACE_GROUPS

In der folgenden Tabelle sind die Logfelder des Logtyps WORKSPACE_GROUPS und die zugehörigen UDM-Felder aufgeführt.

Eingestellt:

Die folgenden labels-Felder für UDM-Nomen wurden eingestellt: about.labels, intermediary.labels, observer.labels, principal.labels, src.labels, security_result.about.labels und target.labels. Bei vorhandenen Parsern werden die Logfelder zusätzlich zu diesen UDM-Feldern auch den Schlüssel/Wert-additional.fields-UDM-Feldern zugeordnet. Bei neuen Parsern werden die Schlüssel/Wert-Einstellungen in den UDM-Feldern additional.fields anstelle der verworfenen UDM-Felder labels verwendet. Wir empfehlen, die vorhandenen Regeln so zu aktualisieren, dass die Schlüssel/Wert-Einstellungen in den UDM-Feldern „additional.fields“ anstelle der verworfenen UDM-Felder labels verwendet werden.

Log field	UDM mapping	Logic
adminCreated	entity.group.attribute.labels[admin_created]	If the adminCreated log field value is equal to true, then the admin_created.value UDM field is set to true. Else, the admin_created.value UDM field is set to false.
description	metadata.description
directMembersCount	entity.group.attribute.labels[direct_members_count]
email	entity.group.email_addresses
nonEditableAliases	entity.group.email_addresses
aliases	entity.group.email_addresses
etag	entity.labels[etag] (deprecated)
etag	additional.fields[etag]
id	entity.group.product_object_id
kind	entity.labels[kind] (deprecated)
kind	additional.fields[kind]
name	entity.group.group_display_name
	metadata.vendor_name	The metadata.vendor_name UDM field is set to GOOGLE.
	metadata.product_name	The metadata.product_name UDM field is set to WORKSPACE GROUPS.
	metadata.entity_type	The metadata.entity_type UDM field is set to GROUP.

Referenz für die Feldzuordnung: WORKSPACE_USERS

In der folgenden Tabelle sind die Protokollfelder des WORKSPACE_USERS-Protokolltyps und die zugehörigen UDM-Felder aufgeführt.

Eingestellt:

Die folgenden labels-Felder für UDM-Nomen wurden eingestellt: about.labels, intermediary.labels, observer.labels, principal.labels, src.labels, security_result.about.labels und target.labels. Bei vorhandenen Parsern werden die Logfelder zusätzlich zu diesen UDM-Feldern auch den Schlüssel/Wert-additional.fields-UDM-Feldern zugeordnet. Bei neuen Parsern werden die Schlüssel/Wert-Einstellungen in den UDM-Feldern von additional.fields anstelle der eingestellten UDM-Felder von labels verwendet. Wir empfehlen, die vorhandenen Regeln so zu aktualisieren, dass die Schlüssel/Wert-Einstellungen in den UDM-Feldern „additional.fields“ anstelle der verworfenen UDM-Felder labels verwendet werden.

