Esta página foi traduzida pela API Cloud Translation.

Coletar registros do Google Workspace

Compatível com:

Google SecOps SIEM

Este documento descreve como coletar registros do Google Workspace configurando um feed de operações de segurança do Google e como os campos de registro são mapeados para os campos do modelo de dados unificado (UDM, na sigla em inglês) das operações de segurança do Google. Este documento também lista os tipos de registro e de evento compatíveis com o Google Workspace.

Para mais informações, consulte Ingestão de dados para as Operações de segurança do Google.

Uma implantação típica consiste no Google Workspace e no feed do Google Security Operations configurado para enviar registros ao Google Security Operations. Cada implantação do cliente pode ser diferente e mais complexa.

A implantação contém os seguintes componentes:

Google Workspace A plataforma do Google Workspace em que os registros serão coletados.
Feed de Operações de segurança do Google. O feed de Operações de Segurança do Google que busca registros do Google Workspace e grava registros nas Operações de segurança do Google.
Google Security Operations. O Google Security Operations retém e analisa os registros do Google Workspace.

Um rótulo de ingestão identifica o analisador que normaliza dados de registro brutos ao formato UDM estruturado. As informações neste documento se aplicam a analisadores do Google Workspace com os seguintes rótulos de transferência:

WORKSPACE_ACTIVITY
WORKSPACE_ALERTS
WORKSPACE_CHROMEOS
WORKSPACE_GROUPS
WORKSPACE_MOBILE
WORKSPACE_PRIVILEGES
WORKSPACE_USERS

Antes de começar

Confirme se você usa o Google Workspace Business Standard ou Business Plus porque o analisador do Google Workspace é compatível com as duas edições.
Verifique se você tem uma conta de administrador do Google Workspace.
Ative as seguintes APIs no seu projeto do Google Cloud:
- SDK Admin do Google Workspace
- API Alert Center
Para autenticar as APIs do Google Workspace, crie uma conta de serviço no seu projeto do Google Cloud e anote o ID numérico exclusivo e o endereço de e-mail da conta de serviço. Para mais informações sobre como criar uma conta de serviço, consulte Como criar e gerenciar contas de serviço.
Crie um usuário que imite a conta de serviço e conceda privilégios a ele:
1. Faça login no Google Admin Console.
2. Selecione Diretório > Usuários e clique em Adicionar novo usuário.
3. Insira os detalhes do usuário.
4. Clique em Adicionar novo usuário.
5. Clique no link do usuário recém-criado e em Funções e privilégios do administrador.
6. Clique em Abrir menos.
7. Clique em Criar função personalizada.
8. Clique em Criar nova função e dê um nome a ela.
9. Conceda os seguintes privilégios ao papel:
  - Privilégios > Denúncias
  - Privilégios > Serviços > Central de alertas > Acesso total > Acesso de leitura
  - Privilégios > Serviços > Gerenciamento de dispositivos móveis > Gerenciar dispositivos e configurações
  - Privilégios > Serviços > Gerenciamento do Google Chrome > Configurações
  - API Admin > Privilégios > Usuários > Lida
  - API Admin > Privilégios > Grupos > Lida
10. Clique em Continuar e em Criar função.
11. Clique em Atribuir usuários.
12. Selecione o usuário para atribuir a função.
13. Clique em Atribuir função.
Criar credenciais de acesso. Para mais informações sobre como criar credenciais de acesso, consulte Criar uma chave de conta de serviço.

Observação: as chaves de conta de serviço poderão causar problemas de segurança se não forem gerenciadas corretamente. Você é responsável pela segurança da chave privada e por outras operações descritas em Práticas recomendadas para gerenciar chaves de contas de serviço. Se não for possível criar uma chave de conta de serviço, a criação pode ser desativada para sua organização. Para mais informações, consulte Gerenciar recursos da organização com segurança por padrão.
Para acessar dados, autorize a delegação em todo o domínio para a conta de serviço com os seguintes escopos:
- https://www.googleapis.com/auth/admin.reports.audit.readonly
- https://www.googleapis.com/auth/apps.alerts
- https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly
- https://www.googleapis.com/auth/admin.directory.group.readonly
- https://www.googleapis.com/auth/admin.directory.device.mobile.readonly
- https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly
- https://www.googleapis.com/auth/admin.directory.user.readonly
Para localizar o ID de cliente do Google Workspace, no Google Admin Console, faça o seguinte: Selecione Conta > Configurações da conta > Perfil.
Verifique se todos os sistemas na arquitetura de implantação estão configurados no fuso horário UTC.
Verifique os tipos de registro aceitos pelo analisador de Operações de Segurança do Google. Para saber mais sobre os registros do Google Workspace aceitos, consulte Tipos de registros do Google Workspace aceitos.

Configurar um feed nas Operações de segurança do Google para processar registros do Google Workspace

Na barra de navegação, selecione Configurações > Configurações do SIEM > Feeds:
Clique em Add New.
Selecione API de terceiros em Tipo de origem.
Para criar um feed para as atividades do espaço de trabalho, selecione Atividades do espaço de trabalho como o Tipo de registro.
Clique em Próxima.
Com base na configuração do Google Workspace que você criou, especifique os valores nos seguintes campos:
- Endpoint do JWT do OAuth. O endpoint que contém o token JSON da Web OAuth. Especifique o valor token_uri da chave JSON da conta de serviço.
- Emissor de declarações JWT. Esse é o ID do cliente. Especifique o valor client_email. da chave JSON da conta de serviço. Por exemplo, InsertServiceAccount@project.iam.gserviceaccount.com
- Assunto das declarações do JWT. Especifique o endereço de e-mail do usuário que você criou no console do administrador do Google Workspace.
- Declaração de público do JWT. Especifique o valor token_uri da chave JSON da conta de serviço.
- Chave privada RSA. Uma chave privada RSA no formato PEM. A chave PEM está disponível no arquivo de chave da conta de serviço. Ao inserir a chave privada, inclua o cabeçalho BEGIN PRIVATE KEY e o rodapé END PRIVATE KEY e substitua todas as instâncias do token \n por um pressionamento de tecla Enter real na caixa de texto.
- ID do cliente. Para todos os tipos de registro, exceto o de alerta, o ID de cliente campo requer um "C" no início caractere. Se o campo de ID do cliente não tiver um caractere 'C' inicial, adicione o valor com um caractere 'C'.
- Aplicativos. O campo Aplicativos é obrigatório apenas quando você cria um feed para atividades do Workspace.
Clique em Próxima e em Enviar.
Depois de concluir as etapas para criar um feed para atividades do Workspace, repita as etapas para criar um feed separado para cada um dos seguintes tipos de registro.
- Workspace Alerts
- Workspace ChromeOS Devices
- Workspace Groups
- Workspace Mobile Devices
- Workspace Privileges
- Workspace Users

Para mais informações sobre os feeds do Google Security Operations, consulte a documentação sobre feeds do Google Security Operations. Para informações sobre os requisitos de cada tipo de feed, consulte Configuração do feed por tipo.

Se você encontrar problemas ao criar feeds, entre em contato com o suporte das Operações de segurança do Google.

Tipos de registro do Google Workspace compatíveis

As seções a seguir listam os tipos de registro compatíveis com o analisador do Google Workspace:

WORKSPACE_ACTIVITY

A tabela a seguir lista o nome do aplicativo com suporte e os tipos de evento para o tipo de registro WORKSPACE_ACTIVITY.

Nome do aplicativo	Tipo de evento
`access_transparency`	`GSUITE_RESOURCE`
`chrome`	`CHROME_OS_ADD_REMOVE_USER_TYPE`
	`DEVICE_BOOT_STATE_CHANGE_TYPE`
	`CHROME_OS_LOGIN_LOGOUT_TYPE`
	`CHROME_OS_REPORTING_DATA_LOST_TYPE`
	`SAFE_BROWSING_PASSWORD_ALERT`
	`DLP_EVENTS_TYPE`
	`CONTENT_TRANSFER_TYPE`
	`CONTENT_UNSCANNED_TYPE`
	`EXTENSION_REQUEST_TYPE`
	`LOGIN_EVENT_TYPE`
	`MALWARE_TRANSFER_TYPE`
	`PASSWORD_BREACH_TYPE`
	`SENSITIVE_DATA_TRANSFER_TYPE`
	`UNSAFE_SITE_VISIT_TYPE`
`context_aware_access`	`CONTEXT_AWARE_ACCESS_USER_EVENT`
`gplus`	`comment_change`
	`plusone_change`
	`poll_vote_change`
	`post_change`
`data_studio`	`ACCESS`
`data_studio`	`ACL_CHANGE`
`mobile`	`device_applications`
	`device_updates`
	`suspicious_activity`
`groups_enterprise`	`moderator_action`
`calendar`	`calendar_change`
	`notification`
	`subscription_change`
	`event_change`
	`interop`
`chat`	`user_action`
`gcp`	`CLOUD_OSLOGIN`
`drive`	`access`
	`acl_change`
	`pooled_quota_metadata`
`groups`	`acl_change`
`groups`	`moderator_action`
`keep`	`user_action`
`meet`	`call`
`token`	`auth`
`rules`	`action_complete_type`
	`rule_match_type`
	`rule_trigger_type`
`saml`	`login`
`user_accounts`	`2sv_change`
	`password_change`
	`recovery_info_change`
	`titanium_change`
	`email_forwarding_change`
`login`	`2sv_change`
	`password_change`
	`recovery_info_change`
	`account_warning`
	`titanium_change`
	`email_forwarding_change`
`jamboard`	`administrative_action`
	`setting_change`
	`status_change`
`admin`	`USER_SETTINGS`

Para mais informações sobre os aplicativos do Google Workspace compatíveis com o Google Security Operations, consulte Aplicativos do Google Workspace.

WORKSPACE_ALERTS

Confira a lista de tipos de alertas compatíveis:

Customer takeout initiated
Malware reclassification
Misconfigured whitelist
Phishing reclassification
Suspicious message reported
User reported phishing
User reported spam spike
Leaked password
Suspicious login
Suspicious login (less secure app)
Suspicious programmatic login
User suspended
User suspended (spam)
User suspended (spam through relay)
User suspended (suspicious activity)
Google Operations
Configuration problem
Government attack warning
Device compromised
Suspicious activity
AppMaker Default Cloud SQL setup
Activity Rule
Data Loss Prevention
Apps outage
Primary admin changed
SSO profile added
SSO profile updated
SSO profile deleted
Super admin password reset

WORKSPACE_CHROMEOS

Saiba mais sobre o esquema de registro do ChromeOS com suporte em Dispositivos ChromeOS.

WORKSPACE_GROUPS

Para saber mais sobre o esquema de registro de grupos com suporte, consulte group.

WORKSPACE_MOBILE

Para mais informações sobre o esquema de registro de dispositivos móveis compatível, consulte dispositivos móveis.

WORKSPACE_PRIVILEGES

Para informações sobre o esquema de registro de privilégios compatíveis, consulte privilégio (em inglês).

WORKSPACE_USERS

Para informações sobre o esquema de registro de usuários compatível, consulte users.

Referência do mapeamento de campo

As seções a seguir explicam como o analisador de operações de segurança do Google mapeia os campos de registro do Google Workspace para os campos do modelo de dados unificado (UDM, na sigla em inglês) de operações de segurança do Google. Os mapeamentos de campo deste analisador permanecem os mesmos para a ingestão de feeds com base em feeds e com a ingestão de nativos.

Referência de mapeamento de campo: tipos de registro WORKSPACE_ACTIVITY para tipo de evento UDM

A tabela a seguir lista os tipos de registro WORKSPACE_ACTIVITY e os tipos de evento do UDM correspondentes.

Workspace application	Event identifier	Event type
`access_transparency`	`ACCESS`	`USER_RESOURCE_ACCESS`
`chrome`	`CHROME_OS_ADD_USER`	`USER_CREATION`
`chrome`	`CHROME_OS_REMOVE_USER`	`USER_DELETION`
`chrome`	`DEVICE_BOOT_STATE_CHANGE`	`SETTING_MODIFICATION`
`chrome`	`CHROME_OS_LOGIN_FAILURE_EVENT`	`USER_LOGIN`
`chrome`	`CHROME_OS_LOGIN_LOGOUT_EVENT`	`USER_LOGIN`
`chrome`	`CHROME_OS_LOGIN_EVENT`	`USER_LOGIN`
`chrome`	`CHROME_OS_LOGOUT_EVENT`	`USER_LOGOUT`
`chrome`	`CHROME_OS_REPORTING_DATA_LOST`	`STATUS_UPDATE`
`chrome`	`PASSWORD_CHANGED`	`USER_CHANGE_PASSWORD`
`chrome`	`PASSWORD_REUSE`	`USER_UNCATEGORIZED`
`chrome`	`DLP_EVENT`	`USER_UNCATEGORIZED`
`chrome`	`CONTENT_TRANSFER`	`STATUS_UNCATEGORIZED`
`chrome`	`CONTENT_UNSCANNED`	`SCAN_UNCATEGORIZED`
`chrome`	`EXTENSION_REQUEST`	`USER_UNCATEGORIZED`
`chrome`	`LOGIN_EVENT`	`USER_LOGIN`
`chrome`	`MALWARE_TRANSFER`	`SCAN_UNCATEGORIZED`. The security category is `SOFTWARE_MALICIOUS`.
`chrome`	`PASSWORD_BREACH`	`USER_RESOURCE_ACCESS`. The security category is `PHISHING`.
`chrome`	`SENSITIVE_DATA_TRANSFER`	`SCAN_UNCATEGORIZED`
`chrome`	`UNSAFE_SITE_VISIT`	`NETWORK_UNCATEGORIZED`. The security category is `NETWORK_SUSPICIOUS`.
`chrome`	`BROWSER_CRASH`	`STATUS_UNCATEGORIZED`
`chrome`	`BROWSER_EXTENSION_INSTALL`	`USER_RESOURCE_UPDATE_CONTENT`
`chrome`	`CHROMEOS_AFFILIATED_LOCK_SUCCESS`	`USER_LOGOUT`
`chrome`	`CHROMEOS_AFFILIATED_UNLOCK_FAILURE`	`USER_LOGIN`
`chrome`	`CHROMEOS_AFFILIATED_UNLOCK_SUCCESS`	`USER_LOGIN`
`chrome`	`CHROMEOS_PERIPHERAL_ADDED`	`USER_RESOURCE_ACCESS`
`chrome`	`CHROMEOS_PERIPHERAL_REMOVED`	`USER_RESOURCE_DELETION`
`chrome`	`CHROMEOS_PERIPHERAL_STATUS_UPDATED`	`USER_RESOURCE_UPDATE_CONTENT`
`chrome`	`CHROMEOS_UPDATE_FAILURE`	`STATUS_UNCATEGORIZED`
`chrome`	`CHROMEOS_UPDATE_SUCCESS`	`STATUS_UNCATEGORIZED`
`chrome`	`CHROME_OS_CRD_CLIENT_CONNECTED`	`USER_LOGIN`
`chrome`	`CHROME_OS_CRD_HOST_ENDED`	`STATUS_STARTUP`
`chrome`	`CHROME_OS_CRD_HOST_STARTED`	`STATUS_STARTUP`
`chrome`	`URL_FILTERING_INTERSTITIAL`	`STATUS_UNCATEGORIZED`
`context_aware_access`	`ACCESS_DENY_EVENT`	`USER_RESOURCE_ACCESS`
`context_aware_access`	`ACCESS_DENY_INTERNAL_ERROR_EVENT`	`USER_RESOURCE_ACCESS`
`context_aware_access`	`MONITOR_MODE_ACCESS_DENY_EVENT`	`USER_RESOURCE_ACCESS`
`gplus`	`create_comment`	`USER_RESOURCE_CREATION`
`gplus`	`delete_comment`	`USER_RESOURCE_DELETION`
`gplus`	`edit_comment`	`USER_RESOURCE_UPDATE_CONTENT`
`gplus`	`add_plusone`	`STATUS_UPDATE`
`gplus`	`remove_plusone`	`STATUS_UPDATE`
`gplus`	`add_poll_vote`	`STATUS_UPDATE`
`gplus`	`remove_poll_vote`	`STATUS_UPDATE`
`gplus`	`create_post`	`USER_RESOURCE_CREATION`
`gplus`	`delete_post`	`USER_RESOURCE_DELETION`
`gplus`	`content_manager_delete_post`	`USER_RESOURCE_DELETION`
`gplus`	`edit_post`	`USER_RESOURCE_UPDATE_CONTENT`
`data_studio`	`ADD_REPORT_EMAIL_DELIVERY`	`USER_UNCATEGORIZED`
`data_studio`	`CREATE`	`USER_RESOURCE_CREATION`
`data_studio`	`DATA_EXPORT`	`USER_RESOURCE_ACCESS`
`data_studio`	`DELETE`	`USER_RESOURCE_DELETION`
`data_studio`	`DOWNLOAD_REPORT`	`USER_UNCATEGORIZED`
`data_studio`	`EDIT`	`USER_RESOURCE_UPDATE_CONTENT`
`data_studio`	`RESTORE`	`USER_RESOURCE_CREATION`
`data_studio`	`STOP_REPORT_EMAIL_DELIVERY`	`USER_UNCATEGORIZED`
`data_studio`	`TRASH`	`USER_RESOURCE_DELETION`
`data_studio`	`UPDATE_REPORT_EMAIL_DELIVERY`	`USER_UNCATEGORIZED`
`data_studio`	`VIEW`	`USER_RESOURCE_ACCESS`
`data_studio`	`CHANGE_DATA_SOURCE_ACCESS_TYPE`	`USER_RESOURCE_UPDATE_PERMISSIONS`
`data_studio`	`CHANGE_ASSET_LINK_SHARING_ACCESS_TYPE`	`USER_RESOURCE_UPDATE_PERMISSIONS`
`data_studio`	`CHANGE_ASSET_LINK_SHARING_VISIBILITY`	`USER_RESOURCE_UPDATE_PERMISSIONS`
`data_studio`	`CHANGE_USER_ACCESS`	`USER_CHANGE_PERMISSIONS`
`mobile`	`APPLICATION_EVENT`	`USER_RESOURCE_UPDATE_CONTENT`
`mobile`	`APPLICATION_REPORT_EVENT`	`STATUS_UPDATE`
`mobile`	`DEVICE_REGISTER_UNREGISTER_EVENT`	`USER_RESOURCE_UPDATE_PERMISSIONS`
`mobile`	`ADVANCED_POLICY_SYNC_EVENT`	`STATUS_UPDATE`
`mobile`	`DEVICE_ACTION_EVENT`	`USER_RESOURCE_UPDATE_CONTENT`
`mobile`	`DEVICE_COMPLIANCE_CHANGED_EVENT`	`STATUS_UPDATE`
`mobile`	`OS_UPDATED_EVENT`	`USER_RESOURCE_UPDATE_CONTENT`
`mobile`	`DEVICE_OWNERSHIP_CHANGE_EVENT`	`STATUS_UPDATE`
`mobile`	`DEVICE_SETTINGS_UPDATED_EVENT`	`SETTING_MODIFICATION`
`mobile`	`APPLE_DEP_DEVICE_UPDATE_ON_APPLE_PORTAL_EVENT`	`STATUS_UPDATE`
`mobile`	`DEVICE_SYNC_EVENT`	`USER_RESOURCE_UPDATE_CONTENT`
`mobile`	`RISK_SIGNAL_UPDATED_EVENT`	`STATUS_UPDATE`
`mobile`	`ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT`	`STATUS_UPDATE`
`mobile`	`DEVICE_COMPROMISED_EVENT`	`STATUS_UPDATE`
`mobile`	`FAILED_PASSWORD_ATTEMPTS_EVENT`	`STATUS_UPDATE`
`mobile`	`SUSPICIOUS_ACTIVITY_EVENT`	`STATUS_UPDATE`
`groups_enterprise`	`accept_invitation`	`USER_UNCATEGORIZED`
`groups_enterprise`	`add_info_setting`	`GROUP_MODIFICATION`
`groups_enterprise`	`add_member`	`GROUP_MODIFICATION`
`groups_enterprise`	`add_member_role`	`USER_CHANGE_PERMISSIONS`
`groups_enterprise`	`add_security_setting`	`GROUP_MODIFICATION`
`groups_enterprise`	`add_service_account_permission`	`USER_CHANGE_PERMISSIONS`
`groups_enterprise`	`approve_join_request`	`USER_UNCATEGORIZED`
`groups_enterprise`	`ban_member_with_moderation`	`GROUP_MODIFICATION`
`groups_enterprise`	`change_info_setting`	`GROUP_MODIFICATION`
`groups_enterprise`	`change_security_setting`	`GROUP_MODIFICATION`
`groups_enterprise`	`create_group`	`GROUP_CREATION`
`groups_enterprise`	`create_namespace`	`GROUP_UNCATEGORIZED`
`groups_enterprise`	`delete_group`	`GROUP_DELETION`
`groups_enterprise`	`delete_namespace`	`GROUP_UNCATEGORIZED`
`groups_enterprise`	`add_dynamic_group_query`	`GROUP_UNCATEGORIZED`
`groups_enterprise`	`change_dynamic_group_query`	`GROUP_MODIFICATION`
`groups_enterprise`	`invite_member`	`GROUP_UNCATEGORIZED`
`groups_enterprise`	`join`	`GROUP_MODIFICATION`
`groups_enterprise`	`add_membership_expiry`	`GROUP_MODIFICATION`
`groups_enterprise`	`remove_membership_expiry`	`GROUP_MODIFICATION`
`groups_enterprise`	`update_membership_expiry`	`GROUP_MODIFICATION`
`groups_enterprise`	`reject_invitation`	`USER_UNCATEGORIZED`
`groups_enterprise`	`reject_join_request`	`USER_UNCATEGORIZED`
`groups_enterprise`	`remove_info_setting`	`GROUP_MODIFICATION`
`groups_enterprise`	`remove_member`	`GROUP_MODIFICATION`
`groups_enterprise`	`remove_member_role`	`GROUP_MODIFICATION`
`groups_enterprise`	`remove_security_setting`	`GROUP_MODIFICATION`
`groups_enterprise`	`remove_service_account_permission`	`GROUP_MODIFICATION`
`groups_enterprise`	`request_to_join`	`USER_UNCATEGORIZED`
`groups_enterprise`	`revoke_invitation`	`USER_UNCATEGORIZED`
`groups_enterprise`	`unban_member`	`GROUP_MODIFICATION`
`calendar`	`change_calendar_acls`	`USER_CHANGE_PERMISSIONS`
`calendar`	`change_calendar_country`	`USER_RESOURCE_UPDATE_CONTENT`
`calendar`	`create_calendar`	`USER_RESOURCE_CREATION`
`calendar`	`delete_calendar`	`USER_RESOURCE_DELETION`
`calendar`	`change_calendar_description`	`USER_RESOURCE_UPDATE_CONTENT`
`calendar`	`change_calendar_location`	`USER_RESOURCE_UPDATE_CONTENT`
`calendar`	`change_calendar_timezone`	`USER_RESOURCE_UPDATE_CONTENT`
`calendar`	`change_calendar_title`	`USER_RESOURCE_UPDATE_CONTENT`
`calendar`	`notification_triggered`	`USER_UNCATEGORIZED`
`calendar`	`add_subscription`	`USER_UNCATEGORIZED`
`calendar`	`delete_subscription`	`STATUS_UPDATE`
`calendar`	`create_event`	`USER_RESOURCE_UPDATE_CONTENT`
`calendar`	`delete_event`	`USER_RESOURCE_UPDATE_CONTENT`
`calendar`	`add_event_guest`	`USER_RESOURCE_UPDATE_CONTENT`
`calendar`	`change_event_guest_response_auto`	`USER_UNCATEGORIZED`
`calendar`	`remove_event_guest`	`USER_RESOURCE_UPDATE_CONTENT`
`calendar`	`change_event_guest_response`	`USER_RESOURCE_UPDATE_CONTENT`
`calendar`	`change_event`	`USER_RESOURCE_UPDATE_CONTENT`
`calendar`	`remove_event_from_trash`	`USER_RESOURCE_UPDATE_CONTENT`
`calendar`	`restore_event`	`USER_RESOURCE_UPDATE_CONTENT`
`calendar`	`change_event_start_time`	`USER_RESOURCE_UPDATE_CONTENT`
`calendar`	`change_event_title`	`USER_RESOURCE_UPDATE_CONTENT`
`calendar`	`transfer_event_requested`	`USER_UNCATEGORIZED`
`calendar`	`transfer_event_completed`	`USER_UNCATEGORIZED`
`calendar`	`interop_freebusy_lookup_outbound_successful`	`USER_RESOURCE_ACCESS`
`calendar`	`interop_freebusy_lookup_inbound_successful`	`USER_RESOURCE_ACCESS`
`calendar`	`interop_exchange_resource_availability_lookup_successful`	`USER_RESOURCE_ACCESS`
`calendar`	`interop_exchange_resource_list_lookup_successful`	`USER_RESOURCE_ACCESS`
`calendar`	`interop_freebusy_lookup_outbound_unsuccessful`	`USER_RESOURCE_ACCESS`
`calendar`	`interop_freebusy_lookup_inbound_unsuccessful`	`USER_RESOURCE_ACCESS`
`calendar`	`interop_exchange_resource_availability_lookup_unsuccessful`	`USER_RESOURCE_ACCESS`
`calendar`	`interop_exchange_resource_list_lookup_unsuccessful`	`USER_RESOURCE_ACCESS`
`chat`	`add_room_member`	`GROUP_MODIFICATION`
`chat`	`attachment_download`	`FILE_UNCATEGORIZED`
`chat`	`attachment_upload`	`FILE_UNCATEGORIZED`
`chat`	`block_room`	`GROUP_UNCATEGORIZED`
`chat`	`block_user`	`USER_UNCATEGORIZED`
`chat`	`direct_message_started`	`USER_UNCATEGORIZED`
`chat`	`invite_accept`	`USER_UNCATEGORIZED`
`chat`	`invite_decline`	`USER_UNCATEGORIZED`
`chat`	`invite_send`	`USER_UNCATEGORIZED`
`chat`	`message_edited`	`USER_RESOURCE_UPDATE_CONTENT`
`chat`	`message_posted`	`USER_RESOURCE_CREATION`
`chat`	`message_reported`	`USER_UNCATEGORIZED`
`chat`	`message_deleted`	`USER_RESOURCE_DELETION`
`chat`	`remove_room_member`	`GROUP_MODIFICATION`
`chat`	`room_created`	`GROUP_CREATED`
`chat`	`reaction_added`	`USER_UNCATEGORIZED`
`chat`	`call_ended`	`USER_UNCATEGORIZED`
`chat`	`presentation_started`	`STATUS_UNCATEGORIZED`
`chat`	`invitation_sent`	`STATUS_UNCATEGORIZED`
`chat`	`presentation_stopped`	`STATUS_UNCATEGORIZED`
`gcp`	`IMPORT_SSH_PUBLIC_KEY`	`USER_UNCATEGORIZED`
`gcp`	`DELETE_POSIX_ACCOUNT`	`USER_UNCATEGORIZED`
`gcp`	`DELETE_SSH_PUBLIC_KEY`	`USER_UNCATEGORIZED`
`gcp`	`GET_SSH_PUBLIC_KEY`	`USER_UNCATEGORIZED`
`gcp`	`GET_LOGIN_PROFILE`	`USER_UNCATEGORIZED`
`gcp`	`UPDATE_SSH_PUBLIC_KEY`	`USER_UNCATEGORIZED`
`drive`	`add_to_folder`	`USER_RESOURCE_CREATION`
`drive`	`approval_canceled`	`USER_UNCATEGORIZED`
`drive`	`approval_comment_added`	`USER_UNCATEGORIZED`
`drive`	`approval_completed`	`USER_UNCATEGORIZED`
`drive`	`approval_decisions_reset`	`USER_UNCATEGORIZED`
`drive`	`approval_due_time_change`	`USER_UNCATEGORIZED`
`drive`	`approval_requested`	`USER_UNCATEGORIZED`
`drive`	`approval_reviewer_change`	`USER_UNCATEGORIZED`
`drive`	`approval_reviewer_responded`	`USER_UNCATEGORIZED`
`drive`	`copy`	`USER_RESOURCE_CREATION`
`drive`	`create`	`USER_RESOURCE_CREATION`
`drive`	`delete`	`USER_RESOURCE_DELETION`
`drive`	`download`	`USER_RESOURCE_ACCESS`
`drive`	`email_as_attachment`	`EMAIL_TRANSACTION`
`drive`	`edit`	`USER_RESOURCE_UPDATE_CONTENT`
`drive`	`label_added`	`USER_UNCATEGORIZED`
`drive`	`label_added_by_item_create`	`USER_UNCATEGORIZED`
`drive`	`label_field_changed`	`USER_UNCATEGORIZED`
`drive`	`label_removed`	`USER_UNCATEGORIZED`
`drive`	`add_lock`	`USER_UNCATEGORIZED`
`drive`	`move`	`USER_UNCATEGORIZED`
`drive`	`preview`	`USER_RESOURCE_ACCESS`
`drive`	`print`	`USER_UNCATEGORIZED`
`drive`	`remove_from_folder`	`USER_RESOURCE_DELETION`
`drive`	`rename`	`USER_RESOURCE_UPDATE_CONTENT`
`drive`	`untrash`	`USER_RESOURCE_CREATION`
`drive`	`sheets_import_range`	`USER_RESOURCE_ACCESS`
`drive`	`source_copy`	`USER_RESOURCE_UPDATE_CONTENT`
`drive`	`trash`	`USER_RESOURCE_DELETION`
`drive`	`remove_lock`	`USER_UNCATEGORIZED`
`drive`	`unmovable_item_reparented`	`USER_UNCATEGORIZED`
`drive`	`upload`	`USER_RESOURCE_CREATION`
`drive`	`view`	`USER_RESOURCE_ACCESS`
`drive`	`connected_sheets_query`	`USER_RESOURCE_ACCESS`
`drive`	`accept_suggestion`	`USER_RESOURCE_UPDATE_CONTENT`
`drive`	`create_comment`	`USER_RESOURCE_CREATION`
`drive`	`create_suggestion`	`USER_RESOURCE_CREATION`
`drive`	`delete_comment`	`USER_RESOURCE_DELETION`
`drive`	`delete_suggestion`	`USER_RESOURCE_DELETION`
`drive`	`edit_comment`	`USER_RESOURCE_UPDATE_CONTENT`
`drive`	`expire_access_request`	`USER_RESOURCE_UPDATE_PERMISSIONS`
`drive`	`reassign_comment`	`USER_RESOURCE_UPDATE_CONTENT`
`drive`	`reject_suggestion`	`USER_RESOURCE_UPDATE_CONTENT`
`drive`	`reopen_comment`	`USER_RESOURCE_UPDATE_CONTENT`
`drive`	`request_access`	`USER_RESOURCE_UPDATE_PERMISSIONS`
`drive`	`resolve_comment`	`USER_RESOURCE_UPDATE_CONTENT`
`drive`	`deny_access_request`	`USER_UNCATEGORIZED`
`drive`	`download_forms_response`	`USER_RESOURCE_ACCESS`
`drive`	`email_collaborators`	`EMAIL_UNCATEGORIZED`
`drive`	`access_url`	`USER_RESOURCE_ACCESS`
`drive`	`access_item_content`	`USER_RESOURCE_ACCESS`
`drive`	`sheets_import_url`	`USER_UNCATEGORIZED`
`drive`	`apply_security_update`	`USER_RESOURCE_UPDATE_PERMISSIONS`
`drive`	`shared_drive_apply_security_update`	`USER_RESOURCE_UPDATE_PERMISSIONS`
`drive`	`shared_drive_remove_security_update`	`USER_RESOURCE_UPDATE_PERMISSIONS`
`drive`	`publish_change`	`USER_RESOURCE_UPDATE_PERMISSIONS`
`drive`	`change_acl_editors`	`USER_RESOURCE_UPDATE_PERMISSIONS`
`drive`	`change_document_access_scope`	`USER_RESOURCE_UPDATE_PERMISSIONS`
`drive`	`change_document_access_scope_hierarchy_reconciled`	`USER_RESOURCE_UPDATE_PERMISSIONS`
`drive`	`change_document_visibility`	`USER_RESOURCE_UPDATE_PERMISSIONS`
`drive`	`change_document_visibility_hierarchy_reconciled`	`USER_RESOURCE_UPDATE_PERMISSIONS`
`drive`	`remove_security_update`	`USER_RESOURCE_UPDATE_PERMISSIONS`
`drive`	`shared_drive_membership_change`	`USER_RESOURCE_UPDATE_PERMISSIONS`
`drive`	`shared_drive_settings_change`	`USER_RESOURCE_UPDATE_PERMISSIONS`
`drive`	`sheets_import_range_access_change`	`USER_RESOURCE_UPDATE_PERMISSIONS`
`drive`	`change_user_access`	`USER_CHANGE_PERMISSIONS`
`drive`	`change_user_access_hierarchy_reconciled`	`USER_CHANGE_PERMISSIONS`
`drive`	`change_owner`	`USER_CHANGE_PERMISSIONS`
`drive`	`publish_new_version`	`USER_UNCATEGORIZED`
`drive`	`change_owner_hierarchy_reconciled`	`USER_CHANGE_PERMISSIONS`
`drive`	`team_drive_membership_change`	`USER_CHANGE_PERMISSIONS`
`drive`	`team_drive_settings_change`	`USER_CHANGE_PERMISSIONS`
`drive`	`storage_usage_update`	`USER_RESOURCE_ACCESS`
`groups`	`change_acl_permission`	`GROUP_MODIFICATION`
`groups`	`accept_invitation`	`USER_UNCATEGORIZED`
`groups`	`approve_join_request`	`USER_UNCATEGORIZED`
`groups`	`join`	`GROUP_MODIFICATION`
`groups`	`request_to_join`	`USER_UNCATEGORIZED`
`groups`	`change_basic_setting`	`GROUP_MODIFICATION`
`groups`	`create_group`	`GROUP_CREATION`
`groups`	`delete_group`	`GROUP_DELETION`
`groups`	`change_identity_setting`	`GROUP_MODIFICATION`
`groups`	`add_info_setting`	`GROUP_MODIFICATION`