Log field	UDM mapping	Logic
addresses.country	entity.user.personal_address.country_or_region
addresses.countryCode	entity.user.attribute.labels[addresses_country_code]
addresses.customType	entity.user.attribute.labels[addresses_custom_type]
addresses.extendedAddress	entity.user.attribute.labels[addresses_extended_address]
addresses.formatted	entity.user.office_address.name	The addresses.formatted log field is mapped to the user.office_address.name UDM field if the following conditions are met: The message log field value matches the regular expression pattern addresses.*?formatted. The addresses.type log field value is equal to work. The addresses.formatted log field value is not empty.
addresses.locality	entity.user.attribute.labels[addresses_locality]
addresses.poBox	entity.user.attribute.labels[addresses_pobox]
addresses.postalCode	entity.user.attribute.labels[addresses_postal_code]
addresses.primary	entity.user.attribute.labels[addresses_primary]
addresses.region	entity.user.attribute.labels[addresses_region]
addresses.sourceIsStructured	entity.user.attribute.labels[addresses_source_is_structured]
addresses.streetAddress	entity.user.attribute.labels[addresses_street_address]
addresses.type	entity.user.attribute.labels[addresses_type]
agreedToTerms	entity.user.attribute.labels[agreed_to_terms]
aliases	entity.user.attribute.labels[aliases_email]
changePasswordAtNextLogin	entity.user.attribute.labels[change_password_at_next_login]	If the changePasswordAtNextLogin log field value is equal to true, then the change_password_at_next_login.value UDM field is set to true. Else, the change_password_at_next_login.value UDM field is set to false.
creationTime	entity.user.attribute.creation_time
customerId	entity.user.attribute.labels[customer_id]
deletionTime	entity.user.attribute.labels[deletion_time]
emails.customType	entity.user.attribute.labels[email_acustom_type]
emails.primary	entity.user.attribute.labels[email_primary]
emails.type	entity.user.attribute.labels[email_type]
etag	entity.labels[etag] (deprecated)
etag	additional.fields[etag]
externalIds.customType	entity.user.attribute.labels[external_id_custom_type]
externalIds.type	entity.user.attribute.labels[external_id_type]
externalIds.value	entity.user.employee_id	If the externalIds.type log field value is equal to organization, then the externalIds.value log field is mapped to the user.employee_id UDM field.
gender.addressMeAs	entity.user.attribute.labels[gender_address_me_as]
gender.customGender	entity.user.attribute.labels[custom_gender]
gender.type	entity.user.attribute.labels[gender]
hashFunction	entity.user.attribute.labels[hash_function]
id	entity.user.product_object_id
ims.customProtocol	entity.user.attribute.labels[ims_custom_protocol]
ims.customType	entity.user.attribute.labels[ims_custom_type]
ims.im	entity.user.attribute.labels[ims_im]
ims.primary	entity.user.attribute.labels[ims_primary]
ims.protocol	entity.user.attribute.labels[ims_protocol]
ims.type	entity.user.attribute.labels[ims_type]
includeInGlobalAddressList	entity.user.attribute.labels[included_in_global_address_list]	If the includeInGlobalAddressList log field value is equal to true, then the included_in_global_address_list.value UDM field is set to true, else, then the included_in_global_address_list.value UDM field is set to false.
ipWhitelisted	entity.user.attribute.labels[ip_whitelisted]
isAdmin	entity.user.attribute.labels[is_admin]
isDelegatedAdmin	entity.user.attribute.labels[is_delegated_admin]
	user.attribute.roles.type	If the isAdmin log field value or the isDelegatedAdmin log field value is equal to true, then the user.attribute.roles.type UDM field is set to ADMINISTRATOR.
isEnforcedIn2Sv	entity.user.attribute.labels[is_enforced_in_2sv]	If the isEnforcedIn2Sv log field value is equal to true, then the is_enforced_in_2sv.value UDM field is set to true, else, then the is_enforced_in_2sv.value UDM field is set to false.
isEnrolledIn2Sv	entity.user.attribute.labels[is_enrolled_in_2sv]	If the isEnrolledIn2Sv log field value is equal to true, then the is_enrolled_in_2sv.value UDM field is set to true, else, then the is_enrolled_in_2sv.value UDM field is set to false.
isMailboxSetup	entity.user.attribute.labels[is_mailbox_setup]	If the isMailboxSetup log field value is equal to true, then the is_mail_box_setup.value UDM field is set to true, else, then the is_mail_box_setup.value UDM field is set to false.
keywords.customType	entity.user.attribute.labels[keywords_custom_type]
keywords.type	entity.user.attribute.labels[keywords_type]
keywords.value	entity.user.attribute.labels[keywords_value]
kind	entity.labels[kind] (deprecated)
kind	additional.fields[kind]
languages.customLanguage	entity.user.attribute.labels[language_custom_language]
languages.languageCode	entity.user.attribute.labels[language_code]
languages.preference	entity.user.attribute.labels[preferred_language]
lastLoginTime	entity.user.last_login_time
locations.area	entity.user.office_address.country_or_region
locations.buildingId	entity.user.attribute.labels[locations_buildingId]
locations.customType	entity.user.attribute.labels[locations_customType]
locations.deskCode	entity.user.officel_address.desk_name
locations.floorName	entity.user.office_address.floor_name
locations.floorSection	entity.user.attribute.labels[locations_floorSection]
locations.type	entity.user.attribute.labels[locations_type]
name.familyName	entity.user.last_name
name.fullName	entity.user.user_display_name
name.givenName	entity.user.first_name
notes.contentType	entity.user.attribute.labels[notes_content_type]