`groups`	`change_info_setting`	`GROUP_MODIFICATION`
`groups`	`remove_info_setting`	`GROUP_MODIFICATION`
`groups`	`change_new_members_restrictions_setting`	`GROUP_UNCATEGORIZED`
`groups`	`change_post_replies_setting`	`GROUP_MODIFICATION`
`groups`	`change_spam_moderation_setting`	`GROUP_MODIFICATION`
`groups`	`change_topic_setting`	`GROUP_MODIFICATION`
`groups`	`moderate_message`	`GROUP_MODIFICATION`
`groups`	`always_post_from_user`	`USER_UNCATEGORIZED`
`groups`	`add_user`	`GROUP_MODIFICATION`
`groups`	`ban_user_with_moderation`	`GROUP_MODIFICATION`
`groups`	`revoke_invitation`	`USER_UNCATEGORIZED`
`groups`	`invite_user`	`USER_UNCATEGORIZED`
`groups`	`reject_join_request`	`USER_UNCATEGORIZED`
`groups`	`reinvite_user`	`USER_UNCATEGORIZED`
`groups`	`remove_user`	`GROUP_MODIFICATION`
`groups`	`change_email_subscription_type`	`GROUP_MODIFICATION`
`groups`	`unsubscribe_via_mail`	`USER_UNCATEGORIZED`
`keep`	`deleted_attachment`	`USER_UNCATEGORIZED`
`keep`	`uploaded_attachment`	`USER_UNCATEGORIZED`
`keep`	`edited_note_content`	`USER_RESOURCE_UPDATE_CONTENT`
`keep`	`created_note`	`USER_RESOURCE_CREATION`
`keep`	`deleted_note`	`USER_RESOURCE_DELETION`
`keep`	`modified_acl`	`USER_RESOURCE_UPDATE_PERMISSIONS`
`meet`	`abuse_report_submitted`	`USER_UNCATEGORIZED`
`meet`	`call_ended`	`USER_UNCATEGORIZED`
`meet`	`livestream_watched`	`USER_COMMUNICATION`
`meet`	`invitation_sent`	`STATUS_UNCATEGORIZED`
`meet`	`presentation_started`	`STATUS_UNCATEGORIZED`
`meet`	`presentation_stopped`	`STATUS_UNCATEGORIZED`
`meet`	`knocking_denied`	`STATUS_UNCATEGORIZED`
`meet`	`knocking_accepted`	`STATUS_UNCATEGORIZED`
`meet`	`recording_activity`	`STATUS_UNCATEGORIZED`
`meet`	`dialed_out`	`STATUS_UNCATEGORIZED`
`token`	`activity`	`USER_RESOURCE_ACCESS`
`token`	`authorize`	`USER_RESOURCE_ACCESS`
`token`	`revoke`	`USER_RESOURCE_UPDATE_PERMISSIONS`
`rules`	`action_complete`	`USER_RESOURCE_ACCESS`
`rules`	`rule_match`	`USER_RESOURCE_ACCESS`
`rules`	`rule_trigger`	`USER_RESOURCE_ACCESS`
`rules`	`label_field_value_changed`	`USER_RESOURCE_UPDATE_CONTENT`
`rules`	`label_applied`	`USER_RESOURCE_UPDATE_CONTENT`
`rules`	`sharing_blocked`	`USER_RESOURCE_UPDATE_CONTENT`
`rules`	`content_matched`	`USER_RESOURCE_ACCESS`
`rules`	`content_unmatched`	`USER_RESOURCE_ACCESS`
`saml`	`login_failure`	`USER_LOGIN`
`saml`	`login_success`	`USER_LOGIN`
`user_accounts`	`2sv_disable`	`USER_UNCATEGORIZED`
`user_accounts`	`2sv_enroll`	`USER_UNCATEGORIZED`
`user_accounts`	`password_edit`	`USER_UNCATEGORIZED`
`user_accounts`	`recovery_email_edit`	`USER_UNCATEGORIZED`
`user_accounts`	`recovery_phone_edit`	`USER_UNCATEGORIZED`
`user_accounts`	`recovery_secret_qa_edit`	`USER_UNCATEGORIZED`
`user_accounts`	`titanium_enroll`	`USER_UNCATEGORIZED`
`user_accounts`	`titanium_unenroll`	`USER_UNCATEGORIZED`
`user_accounts`	`email_forwarding_out_of_domain`	`USER_UNCATEGORIZED`
`jamboard`	`DEVICE_LICENSE_ENROLLMENT_CHANGE`	`SETTING_MODIFICATION`
`jamboard`	`DEVICE_OTA_UPDATE_REQUESTED`	`SETTING_MODIFICATION`
`jamboard`	`DEVICE_PROVISIONING_CHANGE`	`SETTING_MODIFICATION`
`jamboard`	`DEVICE_REBOOT_REQUESTED`	`USER_UNCATEGORIZED`
`jamboard`	`EXPORT_JAMBOARD_FLEET`	`USER_UNCATEGORIZED`
`jamboard`	`ADB_ENABLED_STATE_CHANGE`	`SETTING_MODIFICATION`
`jamboard`	`DEVICE_ADDITIONAL_IMES_CHANGE`	`SETTING_MODIFICATION`
`jamboard`	`DEVICE_LOGGING_CHANGE`	`SETTING_MODIFICATION`
`jamboard`	`DEMO_MODE_AVAILABILITY_CHANGE`	`SETTING_MODIFICATION`
`jamboard`	`DEMO_MODE_CHANGE`	`SETTING_MODIFICATION`
`jamboard`	`FINGER_ERASING_CHANGE`	`SETTING_MODIFICATION`
`jamboard`	`DEVICE_LANGUAGE_CHANGE`	`SETTING_MODIFICATION`
`jamboard`	`DEVICE_LOCATION_CHANGE`	`STATUS_UPDATE`
`jamboard`	`DEVICE_NAME_CHANGE`	`STATUS_UPDATE`
`jamboard`	`DEVICE_NOTE_CHANGE`	`STATUS_UPDATE`
`jamboard`	`DEVICE_PAIRING_CHANGE`	`SETTING_MODIFICATION`
`jamboard`	`SCREENSAVER_TIMEOUT_CHANGE`	`SETTING_MODIFICATION`
`jamboard`	`DEVICE_SETTING_LOCKED`	`SETTING_MODIFICATION`
`jamboard`	`DEVICE_SETTING_UNLOCKED`	`SETTING_MODIFICATION`
`jamboard`	`VIDEOCONF_ENABLED_CHANGE`	`SETTING_MODIFICATION`
`jamboard`	`DEVICE_UPDATE`	`STATUS_UPDATE`
`login`	`2sv_disable`	`SERVICE_STOP`
`login`	`2sv_enroll`	`SERVICE_START`
`login`	`password_edit`	`USER_CHANGE_PASSWORD`
`login`	`recovery_email_edit`	`USER_UNCATEGORIZED`
`login`	`recovery_phone_edit`	`USER_UNCATEGORIZED`
`login`	`recovery_secret_qa_edit`	`USER_UNCATEGORIZED`
`login`	`account_disabled_password_leak`	`USER_UNCATEGORIZED`
`login`	`suspicious_login`	`USER_LOGIN`
`login`	`suspicious_login_less_secure_app`	`USER_LOGIN`
`login`	`suspicious_programmatic_login`	`USER_LOGIN`
`login`	`account_disabled_generic`	`USER_UNCATEGORIZED`
`login`	`account_disabled_spamming_through_relay`	`USER_UNCATEGORIZED`
`login`	`account_disabled_spamming`	`USER_UNCATEGORIZED`
`login`	`account_disabled_hijacked`	`USER_UNCATEGORIZED`
`login`	`titanium_enroll`	`USER_UNCATEGORIZED`
`login`	`titanium_unenroll`	`USER_UNCATEGORIZED`
`login`	`gov_attack_warning`	`STATUS_UNCATEGORIZED`
`login`	`email_forwarding_out_of_domain`	`USER_UNCATEGORIZED`
`login`	`login_failure`	`USER_LOGIN`. The security category is `AUTH_VIOLATION`.
`login`	`login_challenge`	`USER_LOGIN`
`login`	`login_verification`	`USER_LOGIN`
`login`	`logout`	`USER_LOGOUT`
`login`	`login_success`	`USER_LOGIN`
`login`	`risky_sensitive_action_allowed`	`USER_LOGIN`
`login`	`risky_sensitive_action_blocked`	`USER_LOGIN`
`login`	`blocked_sender`	`STATUS_UNCATEGORIZED`
`admin`	`DELETE_2SV_SCRATCH_CODES`	`USER_RESOURCE_DELETION`
`admin`	`GENERATE_2SV_SCRATCH_CODES`	`USER_RESOURCE_CREATION`
`admin`	`REVOKE_3LO_DEVICE_TOKENS`	`USER_RESOURCE_ACCESS`
`admin`	`REVOKE_3LO_TOKEN`	`USER_RESOURCE_ACCESS`
`admin`	`ADD_RECOVERY_EMAIL`	`USER_RESOURCE_CREATION`
`admin`	`ADD_RECOVERY_PHONE`	`USER_RESOURCE_CREATION`
`admin`	`GRANT_ADMIN_PRIVILEGE`	`USER_CHANGE_PERMISSIONS`
`admin`	`REVOKE_ADMIN_PRIVILEGE`	`USER_CHANGE_PERMISSIONS`
`admin`	`REVOKE_ASP`	`USER_CHANGE_PERMISSIONS`
`admin`	`TOGGLE_AUTOMATIC_CONTACT_SHARING`	`SETTING_MODIFICATION`
`admin`	`BULK_UPLOAD`	`USER_RESOURCE_CREATION`
`admin`	`BULK_UPLOAD_NOTIFICATION_SENT`	`USER_UNCATEGORIZED`
`admin`	`CANCEL_USER_INVITE`	`USER_UNCATEGORIZED`
`admin`	`CHANGE_USER_CUSTOM_FIELD`	`USER_UNCATEGORIZED`
`admin`	`CHANGE_USER_EXTERNAL_ID`	`USER_UNCATEGORIZED`
`admin`	`CHANGE_USER_GENDER`	`USER_UNCATEGORIZED`
`admin`	`CHANGE_USER_IM`	`USER_UNCATEGORIZED`
`admin`	`ENABLE_USER_IP_WHITELIST`	`USER_UNCATEGORIZED`
`admin`	`CHANGE_USER_KEYWORD`	`USER_UNCATEGORIZED`
`admin`	`CHANGE_USER_LANGUAGE`	`USER_UNCATEGORIZED`
`admin`	`CHANGE_USER_LOCATION`	`USER_UNCATEGORIZED`
`admin`	`CHANGE_USER_ORGANIZATION`	`USER_UNCATEGORIZED`
`admin`	`CHANGE_USER_PHONE_NUMBER`	`USER_UNCATEGORIZED`
`admin`	`CHANGE_RECOVERY_EMAIL`	`USER_UNCATEGORIZED`
`admin`	`CHANGE_RECOVERY_PHONE`	`USER_UNCATEGORIZED`
`admin`	`CHANGE_USER_RELATION`	`USER_UNCATEGORIZED`
`admin`	`CHANGE_USER_ADDRESS`	`USER_UNCATEGORIZED`
`admin`	`CREATE_EMAIL_MONITOR`	`SERVICE_CREATION`
`admin`	`CREATE_DATA_TRANSFER_REQUEST`	`USER_UNCATEGORIZED`
`admin`	`GRANT_DELEGATED_ADMIN_PRIVILEGES`	`USER_CHANGE_PERMISSIONS`
`admin`	`DELETE_ACCOUNT_INFO_DUMP`	`USER_RESOURCE_DELETION`
`admin`	`DELETE_EMAIL_MONITOR`	`SERVICE_DELETION`
`admin`	`DELETE_MAILBOX_DUMP`	`USER_RESOURCE_DELETION`
`admin`	`DELETE_PROFILE_PHOTO`	`USER_RESOURCE_DELETION`
`admin`	`CHANGE_DISPLAY_NAME`	`USER_UNCATEGORIZED`
`admin`	`CHANGE_FIRST_NAME`	`USER_UNCATEGORIZED`
`admin`	`GMAIL_RESET_USER`	`USER_UNCATEGORIZED`
`admin`	`CHANGE_LAST_NAME`	`USER_UNCATEGORIZED`
`admin`	`MAIL_ROUTING_DESTINATION_ADDED`	`USER_RESOURCE_CREATION`
`admin`	`MAIL_ROUTING_DESTINATION_REMOVED`	`USER_RESOURCE_DELETION`
`admin`	`ADD_NICKNAME`	`USER_UNCATEGORIZED`
`admin`	`REMOVE_NICKNAME`	`USER_UNCATEGORIZED`
`admin`	`CHANGE_PASSWORD`	`USER_CHANGE_PASSWORD`
`admin`	`CHANGE_PASSWORD_ON_NEXT_LOGIN`	`USER_CHANGE_PASSWORD`
`admin`	`DOWNLOAD_PENDING_INVITES_LIST`	`STATUS_UNCATEGORIZED`
`admin`	`REMOVE_RECOVERY_EMAIL`	`USER_RESOURCE_DELETION`
`admin`	`REMOVE_RECOVERY_PHONE`	`USER_RESOURCE_DELETION`
`admin`	`REQUEST_ACCOUNT_INFO`	`USER_UNCATEGORIZED`
`admin`	`REQUEST_MAILBOX_DUMP`	`USER_UNCATEGORIZED`
`admin`	`RESEND_USER_INVITE`	`USER_UNCATEGORIZED`
`admin`	`RESET_SIGNIN_COOKIES`	`USER_RESOURCE_UPDATE_CONTENT`
`admin`	`SECURITY_KEY_REGISTERED_FOR_USER`	`USER_RESOURCE_CREATION`
`admin`	`REVOKE_SECURITY_KEY`	`USER_RESOURCE_UPDATE_PERMISSIONS`
`admin`	`USER_INVITE`	`USER_UNCATEGORIZED`
`admin`	`VIEW_TEMP_PASSWORD`	`USER_UNCATEGORIZED`
`admin`	`TURN_OFF_2_STEP_VERIFICATION`	`USER_RESOURCE_UPDATE_PERMISSIONS`
`admin`	`UNBLOCK_USER_SESSION`	`USER_UNCATEGORIZED`
`admin`	`UNMANAGED_USERS_BULK_UPLOAD`	`USER_RESOURCE_CREATION`
`admin`	`DOWNLOAD_UNMANAGED_USERS_LIST`	`USER_UNCATEGORIZED`
`admin`	`UPDATE_PROFILE_PHOTO`	`USER_RESOURCE_UPDATE_CONTENT`
`admin`	`UNENROLL_USER_FROM_TITANIUM`	`USER_UNCATEGORIZED`
`admin`	`ARCHIVE_USER`	`USER_UNCATEGORIZED`
`admin`	`UPDATE_BIRTHDATE`	`USER_UNCATEGORIZED`
`admin`	`CREATE_USER`	`USER_CREATION`
`admin`	`DELETE_USER`	`USER_DELETION`
`admin`	`DOWNGRADE_USER_FROM_GPLUS`	`USER_CHANGE_PERMISSIONS`
`admin`	`USER_ENROLLED_IN_TWO_STEP_VERIFICATION`	`USER_UNCATEGORIZED`
`admin`	`DOWNLOAD_USERLIST_CSV`	`STATUS_UNCATEGORIZED`
`admin`	`MOVE_USER_TO_ORG_UNIT`	`USER_UNCATEGORIZED`
`admin`	`USER_PUT_IN_TWO_STEP_VERIFICATION_GRACE_PERIOD`	`USER_UNCATEGORIZED`
`admin`	`RENAME_USER`	`USER_RESOURCE_UPDATE_CONTENT`
`admin`	`UNENROLL_USER_FROM_STRONG_AUTH`	`USER_UNCATEGORIZED`
`admin`	`SUSPEND_USER`	`USER_UNCATEGORIZED`
`admin`	`UNARCHIVE_USER`	`USER_UNCATEGORIZED`
`admin`	`UNDELETE_USER`	`USER_UNCATEGORIZED`
`admin`	`UNSUSPEND_USER`	`USER_UNCATEGORIZED`
`admin`	`UPGRADE_USER_TO_GPLUS`	`USER_CHANGE_PERMISSIONS`
`admin`	`USERS_BULK_UPLOAD`	`USER_RESOURCE_CREATION`
`admin`	`USERS_BULK_UPLOAD_NOTIFICATION_SENT`	`USER_UNCATEGORIZED`
`admin`	`ASSIGN_ROLE`	`USER_RESOURCE_UPDATE_PERMISSIONS`
`admin`	`CREATE_ROLE`	`USER_RESOURCE_CREATION`
`admin`	`UNASSIGN_ROLE`	`USER_RESOURCE_UPDATE_PERMISSIONS`
`admin`	`AUTHORIZE_API_CLIENT_ACCESS`	`USER_RESOURCE_ACCESS`
`admin`	`ADD_TRUSTED_DOMAINS`	`USER_RESOURCE_UPDATE_CONTENT`
`admin`	`CHANGE_DOMAIN_DEFAULT_TIMEZONE`	`USER_RESOURCE_UPDATE_CONTENT`
`admin`	`CHANGE_DOMAIN_DEFAULT_LOCALE`	`USER_RESOURCE_UPDATE_CONTENT`
`admin`	`CREATE_ALERT`	`USER_RESOURCE_CREATION`
`admin`	`REMOVE_APPLICATION`	`USER_RESOURCE_DELETION`
`admin`	`ADD_APPLICATION`	`USER_RESOURCE_CREATION`
`admin`	`REMOVE_API_CLIENT_ACCESS`	`USER_RESOURCE_DELETION`
`admin`	`CHANGE_SSO_SETTINGS`	`SETTING_MODIFICATION`
`admin`	`ALERT_CENTER_VIEW`	`STATUS_UNCATEGORIZED`
`admin`	`ALERT_CENTER_LIST_FEEDBACK`	`STATUS_UNCATEGORIZED`
`admin`	`ALERT_CENTER_GET_SIT_LINK`	`STATUS_UNCATEGORIZED`
`admin`	`ALERT_CENTER_LIST_CHANGE`	`STATUS_UNCATEGORIZED`
`admin`	`ALERT_CENTER_LIST_RELATED_ALERTS`	`STATUS_UNCATEGORIZED`
`admin`	`EMAIL_LOG_SEARCH`	`EMAIL_UNCATEGORIZED`
`admin`	`CHANGE_EMAIL_SETTING`	`SETTING_MODIFICATION`
`admin`	`CREATE_GMAIL_SETTING`	`SETTING_MODIFICATION`
`admin`	`CHANGE_GMAIL_SETTING`	`SETTING_MODIFICATION`
`admin`	`DELETE_GMAIL_SETTING`	`SETTING_MODIFICATION`
`admin`	`RELEASE_FROM_QUARANTINE`	`EMAIL_UNCATEGORIZED`
`admin`	`SECURITY_INVESTIGATION_QUERY`	`STATUS_UNCATEGORIZED`
`admin`	`SECURITY_INVESTIGATION_ACTION`	`STATUS_UNCATEGORIZED`
`admin`	`SECURITY_INVESTIGATION_OBJECT_CREATE_DRAFT_INVESTIGATION`	`STATUS_UNCATEGORIZED`
`admin`	`SECURITY_INVESTIGATION_ACTION_COMPLETION`	`STATUS_UNCATEGORIZED`
`admin`	`SECURITY_INVESTIGATION_EXPORT_QUERY`	`STATUS_UNCATEGORIZED`
`admin`	`SECURITY_INVESTIGATION_ACTION_CANCELLATION`	`STATUS_UNCATEGORIZED`
`admin`	`CHANGE_GROUP_SETTING`	`GROUP_MODIFICATION`
`admin`	`ADD_GROUP_MEMBER`	`GROUP_MODIFICATION`
`admin`	`CREATE_GROUP`	`GROUP_CREATION`
`admin`	`REMOVE_GROUP_MEMBER`	`GROUP_MODIFICATION`
`admin`	`UPDATE_GROUP_MEMBER_DELIVERY_SETTINGS`	`GROUP_MODIFICATION`
`admin`	`UPDATE_GROUP_MEMBER`	`GROUP_MODIFICATION`
`admin`	`DELETE_GROUP`	`GROUP_DELETION`
`admin`	`USER_LICENSE_ASSIGNMENT`	`USER_RESOURCE_UPDATE_PERMISSIONS`
`admin`	`USER_LICENSE_REVOKE`	`USER_RESOURCE_UPDATE_PERMISSIONS`
`admin`	`SECURITY_CHART_DRILLDOWN`	`STATUS_UNCATEGORIZED`
`admin`	`SYSTEM_DEFINED_RULE_UPDATED`	`SETTING_MODIFICATION`
`admin`	`CUSTOMER_USER_DEVICE_DELETION_EVENT`	`USER_RESOURCE_DELETION`
`admin`	`ADD_MOBILE_APPLICATION_TO_WHITELIST`	`USER_RESOURCE_UPDATE_CONTENT`
`admin`	`REMOVE_MOBILE_APPLICATION_FROM_WHITELIST`	`USER_RESOURCE_UPDATE_CONTENT`
`admin`	`CHANGE_MOBILE_APPLICATION_SETTINGS`	`SETTING_MODIFICATION`
`admin`	`ACTION_REQUESTED`	`USER_UNCATEGORIZED`
`admin`	`CREATE_APPLICATION_SETTING`	`SETTING_CREATION`
`admin`	`CHANGE_APPLICATION_SETTING`	`SETTING_MODIFICATION`
`admin`	`CREATE_SAML2_SERVICE_PROVIDER_CONFIG`	`SETTING_CREATION`
`admin`	`DELETE_SAML2_SERVICE_PROVIDER_CONFIG`	`SETTING_DELETION`
`admin`	`TOGGLE_SERVICE_ENABLED`	`SETTING_MODIFICATION`
`admin`	`CREATE_ORG_UNIT`	`USER_RESOURCE_CREATION`
`admin`	`MOVE_ORG_UNIT`	`USER_RESOURCE_UPDATE_CONTENT`
`admin`	`EDIT_ORG_UNIT_NAME`	`USER_RESOURCE_UPDATE_CONTENT`
`admin`	`REMOVE_ORG_UNIT`	`USER_RESOURCE_DELETION`
`admin`	`UNASSIGN_CUSTOM_LOGO`	`USER_RESOURCE_UPDATE_CONTENT`
`admin`	`ASSIGN_CUSTOM_LOGO`	`USER_RESOURCE_UPDATE_CONTENT`
`admin`	`EDIT_ORG_UNIT_DESCRIPTION`	`USER_RESOURCE_UPDATE_CONTENT`
`admin`	`CHANGE_DOCS_SETTING`	`SETTING_MODIFICATION`
`admin`	`CHANGE_CALENDAR_SETTING`	`SETTING_MODIFICATION`
`admin`	`SESSION_CONTROL_SETTINGS_CHANGE`	`SETTING_MODIFICATION`
`admin`	`DISALLOW_SERVICE_FOR_OAUTH2_ACCESS`	`SETTING_MODIFICATION`
`admin`	`ALLOW_STRONG_AUTHENTICATION`	`SETTING_MODIFICATION`
`admin`	`ENFORCE_STRONG_AUTHENTICATION`	`SETTING_MODIFICATION`
`admin`	`CHANGE_TWO_STEP_VERIFICATION_FREQUENCY`	`SETTING_MODIFICATION`
`admin`	`CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION`	`SETTING_MODIFICATION`
`admin`	`CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION`	`SETTING_MODIFICATION`
`admin`	`CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS`	`SETTING_MODIFICATION`
`admin`	`CHANGE_TWO_STEP_VERIFICATION_START_DATE`	`SETTING_MODIFICATION`
`admin`	`WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED`	`SETTING_MODIFICATION`
`admin`	`ADD_TO_BLOCKED_OAUTH2_APPS`	`STATUS_UPDATE`
`admin`	`ADD_TO_TRUSTED_OAUTH2_APPS`	`STATUS_UPDATE`
`admin`	`GENERATE_CERTIFICATE`	`USER_RESOURCE_CREATION`
`admin`	`ENABLE_DIRECTORY_SYNC`	`SETTING_MODIFICATION`
`admin`	`CHANGE_DEVICE_STATE`	`STATUS_UPDATE`
`admin`	`UPDATE_ACCESS_LEVEL_V2`	`USER_RESOURCE_UPDATE_PERMISSIONS`
`admin`	`UPDATE_AUTO_PROVISIONED_USER`	`STATUS_UPDATE`
`admin`	`SECURITY_CENTER_RULE_THRESHOLD_TRIGGER`	`STATUS_UPDATE`
`gmail`		`EMAIL_TRANSACTION`

Referência de mapeamento de campo: WORKSPACE_ACTIVITY-Common Fields

A tabela a seguir lista campos comuns do tipo de registro WORKSPACE_ACTIVITY e os campos correspondentes do UDM.

Log field	UDM mapping	Logic
`actor.callerType`	`target.user.attribute.labels[caller_type]`	If the `event.name` log field value is equal to one of the following values, then the `actor.callerType` log field is mapped to the `target.user.attribute.labels` UDM field: `CHROME_OS_LOGIN_FAILURE_EVENT` `CHROME_OS_LOGIN_LOGOUT_EVENT` `CHROME_OS_LOGIN_EVENT` `LOGIN_EVENT` `login_failure` `login_success` `suspicious_login` `suspicious_login_less_secure_app` `suspicious_programmatic_login` `login_failure` `login_challenge` `login_verification` `login_success` `risky_sensitive_action_allowed` `logout` `CHROME_OS_LOGOUT_EVENT` `risky_sensitive_action_blocked`
`actor.callerType`	`principal.user.attribute.labels[caller_type]`	If the `event.name` log field value is not equal to one of the following values, then the `actor.callerType` log field is mapped to the `principal.user.attribute.labels` UDM field: `CHROME_OS_LOGIN_FAILURE_EVENT` `CHROME_OS_LOGIN_LOGOUT_EVENT` `CHROME_OS_LOGIN_EVENT` `LOGIN_EVENT` `login_failure` `login_success` `suspicious_login` `suspicious_login_less_secure_app` `suspicious_programmatic_login` `login_failure` `login_challenge` `login_verification` `login_success` `risky_sensitive_action_allowed` `logout` `CHROME_OS_LOGOUT_EVENT` `risky_sensitive_action_blocked` If the `id.applicationName` log field value is equal to `gmail`, then `principal.user.attribute.labels.key` UDM field is set to `actor_caller_type` and `actor.callerType` log field is mapped to `principal.user.attribute.labels.value` UDM field.
`actor.email`	`target.user.email_addresses`	If the `event.name` log field value is equal to one of the following values, then the `actor.email` log field is mapped to the `target.user.email_addresses` UDM field: `CHROME_OS_LOGIN_FAILURE_EVENT` `CHROME_OS_LOGIN_LOGOUT_EVENT` `CHROME_OS_LOGIN_EVENT` `LOGIN_EVENT` `login_failure` `login_success` `suspicious_login` `suspicious_login_less_secure_app` `suspicious_programmatic_login` `login_failure` `login_challenge` `login_verification` `login_success` `risky_sensitive_action_allowed` `logout` `CHROME_OS_LOGOUT_EVENT` `risky_sensitive_action_blocked` If the `id.applicationName` log field value is equal to `gmail`, then `actor.email` log field is mapped to `principal.user.email_addresses` UDM field.
`actor.email`	`principal.user.email_addresses`	If the `event.name` log field value is not equal to one of the following values, then the `actor.email` log field is mapped to the `principal.user.email_addresses` UDM field: `CHROME_OS_LOGIN_FAILURE_EVENT` `CHROME_OS_LOGIN_LOGOUT_EVENT` `CHROME_OS_LOGIN_EVENT` `LOGIN_EVENT` `login_failure` `login_success` `suspicious_login` `suspicious_login_less_secure_app` `suspicious_programmatic_login` `login_failure` `login_challenge` `login_verification` `login_success` `risky_sensitive_action_allowed` `logout` `CHROME_OS_LOGOUT_EVENT` `risky_sensitive_action_blocked`
`actor.email`	`security_result.about.email`
`actor.key`	`target.user.attribute.labels[actor_key]`	If the `event.name` log field value is equal to one of the following values, then the `actor.key` log field is mapped to the `target.user.attribute.labels[actor_key]` UDM field: `CHROME_OS_LOGIN_FAILURE_EVENT` `CHROME_OS_LOGIN_LOGOUT_EVENT` `CHROME_OS_LOGIN_EVENT` `LOGIN_EVENT` `login_failure` `login_success` `suspicious_login` `suspicious_login_less_secure_app` `suspicious_programmatic_login` `login_failure` `login_challenge` `login_verification` `login_success` `risky_sensitive_action_allowed` `logout` `CHROME_OS_LOGOUT_EVENT` `risky_sensitive_action_blocked`
`actor.key`	`principal.user.attribute.labels[actor_key]`	If the `event.name` log field value is not equal to one of the following values, then the `actor.key` log field is mapped to the `principal.user.attribute.labels[actor_key]` UDM field: `CHROME_OS_LOGIN_FAILURE_EVENT` `CHROME_OS_LOGIN_LOGOUT_EVENT` `CHROME_OS_LOGIN_EVENT` `LOGIN_EVENT` `login_failure` `login_success` `suspicious_login` `suspicious_login_less_secure_app` `suspicious_programmatic_login` `login_failure` `login_challenge` `login_verification` `login_success` `risky_sensitive_action_allowed` `logout` `CHROME_OS_LOGOUT_EVENT` `risky_sensitive_action_blocked`
`actor.key`	`target.user.userid`	The `actor.key` log field is mapped to the `target.user.userid` UDM field if the following conditions are met: The `actor.callerType` log field value is equal to `KEY`. The `event.name` log field value is equal to one of the following values: `CHROME_OS_LOGIN_FAILURE_EVENT` `CHROME_OS_LOGIN_LOGOUT_EVENT` `CHROME_OS_LOGIN_EVENT` `LOGIN_EVENT` `login_failure` `login_success` `suspicious_login` `suspicious_login_less_secure_app` `suspicious_programmatic_login` `login_failure` `login_challenge` `login_verification` `login_success` `risky_sensitive_action_allowed` `logout` `CHROME_OS_LOGOUT_EVENT` `risky_sensitive_action_blocked`
`actor.key`	`principal.user.userid`	The `actor.key` log field is mapped to the `principal.user.userid` UDM field if the following conditions are met: The `actor.callerType` log field value is equal to `KEY`. If the `event.name` log field value is not equal to one of the following values: `CHROME_OS_LOGIN_FAILURE_EVENT` `CHROME_OS_LOGIN_LOGOUT_EVENT` `CHROME_OS_LOGIN_EVENT` `LOGIN_EVENT` `login_failure` `login_success` `suspicious_login` `suspicious_login_less_secure_app` `suspicious_programmatic_login` `login_failure` `login_challenge` `login_verification` `login_success` `risky_sensitive_action_allowed` `logout` `CHROME_OS_LOGOUT_EVENT` `risky_sensitive_action_blocked`
`actor.profileId`	`target.user.product_object_id`	If the `event.name` log field value is equal to one of the following values, then the `actor.profileId` log field is mapped to the `target.user.product_object_id` UDM field: `CHROME_OS_LOGIN_FAILURE_EVENT` `CHROME_OS_LOGIN_LOGOUT_EVENT` `CHROME_OS_LOGIN_EVENT` `LOGIN_EVENT` `login_failure` `login_success` `suspicious_login` `suspicious_login_less_secure_app` `suspicious_programmatic_login` `login_failure` `login_challenge` `login_verification` `login_success` `risky_sensitive_action_allowed` `logout` `CHROME_OS_LOGOUT_EVENT` `risky_sensitive_action_blocked`
`actor.profileId`	`principal.user.product_object_id`	If the `event.name` log field value is not equal to one of the following values, then the `actor.profileId` log field is mapped to the `principal.user.product_object_id` UDM field: `CHROME_OS_LOGIN_FAILURE_EVENT` `CHROME_OS_LOGIN_LOGOUT_EVENT` `CHROME_OS_LOGIN_EVENT` `LOGIN_EVENT` `login_failure` `login_success` `suspicious_login` `suspicious_login_less_secure_app` `suspicious_programmatic_login` `login_failure` `login_challenge` `login_verification` `login_success` `risky_sensitive_action_allowed` `logout` `CHROME_OS_LOGOUT_EVENT` `risky_sensitive_action_blocked`
`etag`	`metadata.product_log_id`
`events.name`	`metadata.product_event_type`
`events.type`	`security_result.category_details`
`id.applicationName`	`metadata.product_name`
`id.customerId`	`about.resource.product_object_id`
`id.time`	`metadata.event_timestamp`
`id.uniqueQualifier`	`metadata.product_log_id`
`ipAddress`	`principal.ip`
`kind`	`about.labels[kind]` (deprecated)
`kind`	`additional.fields[kind]`
`ownerDomain`	`target.administrative_domain`	If the `target.resource` log field value is not empty, then the `ownerDomain` log field is mapped to the `target.administrative_domain` UDM field. If the `principal.resource` log field value is not empty, then the `ownerDomain` log field is mapped to the `principal.administrative_domain` If the `id.applicationName` log field value is equal to `gmail`, then `ownerDomain` log field is mapped to `principal.administrative_domain` UDM field.
	`about.resource.resource_type`	The `about.resource.resource_type` UDM field is set to `CLOUD_ORGANIZATION`.
	`metadata.vendor_name`	The `metadata.vendor_name` UDM field is set to `GOOGLE`.
`actor.gaiaId`	`principal.user.product_object_id`	If the `event.name` log field value is not equal to one of the following values, then the `actor.gaiaId` log field is mapped to the `principal.user.product_object_id` UDM field: `CHROME_OS_LOGIN_FAILURE_EVENT` `CHROME_OS_LOGIN_LOGOUT_EVENT` `CHROME_OS_LOGIN_EVENT` `LOGIN_EVENT` `login_failure` `login_success` `suspicious_login` `suspicious_login_less_secure_app` `suspicious_programmatic_login` `login_failure` `login_challenge` `login_verification` `login_success` `risky_sensitive_action_allowed` `logout` `CHROME_OS_LOGOUT_EVENT` `risky_sensitive_action_blocked`
`actor.gaiaId`	`target.user.product_object_id`	If the `event.name` log field value is equal to one of the following values, then the `actor.gaiaId` log field is mapped to the `target.user.product_object_id` UDM field: `CHROME_OS_LOGIN_FAILURE_EVENT` `CHROME_OS_LOGIN_LOGOUT_EVENT` `CHROME_OS_LOGIN_EVENT` `LOGIN_EVENT` `login_failure` `login_success` `suspicious_login` `suspicious_login_less_secure_app` `suspicious_programmatic_login` `login_failure` `login_challenge` `login_verification` `login_success` `risky_sensitive_action_allowed` `logout` `CHROME_OS_LOGOUT_EVENT` `risky_sensitive_action_blocked`
`actor.orgunitPath`	`principal.user.attribute.labels[org_unit_path]`	If the `event.name` log field value is not equal to one of the following values, then the `actor.orgunitPath` log field is mapped to the `principal.user.attribute.labels[org_unit_path]` UDM field: `CHROME_OS_LOGIN_FAILURE_EVENT` `CHROME_OS_LOGIN_LOGOUT_EVENT` `CHROME_OS_LOGIN_EVENT` `LOGIN_EVENT` `login_failure` `login_success` `suspicious_login` `suspicious_login_less_secure_app` `suspicious_programmatic_login` `login_failure` `login_challenge` `login_verification` `login_success` `risky_sensitive_action_allowed` `logout` `CHROME_OS_LOGOUT_EVENT` `risky_sensitive_action_blocked`
`actor.orgunitPath`	`target.user.attribute.labels[org_unit_path]`	If the `event.name` log field value is equal to one of the following values, then the `actor.orgunitPath` log field is mapped to the `target.user.attribute.labels[org_unit_path]` UDM field: `CHROME_OS_LOGIN_FAILURE_EVENT` `CHROME_OS_LOGIN_LOGOUT_EVENT` `CHROME_OS_LOGIN_EVENT` `LOGIN_EVENT` `login_failure` `login_success` `suspicious_login` `suspicious_login_less_secure_app` `suspicious_programmatic_login` `login_failure` `login_challenge` `login_verification` `login_success` `risky_sensitive_action_allowed` `logout` `CHROME_OS_LOGOUT_EVENT` `risky_sensitive_action_blocked`
`actor.groupId`	`principal.user.group_identifiers`	If the `event.name` log field value is not equal to one of the following values, then the `actor.groupId` log field is mapped to the `principal.user.group_identifiers` UDM field: `CHROME_OS_LOGIN_FAILURE_EVENT` `CHROME_OS_LOGIN_LOGOUT_EVENT` `CHROME_OS_LOGIN_EVENT` `LOGIN_EVENT` `login_failure` `login_success` `suspicious_login` `suspicious_login_less_secure_app` `suspicious_programmatic_login` `login_failure` `login_challenge` `login_verification` `login_success` `risky_sensitive_action_allowed` `logout` `CHROME_OS_LOGOUT_EVENT` `risky_sensitive_action_blocked`
`actor.groupId`	`target.user.group_identifiers`	If the `event.name` log field value is equal to one of the following values, then the `actor.groupId` log field is mapped to the `target.user.group_identifiers` UDM field: `CHROME_OS_LOGIN_FAILURE_EVENT` `CHROME_OS_LOGIN_LOGOUT_EVENT` `CHROME_OS_LOGIN_EVENT` `LOGIN_EVENT` `login_failure` `login_success` `suspicious_login` `suspicious_login_less_secure_app` `suspicious_programmatic_login` `login_failure` `login_challenge` `login_verification` `login_success` `risky_sensitive_action_allowed` `logout` `CHROME_OS_LOGOUT_EVENT` `risky_sensitive_action_blocked`

Referência do mapeamento de campo: WORKSPACE_ACTIVITY

A tabela a seguir lista os campos de registro do tipo WORKSPACE_ACTIVITY e aos campos UDM correspondentes.