notes.value	entity.user.attribute.labels[notes_value]
organizations.costCenter	entity.user.attribute.labels[organization_cost_center]
organizations.customType	entity.user.attribute.labels[organization_custom_type]
organizations.department	entity.user.department	The organizations.department log field is mapped to the user.department UDM field if the following conditions are met: The message log field value matches the regular expression pattern organizations.*?department. The org.department log field value is not empty.
organizations.description	entity.user.attribute.labels [organizations_description]
organizations.domain	entity.user.attribute.labels[organization_domain]
organizations.fullTimeEquivalent	entity.user.attribute.labels[organization_full_time_equivalent]
organizations.location	entity.user.attribute.labels[organization_location]
organizations.name	entity.user.attribute.labels[organization_name]
organizations.primary	entity.user.attribute.labels[organization_primary]
organizations.symbol	entity.user.attribute.labels[organization_symbol]
organizations.title	entity.user.title
organizations.type	entity.user.attribute.labels[organization_type]
orgUnitPath	entity.user.attribute.labels[org_unit_path]
password	entity.user.attribute.labels[password]
phones.customType	entity.user.attribute.labels[phone_custom_type]
phones.primary	entity.user.attribute.labels[phone_primary]
phones.type	entity.user.attribute.labels[phone_type]
phones.value	entity.user.phone_numbers	If the phones.value log field value matches the regular expression pattern (^the +.0-9 log field value*), then the phones.value log field is mapped to the user.phone_numbers UDM field.
recoveryPhone	entity.user.phone_numbers
posixAccounts.accountId	entity.user.attribute.labels[posix_account_id]
posixAccounts.gecos	entity.user.attribute.labels[posix_account_gecos]
posixAccounts.gid	entity.user.group_identifiers
posixAccounts.homeDirectory	entity.user.attribute.labels[posix_account_home_directory]
posixAccounts.operatingSystemType	entity.platform	If the posixAccounts.operatingSystemType log field value is equal to linux, then the entity.platform UDM field is set to LINUX. If the posixAccounts.operatingSystemType log field value is equal to windows, then the entity.platform UDM field is set to WINDOWS. Else, the entity.platform UDM field is set to UNKNOWN_PLATFORM.
posixAccounts.primary	entity.user.attribute.labels[posix_account_primary]
posixAccounts.shell	entity.user.attribute.labels[posix_account_shell]
posixAccounts.systemId	entity.asset.asset_id
posixAccounts.uid	entity.user.attribute.labels[posix_account_uid]
posixAccounts.username	entity.user.userid	If the posixAccounts.username log field value is not empty, then the posixAccounts.username log field is mapped to the entity.user.userid UDM field.
primaryEmail	entity.user.email_addresses
recoveryEmail	entity.user.email_addresses
nonEditableAliases	entity.user.email_addresses
emails.address	entity.user.email_addresses	If the emails.address log field value is not equal to primaryEmail, then the emails.address log field is mapped to the entity.user.email_addresses UDM field.
relations.customType	entity.user.attribute.labels[relations_custom_type]
relations.type	entity.user.attribute.labels[relation_type]
relations.value	entity.user.managers.email_addresses	If the relation.type log field value is equal to manager, then the relations.value log field is mapped to the user.managers.email_addresses UDM field. Else, the relations.value log field is mapped to the user.attribute.labels UDM field.
relations.value	entity.user.attribute.labels[relations_type]	If the relation.type log field value is equal to manager, then the relations.value log field is mapped to the user.managers.email_addresses UDM field. Else, the relations.value log field is mapped to the user.attribute.labels UDM field.
sshPublicKeys.expirationTimeUsec	entity.user.attribute.labels[ssh_key_expiration_timec]
sshPublicKeys.fingerprint	entity.user.attribute.labels[ssh_key_fingerprint]
sshPublicKeys.key	entity.user.attribute.labels[ssh_key]
suspended	entity.user.user_authentication_status	If the suspended log field value is equal to true and the archived log field value is not equal to true, then the entity.user.user_authentication_status UDM field is set to SUSPENDED. If the archived log field value is equal to true, then the entity.user.user_authentication_status UDM field is set to DELETED. Else, the entity.user.user_authentication_status UDM field is set to ACTIVE.
archived	entity.user.user_authentication_status	If the suspended log field value is equal to true and the archived log field value is not equal to true, then the entity.user.user_authentication_status UDM field is set to SUSPENDED. If the archived log field value is equal to true, then the entity.user.user_authentication_status UDM field is set to DELETED. Else, the entity.user.user_authentication_status UDM field is set to ACTIVE.
suspensionReason	entity.user.attribute.labels[suspension_reason]
thumbnailPhotoEtag	entity.user.attribute.labels[thumbnail_photo_etag]
thumbnailPhotoUrl	entity.url
websites.customType	entity.user.attribute.labels[websites_custom_type]
websites.primary	entity.user.attribute.labels[websites_primary]
websites.type	entity.user.attribute.labels[websites_type]
websites.value	entity.user.attribute.labels[websites_value]
	metadata.vendor_name	The metadata.vendor_name UDM field is set to GOOGLE.
	metadata.product_name	The metadata.product_name UDM field is set to Cloud Identity.
	metadata.entity_type	The metadata.entity_type UDM field is set to USER.