Workspace application	Log field	UDM mapping	Logic
`access_transparency`	`ACCESS_APPROVAL_REQUEST_IDS`	`about.labels [access_approval_request_ids]` (deprecated)
`access_transparency`	`ACCESS_APPROVAL_REQUEST_IDS`	`additional.fields [access_approval_request_ids]`
`access_transparency`	`ACCESS_MANAGEMENT_POLICY`	`about.labels [access_management_policy]` (deprecated)
`access_transparency`	`ACCESS_MANAGEMENT_POLICY`	`additional.fields [access_management_policy]`
`access_transparency`	`ACTOR_HOME_OFFICE`	`principal.user.office_address.country_or_region`	If the `event.name` log field value is equal to `ACCESS`, then the `ACTOR_HOME_OFFICE` log field is mapped to the `principal.user.office_address.country_or_region` UDM field.
`access_transparency`	`GSUITE_PRODUCT_NAME`	`target.application`	If the `event.name` log field value is equal to `ACCESS`, then the `GSUITE_PRODUCT_NAME` log field is mapped to the `target.application` UDM field.
`access_transparency`	`JUSTIFICATIONS`	`about.labels [justifications]` (deprecated)	If the `event.name` log field value is equal to `ACCESS`, then the `JUSTIFICATIONS` log field is mapped to the `about.labels` UDM field.
`access_transparency`	`JUSTIFICATIONS`	`additional.fields [justifications]`	If the `event.name` log field value is equal to `ACCESS`, then the `JUSTIFICATIONS` log field is mapped to the `additional.fields` UDM field.
`access_transparency`	`LOG_ID`	`about.labels [logid]` (deprecated)	If the `event.name` log field value is equal to `ACCESS`, then the `LOG_ID` log field is mapped to the `about.labels` UDM field.
`access_transparency`	`LOG_ID`	`additional.fields [logid]`	If the `event.name` log field value is equal to `ACCESS`, then the `LOG_ID` log field is mapped to the `additional.fields` UDM field.
`access_transparency`	`ON_BEHALF_OF`	`about.labels [on_behalf_of]` (deprecated)	If the `event.name` log field value is equal to `ACCESS`, then the `ON_BEHALF_OF` log field is mapped to the `about.labels` UDM field.
`access_transparency`	`ON_BEHALF_OF`	`additional.fields [on_behalf_of]`	If the `event.name` log field value is equal to `ACCESS`, then the `ON_BEHALF_OF` log field is mapped to the `additional.fields` UDM field.
`access_transparency`	`OWNER_EMAIL`	`target.user.email_addresses`	If the `event.name` log field value is equal to `ACCESS`, then the `OWNER_EMAIL` log field is mapped to the `target.user.email_addresses` UDM field.
`access_transparency`	`RESOURCE_NAME`	`target.resource.name`	If the `event.name` log field value is equal to `ACCESS`, then the `RESOURCE_NAME` log field is mapped to the `target.resource.name` UDM field.
`access_transparency`	`TICKETS`	`about.labels [tickets]` (deprecated)
`access_transparency`	`TICKETS`	`additional.fields [tickets]`
`chrome`	`DEVICE_NAME`	`target.asset.attribute.labels [device_name]`	If the `event.name` log field value is equal to one of the following values, then the `DEVICE_NAME` log field is mapped to the `target.asset.attribute.labels` UDM field: `CHROME_OS_ADD_USER` `CHROME_OS_REMOVE_USER` `DEVICE_BOOT_STATE_CHANGE` `CHROME_OS_LOGIN_FAILURE_EVENT` `CHROME_OS_LOGIN_LOGOUT_EVENT` `CHROME_OS_LOGIN_EVENT` `CHROME_OS_LOGOUT_EVENT` `CHROME_OS_REPORTING_DATA_LOST` `PASSWORD_CHANGED` `PASSWORD_REUSE` `DLP_EVENT` `CONTENT_TRANSFER` `CONTENT_UNSCANNED` `EXTENSION_REQUEST` `LOGIN_EVENT` `MALWARE_TRANSFER` `PASSWORD_BREACH` `SENSITIVE_DATA_TRANSFER` `UNSAFE_SITE_VISIT` `BROWSER_EXTENSION_INSTALL` `CHROMEOS_AFFILIATED_LOCK_SUCCESS` `CHROMEOS_AFFILIATED_UNLOCK_FAILURE` `CHROMEOS_AFFILIATED_UNLOCK_SUCCESS` `CHROMEOS_PERIPHERAL_ADDED` `CHROMEOS_PERIPHERAL_REMOVED` `CHROMEOS_PERIPHERAL_STATUS_UPDATED` `CHROMEOS_UPDATE_FAILURE` `CHROMEOS_UPDATE_SUCCESS` `CHROME_OS_CRD_CLIENT_CONNECTED` `CHROME_OS_CRD_HOST_ENDED` `CHROME_OS_CRD_HOST_STARTED` `URL_FILTERING_INTERSTITIAL` `BROWSER_CRASH`
`chrome`	`DEVICE_PLATFORM`	`target.asset.platform_software.platform`	If the `DEVICE_PLATFORM` log field value matches `windows`, then the `target.asset.platform_software.platform` UDM field is set to `WINDOWS`. If the `DEVICE_PLATFORM` log field value matches `mac`, then the `target.asset.platform_software.platform` UDM field is set to `MAC`. If the `DEVICE_PLATFORM` log field value matches `linux`, then the `target.asset.platform_software.platform` UDM field is set to `LINUX`. Else, the `target.asset.platform_software.platform` UDM field is set to `UNKNOWN_PLATFORM`.
`chrome`	`DEVICE_USER`	`principal.user.user_display_name`	If the `event.name` log field value is equal to `LOGIN_EVENT`, then the `DEVICE_USER` log field is mapped to the `principal.user.user_display_name` UDM field.
`chrome`	`LOGIN_USER_NAME`	`target.user.user_display_name`	If the `event.name` log field value is equal to `LOGIN_EVENT`, then the `LOGIN_USER_NAME` log field is mapped to the `target.user.user_display_name` UDM field.
`chrome`	`DEVICE_USER`	`target.user.user_display_name`	If the `event.name` log field value is equal to one of the following values, then the `DEVICE_USER` log field is mapped to the `target.user.user_display_name` UDM field: `CHROME_OS_ADD_USER` `CHROME_OS_REMOVE_USER` `CHROME_OS_LOGIN_FAILURE_EVENT` `CHROME_OS_LOGIN_LOGOUT_EVENT` `CHROME_OS_LOGIN_EVENT` `CHROME_OS_LOGOUT_EVENT` `PASSWORD_CHANGED` `PASSWORD_REUSE` `DLP_EVENT` `CONTENT_TRANSFER` `CONTENT_UNSCANNED` `EXTENSION_REQUEST` `LOGIN_EVENT` `MALWARE_TRANSFER` `PASSWORD_BREACH` `SENSITIVE_DATA_TRANSFER` `UNSAFE_SITE_VISIT` `BROWSER_EXTENSION_INSTALL` `CHROMEOS_AFFILIATED_LOCK_SUCCESS` `CHROMEOS_AFFILIATED_UNLOCK_FAILURE` `CHROMEOS_AFFILIATED_UNLOCK_SUCCESS` `CHROMEOS_PERIPHERAL_ADDED` `CHROMEOS_PERIPHERAL_REMOVED` `CHROMEOS_PERIPHERAL_STATUS_UPDATED` `CHROMEOS_UPDATE_FAILURE` `CHROMEOS_UPDATE_SUCCESS` `CHROME_OS_CRD_CLIENT_CONNECTED` `CHROME_OS_CRD_HOST_ENDED` `CHROME_OS_CRD_HOST_STARTED` `URL_FILTERING_INTERSTITIAL` `BROWSER_CRASH` If the `event.name` log field value is equal to `LOGIN_EVENT`, then the `LOGIN_USER_NAME` log field is mapped to the `target.user.user_display_name` UDM field.
`chrome`	`PROFILE_USER_NAME`	`target.user.attribute.labels [profile_user_name]`	If the `event.name` log field value is equal to one of the following values, then the `PROFILE_USER_NAME` log field is mapped to the `target.user.attribute.labels` UDM field: `PASSWORD_CHANGED` `PASSWORD_REUSE` `CONTENT_TRANSFER` `CONTENT_UNSCANNED` `LOGIN_EVENT` `MALWARE_TRANSFER` `PASSWORD_BREACH` `SENSITIVE_DATA_TRANSFER` `UNSAFE_SITE_VISIT` `URL_FILTERING_INTERSTITIAL`
`chrome`	`DIRECTORY_DEVICE_ID`	`about.labels [directory_device_id]` (deprecated)	If the `event.name` log field value is equal to one of the following values, then the `DIRECTORY_DEVICE_ID` log field is mapped to the `about.labels` UDM field: `CHROME_OS_ADD_USER` `CHROME_OS_REMOVE_USER` `DEVICE_BOOT_STATE_CHANGE` `CHROME_OS_LOGIN_FAILURE_EVENT` `CHROME_OS_LOGIN_LOGOUT_EVENT` `CHROME_OS_LOGIN_EVENT` `CHROME_OS_LOGOUT_EVENT` `CHROME_OS_REPORTING_DATA_LOST` `PASSWORD_CHANGED` `PASSWORD_REUSE` `CONTENT_TRANSFER` `CONTENT_UNSCANNED` `EXTENSION_REQUEST` `LOGIN_EVENT` `MALWARE_TRANSFER` `PASSWORD_BREACH` `SENSITIVE_DATA_TRANSFER` `UNSAFE_SITE_VISIT` `BROWSER_EXTENSION_INSTALL` `CHROMEOS_AFFILIATED_LOCK_SUCCESS` `CHROMEOS_AFFILIATED_UNLOCK_FAILURE` `CHROMEOS_AFFILIATED_UNLOCK_SUCCESS` `CHROMEOS_PERIPHERAL_ADDED` `CHROMEOS_PERIPHERAL_REMOVED` `CHROMEOS_PERIPHERAL_STATUS_UPDATED` `CHROMEOS_UPDATE_FAILURE` `CHROMEOS_UPDATE_SUCCESS` `CHROME_OS_CRD_CLIENT_CONNECTED` `CHROME_OS_CRD_HOST_ENDED` `CHROME_OS_CRD_HOST_STARTED` `URL_FILTERING_INTERSTITIAL` `BROWSER_CRASH`
`chrome`	`DIRECTORY_DEVICE_ID`	`additional.fields [directory_device_id]`	If the `event.name` log field value is equal to one of the following values, then the `DIRECTORY_DEVICE_ID` log field is mapped to the `additional.fields` UDM field: `CHROME_OS_ADD_USER` `CHROME_OS_REMOVE_USER` `DEVICE_BOOT_STATE_CHANGE` `CHROME_OS_LOGIN_FAILURE_EVENT` `CHROME_OS_LOGIN_LOGOUT_EVENT` `CHROME_OS_LOGIN_EVENT` `CHROME_OS_LOGOUT_EVENT` `CHROME_OS_REPORTING_DATA_LOST` `PASSWORD_CHANGED` `PASSWORD_REUSE` `CONTENT_TRANSFER` `CONTENT_UNSCANNED` `EXTENSION_REQUEST` `LOGIN_EVENT` `MALWARE_TRANSFER` `PASSWORD_BREACH` `SENSITIVE_DATA_TRANSFER` `UNSAFE_SITE_VISIT` `BROWSER_EXTENSION_INSTALL` `CHROMEOS_AFFILIATED_LOCK_SUCCESS` `CHROMEOS_AFFILIATED_UNLOCK_FAILURE` `CHROMEOS_AFFILIATED_UNLOCK_SUCCESS` `CHROMEOS_PERIPHERAL_ADDED` `CHROMEOS_PERIPHERAL_REMOVED` `CHROMEOS_PERIPHERAL_STATUS_UPDATED` `CHROMEOS_UPDATE_FAILURE` `CHROMEOS_UPDATE_SUCCESS` `CHROME_OS_CRD_CLIENT_CONNECTED` `CHROME_OS_CRD_HOST_ENDED` `CHROME_OS_CRD_HOST_STARTED` `URL_FILTERING_INTERSTITIAL` `BROWSER_CRASH`
`chrome`	`DEVICE_ID`	`target.asset.asset_id`	If the `event.name` log field value is equal to one of the following values, then the `DEVICE_ID` log field is mapped to the `target.asset.asset_id` UDM field: `CONTENT_TRANSFER` `CONTENT_UNSCANNED` `MALWARE_TRANSFER` `SENSITIVE_DATA_TRANSFER` `UNSAFE_SITE_VISIT`
`chrome`	`VIRTUAL_DEVICE_ID`	`about.labels [virtual_device_id]` (deprecated)	If the `event.name` log field value is equal to one of the following values, then the `VIRTUAL_DEVICE_ID` log field is mapped to the `about.labels` UDM field: `PASSWORD_CHANGED` `PASSWORD_REUSE` `CONTENT_TRANSFER` `CONTENT_UNSCANNED` `LOGIN_EVENT` `MALWARE_TRANSFER` `PASSWORD_BREACH` `SENSITIVE_DATA_TRANSFER` `UNSAFE_SITE_VISIT` `BROWSER_EXTENSION_INSTALL` `URL_FILTERING_INTERSTITIAL` `BROWSER_CRASH`
`chrome`	`VIRTUAL_DEVICE_ID`	`additional.fields [virtual_device_id]`	If the `event.name` log field value is equal to one of the following values, then the `VIRTUAL_DEVICE_ID` log field is mapped to the `additional.fields` UDM field: `PASSWORD_CHANGED` `PASSWORD_REUSE` `CONTENT_TRANSFER` `CONTENT_UNSCANNED` `LOGIN_EVENT` `MALWARE_TRANSFER` `PASSWORD_BREACH` `SENSITIVE_DATA_TRANSFER` `UNSAFE_SITE_VISIT` `BROWSER_EXTENSION_INSTALL` `URL_FILTERING_INTERSTITIAL` `BROWSER_CRASH`
`chrome`	`EVENT_REASON`	`security_result.summary`	If the `event.name` log field value is equal to one of the following values, then the `EVENT_REASON` log field is mapped to the `security_result.summary` UDM field: `CHROME_OS_ADD_USER` `CHROME_OS_REMOVE_USER` `DEVICE_BOOT_STATE_CHANGE` `CHROME_OS_LOGIN_FAILURE_EVENT` `CHROME_OS_LOGIN_LOGOUT_EVENT` `CHROME_OS_LOGIN_EVENT` `CHROME_OS_LOGOUT_EVENT` `CHROME_OS_REPORTING_DATA_LOST` `PASSWORD_REUSE` `DLP_EVENT` `CONTENT_UNSCANNED` `LOGIN_EVENT` `MALWARE_TRANSFER` `PASSWORD_BREACH` `UNSAFE_SITE_VISIT` `BROWSER_EXTENSION_INSTALL` `CHROMEOS_AFFILIATED_LOCK_SUCCESS` `CHROMEOS_AFFILIATED_UNLOCK_FAILURE` `CHROMEOS_AFFILIATED_UNLOCK_SUCCESS` `CHROMEOS_PERIPHERAL_ADDED` `CHROMEOS_PERIPHERAL_REMOVED` `CHROMEOS_PERIPHERAL_STATUS_UPDATED` `CHROMEOS_UPDATE_FAILURE` `CHROMEOS_UPDATE_SUCCESS` `CHROME_OS_CRD_CLIENT_CONNECTED` `CHROME_OS_CRD_HOST_ENDED` `CHROME_OS_CRD_HOST_STARTED` `BROWSER_CRASH`
`chrome`	`EVENT_RESULT`	`security_result.action_details`	If the `event.name` log field value is equal to one of the following values, then the `EVENT_RESULT` log field is mapped to the `security_result.action_details` UDM field: `PASSWORD_REUSE` `DLP_EVENT` `CONTENT_TRANSFER` `CONTENT_UNSCANNED` `MALWARE_TRANSFER` `PASSWORD_BREACH` `SENSITIVE_DATA_TRANSFER` `UNSAFE_SITE_VISIT` `URL_FILTERING_INTERSTITIAL` `BROWSER_CRASH`
`chrome`		`security_result.action`	The `security_result.action` UDM field is set to `ALLOW`.
`chrome`	`TIMESTAMP`	`about.labels [timestamp]` (deprecated)	If the `event.name` log field value is equal to one of the following values, then the `TIMESTAMP` log field is mapped to the `about.labels` UDM field: `CHROME_OS_ADD_USER` `CHROME_OS_REMOVE_USER` `DEVICE_BOOT_STATE_CHANGE` `CHROME_OS_LOGIN_FAILURE_EVENT` `CHROME_OS_LOGIN_LOGOUT_EVENT` `CHROME_OS_LOGIN_EVENT` `CHROME_OS_LOGOUT_EVENT` `CHROME_OS_REPORTING_DATA_LOST` `PASSWORD_CHANGED` `PASSWORD_REUSE` `DLP_EVENT` `CONTENT_TRANSFER` `CONTENT_UNSCANNED` `EXTENSION_REQUEST` `LOGIN_EVENT` `MALWARE_TRANSFER` `PASSWORD_BREACH` `SENSITIVE_DATA_TRANSFER` `UNSAFE_SITE_VISIT` `BROWSER_EXTENSION_INSTALL` `CHROMEOS_AFFILIATED_LOCK_SUCCESS` `CHROMEOS_AFFILIATED_UNLOCK_FAILURE` `CHROMEOS_AFFILIATED_UNLOCK_SUCCESS` `CHROMEOS_PERIPHERAL_ADDED` `CHROMEOS_PERIPHERAL_REMOVED` `CHROMEOS_PERIPHERAL_STATUS_UPDATED` `CHROMEOS_UPDATE_FAILURE` `CHROMEOS_UPDATE_SUCCESS` `CHROME_OS_CRD_CLIENT_CONNECTED` `CHROME_OS_CRD_HOST_ENDED` `CHROME_OS_CRD_HOST_STARTED` `URL_FILTERING_INTERSTITIAL` `BROWSER_CRASH`
`chrome`	`TIMESTAMP`	`additional.fields [timestamp]`	If the `event.name` log field value is equal to one of the following values, then the `TIMESTAMP` log field is mapped to the `additional.fields` UDM field: `CHROME_OS_ADD_USER` `CHROME_OS_REMOVE_USER` `DEVICE_BOOT_STATE_CHANGE` `CHROME_OS_LOGIN_FAILURE_EVENT` `CHROME_OS_LOGIN_LOGOUT_EVENT` `CHROME_OS_LOGIN_EVENT` `CHROME_OS_LOGOUT_EVENT` `CHROME_OS_REPORTING_DATA_LOST` `PASSWORD_CHANGED` `PASSWORD_REUSE` `DLP_EVENT` `CONTENT_TRANSFER` `CONTENT_UNSCANNED` `EXTENSION_REQUEST` `LOGIN_EVENT` `MALWARE_TRANSFER` `PASSWORD_BREACH` `SENSITIVE_DATA_TRANSFER` `UNSAFE_SITE_VISIT` `BROWSER_EXTENSION_INSTALL` `CHROMEOS_AFFILIATED_LOCK_SUCCESS` `CHROMEOS_AFFILIATED_UNLOCK_FAILURE` `CHROMEOS_AFFILIATED_UNLOCK_SUCCESS` `CHROMEOS_PERIPHERAL_ADDED` `CHROMEOS_PERIPHERAL_REMOVED` `CHROMEOS_PERIPHERAL_STATUS_UPDATED` `CHROMEOS_UPDATE_FAILURE` `CHROMEOS_UPDATE_SUCCESS` `CHROME_OS_CRD_CLIENT_CONNECTED` `CHROME_OS_CRD_HOST_ENDED` `CHROME_OS_CRD_HOST_STARTED` `URL_FILTERING_INTERSTITIAL` `BROWSER_CRASH`
`chrome`	`BROWSER_VERSION`	`target.resource.attribute.labels [browser_version]`	If the `event.name` log field value is equal to one of the following values, then the `BROWSER_VERSION` log field is mapped to the `target.resource.attribute.labels` UDM field: `PASSWORD_CHANGED` `PASSWORD_REUSE` `DLP_EVENT` `CONTENT_TRANSFER` `CONTENT_UNSCANNED` `LOGIN_EVENT` `MALWARE_TRANSFER` `PASSWORD_BREACH` `SENSITIVE_DATA_TRANSFER` `UNSAFE_SITE_VISIT` `BROWSER_EXTENSION_INSTALL` `URL_FILTERING_INTERSTITIAL` `BROWSER_CRASH`
`chrome`	`LOGIN_FAILURE_REASON`	`security_result.description`
`chrome`	`USER_AGENT`	`network.http.user_agent`	If the `event.name` log field value is equal to one of the following values, then the `USER_AGENT` log field is mapped to the `network.http.user_agent` UDM field: `PASSWORD_CHANGED` `PASSWORD_REUSE` `DLP_EVENT` `CONTENT_TRANSFER` `CONTENT_UNSCANNED` `LOGIN_EVENT` `MALWARE_TRANSFER` `PASSWORD_BREACH` `SENSITIVE_DATA_TRANSFER` `UNSAFE_SITE_VISIT` `BROWSER_EXTENSION_INSTALL` `URL_FILTERING_INTERSTITIAL` `BROWSER_CRASH`
`chrome`	`URL`	`target.url`	If the `event.name` log field value is equal to one of the following values, then the `URL` log field is mapped to the `about.url` UDM field: `PASSWORD_REUSE` `DLP_EVENT` `CONTENT_TRANSFER` `CONTENT_UNSCANNED` `LOGIN_EVENT` `MALWARE_TRANSFER` `PASSWORD_BREACH` `SENSITIVE_DATA_TRANSFER` `UNSAFE_SITE_VISIT` `URL_FILTERING_INTERSTITIAL`
`chrome`	`SCAN_ID`	`about.labels [scan_id]` (deprecated)	If the `event.name` log field value is equal to one of the following values, then the `SCAN_ID` log field is mapped to the `about.labels` UDM field: `CONTENT_TRANSFER` `MALWARE_TRANSFER` `SENSITIVE_DATA_TRANSFER`
`chrome`	`SCAN_ID`	`additional.fields [scan_id]`	If the `event.name` log field value is equal to one of the following values, then the `SCAN_ID` log field is mapped to the `additional.fields` UDM field: `CONTENT_TRANSFER` `MALWARE_TRANSFER` `SENSITIVE_DATA_TRANSFER`
`chrome`	`REMOVE_USER_REASON`	`security_result.detection_fields [remove_user_reason]`	If the `event.name` log field value is equal to `CHROME_OS_REMOVE_USER`, then the `REMOVE_USER_REASON` log field is mapped to the `security_result.detection_fields` UDM field.
`chrome`	`NEW_BOOT_MODE`	`target.asset.attribute.labels [new_boot_mode]`
`chrome`	`PREVIOUS_BOOT_MODE`	`target.asset.attribute.labels [previous_boot_mode]`
`chrome`	`CLIENT_TYPE`	`target.resource.attribute.labels [client_type]`
`chrome`	`TRIGGER_USER`	`security_result.about.labels [trigger_user]` (deprecated)
`chrome`	`TRIGGER_USER`	`additional.fields [trigger_user]`
`chrome`	`TRIGGER_DESTINATION`	`security_result.about.labels [trigger_destination]` (deprecated)
`chrome`	`TRIGGER_DESTINATION`	`additional.fields [trigger_destination]`
`chrome`	`TRIGGER_SOURCE`	`security_result.about.labels [trigger_source]` (deprecated)
`chrome`	`TRIGGER_SOURCE`	`additional.fields [trigger_source]`
`chrome`	`TRIGGER_TYPE`	`security_result.about.labels [trigger_type]` (deprecated)
`chrome`	`TRIGGER_TYPE`	`additional.fields [trigger_type]`
`chrome`	`TRIGGERED_RULES_REASON`	`security_result.about.labels [triggered_rules_reason]` (deprecated)
`chrome`	`TRIGGERED_RULES_REASON`	`additional.fields [triggered_rules_reason]`
`chrome`	`CONTENT_HASH`	`about.labels [content_hash]` (deprecated)
`chrome`	`CONTENT_HASH`	`additional.fields [content_hash]`
`chrome`	`CONTENT_NAME`	`about.labels [content_name]` (deprecated)
`chrome`	`CONTENT_NAME`	`additional.fields [content_name]`
`chrome`	`CONTENT_SIZE`	`about.labels [content_size]` (deprecated)
`chrome`	`CONTENT_SIZE`	`additional.fields [content_size]`
`chrome`	`CONTENT_TYPE`	`about.labels [content_type]` (deprecated)
`chrome`	`CONTENT_TYPE`	`additional.fields [content_type]`
`chrome`	`APP_NAME`	`target.application`	If the `event.name` log field value is equal to one of the following values, then the `APP_NAME` log field is mapped to the `target.application` UDM field: `EXTENSION_REQUEST` `BROWSER_EXTENSION_INSTALL`
`chrome`	`PRODUCT_NAME`	`target.application`	If the `event.name` log field value is equal to one of the following values, then the `PRODUCT_NAME` log field is mapped to the `target.application` UDM field: `CHROMEOS_PERIPHERAL_ADDED` `CHROMEOS_PERIPHERAL_REMOVED` `CHROMEOS_PERIPHERAL_STATUS_UPDATED` Else, the `PRODUCT_NAME` log field is mapped to the `target.labels` UDM field.
`chrome`	`PRODUCT_NAME`	`target.labels [product_name]` (deprecated)	If the `event.name` log field value is equal to one of the following values, then the `PRODUCT_NAME` log field is mapped to the `target.application` UDM field: `CHROMEOS_PERIPHERAL_ADDED` `CHROMEOS_PERIPHERAL_REMOVED` `CHROMEOS_PERIPHERAL_STATUS_UPDATED` Else, the `PRODUCT_NAME` log field is mapped to the `target.labels` UDM field.
`chrome`	`PRODUCT_NAME`	`additional.fields [product_name]`	If the `event.name` log field value is equal to one of the following values, then the `PRODUCT_NAME` log field is mapped to the `target.application` UDM field: `CHROMEOS_PERIPHERAL_ADDED` `CHROMEOS_PERIPHERAL_REMOVED` `CHROMEOS_PERIPHERAL_STATUS_UPDATED` Else, the `PRODUCT_NAME` log field is mapped to the `additional.fields` UDM field.
`chrome`	`ORG_UNIT_NAME`	`about.labels [org_unit_name]` (deprecated)	If the `event.name` log field value is equal to `EXTENSION_REQUEST`, then the `ORG_UNIT_NAME` log field is mapped to the `about.labels` UDM field.
`chrome`	`ORG_UNIT_NAME`	`additional.fields [org_unit_name]`	If the `event.name` log field value is equal to `EXTENSION_REQUEST`, then the `ORG_UNIT_NAME` log field is mapped to the `additional.fields` UDM field.
`chrome`	`USER_JUSTIFICATION`	`principal.user.attribute.labels [user_justification]`
`chrome`	`FEDERATED_ORIGIN`	`security_result.about.labels [federated_origin]` (deprecated)
`chrome`	`FEDERATED_ORIGIN`	`additional.fields [federated_origin]`
`chrome`	`IS_FEDERATED`	`security_result.about.labels [is_federated]` (deprecated)
`chrome`	`IS_FEDERATED`	`additional.fields [is_federated]`
`chrome`	`EVIDENCE_LOCKER_FILEPATH`	`security_result.about.labels [evidence_locker_filepath]` (deprecated)
`chrome`	`EVIDENCE_LOCKER_FILEPATH`	`additional.fields [evidence_locker_filepath]`
Google Chrome	`CONNECTION_TYPE`	`about.labels[connection_type]` (deprecated)
Google Chrome	`CONNECTION_TYPE`	`additional.fields[connection_type]`
Google Chrome	`PREVIOUS_OS_VERSION`	`target.asset.attribute.labels[previous_os_version]`
Google Chrome	`VENDOR_ID`	`src.labels[vendor_id]` (deprecated)
Google Chrome	`VENDOR_ID`	`additional.fields[vendor_id]`
Google Chrome	`LOCALIZED_URL_CATEGORY`	`about.labels[localized_url_category]` (deprecated)
Google Chrome	`LOCALIZED_URL_CATEGORY`	`additional.fields[localized_url_category]`
Google Chrome	`VENDOR_NAME`	`src.labels[vendor_name]` (deprecated)
Google Chrome	`VENDOR_NAME`	`additional.fields[vendor_name]`
Google Chrome	`SESSION_ID`	`network.session_id`
Google Chrome	`APP_ID`	`target.resource.product_object_id`	If the `event.name` log field value is equal to `BROWSER_EXTENSION_INSTALL`, then the `APP_ID` log field is mapped to the `target.resource.product_object_id` UDM field.
Google Chrome	`CURRENT_OS_VERSION`	`target.asset.platform_software.platform_version`
Google Chrome	`PRODUCT_ID`	`target.resource.product_object_id`	If the `events.name` log field value contains one of the following values, then the `PRODUCT_ID` log field is mapped to the `target.resource.product_object_id` UDM field. `CHROMEOS_PERIPHERAL_ADDEDCHROMEOS_PERIPHERAL_REMOVEDCHROMEOS_PERIPHERAL_STATUS_UPDATED` Else, the `PRODUCT_ID` log field is mapped to the `target.labels` UDM field.
Google Chrome	`PRODUCT_ID`	`target.labels[product_id]` (deprecated)	If the `events.name` log field value contains one of the following values, then the `PRODUCT_ID` log field is mapped to the `target.resource.product_object_id` UDM field. `CHROMEOS_PERIPHERAL_ADDEDCHROMEOS_PERIPHERAL_REMOVEDCHROMEOS_PERIPHERAL_STATUS_UPDATED` Else, the `PRODUCT_ID` log field is mapped to the `target.labels` UDM field.
Google Chrome	`PRODUCT_ID`	`additional.fields[product_id]`	If the `events.name` log field value contains one of the following values, then the `PRODUCT_ID` log field is mapped to the `target.resource.product_object_id` UDM field. `CHROMEOS_PERIPHERAL_ADDEDCHROMEOS_PERIPHERAL_REMOVEDCHROMEOS_PERIPHERAL_STATUS_UPDATED` Else, the `PRODUCT_ID` log field is mapped to the `additional.fields` UDM field.
Google Chrome	`UNLOCK_TYPE`	`target.labels[unlock_type]` (deprecated)
Google Chrome	`UNLOCK_TYPE`	`additional.fields[unlock_type]`
Google Chrome	`REPORT_ID`	`target.labels[report_id]` (deprecated)
Google Chrome	`REPORT_ID`	`additional.fields[report_id]`
Google Chrome	`CHANNEL`	`target.labels[channel]` (deprecated)
Google Chrome	`CHANNEL`	`additional.fields[channel]`
Google Chrome	`TAB_URL`	`additional.fields[tab_url]`
`context_aware_access`	`CAA_ACCESS_LEVEL_APPLIED`	`security_result.about.labels [caa_access_level_applied]` (deprecated)	If the `event.name` log field value is equal to `ACCESS_DENY_EVENT`, then the `CAA_ACCESS_LEVEL_APPLIED` log field is mapped to the `security_result.about.labels` UDM field.
`context_aware_access`	`CAA_ACCESS_LEVEL_APPLIED`	`additional.fields [caa_access_level_applied]`	If the `event.name` log field value is equal to `ACCESS_DENY_EVENT`, then the `CAA_ACCESS_LEVEL_APPLIED` log field is mapped to the `additional.fields` UDM field.
`context_aware_access`	`CAA_ACCESS_LEVEL_SATISFIED`	`security_result.about.labels [caa_access_level_satisfied]` (deprecated)	If the `event.name` log field value is equal to `ACCESS_DENY_EVENT`, then the `CAA_ACCESS_LEVEL_SATISFIED` log field is mapped to the `security_result.about.labels` UDM field.
`context_aware_access`	`CAA_ACCESS_LEVEL_SATISFIED`	`additional.fields [caa_access_level_satisfied]`	If the `event.name` log field value is equal to `ACCESS_DENY_EVENT`, then the `CAA_ACCESS_LEVEL_SATISFIED` log field is mapped to the `additional.fields` UDM field.
`context_aware_access`	`CAA_ACCESS_LEVEL_UNSATISFIED`	`security_result.about.labels [caa_access_level_unsatisfied]` (deprecated)	If the `event.name` log field value is equal to `ACCESS_DENY_EVENT`, then the `CAA_ACCESS_LEVEL_UNSATISFIED` log field is mapped to the `security_result.about.labels` UDM field.
`context_aware_access`	`CAA_ACCESS_LEVEL_UNSATISFIED`	`additional.fields [caa_access_level_unsatisfied]`	If the `event.name` log field value is equal to `ACCESS_DENY_EVENT`, then the `CAA_ACCESS_LEVEL_UNSATISFIED` log field is mapped to the `additional.fields` UDM field.
`context_aware_access`	`CAA_APPLICATION`	`target.resource.name`	If the `event.name` log field value is equal to `ACCESS_DENY_EVENT`, then the `CAA_APPLICATION` log field is mapped to the `target.resource.name` UDM field.
`context_aware_access`		`target.resource.resource_type`	If the `event.name` log field value is equal to `DEVICE_SETTINGS_UPDATED_EVENT`, then the `target.resource.resource_type` UDM field is set to `SETTING`. Else, the `target.resource.resource_type` UDM field is set to `DEVICE`.
`context_aware_access`	`CAA_DEVICE_ID`	`principal.asset.asset_id`	If the `event.name` log field value is equal to `ACCESS_DENY_EVENT`, then the `CAA_DEVICE_ID` log field is mapped to the `principal.asset.asset_id` UDM field.
`context_aware_access`	`CAA_DEVICE_STATE`	`principal.labels [caa_device_state]` (deprecated)	If the `event.name` log field value is equal to `ACCESS_DENY_EVENT`, then the `CAA_DEVICE_STATE` log field is mapped to the `principal.labels` UDM field.
`context_aware_access`	`CAA_DEVICE_STATE`	`additional.fields [caa_device_state]`	If the `event.name` log field value is equal to `ACCESS_DENY_EVENT`, then the `CAA_DEVICE_STATE` log field is mapped to the `additional.fields` UDM field.
`context_aware_access`	`BLOCKED_API_ACCESS`	`additional.fields [blocked_api_access]`
`gplus`	`attachment_type`	`target.resource.attribute.labels [attachment_type]`	If the `event.name` log field value is equal to one of the following values, then the `attachment_type` log field is mapped to the `target.resource.attribute.labels` UDM field: `create_comment` `edit_comment` `create_post` `edit_post`
`gplus`	`comment_resource_name`	`target.resource.product_object_id`	If the `event.name` log field value is equal to one of the following values, then the `comment_resource_name` log field is mapped to the `target.resource.product_object_id` UDM field: `create_comment` `delete_comment` `edit_comment` `add_plusone` `remove_plusone`
`gplus`	`post_resource_name`	`target.resource_ancestors.product_object_id`	If the `event.name` log field value is equal to one of the following values, then the `post_resource_name` log field is mapped to the `target.resource_ancestors.product_object_id` UDM field: `create_comment` `delete_comment` `edit_comment` `add_plusone` `remove_plusone` `add_poll_vote` `remove_poll_vote` `create_post` `delete_post` `content_manager_delete_post` `edit_post`