Referenz für die Feldzuordnung: WORKSPACE_MOBILE_devices

In der folgenden Tabelle sind die Protokollfelder des WORKSPACE_MOBILE_DEVICES-Protokolltyps und die zugehörigen UDM-Felder aufgeführt.

Eingestellt:

Die folgenden labels-Felder für UDM-Nomen wurden eingestellt: about.labels, intermediary.labels, observer.labels, principal.labels, src.labels, security_result.about.labels und target.labels. Bei vorhandenen Parsern werden die Logfelder zusätzlich zu diesen UDM-Feldern auch den Schlüssel/Wert-additional.fields-UDM-Feldern zugeordnet. Bei neuen Parsern werden die Schlüssel/Wert-Einstellungen in den UDM-Feldern additional.fields anstelle der verworfenen UDM-Felder labels verwendet. Wir empfehlen, die vorhandenen Regeln so zu aktualisieren, dass die Schlüssel/Wert-Einstellungen in den UDM-Feldern „additional.fields“ anstelle der verworfenen UDM-Felder labels verwendet werden.

Log field	UDM mapping	Logic
adbStatus	entity.asset.attribute.labels[abd status]
applications.displayName	entity.asset.software.name
applications.packageName	entity.asset.attribute.labels[application_package_name]
applications.permission	entity.asset.software.permissions.name
applications.versionCode	entity.asset.attribute.labels[application_version_code]
applications.versionName	entity.asset.software.version
basebandVersion	entity.asset.attribute.labels[baseband_version]
bootloaderVersion	entity.asset.attribute.labels[bootloader_version]
brand	entity.asset.attribute.labels[brand]
buildNumber	entity.asset.attribute.labels[build_number]
defaultLanguage	entity.asset.attribute.labels[default_language]
developerOptionsStatus	entity.asset.attribute.labels[developer_options_status]
deviceCompromisedStatus	entity.asset.attribute.labels[device_compromised_status]
deviceId	entity.asset.asset_id
devicePasswordStatus	entity.asset.attribute.labels[device_password_status]
email	entity.user.email_addresses
encryptionStatus	entity.asset.attribute.labels[encryption_status]
etag	entity.labels[etag] (deprecated)
etag	additional.fields[etag]
firstSync	entity.asset.attribute.labels[first_sync]
hardware	entity.asset.attribute.labels[hardware]
hardwareId	entity.asset.attribute.labels[hardware_id]
imei	entity.asset.asset_id
deviceId	entity.asset.asset_id	If the imei log field value is empty, then the deviceId log field is mapped to the entity.asset.asset_id UDM field.
kernelVersion	entity.asset.attribute.labels[kernel_version]
kind	entity.labels[kind] (deprecated)
kind	additional.fields[kind]
lastSync	entity.asset.attribute.labels[last_sync]
managedAccountIsOnOwnerProfile	entity.asset.attribute.labels[managed_account_is_on_owner_profile]
manufacturer	entity.asset.hardware.manufacturer
meid	entity.asset.attribute.labels[meid]
model	entity.asset.hardware.model
name	entity.user.user_display_name
networkOperator	entity.asset.attribute.labels[network_operator]
os	entity.asset.platform_software.platform	If the os log field value matches iOS, then the entity.asset.platform_software.platform UDM field is set to IOS. If the os log field value matches Android, then the entity.asset.platform_software.platform UDM field is set to ANDROID. Else, the entity.asset.platform_software.platform UDM field is set to UNKNOWN_PLATFORM.
otherAccountsInfo[]	entity.asset.attribute.labels[other_accounts_info]
privilege	entity.asset.attribute.labels[privilege]
releaseVersion	entity.asset.attribute.labels[release_version]
resourceId	entity.asset.product_object_id
securityPatchLevel	entity.asset.platform_software.platform_patch_level
serialNumber	entity.asset.hardware.serial_number
status	entity.user.user_authentication_status	If the status log field value is equal to approved, then the entity.user.user_authentication_status UDM field is set to ACTIVE. If the status log field value is equal to unprovisined, then the entity.user.user_authentication_status UDM field is set to SUSPENDED.
supportsWorkProfile	entity.asset.attribute.labels[supports_work_profile]
type	entity.asset.attribute.labels[type]
unknownSourcesStatus	entity.asset.attribute.labels[unknown_sources_status]
userAgent	entity.asset.attribute.labels[user_agent]
wifiMacAddress	entity.asset.mac
	metadata.entity_type	The metadata.entity_type UDM field is set to ASSET.
	metadata.product_name	The metadata.product_name UDM field is set to WORKSPACE_MOBILE.
	metadata.vendor_name	The metadata.vendor_name UDM field is set to GOOGLE.
	relations.entity_type	The relations.entity_type UDM field is set to USER.
	relations.relationship	The relations.relationship UDM field is set to MEMBER.

Referenz für die Feldzuordnung: WORKSPACE_CHROMEOS

In der folgenden Tabelle sind die Logfelder des Logtyps WORKSPACE_CHROMEOS und die zugehörigen UDM-Felder aufgeführt.

Eingestellt:

Die folgenden labels-Felder für UDM-Nomen wurden eingestellt: about.labels, intermediary.labels, observer.labels, principal.labels, src.labels, security_result.about.labels und target.labels. Bei vorhandenen Parsern werden die Logfelder zusätzlich zu diesen UDM-Feldern auch den Schlüssel/Wert-additional.fields-UDM-Feldern zugeordnet. Bei neuen Parsern werden die Schlüssel/Wert-Einstellungen in den UDM-Feldern additional.fields anstelle der verworfenen UDM-Felder labels verwendet. Wir empfehlen, die vorhandenen Regeln so zu aktualisieren, dass die Schlüssel/Wert-Einstellungen in den UDM-Feldern „additional.fields“ anstelle der verworfenen UDM-Felder labels verwendet werden.

Log field	UDM mapping	Logic
activeTimeRanges.activeTime	entity.asset.attribute.labels[active_time]
activeTimeRanges.date	entity.asset.attribute.labels[active_time_range_date]
annotatedAssetId	entity.asset.asset_id	If the annotatedAssetId log field value is not empty, then the ASSET ID: annotatedAssetId log field is mapped to the entity.asset.asset_id UDM field.
deviceId	entity.asset.asset_id	If the annotatedAssetId log field value is empty, then the CHROMEOS:deviceId log field is mapped to the entity.asset.asset_id UDM field.
annotatedLocation	entity.asset.location.name
annotatedUser	relations.entity.user.user_display_name	If the annotatedUser log field value is not empty and the annotatedUser log field value does not match the regular expression @, then the annotatedUser log field is mapped to the relations.entity.user.user_display_name UDM field.
autoUpdateExpiration	entity.asset.attribute.labels[auto_update_expiration]
bootMode	entity.asset.attribute.labels[boot_mode]
cpuInfo.architecture	entity.asset.attribute.labels[cpu_architecture]
cpuInfo.logicalCpus.cStates.displayName	entity.asset.attribute.labels[cpu_logical_cups_cstates_display_name]
cpuInfo.logicalCpus.cStates.sessionDuration	entity.asset.attribute.labels[cpu_logical_cups_cstates_session_duration]
cpuInfo.logicalCpus.currentScalingFrequencyKhz	entity.asset.attribute.labels[cpu_current_scaling_frequency]
cpuInfo.logicalCpus.idleDuration	entity.asset.attribute.labels[cpu_ideal_duration]
cpuInfo.logicalCpus.maxScalingFrequencyKhz	entity.asset.attribute.labels[cpu_max_scaling_frequency]
cpuInfo.maxClockSpeedKhz	entity.asset.attribute.labels[cpu_max_clock_speed]
cpuInfo.model	entity.asset.hardware.cpu_model
cpuStatusReports.cpuTemperatureInfo.label	entity.asset.attribute.labels[cpu_temperature_label]
cpuStatusReports.cpuTemperatureInfo.temperature	entity.asset.attribute.labels[cpu_temperature]
cpuStatusReports.cpuUtilizationPercentageInfo	entity.asset.attribute.labels[cpu_utilization_percentage_info]
cpuStatusReports.reportTime	entity.asset.attribute.labels[cpu_report_time]
deviceFiles.createTime	relations.entity.file.first_seen_time
deviceFiles.downloadUrl	relations.entity.file.full_path
deviceFiles.name	relations.entity.file.names
deviceFiles.type	relations.entity.file.mime_type
	relations.entity_type	The relations.entity_type UDM field is set to FILE.
	relations.relationship	The relations.relationship UDM field is set to MEMBER.
deviceId	entity.asset.product_object_id
diskVolumeReports.volumeInfo.storageFree	entity.asset.attribute.labels[volume_info_storage_free]
diskVolumeReports.volumeInfo.storageTotal	entity.asset.attribute.labels[volume_info_storage_total]
diskVolumeReports.volumeInfo.volumeId	entity.asset.attribute.labels[volume_id]