`gplus`	`post_permalink`	`target.resource_ancestors.attribute.labels [post_permalink]`
`gplus`	`post_visibility`	`target.resource_ancestors.attribute.labels [post_visibility]`
`gplus`	`plusone_context`	`target.resource_ancestors.attribute.labels [plusone_context]`
`gplus`	`post_author_name`	`target.user.user_display_name`	If the `event.name` log field value is equal to `content_manager_delete_post`, then the `post_resource_name` log field is mapped to the `target.user.user_display_name` UDM field.
`data_studio`	`ASSET_ID`	`principal.resource.product_object_id`	If the `ASSET_TYPE` log field value is equal to `DATA_SOURCE`, then the `ASSET_ID` log field is mapped to the `principal.resource.product_object_id` UDM field. Else, the `ASSET_ID` log field is mapped to the `target.resource.product_object_id` UDM field.
`data_studio`	`ASSET_NAME`	`principal.resource.name`	If the `ASSET_TYPE` log field value is equal to `DATA_SOURCE`, then the `ASSET_NAME` log field is mapped to the `principal.resource.name` UDM field. Else, the `ASSET_NAME` log field is mapped to the `target.resource.name` UDM field.
`data_studio`	`ASSET_TYPE`	`principal.resource.resource_subtype`	If the `ASSET_TYPE` log field value is equal to `DATA_SOURCE`, then the `ASSET_TYPE` log field is mapped to the `principal.resource.resource_subtype` UDM field. Else, the `ASSET_TYPE` log field is mapped to the `target.resource.resource_subtype` UDM field.
`data_studio`	`ASSET_ID`	`target.resource.product_object_id`	If the `ASSET_TYPE` log field value is equal to `DATA_SOURCE`, then the `ASSET_ID` log field is mapped to the `principal.resource.product_object_id` UDM field. Else, the `ASSET_ID` log field is mapped to the `target.resource.product_object_id` UDM field.
`data_studio`	`ASSET_NAME`	`target.resource.name`	If the `ASSET_TYPE` log field value is equal to `DATA_SOURCE`, then the `ASSET_NAME` log field is mapped to the `principal.resource.name` UDM field. Else, the `ASSET_NAME` log field is mapped to the `target.resource.name` UDM field.
`data_studio`	`ASSET_TYPE`	`target.resource.resource_subtype`	If the `ASSET_TYPE` log field value is equal to `DATA_SOURCE`, then the `ASSET_TYPE` log field is mapped to the `principal.resource.resource_subtype` UDM field. Else, the `ASSET_TYPE` log field is mapped to the `target.resource.resource_subtype` UDM field.
`data_studio`	`CONNECTOR_TYPE`	`target.resource.attribute.labels[connector_type]`
`data_studio`	`EMBEDDED_IN_REPORT_ID`	`target.resource.attribute.labels[embedded_in_report_id]`
`data_studio`	`OWNER_EMAIL`	`principal.user.email_addresses`	If the `actor.email` log field value is not equal to the `OWNER_EMAIL`, then the `OWNER_EMAIL` log field is mapped to the `principal.user.email_addresses` UDM field.
`data_studio`	`TARGET_USER_EMAIL`	`target.user.email_addresses`
`data_studio`	`PRIOR_VISIBILITY`	`target.resource.attribute.labels [prior_visibility]`
`data_studio`	`VISIBILITY`	`target.resource.attribute.labels [visibility]`
`data_studio`	`NEW_VALUE`	`target.resource.attribute.labels [new_value]`
`data_studio`	`OLD_VALUE`	`target.resource.attribute.labels [old_value]`
`data_studio`	`TARGET_DOMAIN`	`target.domain.name [ target_domain]`
`data_studio`	`DATA_EXPORT_TYPE`	`target.resource.attribute.labels [data_export_type]`
`mobile`		`target.resource.resource_type`	The `target.resource.resource_type` UDM field is set to `DEVICE`.
`mobile`	`ACCOUNT_STATE`	`target.resource.attribute.labels [account_state]`
`mobile`	`ACTION_EXECUTION_STATUS`	`target.resource.attribute.labels [account_execution_status]`
`mobile`	`ACTION_ID`	`target.resource.attribute.labels [action_id]`
`mobile`	`ACTION_TYPE`	`target.resource.attribute.labels [action_type]`
`mobile`	`APK_SHA256_HASH`	`target.resource.attribute.labels [apk_sha256_hash]`
`mobile`	`APPLICATION_ID`	`target.resource.attribute.labels [application_id]`
`mobile`	`APPLICATION_MESSAGE`	`target.resource.attribute.labels [application_message]`
`mobile`	`APPLICATION_REPORT_KEY`	`target.resource.attribute.labels [application_report_key]`
`mobile`	`APPLICATION_REPORT_SEVERITY`	`target.resource.attribute.labels [application_report_severity]`
`mobile`	`APPLICATION_STATE`	`target.resource.attribute.labels [application_state]`
`mobile`	`APPLICATION_REPORT_TIMESTAMP`	`target.resource.attribute.labels [application_report_timestamp]`
`mobile`	`BASIC_INTEGRITY`	`target.resource.attribute.labels [basic_integrity]`
`mobile`	`CTS_PROFILE_MATCH`	`target.resource.attribute.labels [cts_profile_match]`
`mobile`	`DEVICE_COMPLIANCE`	`target.resource.attribute.labels [device_compliance]`
`mobile`	`DEVICE_COMPROMISED_STATE`	`about.target.resource.attribute.labels [device_compromised_state]`
`mobile`	`DEVICE_DEACTIVATION_REASON`	`target.resource.attribute.labels [device_deactivation_reason]`
`mobile`	`DEVICE_ID`	`target.resource.product_object_id`	If the `event.name` log field value is equal to one of the following values, then the `DEVICE_ID` log field is mapped to the `target.resource.product_object_id` UDM field: `APPLICATION_EVENT` `APPLICATION_REPORT_EVENT` `DEVICE_REGISTER_UNREGISTER_EVENT` `ADVANCED_POLICY_SYNC_EVENT` `DEVICE_ACTION_EVENT` `DEVICE_COMPLIANCE_CHANGED_EVENT` `OS_UPDATED_EVENT` `DEVICE_OWNERSHIP_CHANGE_EVENT` `DEVICE_SETTINGS_UPDATED_EVENT` `DEVICE_SYNC_EVENT` `RISK_SIGNAL_UPDATED_EVENT` `ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT` `DEVICE_COMPROMISED_EVENT` `FAILED_PASSWORD_ATTEMPTS_EVENT` `SUSPICIOUS_ACTIVITY_EVENT`
`mobile`	`NEW_DEVICE_ID`	`target.resource.attribute.labels [new_device_id]`	If the `NEW_DEVICE_ID` log field value is not empty, then the `NEW_DEVICE_ID` log field is mapped to the `target.resource.product_object_id` UDM field.
`mobile`	`DEVICE_MODEL`	`target.resource.attribute.labels [device_model]`
`mobile`	`DEVICE_OWNERSHIP`	`target.resource.attribute.labels [device_ownership]`
`mobile`	`DEVICE_PROPERTY`	`target.resource.attribute.labels [device_property]`
`mobile`	`DEVICE_SETTING`	`target.resource.attribute.labels [device_setting]`
`mobile`	`DEVICE_STATUS_ON_APPLE_PORTAL`	`target.resource.attribute.labels [device_status_on_apple_portal]`
`mobile`	`DEVICE_TYPE`	`target.resource.resource_subtype`	If the `event.name` log field value is equal to one of the following values, then the `DEVICE_TYPE` log field is mapped to the `target.resource.resource_subtype` UDM field: `APPLICATION_EVENT` `APPLICATION_REPORT_EVENT` `DEVICE_REGISTER_UNREGISTER_EVENT` `ADVANCED_POLICY_SYNC_EVENT` `DEVICE_ACTION_EVENT` `DEVICE_COMPLIANCE_CHANGED_EVENT` `OS_UPDATED_EVENT` `DEVICE_OWNERSHIP_CHANGE_EVENT` `DEVICE_SETTINGS_UPDATED_EVENT` `DEVICE_SYNC_EVENT` `RISK_SIGNAL_UPDATED_EVENT` `ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT` `DEVICE_COMPROMISED_EVENT` `FAILED_PASSWORD_ATTEMPTS_EVENT` `SUSPICIOUS_ACTIVITY_EVENT`
`mobile`	`FAILED_PASSWD_ATTEMPTS`	`target.resource.attribute.labels [failed_passwd_attempts]`
`mobile`	`IOS_VENDOR_ID`	`target.resource.attribute.labels [ios_vendor_id]`
`mobile`	`NEW_VALUE`	`target.resource.attribute.labels [new_value]`
`mobile`	`OLD_VALUE`	`target.resource.attribute.labels [old_value]`
`mobile`	`OS_EDITION`	`target.resource.attribute.labels [os_edition]`
`mobile`	`OS_PROPERTY`	`target.resource.attribute.labels [os_property]`
`mobile`	`OS_VERSION`	`target.resource.attribute.labels [os_version]`
`mobile`	`PHA_CATEGORY`	`security_results.detection_fields`
`mobile`	`POLICY_NAME`	`security_result.about.labels [policy_name]` (deprecated)
`mobile`	`POLICY_NAME`	`additional.fields [policy_name]`
`mobile`	`POLICY_SYNC_RESULT`	`security_result.about.labels [policy_sync_result]` (deprecated)
`mobile`	`POLICY_SYNC_RESULT`	`additional.fields [policy_sync_result]`
`mobile`	`POLICY_SYNC_TYPE`	`security_result.about.labels [policy_sync_type]` (deprecated)
`mobile`	`POLICY_SYNC_TYPE`	`additional.fields [policy_sync_type]`
`mobile`	`RESOURCE_ID`	`target.resource.attribute.labels`	If the `event.name` log field value is equal to one of the following values, then the `RESOURCE_ID` log field is mapped to the `target.resource.attribute.labels` UDM field: `APPLICATION_EVENT` `APPLICATION_REPORT_EVENT` `DEVICE_REGISTER_UNREGISTER_EVENT` `ADVANCED_POLICY_SYNC_EVENT` `DEVICE_ACTION_EVENT` `DEVICE_COMPLIANCE_CHANGED_EVENT` `OS_UPDATED_EVENT` `DEVICE_OWNERSHIP_CHANGE_EVENT` `DEVICE_SETTINGS_UPDATED_EVENT` `DEVICE_SYNC_EVENT` `RISK_SIGNAL_UPDATED_EVENT` `ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT` `DEVICE_COMPROMISED_EVENT` `FAILED_PASSWORD_ATTEMPTS_EVENT` `SUSPICIOUS_ACTIVITY_EVENT`
`mobile`	`REGISTER_PRIVILEGE`	`security_result.about.labels [register_privilege]` (deprecated)
`mobile`	`REGISTER_PRIVILEGE`	`additional.fields`
`mobile`	`RISK_SIGNAL`	`security_result.about.labels [risk_signal]` (deprecated)
`mobile`	`RISK_SIGNAL`	`additional.fields [risk_signal]`
`mobile`	`SECURITY_EVENT_ID`	`security_result.about.labels [security_event_id]` (deprecated)	If the `event.name` log field value is equal to `APPLICATION_EVENT`, then the `SECURITY_EVENT_ID` log field is mapped to the `security_result.about.labels` UDM field.
`mobile`	`SECURITY_EVENT_ID`	`additional.fields`	If the `event.name` log field value is equal to `APPLICATION_EVENT`, then the `SECURITY_EVENT_ID` log field is mapped to the `additional.fields` UDM field.
`mobile`	`SECURITY_PATCH_LEVEL`	`security_result.about.labels [security_patch_level]` (deprecated)	If the `event.name` log field value is equal to one of the following values, then the `SECURITY_PATCH_LEVEL` log field is mapped to the `security_result.about.labels` UDM field: `DEVICE_SYNC_EVENT` `DEVICE_REGISTER_UNREGISTER_EVENT`
`mobile`	`SECURITY_PATCH_LEVEL`	`additional.fields [security_patch_level]`	If the `event.name` log field value is equal to one of the following values, then the `SECURITY_PATCH_LEVEL` log field is mapped to the `additional.fields` UDM field: `DEVICE_SYNC_EVENT` `DEVICE_REGISTER_UNREGISTER_EVENT`
`mobile`	`SERIAL_NUMBER`	`target.resource.attribute.labels [serial_number]`
`mobile`	`USER_EMAIL`	`target.user.email_addresses`	If the `event.name` log field value is equal to one of the following values, then the `USER_EMAIL` log field is mapped to the `target.user.email_addresses` UDM field: `APPLICATION_EVENT` `APPLICATION_REPORT_EVENT` `DEVICE_REGISTER_UNREGISTER_EVENT` `ADVANCED_POLICY_SYNC_EVENT` `DEVICE_ACTION_EVENT` `DEVICE_COMPLIANCE_CHANGED_EVENT` `OS_UPDATED_EVENT` `DEVICE_OWNERSHIP_CHANGE_EVENT` `DEVICE_SETTINGS_UPDATED_EVENT` `DEVICE_SYNC_EVENT` `RISK_SIGNAL_UPDATED_EVENT` `ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT` `DEVICE_COMPROMISED_EVENT` `FAILED_PASSWORD_ATTEMPTS_EVENT` `SUSPICIOUS_ACTIVITY_EVENT`
`mobile`	`VALUE`	`security_result.about.labels [value]` (deprecated)
`mobile`	`VALUE`	`additional.fields [value]`
`mobile`	`WINDOWS_SYNCML_POLICY_STATUS_CODE`	`security_result.about.labels [windows_syncml_policy_status_code]` (deprecated)
`mobile`	`WINDOWS_SYNCML_POLICY_STATUS_CODE`	`additional.fields [windows_syncml_policy_status_code]`
`mobile`	`LAST_SYNC_AUDIT_DATE`	`target.resource.attribute.labels[LAST_SYNC_AUDIT_DATE]`
`groups_enterprise`	`dynamic_group_query`	`target.group.attribute.labels [dynamic_group_query]`
`groups_enterprise`	`group_id`	`target.user.group_identifiers`	If the `event.name` log field value is equal to one of the following values, then the `group_id` log field is mapped to the `target.user.group_identifiers` UDM field: `accept_invitation` `add_info_setting` `add_member` `add_member_role` `add_security_setting` `approve_join_request` `ban_member_with_moderation` `change_info_setting` `change_security_setting` `create_group` `delete_group` `add_dynamic_group_query` `change_dynamic_group_query` `invite_member` `join` `add_membership_expiry` `remove_membership_expiry` `update_membership_expiry` `reject_invitation` `reject_join_request` `remove_info_setting` `remove_member` `remove_member_role` `remove_security_setting` `request_to_join` `revoke_invitation` `unban_member`
`groups_enterprise`	`info_setting`	`target.group.attribute.labels [info_setting]`
`groups_enterprise`	`member_id`	`target.user.email_addresses`	If the `event.name` log field value is equal to one of the following values, then the `member_id` log field is mapped to the `target.user.email_addresses` UDM field: `add_member` `add_member_role` `add_service_account_permission` `approve_join_request` `ban_member_with_moderation` `invite_member` `add_membership_expiry` `remove_membership_expiry` `update_membership_expiry` `reject_join_request` `remove_member` `remove_member_role` `remove_service_account_permission` `revoke_invitation` `unban_member`
`groups_enterprise`	`member_role`	`target.user.attribute.roles.name`	If the `event.name` log field value is equal to one of the following values, then the `member_role` log field is mapped to the `target.user.attribute.roles.name` UDM field: `add_member` `add_member_role` `add_service_account_permission` `remove_member_role` `remove_service_account_permission`
`groups_enterprise`	`member_type`	`target.user.attribute.labels[member_type]`
`groups_enterprise`	`membership_expiry`	`target.group.attribute.labels [membership_query]`
`groups_enterprise`	`namespace`	`target.group.group_display_name`
`groups_enterprise`	`new_value`	`target.group.attribute.labels [new_value]`
`groups_enterprise`	`old_value`	`target.group.attribute.labels [old_value]`
`groups_enterprise`	`value`	`target.group.attribute.labels [value]`
`groups_enterprise`	`security_setting`	`target.group.attribute.labels [security_setting]`
`calendar`	`access_level`	`security_result.about.labels [access_level]` (deprecated)
`calendar`	`access_level`	`additional.fields [access_level]`
`calendar`	`api_kind`	`target.resource.attribute.labels [api_kind]`
`calendar`	`calendar_country`	`target.resource.attribute.labels [calendar_country]`	If the `event.name` log field value is equal to `change_calendar_country`, then the `calendar_country` log field is mapped to the `target.resource.attribute.labels` UDM field.
`calendar`	`calendar_description`	`target.resource.attribute.labels [calendar_description]`
`calendar`	`calendar_id`	`target.resource.product_object_id`	If the `event.name` log field value is equal to one of the following values, then the `calendar_id` log field is mapped to the `target.resource.product_object_id` UDM field: `change_calendar_acls` `change_calendar_country` `create_calendar` `delete_calendar` `change_calendar_description` `change_calendar_location` `change_calendar_timezone` `change_calendar_title` `notification_triggered` `add_subscription` `delete_subscription` `create_event` `delete_event` `add_event_guest` `change_event_guest_response_auto` `remove_event_guest` `change_event_guest_response` `change_event` `remove_event_from_trash` `restore_event` `change_event_start_time` `change_event_title` `interop_freebusy_lookup_outbound_successful` `interop_freebusy_lookup_inbound_successful` `interop_exchange_resource_availability_lookup_successful` `interop_freebusy_lookup_outbound_unsuccessful` `interop_freebusy_lookup_inbound_unsuccessful` `interop_exchange_resource_availability_lookup_unsuccessful` `transfer_event_requested` `transfer_event_completed`
`calendar`	`calendar_location`	`target.resource.attribute.labels [calendar_location]`
`calendar`	`calendar_timezone`	`target.resource.attribute.labels [calendar_timezone]`
`calendar`	`calendar_title`	`target.resource.name`	If the `event.name` log field value is equal to `change_calendar_title`, then the `calendar_title` log field is mapped to the `target.resource.name` UDM field.
`calendar`	`end_time`	`target.resource.attribute.labels [end_time]`
`calendar`	`start_time`	`target.resource.attribute.labels [start_time]`
`calendar`	`event_guest`	`target.labels [event_guest]` (deprecated)
`calendar`	`event_guest`	`additional.fields [event_guest]`
`calendar`	`event_id`	`target.resource.attribute.labels [event_id]`	If the `event.name` log field value is equal to one of the following values, then the `event_id` log field is mapped to the `target.resource.attribute.labels` UDM field: `notification_triggered` `add_subscription` `delete_subscription` `create_event` `delete_event` `add_event_guest` `change_event_guest_response_auto` `remove_event_guest` `change_event_guest_response` `change_event` `remove_event_from_trash` `restore_event` `change_event_start_time` `change_event_title` `transfer_event_requested` `transfer_event_completed`
`calendar`	`event_response_status`	`target.resource.attribute.labels [event_response_status]`
`calendar`	`event_title`	`target.resource.attribute.labels [event_title]`	If the `event.name` log field value is equal to one of the following values, then the `event_title` log field is mapped to the `target.resource.attribute.labels` UDM field: `create_event` `delete_event` `add_event_guest` `change_event_guest_response_auto` `remove_event_guest` `change_event_guest_response` `change_event` `remove_event_from_trash` `restore_event` `change_event_start_time` `change_event_title` `transfer_event_requested` `transfer_event_completed`
`calendar`	`old_event_title`	`target.resource.attribute.labels [old_event_title]`
`calendar`	`grantee_email`	`target.user.email_addresses`	If the `event.name` log field value is equal to one of the following values, then the `grantee_email` log field is mapped to the `target.user.email_addresses` UDM field: `change_calendar_acls` `transfer_event_requested`
`calendar`	`interop_error_code`	`security_result.action_details`	If the `event.name` log field value is equal to one of the following values, then the `interop_error_code` log field is mapped to the `security_result.action_details` UDM field: `interop_exchange_resource_list_lookup_successful` `interop_freebusy_lookup_outbound_unsuccessful` `interop_freebusy_lookup_inbound_unsuccessful` `interop_exchange_resource_availability_lookup_unsuccessful` `interop_exchange_resource_list_lookup_unsuccessful`
`calendar`	`notification_message_id`	`target.resource.attribute.labels [notification_message_id]`	If the `event.name` log field value is equal to one of the following values, then the `notification_message_id` log field is mapped to the `target.resource.attribute.labels` UDM field: `notification_triggered` `create_event` `delete_event` `add_event_guest` `remove_event_guest` `change_event_guest_response` `change_event` `restore_event` `change_event_start_time` `change_event_title`
`calendar`	`notification_method`	`target.resource.attribute.labels [notification_method]`	If the `event.name` log field value is equal to one of the following values, then the `notification_method` log field is mapped to the `target.resource.attribute.labels` UDM field: `notification_triggered` `add_subscription` `delete_subscription`
`calendar`	`notification_type`	`target.resource.resource_subtype`	If the `event.name` log field value is equal to one of the following values, then the `notification_type` log field is mapped to the `target.resource.resource_subtype` UDM field: `notification_triggered` `add_subscription` `delete_subscription`
`calendar`	`organizer_calendar_id`	`principal.user.attribute.labels[organizer_calendar_id]`	If the `event.name` log field value is equal to one of the following values, then the `organizer_calendar_id` log field is mapped to the `principal.user.attribute.labels[organizer_calendar_id]` UDM field: `create_event` `delete_event` `add_event_guest` `change_event_guest_response_auto` `remove_event_guest` `change_event_guest_response` `change_event` `remove_event_from_trash` `restore_event` `change_event_start_time` `change_event_title` `transfer_event_requested` `transfer_event_completed`
`calendar`	`recipient_email`	`principal.user.email_addresses`	If the `event.name` log field value is equal to one of the following values, then the `recipient_email` log field is mapped to the `principal.user.email_addresses` UDM field: `notification_triggered` `create_event` `delete_event` `add_event_guest` `remove_event_guest` `change_event_guest_response` `change_event` `restore_event` `change_event_start_time` `change_event_title`
`calendar`	`remote_ews_url`	`security_result.about.labels [remote_ews_url]` (deprecated)
`calendar`	`remote_ews_url`	`additional.fields [remote_ews_url]`
`calendar`	`requested_period_end`	`security_result.about.labels [requested_period_end]` (deprecated)
`calendar`	`requested_period_end`	`additional.fields [requested_period_end]`
`calendar`	`requested_period_start`	`security_result.about.labels [requested_period_start]` (deprecated)
`calendar`	`requested_period_start`	`additional.fields [requested_period_start]`
`calendar`	`subscriber_calendar_id`	`principal.user.attribute.labels[subscriber_calendar_id]`
`calendar`	`user_agent`	`network.http.user_agent`
`calendar`	`target_calendar_id`	`target.resource.attribute.labels [target_calendar_id]`
`calendar`	`user_agent`	`network.http.user_agent`
`calendar`	`target_calendar_id`	`target.resource.attribute.labels [target_calendar_id]`
`calendar`	`client_side_encrypted`	`target.resource.attribute.labels [client_side_encrypted]`
`calendar`	`is_recurring`	`target.resource.attribute.labels [is_recurring]`
`calendar`	`recurring`	`target.resource.attribute.labels [recurring]`
`chat`	`actor`	`principal.user.email_addresses`	The `event.name` log field is mapped to the `principal.user.email_addresses` UDM field if the following conditions are met: The `actor` log field value is not equal to `actor.email`. The `event.name` log field value is equal to one of the following values: `add_room_member` `attachment_download` `attachment_upload` `block_room` `block_user` `direct_message_started` `invite_accept` `invite_decline` `invite_send` `message_edited` `message_posted` `message_reported` `remove_room_member` `room_created` `reaction_added` `message_deleted`
`chat`	`attachment_hash`	`target.file.sha256`	If the `event.name` log field value is equal to one of the following values, then the `attachment_hash` log field is mapped to the `target.file.sha256` UDM field: `attachment_download` `attachment_upload` `message_edited` `message_posted`
`chat`	`attachment_name`	`target.file.names`	If the `event.name` log field value is equal to one of the following values, then the `attachment_name` log field is mapped to the `target.file.names` UDM field: `attachment_download` `attachment_upload` `message_edited` `message_posted`
`chat`	`attachment_url`	`target.file.full_path`	If the `event.name` log field value is equal to `attachment_download`, then the `attachment_url` log field is mapped to the `target.file.full_path` UDM field.
`chat`	`dlp_scan_status`	`security_result.action_details`	If the `event.name` log field value is equal to one of the following values, then the `dlp_scan_status` log field is mapped to the `security_result.action_details` UDM field: `attachment_upload` `direct_message_started` `message_edited` `message_posted`
`chat`	`message_id`	`target.resource.product_object_id`	If the `event.name` log field value is equal to one of the following values, then the `message_id` log field is mapped to the `target.resource.product_object_id` UDM field: `message_edited` `message_posted` `message_reported` `reaction_added` `message_deleted`
`chat`	`conference_id`	`target.resource.product_object_id`	If the `event.name` log field value is equal to one of the following values, then the `message_id` log field is mapped to the `target.resource.product_object_id` UDM field: `call_ended` `presentation_started` `invitation_sent`
`chat`		`target.resource.resource_subtype`	If the `event.name` log field value is equal to one of the following values, then the `target.resource.resource_subtype` UDM field is set to `Google Chat - Message`: `message_edited` `message_posted` `message_reported`
`chat`	`report_type`	`target.resource.attribute.labels [report_type]`
`chat`	`room_id`	`target.group.product_object_id`	If the `event.name` log field value is equal to one of the following values, then the `room_id` log field is mapped to the `target.group.product_object_id` UDM field: `add_room_member` `attachment_download` `attachment_upload` `block_room` `block_user` `direct_message_started` `invite_accept` `invite_decline` `invite_send` `message_edited` `message_posted` `message_reported` `remove_room_member` `room_created` `reaction_added` `message_deleted`
`chat`	`dm_id`	`about.labels [dm_id]` (deprecated)	If the `event.name` log field value is equal to `direct_message_started`, then the `about.labels` UDM field is set to `dm_id`.
`chat`	`dm_id`	`additional.fields [dm_id]`	If the `event.name` log field value is equal to `direct_message_started`, then the `additional.fields` UDM field is set to `dm_id`.
`chat`	`target_users`	`target.user.email_addresses`	If the `event.name` log field value is equal to one of the following values, then the `target_users` log field is mapped to the `target.user.email_addresses` UDM field: `add_room_member` `block_user` `invite_send` `message_reported` `remove_room_member`
`chat`	`retention_state`	`target.user.attribute.labels[retention_state]`
`chat`	`room_name`	`target.group.group_display_name`
`chat`	`timestamp_ms`	`target.resource.attribute.labels [timestamp_ms]`
`chat`	`external_room`	`about.labels[external_room]` (deprecated)
`chat`	`external_room`	`additional.fields[external_room]`
`chat`	`device_type`	`principal.asset.attribute.labels [device_type]`
`chat`	`identifier_type`	`principal.user.attribute.labels [identifier_type]`
`chat`	`location_region`	`principal.user.attribute.labels [location_region]`
`chat`	`identifier`	`principal.user.userid`
`chat`	`display_name`	`principal.user.user_display_name`
`chat`	`location_country`	`principal.location.country_or_region`
`chat`	`product_type`	`principal.resource.resource_subtype`
`chat`	`ip_address`	`target.ip`
`chat`	`target_user_count`	`target.user.attribute.labels[target_user_count]`
`chat`	`duration_seconds`	`target.resource.attribute.labels [duration_seconds]`