dockMacAddress	entity.asset.attribute.labels[dock_mac_address]
etag	entity.labels[etag] (deprecated)
etag	additional.fields[etag]
ethernetMacAddress0	entity.asset.attribute.labels[ethernet_mac_address]
firmwareVersion	entity.asset.attribute.labels[firmware_version]
kind	entity.labels[kind] (deprecated)
kind	additional.fields[kind]
lastEnrollmentTime	entity.asset.last_discover_time
lastKnownNetwork.ipAddress	entity.asset.ip
lastKnownNetwork.wanIpAddress	entity.asset.nat_ip
lastSync	entity.asset.system_last_update_time
macAddress	entity.asset.mac
ethernetMacAddress	entity.asset.mac
manufactureDate	entity.asset.attribute.labels[manufacture_date]
meid	entity.asset.attribute.labels[meid]
model	entity.asset.hardware.model
notes	entity.asset.attribute.labels[notes]
orderNumber	entity.asset.attribute.labels[order_number]
orgUnitId	entity.asset.attribute.labels[org_unit_id]
orgUnitPath	entity.user.attribute.labels[org_unit_path]
osVersion	entity.asset.attribute.labels[os_version]
platformVersion	entity.asset.platform_software.platform_version
annotatedUser	entity.user.email_addresses	If the annotatedUser log field value is not empty and the annotatedUser log field value matches the regular expression @, then the annotatedUser log field is mapped to the entity.user.email_addresses UDM field.
recentUsers.email	entity.user.email_addresses
recentUsers.type	relations.entity.user.attribute.roles.name
	relations.entity.user.attribute.roles.description	If the recentUsers.type log field value is equal to USER_TYPE_MANAGED, then the relations.entity.user.attribute.roles.description UDM field is set to The user is managed by the domain. Else, if the recentUsers.type log field value is equal to USER_TYPE_UNMANAGED, then the relations.entity.user.attribute.roles.description UDM field is set to The user is not managed by the domain.
screenshotFiles.createTime	relations.entity.file.first_seen_time
screenshotFiles.downloadUrl	relations.entity.file.full_path
screenshotFiles.name	relations.entity.file.names
screenshotFiles.type	relations.entity.file.mime_type
serialNumber	entity.asset.hardware.serial_number
status	entity.asset.deployment_status	If the status log field value is equal to DEPROVISIONED, then the entity.asset.deployment_status UDM field is set to DECOMMISSIONED. Else, the entity.asset.deployment_status UDM field is set to ACTIVE.
supportEndDate	entity.asset.attribute.labels[support_end_date]
systemRamFreeReports.reportTime	entity.asset.attribute.labels[system_ram_report_time]
systemRamFreeReports.systemRamFreeInfo	entity.asset.attribute.labels[system_ram_free_info]
systemRamTotal	entity.asset.hardware.ram
tpmVersionInfo.family	entity.asset.attribute.labels[tpm_ver_info_family]
tpmVersionInfo.firmwareVersion	entity.asset.attribute.labels[tpm_ver_info_firmware_version]
tpmVersionInfo.manufacturer	entity.asset.attribute.labels[tpm_ver_info_manufacturer]
tpmVersionInfo.specLevel	entity.asset.attribute.labels[tpm_ver_info_spec_level]
tpmVersionInfo.tpmModel	entity.asset.attribute.labels[tpm_ver_info_tpm_model]
tpmVersionInfo.vendorSpecific	entity.asset.attribute.labels[tpm_ver_info_vendor_specific]
willAutoRenew	entity.asset.attribute.labels[will_auto_renew]
	entity.asset.type	The entity.asset.type UDM field is set to WORKSTATION.
	metadata.entity_type	The metadata.entity_type UDM field is set to ASSET.
	metadata.product_name	The metadata.product_name UDM field is set to ChromeOS.
	metadata.vendor_name	The metadata.vendor_name UDM field is set to GOOGLE.
	relations.entity_type	The relations.entity_type UDM field is set to USER.
	relations.relationship	The relations.relationship UDM field is set to MEMBER.