`chat`	`meeting_code`	`target.resource.attribute.labels[meeting_code]`
`chat`	`organizer_email`	`about.user.email_addresses`
`chat`	`network_estimated_upload_kbps_mean`	`additional.fields [network_estimated_upload_kbps_mean]`
`chat`	`video_recv_fps_mean`	`additional.fields [video_recv_fps_mean]`
`chat`	`screencast_send_fps_mean`	`additional.fields [screencast_send_fps_mean]`
`chat`	`audio_recv_packet_loss_max`	`additional.fields [audio_recv_packet_loss_max]`
`chat`	`video_send_long_side_median_pixels`	`additional.fields [video_send_long_side_median_pixels]`
`chat`	`screencast_recv_packet_loss_mean`	`additional.fields [screencast_recv_packet_loss_mean]`
`chat`	`video_recv_packet_loss_mean`	`additional.fields [video_recv_packet_loss_mean]`
`chat`	`video_recv_long_side_median_pixels`	`additional.fields [video_recv_long_side_median_pixels]`
`chat`	`video_send_packet_loss_mean`	`additional.fields [video_send_packet_loss_mean]`
`chat`	`audio_send_packet_loss_max`	`additional.fields [audio_send_packet_loss_max]`
`chat`	`video_recv_short_side_median_pixels`	`additional.fields [video_recv_short_side_median_pixels]`
`chat`	`screencast_recv_bitrate_kbps_mean`	`additional.fields [screencast_recv_bitrate_kbps_mean]`
`chat`	`calendar_event_id`	`additional.fields [calendar_event_id]`
`video_send_fps_mean`	`additional.fields [video_send_fps_mean]`	`target`
`chat`	`audio_recv_packet_loss_mean`	`additional.fields [audio_recv_packet_loss_mean]`
`chat`	`video_recv_seconds`	`additional.fields [video_recv_seconds]`
`chat`	`video_send_packet_loss_max`	`additional.fields [video_send_packet_loss_max]`
`chat`	`network_recv_jitter_msec_max`	`additional.fields [network_recv_jitter_msec_max]`
`chat`	`network_recv_jitter_msec_mean`	`additional.fields [network_recv_jitter_msec_mean]`
`chat`	`audio_send_seconds`	`additional.fields [audio_send_seconds]`
`chat`	`screencast_send_long_side_median_pixels`	`additional.fields [screencast_send_long_side_median_pixels]`
`chat`	`screencast_recv_seconds`	`additional.fields [screencast_recv_seconds]`
`chat`	`screencast_recv_long_side_median_pixels`	`additional.fields [screencast_recv_long_side_median_pixels]`
`chat`	`screencast_send_bitrate_kbps_mean`	`additional.fields [screencast_send_bitrate_kbps_mean]`
`chat`	`screencast_send_packet_loss_max`	`additional.fields [screencast_send_packet_loss_max]`
`chat`	`video_send_bitrate_kbps_mean`	`additional.fields [video_send_bitrate_kbps_mean]`
`chat`	`screencast_send_seconds`	`additional.fields [screencast_send_seconds]`
`chat`	`audio_send_bitrate_kbps_mean`	`additional.fields [audio_send_bitrate_kbps_mean]`
`chat`	`screencast_recv_fps_mean`	`additional.fields [screencast_recv_fps_mean]`
`chat`	`audio_recv_seconds`	`additional.fields [audio_recv_seconds]`
`chat`	`video_recv_packet_loss_max`	`additional.fields [video_recv_packet_loss_max]`
`chat`	`screencast_send_packet_loss_mean`	`additional.fields [screencast_send_packet_loss_mean]`
`chat`	`network_transport_protocol`	`additional.fields [network_transport_protocol]`
`chat`	`screencast_recv_short_side_median_pixels`	`additional.fields [screencast_recv_short_side_median_pixels]`
`chat`	`screencast_send_short_side_median_pixels`	`additional.fields [screencast_send_short_side_median_pixels]`
`chat`	`screencast_recv_packet_loss_max`	`additional.fields [screencast_recv_packet_loss_max]`
`chat`	`is_external`	`additional.fields [is_external]`
`chat`	`video_send_short_side_median_pixels`	`additional.fields [video_send_short_side_median_pixels]`
`chat`	`endpoint_id`	`additional.fields [endpoint_id]`
`chat`	`network_estimated_download_kbps_mean`	`additional.fields [network_estimated_download_kbps_mean]`
`chat`	`network_send_jitter_msec_mean`	`additional.fields [network_send_jitter_msec_mean]`
`chat`	`video_send_seconds`	`additional.fields [video_send_seconds]`
`chat`	`network_rtt_msec_mean`	`additional.fields [network_rtt_msec_mean]`
`chat`	`network_congestion`	`additional.fields [network_congestion]`
`chat`	`audio_send_packet_loss_mean`	`additional.fields [audio_send_packet_loss_mean]`
`chat`	`action_time`	`additional.fields [action_time]`
`gcp`	`USER_EMAIL`	`principal.user.email_addresses`	If the `actor.email` log field value is empty, then the `USER_EMAIL` log field is mapped to the `principal.user.email_addresses` UDM field.
`drive`	`actor_is_collaborator_account`	`about.labels [actor_is_collaborator_account]` (deprecated)
`drive`	`actor_is_collaborator_account`	`additional.fields [actor_is_collaborator_account]`
`drive`	`added_role`	`target.user.attribute.roles.name`	If the `event.name` log field value is equal to `shared_drive_membership_change`, then the `added_role` log field is mapped to the `target.user.attribute.roles.name` UDM field.
`drive`	`requested_role`	`target.user.attribute.roles.name`	If the `event.name` log field value is equal to `request_access`, then the `requested_role` log field is mapped to the `target.user.attribute.roles.name` UDM field.
`drive`	`billable`	`about.labels [billable]` (deprecated)
`drive`	`billable`	`additional.fields [billable]`
`drive`	`copy_type`	`about.labels [copy_type]` (deprecated)
`drive`	`copy_type`	`additional.fields [copy_type]`
`drive`	`destination_folder_id`	`target.resource.product_object_id`	If the `event.name` log field value is equal to one of the following values, then the `destination_folder_id` log field is mapped to the `target.resource.product_object_id` UDM field: `add_to_folder` `move` `unmovable_item_reparented`
`drive`	`doc_id`	`target.resource.product_object_id`	If the `event.name` log field value is equal to one of the following values, then the `doc_id` log field is mapped to the `target.resource.product_object_id` UDM field: `add_to_folder` `approval_canceled` `approval_comment_added` `approval_completed` `approval_decisions_reset` `approval_due_time_change` `approval_requested` `approval_reviewer_change` `approval_reviewer_responded` `copy` `create` `delete` `download` `email_as_attachment` `edit` `label_added` `label_added_by_item_create` `label_field_changed` `label_removed` `add_lock` `move` `preview` `print` `remove_from_folder` `rename` `untrash` `sheets_import_range` `source_copy` `trash` `remove_lock` `unmovable_item_reparented` `upload` `view` `apply_security_update` `shared_drive_apply_security_update` `shared_drive_remove_security_update` `publish_change` `change_acl_editors` `change_document_access_scope` `change_document_access_scope_hierarchy_reconciled` `change_document_visibility` `change_document_visibility_hierarchy_reconciled` `remove_security_update` `shared_drive_membership_change` `shared_drive_settings_change` `sheets_import_range_access_change` `change_user_access` `change_user_access_hierarchy_reconciled` `connected_sheets_query` `create_comment` `accept_suggestion` `change_owner` `create_suggestion` `delete_comment` `delete_suggestion` `edit_comment` `expire_access_request` `reassign_comment` `reject_suggestion` `reopen_comment` `request_access` `resolve_comment` `download_forms_response` `email_collaborators`
`drive`	`destination_folder_title`	`target.resource.name`	If the `event.name` log field value is equal to one of the following values, then the `destination_folder_title` log field is mapped to the `target.resource.name` UDM field: `add_to_folder` `move` `unmovable_item_reparented`
`drive`	`doc_title`	`target.resource.name`	If the `event.name` log field value is equal to one of the following values, then the `doc_title` log field is mapped to the `target.resource.name` UDM field: `add_to_folder` `approval_canceled` `approval_comment_added` `approval_completed` `approval_decisions_reset` `approval_due_time_change` `approval_requested` `approval_reviewer_change` `approval_reviewer_responded` `copy` `create` `delete` `download` `email_as_attachment` `edit` `label_added` `label_added_by_item_create` `label_field_changed` `label_removed` `add_lock` `move` `preview` `print` `remove_from_folder` `rename` `untrash` `sheets_import_range` `source_copy` `trash` `remove_lock` `unmovable_item_reparented` `upload` `view` `apply_security_update` `shared_drive_apply_security_update` `shared_drive_remove_security_update` `publish_change` `change_acl_editors` `change_document_access_scope` `change_document_access_scope_hierarchy_reconciled` `change_document_visibility` `change_document_visibility_hierarchy_reconciled` `remove_security_update` `shared_drive_membership_change` `shared_drive_settings_change` `sheets_import_range_access_change` `change_user_access` `change_user_access_hierarchy_reconciled` `connected_sheets_query` `create_comment` `accept_suggestion` `change_owner` `create_suggestion` `delete_comment` `delete_suggestion` `edit_comment` `expire_access_request` `reassign_comment` `reject_suggestion` `reopen_comment` `request_access` `resolve_comment` `download_forms_response` `email_collaborators`
`drive`	`doc_id`	`src.resource.product_object_id`	If the `event.name` log field value is equal to one of the following values, then the `doc_id` log field is mapped to the `src.resource.product_object_id` UDM field: `add_to_folder` `move` `unmovable_item_reparented`
`drive`	`doc_title`	`src.resource.name`	If the `event.name` log field value is equal to one of the following values, then the `doc_title` log field is mapped to the `src.resource.name` UDM field: `add_to_folder` `move` `unmovable_item_reparented`
`drive`	`doc_type`	`target.resource.attribute.labels[doc_type]`	If the `event.name` log field value is equal to one of the following values, then the `doc_type` log field is mapped to the `target.resource.attribute.labels[doc_type]` UDM field: `add_to_folder` `approval_canceled` `approval_comment_added` `approval_completed` `approval_decisions_reset` `approval_due_time_change` `approval_requested` `approval_reviewer_change` `approval_reviewer_responded` `copy` `create` `delete` `download` `email_as_attachment` `edit` `label_added` `label_added_by_item_create` `label_field_changed` `label_removed` `add_lock` `move` `preview` `print` `remove_from_folder` `rename` `untrash` `sheets_import_range` `source_copy` `trash` `remove_lock` `unmovable_item_reparented` `upload` `view` `apply_security_update` `shared_drive_apply_security_update` `shared_drive_remove_security_update` `publish_change` `change_acl_editors` `change_document_access_scope` `change_document_access_scope_hierarchy_reconciled` `change_document_visibility` `change_document_visibility_hierarchy_reconciled` `remove_security_update` `shared_drive_membership_change` `shared_drive_settings_change` `sheets_import_range_access_change` `change_user_access` `change_user_access_hierarchy_reconciled` `connected_sheets_query` `create_comment` `accept_suggestion` `change_owner` `create_suggestion` `delete_comment` `delete_suggestion` `edit_comment` `expire_access_request` `reassign_comment` `reject_suggestion` `reopen_comment` `request_access` `resolve_comment` `download_forms_response` `email_collaborators`
`drive`	`doc_type`	`src.resource.attribute.labels [doc_type]`	If the `event.name` log field value is equal to one of the following values, then the `doc_type` log field is mapped to the `src.resource.attribute.labels [doc_type]` UDM field: `add_to_folder` `move` `unmovable_item_reparented`
`drive`	`field`	`target.resource.attribute.labels [field]`
`drive`	`field_id`	`target.resource.attribute.labels [field_id]`
`drive`	`is_encrypted`	`target.labels [is_encrypted]` (deprecated)
`drive`	`is_encrypted`	`additional.fields [is_encrypted]`
`drive`	`label`	`target.resource.attribute.labels [label]`
`drive`	`label_title`	`target.resource.attribute.labels [label_title]`
`drive`	`membership_change_type`	`about.labels [membership_change_type]` (deprecated)
`drive`	`membership_change_type`	`additional.fields [membership_change_type]`
`drive`	`new_publish_visibility`	`target.resource.attribute.labels [new_publish_visibility]`
`drive`	`new_value`	`target.resource.attribute.labels [new_value]`
`drive`	`new_value_id`	`target.resource.attribute.labels [new_value_id]`
`drive`	`new_settings_state`	`about.labels [new_settings_state]` (deprecated)
`drive`	`new_settings_state`	`additional.fields [new_settings_state]`
`drive`	`old_settings_state`	`about.labels [old_settings_state]` (deprecated)
`drive`	`old_settings_state`	`additional.fields [old_settings_state]`
`drive`	`old_publish_visibility`	`target.resource.attribute.labels [old_publish_visibility]`
`drive`	`old_value`	`target.resource.attribute.labels [old_value]`
`drive`	`old_value_id`	`target.resource.attribute.labels [old_value_id]`
`drive`	`old_visibility`	`target.resource.attribute.labels [old_visibility]`
`drive`	`originating_app_id`	`about.labels [originating_app_id]` (deprecated)
`drive`	`originating_app_id`	`additional.fields [originating_app_id]`
`drive`	`owner`	`target.resource.attribute.labels[owner]`
`drive`	`owner_is_shared_drive`	`target.resource.attribute.labels [owner_is_shared_drive]`
`drive`	`primary_event`	`about.labels [primary_event]` (deprecated)
`drive`	`primary_event`	`additional.fields [primary_event]`
`drive`	`reason`	`security_result.summary`	If the `event.name` log field value is equal to one of the following values, then the `reason` log field is mapped to the `security_result.summary` UDM field: `label_added` `label_added_by_item_create` `label_field_changed` `label_removed`
`drive`	`removed_role`	`target.user.attribute.labels [removed_role]` and `target.user.roles.description`	If the `removed_role` log field value is equal to `commenter`, then the `target.user.roles.description` UDM field is set to `Team Drive role Commenter`. If the `removed_role` log field value is equal to `content_manager`, then the `target.user.roles.description` UDM field is set to `Team Drive role Content manager`. If the `removed_role` log field value is equal to `editor`, then the `target.user.roles.description` UDM field is set to `Team Drive role Contributor`. If the `removed_role` log field value is equal to `none`, then the `target.user.roles.description` UDM field is set to `No role in Team Drive`. If the `removed_role` log field value is equal to `organizer`, then the `target.user.roles.description` UDM field is set to `Team Drive role Manager`. If the `removed_role` log field value is equal to `viewer`, then the `target.user.roles.description` UDM field is set to `Team Drive role Viewer`.
`drive`	`target_domain`	`target.domain.name`	If the `event.name` log field value is equal to one of the following values, then the `target_domain` log field is mapped to the `target.domain.name` UDM field: `change_document_access_scope` `change_document_access_scope_hierarchy_reconciled` `change_document_visibility` `change_document_visibility_hierarchy_reconciled`
`drive`	`target_user`	`target.user.email_addresses`	If the `event.name` log field value is equal to one of the following values, then the `target_user` log field is mapped to the `target.user.email_addresses` UDM field: `change_user_access` `change_user_access_hierarchy_reconciled` `expire_access_request` `request_access`
`drive`	`target_user`	`additional.fields[target_user]`
`drive`	`new_owner`	`target.user.email_addresses`	The `new_owner` log field is mapped to the `target.user.email_addresses` UDM field if the following conditions are met: The `event.name` log field value matches the regular expression pattern `^.+@.+$`. The `event.name` log field value is equal to `change_owner`. Else, the `new_owner` log field is mapped to the `target.user.attribute.labels` UDM field.
`drive`	`target`	`target.user.email_addresses`	If the `event.name` log field value matches the regular expression pattern `^.+@.+$`, then the `target` log field is mapped to the `target.user.email_addresses` UDM field.
`drive`	`target`	`target.user.attribute.labels[target]`	If the `event.name` log field value does not match the regular expression pattern `^.+@.+$`, then the `target` log field is mapped to the `target.user.attribute.labels[target]` UDM field.
`drive`	`recipients`	`target.user.email_addresses`	If the `event.name` log field value is equal to `email_collaborators`, then the `recipients` log field is mapped to the `target.user.email_addresses` UDM field.
`drive`	`shared_drive_id`	`target.resource_ancestors.product_object_id`
`drive`	`shared_drive_settings_change_type`	`about.labels [shared_drive_settings_change_type]` (deprecated)
`drive`	`shared_drive_settings_change_type`	`additional.fields [shared_drive_settings_change_type]`
`drive`	`sheets_import_range_recipient_doc`	`target.resource.attribute.labels [sheets_import_range_recipient_doc]`
`drive`	`source_folder_id`	`principal.resource.id`	If the `event.name` log field value is equal to one of the following values, then the `source_folder_id` log field is mapped to the `principal.resource.id` UDM field: `unmovable_item_reparented` `remove_from_folder` `move`
`drive`	`source_folder_title`	`principal.resource.name`	If the `event.name` log field value is equal to one of the following values, then the `source_folder_title` log field is mapped to the `principal.resource.name` UDM field: `move` `remove_from_folder` `unmovable_item_reparented`
`drive`	`storage_entity_id`	`about.labels [storage_entity_id]` (deprecated)
`drive`	`storage_entity_id`	`additional.fields [storage_entity_id]`
`drive`	`storage_usage_in_bytes`	`about.labels [storage_usage_in_bytes]` (deprecated)
`drive`	`storage_usage_in_bytes`	`additional.fields [storage_usage_in_bytes]`
`drive`	`visibility`	`target.resource.attribute.labels [visibility]`
`drive`	`visibility_change`	`target.resource.attribute.labels [visibility_change]`
`drive`	`team_drive_id`	`target.group.product_object_id`
`drive`	`owner_is_team_drive`	`target.resource.attribute.labels [owner_is_team_drive]`
`drive`	`data_connection_id`	`about.labels[data_connection_id]` (deprecated)
`drive`	`data_connection_id`	`additional.fields[data_connection_id]`
`drive`	`delegating_principal`	`about.user.email_addresses`	If the `actor.email` log field value is not equal to `delegating_principal`, then the `delegating_principal` log field is mapped to `about.user.email_addresses` UDM field.
`drive`	`execution_id`	`about.labels[execution_id]` (deprecated)
`drive`	`execution_id`	`additional.fields[execution_id]`
`drive`	`execution_trigger`	`about.labels[execution_trigger]` (deprecated)
`drive`	`execution_trigger`	`additional.fields[execution_trigger]`
`drive`	`query_type`	`about.labels[query_type]` (deprecated)
`drive`	`query_type`	`additional.fields[query_type]`
`drive`	`owner_team_drive_id`	`target.resource.attribute.labels[owner_team_drive_id]`
`drive`	`new_owner_is_team_drive`	`target.resource.attribute.labels [new_owner_is_team_drive]`
`drive`	`new_owner_team_drive_id`	`target.resource.attribute.labels[new_owner_team_drive_id]`
`drive`	`owner_shared_drive_id`	`target.resource.attribute.labels[owner_shared_drive_id]`
`drive`	`dlp_info`	`target.resource.attribute.labels[dlp_info]`
`drive`	`team_drive_settings_change_type`	`target.resource.attribute.labels[team_drive_settings_change_type]`
`drive`	`accessed_url`	`target.url`
`drive`	`script_id`	`additional.fields[script_id]`
`drive`	`additional.fields[script_id]`	`additional.fields[api_method]`
`keep`	`attachment_name`	`target.resource.attribute.labels [attachment_name]`	If the `event.name` log field value is equal to one of the following values, then the `attachment_name` log field is mapped to the `target.resource.attribute.labels` UDM field: `deleted_attachment` `uploaded_attachment`
`keep`	`note_name`	`target.url`	If the `event.name` log field value is equal to one of the following values, then the `note_name` log field is mapped to the `target.url` UDM field: `deleted_attachment` `uploaded_attachment` `edited_note_content` `created_note` `deleted_note` `modified_acl`
`keep`	`owner_email`	`principal.user.email_addresses`	If the `actor.email` log field value is empty, then the `owner_email` log field is mapped to the `principal.user.email_addresses` UDM field.
`keep`		`target.resource_subtype`	The `target.resource_subtype` UDM field is set to `keep`.
`meet`	`action_description`	`security_result.action_details`	If the `event.name` log field value is equal to `abuse_report_submitted`, then the `action_description` log field is mapped to the `security_result.action_details` UDM field.
`meet`	`action_reason`	`security_result.summary`
`meet`	`conference_id`	`target.resource.product_object_id`	If the `event.name` log field value is equal to one of the following values, then the `conference_id` log field is mapped to the `target.resource.product_object_id` UDM field: `abuse_report_submitted` `call_ended` `livestream_watched` `knocking_accepted` `knocking_denied` `presentation_started` `presentation_stopped` `recording_activity` `invitation_sent`
`meet`	`calendar_event_id`	`target.labels [calendar_event_id]` (deprecated)
`meet`	`calendar_event_id`	`additional.fields [calendar_event_id]`
`meet`	`device_type`	`principal.asset.attribute.labels [device_type]`
`meet`	`display_name`	`principal.user.user_display_name`	If the `event.name` log field value is equal to one of the following values, then the `display_name` log field is mapped to the `principal.user.user_display_name` UDM field: `abuse_report_submitted` `call_ended` `livestream_watched`
`meet`	`target_display_names`	`target.user.user_display_name`	If the `event.name` log field value is equal to `abuse_report_submitted`, then the `target_display_name` log field is mapped to the `target.user.user_display_name` UDM field.
`meet`	`duration_seconds`	`target.resource.attribute.labels [duration_seconds]`
`meet`	`end_of_call_rating`	`target.resource.attribute.labels [end_of_call_rating]`
`meet`	`endpoint_id`	`security_result.about.labels [endpoint_id]` (deprecated)
`meet`	`endpoint_id`	`additional.fields [endpoint_id]`
`meet`	`identifier`	`principal.user.userid`	If the `event.name` log field value is equal to one of the following values, then the `identifier` log field is mapped to the `principal.user.userid` UDM field: `abuse_report_submitted` `call_ended` `knocking_accepted` `knocking_denied` `presentation_started` `presentation_stopped` `invitation_sent`
`meet`	`identifier_type`	`principal.user.attribute.labels [identifier_type]`
`meet`	`ip_address`	`target.ip`	If the `ipAddress` log field value is empty, then the `ip_address` log field is mapped to the `target.ip` UDM field.
`meet`	`is_external`	`principal.labels [is_external]` (deprecated)
`meet`	`is_external`	`additional.fields [is_external]`
`meet`	`livestream_view_page_id`	`target.resource.attribute.labels [livestream_view_page_id]`
`meet`	`location_country`	`principal.location.country_or_region`	If the `event.name` log field value is equal to `call_ended`, then the `location_country` log field is mapped to the `principal.location.country_or_region` UDM field.
`meet`	`location_region`	`principal.user.attribute.labels [location_region]`	If the `event.name` log field value is equal to `call_ended`, then the `location_region` log field is mapped to the `principal.location.country_or_region` UDM field.
`meet`	`meeting_code`	`target.resource.product_object_id`	If the `event.name` log field value is equal to one of the following values, then the `meeting_code` log field is mapped to the `target.resource.product_object_id` UDM field: `abuse_report_submitted` `call_ended` `livestream_watched` `knocking_accepted` `knocking_denied` `presentation_started` `presentation_stopped` `invitation_sent`
`meet`	`organizer_email`	`about.user.email_addresses`	If the `event.name` log field value is equal to one of the following values, then the `organizer_email` log field is mapped to the `about.user.email_addresses` UDM field: `abuse_report_submitted` `call_ended` `livestream_watched`
`meet`	`product_type`	`principal.resource.resource_subtype`	If the `event.name` log field value is equal to one of the following values, then the `product_type` log field is mapped to the `principal.resource.resource_subtype` UDM field: `abuse_report_submitted` `call_ended` `livestream_watched`
`meet`	`target_email`	`target.user.email_addresses`	If the `event.name` log field value is equal to `abuse_report_submitted`, then the `target_email` log field is mapped to the `target.user.email_addresses` UDM field.
`meet`	`target_phone_number`	`target.user.phone_numbers`	If the `event.name` log field value is equal to `abuse_report_submitted`, then the `target_phone_number` log field is mapped to the `target.user.phone_numbers` UDM field.
`meet`	`audio_recv_packet_loss_max`	`about.labels [audio_recv_packet_loss_max]` (deprecated)
`meet`	`audio_recv_packet_loss_max`	`additional.fields [audio_recv_packet_loss_max]`
`meet`	`audio_recv_packet_loss_mean`	`about.labels [audio_recv_packet_loss_mean]` (deprecated)
`meet`	`audio_recv_packet_loss_mean`	`additional.fields [audio_recv_packet_loss_mean]`
`meet`	`audio_recv_seconds`	`about.labels [audio_recv_seconds]` (deprecated)
`meet`	`audio_recv_seconds`	`additional.fields [audio_recv_seconds]`
`meet`	`audio_send_bitrate_kbps_mean`	`about.labels [audio_send_bitrate_kbps_mean]` (deprecated)
`meet`	`audio_send_bitrate_kbps_mean`	`additional.fields [audio_send_bitrate_kbps_mean]`
`meet`	`audio_send_packet_loss_max`	`about.labels [audio_send_packet_loss_max]` (deprecated)
`meet`	`audio_send_packet_loss_max`	`additional.fields [audio_send_packet_loss_max]`
`meet`	`audio_send_packet_loss_mean`	`about.labels [audio_send_packet_loss_mean]` (deprecated)
`meet`	`audio_send_packet_loss_mean`	`additional.fields [audio_send_packet_loss_mean]`
`meet`	`audio_send_seconds`	`about.labels [audio_send_seconds]` (deprecated)
`meet`	`audio_send_seconds`	`additional.fields [audio_send_seconds]`
`meet`	`network_congestion`	`about.labels [network_congestion]` (deprecated)
`meet`	`network_congestion`	`additional.fields [network_congestion]`
`meet`	`network_estimated_download_kbps_mean`	`about.labels [network_estimated_download_kbps_mean]` (deprecated)
`meet`	`network_estimated_download_kbps_mean`	`additional.fields [network_estimated_download_kbps_mean]`
`meet`	`network_estimated_upload_kbps_mean`	`about.labels [network_estimated_upload_kbps_mean]` (deprecated)