Referenz zur Feldzuordnung: WORKSPACE_PRIVILEGES

In der folgenden Tabelle sind die Logfelder des Logtyps WORKSPACE_PRIVILEGES und die zugehörigen UDM-Felder aufgeführt.

Eingestellt:

Die folgenden labels-Felder für UDM-Nomen wurden eingestellt: about.labels, intermediary.labels, observer.labels, principal.labels, src.labels, security_result.about.labels und target.labels. Bei vorhandenen Parsern werden die Logfelder zusätzlich zu diesen UDM-Feldern auch den Schlüssel/Wert-additional.fields-UDM-Feldern zugeordnet. Bei neuen Parsern werden die Schlüssel/Wert-Einstellungen in den UDM-Feldern additional.fields anstelle der verworfenen UDM-Felder labels verwendet. Wir empfehlen, die vorhandenen Regeln so zu aktualisieren, dass die Schlüssel/Wert-Einstellungen in den UDM-Feldern „additional.fields“ anstelle der verworfenen UDM-Felder labels verwendet werden.

Log field	UDM mapping
roleAssignments.assignedTo	metadata.product_entity_id
roleAssignments.roleAssignmentId	entity.user.attribute.labels[role_assignment_id]
roleAssignments.roleDetails.roleDescription	entity.user.attribute.roles.description
roleAssignments.roleDetails.roleId	entity.user.attribute.labels[role_details_role_id]
roleAssignments.roleDetails.roleName	entity.user.attribute.roles.name
roleAssignments.roleDetails.rolePrivileges.details.childPrivileges.etag
roleAssignments.roleDetails.rolePrivileges.details.childPrivileges.isOuScopable
roleAssignments.roleDetails.rolePrivileges.details.childPrivileges.kind
roleAssignments.roleDetails.rolePrivileges.details.childPrivileges.privilegeName	entity.user.attribute.labels[%{rolePrivilege.privilegeName}_CHILD_PRIVILEGES]
roleAssignments.roleDetails.rolePrivileges.details.childPrivileges.serviceId
roleAssignments.roleDetails.rolePrivileges.details.childPrivileges.serviceName
roleAssignments.roleDetails.rolePrivileges.details.etag	entity.labels[etag] (deprecated)
roleAssignments.roleDetails.rolePrivileges.details.etag	additional.fields[etag]
roleAssignments.roleDetails.rolePrivileges.details.isOuScopable	entity.user.attribute.labels[is_ou_scopable]
roleAssignments.roleDetails.rolePrivileges.details.kind	entity.labels[kind] (deprecated)
roleAssignments.roleDetails.rolePrivileges.details.kind	additional.fields[kind]
roleAssignments.roleDetails.rolePrivileges.details.privilegeName
roleAssignments.roleDetails.rolePrivileges.details.serviceId
roleAssignments.roleDetails.rolePrivileges.details.serviceName	entity.user.attribute.labels[service_name]
roleAssignments.roleDetails.rolePrivileges.privilegeName	entity.user.attribute.permissions.name
roleAssignments.roleDetails.rolePrivileges.serviceId	entity.user.attribute.permissions.description
roleAssignments.roleId	entity.user.attribute.labels[role_id]
roleAssignments.scopeType	entity.user.attribute.labels[scope_type]
userId	entity.user.userid
	metadata.vendor_name
	metadata.product_name
	metadata.entity_type

Nächste Schritte

• Datenaufnahme in Google Security Operations