`meet`	`network_estimated_upload_kbps_mean`	`additional.fields [network_estimated_upload_kbps_mean]`
`meet`	`network_recv_jitter_msec_max`	`about.labels [network_recv_jitter_msec_max]` (deprecated)
`meet`	`network_recv_jitter_msec_max`	`additional.fields [network_recv_jitter_msec_max]`
`meet`	`network_recv_jitter_msec_mean`	`about.labels [network_recv_jitter_msec_mean]` (deprecated)
`meet`	`network_recv_jitter_msec_mean`	`additional.fields [network_recv_jitter_msec_mean]`
`meet`	`network_rtt_msec_mean`	`about.labels [network_rtt_msec_mean]` (deprecated)
`meet`	`network_rtt_msec_mean`	`additional.fields [network_rtt_msec_mean]`
`meet`	`network_send_jitter_msec_mean`	`about.labels [network_send_jitter_msec_mean]` (deprecated)
`meet`	`network_send_jitter_msec_mean`	`additional.fields [network_send_jitter_msec_mean]`
`meet`	`network_transport_protocol`	`about.labels [network_transport_protocol]` (deprecated)
`meet`	`network_transport_protocol`	`additional.fields [network_transport_protocol]`
`meet`	`screencast_recv_bitrate_kbps_mean`	`about.labels [screencast_recv_bitrate_kbps_mean]` (deprecated)
`meet`	`screencast_recv_bitrate_kbps_mean`	`additional.fields [screencast_recv_bitrate_kbps_mean]`
`meet`	`screencast_recv_fps_mean`	`about.labels [screencast_recv_fps_mean]` (deprecated)
`meet`	`screencast_recv_fps_mean`	`additional.fields [screencast_recv_fps_mean]`
`meet`	`screencast_recv_long_side_median_pixels`	`about.labels [screencast_recv_long_side_median_pixels]` (deprecated)
`meet`	`screencast_recv_long_side_median_pixels`	`additional.fields [screencast_recv_long_side_median_pixels]`
`meet`	`screencast_recv_packet_loss_max`	`about.labels [screencast_recv_packet_loss_max]` (deprecated)
`meet`	`screencast_recv_packet_loss_max`	`additional.fields [screencast_recv_packet_loss_max]`
`meet`	`screencast_recv_packet_loss_mean`	`about.labels [screencast_recv_packet_loss_mean]` (deprecated)
`meet`	`screencast_recv_packet_loss_mean`	`additional.fields [screencast_recv_packet_loss_mean]`
`meet`	`screencast_recv_seconds`	`about.labels [screencast_recv_seconds]` (deprecated)
`meet`	`screencast_recv_seconds`	`additional.fields [screencast_recv_seconds]`
`meet`	`screencast_recv_short_side_median_pixels`	`about.labels [screencast_recv_short_side_median_pixels]` (deprecated)
`meet`	`screencast_recv_short_side_median_pixels`	`additional.fields [screencast_recv_short_side_median_pixels]`
`meet`	`screencast_send_bitrate_kbps_mean`	`about.labels [screencast_send_bitrate_kbps_mean]` (deprecated)
`meet`	`screencast_send_bitrate_kbps_mean`	`additional.fields [screencast_send_bitrate_kbps_mean]`
`meet`	`screencast_send_fps_mean`	`about.labels [screencast_send_fps_mean]` (deprecated)
`meet`	`screencast_send_fps_mean`	`additional.fields [screencast_send_fps_mean]`
`meet`	`screencast_send_long_side_median_pixels`	`about.labels [screencast_send_long_side_median_pixels]` (deprecated)
`meet`	`screencast_send_long_side_median_pixels`	`additional.fields [screencast_send_long_side_median_pixels]`
`meet`	`screencast_send_packet_loss_max`	`about.labels [screencast_send_packet_loss_max]` (deprecated)
`meet`	`screencast_send_packet_loss_max`	`additional.fields [screencast_send_packet_loss_max]`
`meet`	`screencast_send_packet_loss_mean`	`about.labels [screencast_send_packet_loss_mean]` (deprecated)
`meet`	`screencast_send_packet_loss_mean`	`additional.fields [screencast_send_packet_loss_mean]`
`meet`	`screencast_send_seconds`	`about.labels [screencast_send_seconds]` (deprecated)
`meet`	`screencast_send_seconds`	`additional.fields [screencast_send_seconds]`
`meet`	`screencast_send_short_side_median_pixels`	`about.labels [screencast_send_short_side_median_pixels]` (deprecated)
`meet`	`screencast_send_short_side_median_pixels`	`additional.fields [screencast_send_short_side_median_pixels]`
`meet`	`video_recv_fps_mean`	`about.labels [video_recv_fps_mean]` (deprecated)
`meet`	`video_recv_fps_mean`	`additional.fields [video_recv_fps_mean]`
`meet`	`video_recv_long_side_median_pixels`	`about.labels [video_recv_long_side_median_pixels]` (deprecated)
`meet`	`video_recv_long_side_median_pixels`	`additional.fields [video_recv_long_side_median_pixels]`
`meet`	`video_recv_packet_loss_max`	`about.labels [video_recv_packet_loss_max]` (deprecated)
`meet`	`video_recv_packet_loss_max`	`additional.fields [video_recv_packet_loss_max]`
`meet`	`video_recv_packet_loss_mean`	`about.labels [video_recv_packet_loss_mean]` (deprecated)
`meet`	`video_recv_packet_loss_mean`	`additional.fields [video_recv_packet_loss_mean]`
`meet`	`video_recv_seconds`	`about.labels [video_recv_seconds]` (deprecated)
`meet`	`video_recv_seconds`	`additional.fields [video_recv_seconds]`
`meet`	`video_recv_short_side_median_pixels`	`about.labels [video_recv_short_side_median_pixels]` (deprecated)
`meet`	`video_recv_short_side_median_pixels`	`additional.fields [video_recv_short_side_median_pixels]`
`meet`	`video_send_bitrate_kbps_mean`	`about.labels [video_send_bitrate_kbps_mean]` (deprecated)
`meet`	`video_send_bitrate_kbps_mean`	`additional.fields [video_send_bitrate_kbps_mean]`
`meet`	`video_send_fps_mean`	`about.labels [video_send_fps_mean]` (deprecated)
`meet`	`video_send_fps_mean`	`additional.fields [video_send_fps_mean]`
`meet`	`video_send_long_side_median_pixels`	`about.labels [video_send_long_side_median_pixels]` (deprecated)
`meet`	`video_send_long_side_median_pixels`	`additional.fields [video_send_long_side_median_pixels]`
`meet`	`video_send_packet_loss_max`	`about.labels [video_send_packet_loss_max]` (deprecated)
`meet`	`video_send_packet_loss_max`	`additional.fields [video_send_packet_loss_max]`
`meet`	`video_send_packet_loss_mean`	`about.labels [video_send_packet_loss_mean]` (deprecated)
`meet`	`video_send_packet_loss_mean`	`additional.fields [video_send_packet_loss_mean]`
`meet`	`video_send_seconds`	`about.labels [video_send_seconds]` (deprecated)
`meet`	`video_send_seconds`	`additional.fields [video_send_seconds]`
`meet`	`video_send_short_side_median_pixels`	`about.labels [video_send_short_side_median_pixels]` (deprecated)
`meet`	`video_send_short_side_median_pixels`	`additional.fields [video_send_short_side_median_pixels]`
`meet`	`action_time`	`about.labels[action_time]` (deprecated)
`meet`	`action_time`	`additional.fields[action_time]`
`meet`	`target_user_count`	`target.user.attribute.labels[target_user_count]`
`meet`	`streaming_session_state`	`about.labels[streaming_session_state]` (deprecated)
`meet`	`streaming_session_state`	`additional.fields[streaming_session_state]`
`login`	`affected_email_address`	`target.user.email_addresses`	If the `event.name` log field value is equal to one of the following values, then the `affected_email_address` log field is mapped to the `target.user.email_addresses` UDM field: `account_disabled_password_leak` `suspicious_login` `suspicious_login_less_secure_app` `suspicious_programmatic_login` `account_disabled_generic` `account_disabled_spamming_through_relay` `account_disabled_spamming` `account_disabled_hijacked` `blocked_sender`
`login`	`login_timestamp`	`security_result.detection_fields [login_timestamp]`
`login`	`is_second_factor`	`about.labels[is_2sv]` (deprecated)
`login`	`is_second_factor`	`additional.fields[is_2sv]`
`login`	`is_suspicious`	`about.labels[is_suspicious]` (deprecated)
`login`	`is_suspicious`	`additional.fields[is_suspicious]`
`login`	`login_failure_type`	`scurity_result.summary`
`login`	`login_challenge_status`	`about.labels[login_challenge_status]` (deprecated)
`login`	`login_challenge_status`	`additional.fields[login_challenge_status]`
`login`	`login_challenge_method`	`security_result.detection_fields [login_challenge_method]`
`login`	`login_challenge_method`	`security_result.detection_fields [login_challenge_method_attempts_count]`
`login`	`login_type`	`security_result.detection_fields [login_type]`
`login`	`sensitive_action_name`	`security_result.action_details [sensitive_action_name]`
`login`		`extensions.auth.mechanism`	If the `param.value` log field value is equal to `google_password`, then the `extensions.auth.mechanism` UDM field is set to `USERNAME_PASSWORD`. Else, the `extensions.auth.mechanism` UDM field is set to `MECHANISM_UNSPECIFIED`.
`login`		`extensions.auth.type`	If the `param.value` log field value is equal to `google_password`, then the `extensions.auth.type` UDM field is set to `SSO`.
`login`		`security_result.action`	If the `event.name` log field value is equal to one of the following values, then the `security_result.action` UDM field is set to `BLOCK`: `login_failure` `risky_sensitive_action_blocked`
`token`	`api_name`	`about.resource.attribute.labels [api_name]`
`token`	`app_name`	`target.resource.name`	If the `event.name` log field value is equal to one of the following values, then the `app_name` log field is mapped to the `target.resource.name` UDM field: `activity` `authorize` `revoke`
`token`	`client_id`	`principal.asset.attribute.labels [client_id]`	If the `event.name` log field value is equal to one of the following values, then the `client_id` log field is mapped to the `principal.asset.attribute.labels` UDM field: `activity` `authorize` `revoke`
`token`	`client_type`	`principal.asset.attribute.labels [client_type]`
`token`	`method_name`	`target.resource.attribute.labels [method_name]`
`token`	`num_response_bytes`	`target.resource.attribute.labels [num_response_bytes]`
`token`	`product_bucket`	`target.resource.attribute.labels product_bucket]`
`token`	`scope`	`target.resource.attribute.labels [scope]`
`token`	`scope_data`	`target.resource.attribute.labels [scope_data]`
`token`	`rejection_type`	`target.resource.attribute.labels [rejection_type]`
`rules`	`actions`	`security_result.action_details [actions]`
`rules`	`triggered_actions`	`security_result.action_details [actions]`
`rules`	`actor_ip_address`	`principal.ip`	If the `ipAddress` log field value is equal to empty, then the `actor_ip_address` log field is mapped to the `principal.ip` UDM field.
`rules`	`application`	`target.resource.attribute.labels[application]`
`rules`	`conference_id`	`target.resource.attribute.labels [conference_id]`
`rules`	`data_source`	`security_result.detection_fields [data_source]`
`rules`	`device_id`	`target.asset.asset_id`	If the `event.name` log field value is equal to one of the following values, then the `device_id` log field is mapped to the `target.asset.asset_id` UDM field: `action_complete` `label_field_value_changed` `label_applied`
`rules`	`device_type`	`target.asset.attribute.labels[device_type]`
`rules`	`drive_shared_drive_id`	`target.resource.attribute.labels[drive_shared_drive_id]`
`rules`	`evaluation_context`	`about.labels [evaluation_context]` (deprecated)
`rules`	`evaluation_context`	`additional.fields [evaluation_context]`
`rules`	`has_alert`	`security_result.about.labels [has_alert]` (deprecated)
`rules`	`has_alert`	`additional.fields [has_alert]`
`rules`	`has_content_match`	`security_result.about.labels [has_content_match]` (deprecated)
`rules`	`has_content_match`	`additional.fields [has_content_match]`
`rules`	`matched_detectors`	`security_result.detection_fields [matched_detectors]`
`rules`	`matched_templates`	`security_result.detection_fields [matched_templates]`
`rules`	`matched_threshold`	`security_result.detection_fields [matched_threshold]`
`rules`	`matched_trigger`	`security_result.detection_fields [matched_trigger]`
`rules`	`mobile_device_type`	`target.asset.category`	If the `event.name` log field value is equal to `rule_match`, then the `mobile_device_type` log field is mapped to the `target.asset.category` UDM field.
`rules`	`mobile_ios_vendor_id`	`target.asset.attribute.labels [mobile_ios_vendor_id]`
`rules`	`resource_id`	`target.resource.product_object_id`	If the `event.name` log field value is equal to one of the following values, then the `resource_id` log field is mapped to the `target.resource.product_object_id` UDM field: `action_complete` `rule_match` `label_field_value_changed` `label_applied`
`rules`	`resource_name`	`target.resource.name`	If the `event.name` log field value is equal to `rule_match`, then the `resource_name` log field is mapped to the `target.resource.name` UDM field.
`rules`	`resource_title`	`target.labels [resource_title]` (deprecated)
`rules`	`resource_title`	`additional.fields [resource_title]`
`rules`	`resource_owner_email`	`principal.user.email_addresses`	If the `actor.email` log field value is not equal to `resource_owner_email`, then the `principal.user.email_addresses` UDM field is set to `resource_owner_email`.
`rules`	`resource_recipients`	`principal.user.email_addresses`	If the `actor.email` log field value is not equal to `resource_recipients`, then the `principal.user.email_addresses` UDM field is set to `resource_recipients`.
`rules`	`resource_recipients_omitted_count`	`target.labels [resource_recipients_omitted_count]` (deprecated)
`rules`	`resource_recipients_omitted_count`	`additional.fields [resource_recipients_omitted_count]`
`rules`	`resource_type`	`target.resource.resource_subtype`	If the `event.name` log field value is equal to one of the following values, then the `resource_type` log field is mapped to the `target.resource.resource_subtype` UDM field: `action_complete` `label_field_value_changed` `label_applied` `sharing_blocked`
`rules`	`rule_name`	`security_result.rule_name`	If the `event.name` log field value is equal to one of the following values, then the `rule_name` log field is mapped to the `security_result.rule_name` UDM field: `action_complete` `rule_match` `rule_trigger` `label_field_value_changed` `label_applied`
`rules`	`rule_id`	`security_result.rule_id`	If the `event.name` log field value is equal to `rule_match`, then the `rule_id` log field is mapped to the `security_result.rule_id` UDM field.
`rules`	`rule_resource_name`	`security_result.rule_labels [rule_resource_name]`
`rules`	`rule_type`	`security_result.rule_type`	If the `event.name` log field value is equal to one of the following values, then the `rule_type` log field is mapped to the `security_result.rule_type` UDM field: `action_complete` `rule_trigger` `label_field_value_changed` `sharing_blocked`
`rules`	`rule_update_time_usec`	`security_result.rule_labels [rule_update_time_usec]`
`rules`	`scan_type`	`security_result.about.labels [scan_type]` (deprecated)
`rules`	`scan_type`	`additional.fields [scan_type]`
`rules`	`severity`	`security_result.severity`	If the `event.name` log field value is equal to one of the following values, then the `severity` log field is mapped to the `security_result.severity` UDM field: `action_complete` `rule_trigger`
`rules`	`space_id`	`target.resource.attribute.labels [space_id]`
`rules`	`space_type`	`target.resource.attribute.labels [space_type]`
`rules`	`suppressed_actions`	`security_result.about.labels [suppressed_actions]` (deprecated)
`rules`	`suppressed_actions`	`additional.fields [suppressed_actions]`
`rules`	`label_field`	`target.resource.attribute.labels [label_field]`
`rules`	`label_title`	`target.resource.attribute.labels [label_title]`
`rules`	`new_value`	`target.resource.attribute.labels [new_value]`
`rules`	`old_value`	`target.resource.attribute.labels [old_value]`
`rules`	`blocked_recipients`	`target.user.email_addresses`
`rules`	`snippets`	`target.resource.attribute.labels [snippets]`
`saml`	`application_name`	`target.application`	If the `event.name` log field value is equal to one of the following values, then the `application_name` log field is mapped to the `target.application` UDM field: `login_failure` `login_success`
`saml`	`device_id`	`principal.asset.asset_id`	If the `event.name` log field value is equal to one of the following values, then the `device_id` log field is mapped to the `principal.asset.assetid` UDM field: `login_failure` `login_success`
`saml`	`failure_type`	`security_result.summary`	If the `event.name` log field value is equal to `login_failure`, then the `failure_type` log field is mapped to the `security_result.summary` UDM field.
`saml`	`initiated_by`	`security_result.detection_fields[initiated_by]`	If the `event.name` log field value is equal to one of the following values, then the `initiated_by` log field is mapped to the `security_result.detection_fields` UDM field: `login_failure` `login_success`
`saml`	`orgunit_path`	`target.user.attribute.labels [orgunit_path]`	If the `event.name` log field value is equal to one of the following values, then the `orgunit_path` log field is mapped to the `target.user.attribute.labels` UDM field: `login_failure` `login_success`
`saml`	`saml_second_level_status_code`	`security_result.about.labels [saml_second_level_status_code]` (deprecated)
`saml`	`saml_second_level_status_code`	`additional.fields [saml_second_level_status_code]`
`saml`	`saml_status_code`	`security_result.about.labels [saml_status_code]` (deprecated)
`saml`	`saml_status_code`	`additional.fields [saml_status_code]`
`saml`		`security_result.action`	If the `event.name` log field value is equal to `login_failure`, then the `security_result.action` UDM field is set to `BLOCK`.
`user_accounts`	`email_forwarding_destination_address`	`target.user.email_addresses`
`groups`	`acl_permission`	`target.group.attribute.roles.name`	If the `event.name` log field value is equal to `change_acl_permission`, then the `acl_permission` log field is mapped to the `target.group.attribute.roles.name` UDM field.
`groups`	`basic_setting`	`target.group.attribute.labels [basic_setting]`
`groups`	`group_email`	`target.group.email_addresses`	If the `event.name` log field value is equal to one of the following values, then the `group_email` log field is mapped to the `target.group.email_addresses` UDM field: `change_acl_permission` `accept_invitation` `approve_join_request` `join` `request_to_join` `change_basic_setting` `create_group` `delete_group` `change_identity_setting` `add_info_setting` `change_info_setting` `remove_info_setting` `change_new_members_restrictions_setting` `change_post_replies_setting` `change_spam_moderation_setting` `change_topic_setting` `moderate_message` `always_post_from_user` `add_user` `ban_user_with_moderation` `revoke_invitation` `invite_user` `reject_join_request` `reinvite_user` `remove_user` `change_email_subscription_type` `unsubscribe_via_mail`
`groups`	`identity_setting`	`target.group.attribute.labels [identity_setting]`
`groups`	`info_setting`	`target.group.attribute.labels [info_setting]`
`groups`	`message_id`	`network.email.mail_id`	If the `event.name` log field value is equal to `moderate_message`, then the `message_id` log field is mapped to the `network.email.mail_id` UDM field.
`groups`	`message_moderation_action`	`target.group.attribute.labels [message_moderation_action]`
`groups`	`member_role`	`target.user.attribute.roles.name`	If the `event.name` log field value is equal to `add_user`, then the `member_role` log field is mapped to the `target.user.attribute.roles.name` UDM field.
`groups`	`new_members_restrictions_setting`	`target.group.attribute.labels [new_members_restrictions_setting]`
`groups`	`new_value`	`target.group.attribute.labels [new_value]`
`groups`	`new_value_repeated`	`target.group.attribute.labels [new_value_repeated]`
`groups`	`old_value`	`target.group.attribute.labels [old_value]`
`groups`	`old_value_repeated`	`target.group.attribute.labels [old_value_repeated]`
`groups`	`post_replies_setting`	`target.group.attribute.labels [post_replies_setting]`
`groups`	`spam_moderation_setting`	`target.group.attribute.labels [spam_moderation_setting]`
`groups`	`status`	`target.group.attribute.labels[status]`
`groups`	`topic_setting`	`target.group.attribute.labels [topic_setting]`
`groups`	`user_email`	`target.user.email_addresses`	If the `event.name` log field value is equal to one of the following values, then the `user_email` log field is mapped to the `target.user.email_addresses` UDM field: `approve_join_request` `always_post_from_user` `add_user` `ban_user_with_moderation` `revoke_invitation` `invite_user` `reject_join_request` `reinvite_user` `remove_user` `change_email_subscription_type`
`groups`	`user_email`	`principal.user.email_addresses`	If the `event.name` log field value is equal to `unsubscribe_via_mail` and the `actor.email` log field value is not equal to the `user_email`, then the `user_email` log field is mapped to the `principal.user.email_addresses` UDM field.
`groups`	`value`	`target.group.attribute.labels [value_of_info_setting]`
`admin`	`USER_EMAIL`	`src.user.email_addresses`	If the `event.name` log field value is equal to `CREATE_DATA_TRANSFER_REQUEST`, then the `USER_EMAIL` log field is mapped to the `src.user.email_addresses` UDM field.
`admin`	`USER_EMAIL`	`target.user.email_addresses`	If the `event.name` log field value is equal to one of the following values, then the `USER_EMAIL` log field is mapped to the `target.user.email_addresses` UDM field: `DELETE_2SV_SCRATCH_CODES` `GENERATE_2SV_SCRATCH_CODES` `REVOKE_3LO_TOKEN` `REVOKE_3LO_DEVICE_TOKENS` `ADD_RECOVERY_EMAIL` `ADD_RECOVERY_PHONE` `GRANT_ADMIN_PRIVILEGE` `REVOKE_ADMIN_PRIVILEGE` `REVOKE_ASP` `TOGGLE_AUTOMATIC_CONTACT_SHARING` `BULK_UPLOAD_NOTIFICATION_SENT` `CANCEL_USER_INVITE` `CHANGE_USER_CUSTOM_FIELD` `CHANGE_USER_EXTERNAL_ID` `CHANGE_USER_GENDER` `CHANGE_USER_IM` `ENABLE_USER_IP_WHITELIST` `CHANGE_USER_KEYWORD` `CHANGE_USER_LANGUAGE` `CHANGE_USER_LOCATION` `CHANGE_USER_ORGANIZATION` `CHANGE_USER_PHONE_NUMBER` `CHANGE_RECOVERY_EMAIL` `CHANGE_RECOVERY_PHONE` `CHANGE_USER_RELATION` `CHANGE_USER_ADDRESS` `CREATE_EMAIL_MONITOR` `CREATE_DATA_TRANSFER_REQUEST` `CREATE_DATA_TRANSFER_REQUEST` `CHANGE_PASSWORD` `DELETE_ACCOUNT_INFO_DUMP` `DELETE_EMAIL_MONITOR` `DELETE_MAILBOX_DUMP` `DELETE_PROFILE_PHOTO` `CHANGE_FIRST_NAME` `xyz_RESET_USER` `CHANGE_LAST_NAME` `MAIL_ROUTING_DESTINATION_ADDED` `MAIL_ROUTING_DESTINATION_REMOVED` `ADD_NICKNAME` `REMOVE_NICKNAME` `CHANGE_PASSWORD_ON_NEXT_LOGIN` `REMOVE_RECOVERY_EMAIL` `REMOVE_RECOVERY_PHONE` `REQUEST_ACCOUNT_INFO` `REQUEST_MAILBOX_DUMP` `RESEND_USER_INVITE` `RESEND_USER_INVITE` `RESET_SIGNIN_COOKIES` `SECURITY_KEY_REGISTERED_FOR_USER` `REVOKE_SECURITY_KEY` `USER_INVITE` `VIEW_TEMP_PASSWORD` `TURN_OFF_2_STEP_VERIFICATION` `UNBLOCK_USER_SESSION` `UPDATE_PROFILE_PHOTO` `UNENROLL_USER_FROM_TITANIUM` `ARCHIVE_USER` `UPDATE_BIRTHDATE` `CREATE_USER` `DELETE_USER` `DOWNGRADE_USER_FROM_GPLUS` `USER_ENROLLED_IN_TWO_STEP_VERIFICATION` `MOVE_USER_TO_ORG_UNIT` `USER_PUT_IN_TWO_STEP_VERIFICATION_GRACE_PERIOD` `RENAME_USER` `UNENROLL_USER_FROM_STRONG_AUTH` `SUSPEND_USER` `UNARCHIVE_USER` `UNDELETE_USER` `UNSUSPEND_USER` `UPGRADE_USER_TO_GPLUS` `USERS_BULK_UPLOAD_NOTIFICATION_SENT` `ASSIGN_ROLE` `USER_LICENSE_ASSIGNMENT` `USER_LICENSE_REVOKE` `ADD_GROUP_MEMBER` `REMOVE_GROUP_MEMBER` `UNASSIGN_ROLE` `ACTION_REQUESTED`
`admin`	`DESTINATION_USER_EMAIL`	`target.user.email_addresses`
`admin`	`DEVICE_ID`	`target.asset.asset_id`	If the `event.name` log field value is equal to one of the following values, then the `DEVICE_ID` log field is mapped to the `target.asset.asset_id` UDM field: `REVOKE_3LO_DEVICE_TOKENS` `ACTION_REQUESTED`
`admin`	`DEVICE_TYPE`	`target.platform`	If the `DEVICE_TYPE` log field value matches the regular expression pattern `(?i)windows`, then the `target.platform` UDM field is set to `WINDOWS`. Else, if the `DEVICE_TYPE` log field value matches the regular expression pattern `(?i)mac`, then the `target.platform` UDM field is set to `MAC`. Else, if the `DEVICE_TYPE` log field value matches the regular expression pattern `(?i)linux`, then the `target.platform` UDM field is set to `LINUX`. Else, if the `DEVICE_TYPE` log field value matches the regular expression pattern `(?i)ios`, then the `target.platform` UDM field is set to `IOS`. Else, if the `DEVICE_TYPE` log field value matches the regular expression pattern `(?i)android`, then the `target.platform` UDM field is set to `ANDROID`. Else, if the `DEVICE_TYPE` log field value matches the regular expression pattern `(?i)chrome`, then the `target.platform` UDM field is set to `CHROME_OS`.
`admin`	`APP_ID`	`target.resource.name`	If the `event.name` log field value is equal to one of the following values, then the `APP_ID` log field is mapped to the `target.resource.name` UDM field: `REVOKE_3LO_TOKEN` `REMOVE_APPLICATION` `ADD_APPLICATION`
`admin`	`NEW_VALUE`	`target.resource.name`	If the `event.name` log field value is equal to `MAIL_ROUTING_DESTINATION_ADDED`, then the `NEW_VALUE` log field is mapped to the `target.resource.name` UDM field.
`admin`	`SETTING_NAME`	`target.resource.name`	If the `event.name` log field value is equal to one of the following values, then the `SETTING_NAME` log field is mapped to the `target.resource.name` UDM field: `CHANGE_GROUP_SETTING` `CHANGE_EMAIL_SETTING` `CREATE_APPLICATION_SETTING` `CHANGE_APPLICATION_SETTING` `CHANGE_DOCS_SETTING` `ENFORCE_STRONG_AUTHENTICATION` `CHANGE_GMAIL_SETTING` `DELETE_GMAIL_SETTING` `CREATE_GMAIL_SETTING`
`admin`	`CERTIFICATE_NAME`	`target.resource.name`	If the `event.name` log field value is equal to `GENERATE_CERTIFICATE`, then the `CERTIFICATE_NAME` log field is mapped to the `target.resource.name` UDM field.
`admin`	`ACCESS_LEVEL_NAME`	`target.resource.name`	If the `event.name` log field value is equal to `UPDATE_ACCESS_LEVEL_V2`, then the `ACCESS_LEVEL_NAME` log field is mapped to the `target.resource.name` UDM field.
`admin`	`ASP_ID`	`target.labels [asp_id]` (deprecated)
`admin`	`ASP_ID`	`additional.fields [asp_id]`
`admin`	`NEW_VALUE`	`target.resource.attribute.labels [new_value]`	If the `event.name` log field value is equal to one of the following values, then the `NEW_VALUE` log field is mapped to the `target.resource.attribute.labels` UDM field: `CHANGE_MOBILE_APPLICATION_SETTINGS` `CREATE_APPLICATION_SETTING` `CHANGE_APPLICATION_SETTING` `CHANGE_DOCS_SETTING` `CHANGE_CALENDAR_SETTING`
`admin`	`NEW_VALUE`	`target.labels [new_value]` (deprecated)	If the `event.name` log field value is equal to one of the following values, then the `NEW_VALUE` log field is mapped to the `target.labels` UDM field: `CHANGE_DOMAIN_DEFAULT_TIMEZONE` `CHANGE_DOMAIN_DEFAULT_LOCALE` `TOGGLE_SERVICE_ENABLED` `MOVE_ORG_UNIT` `EDIT_ORG_UNIT_NAME` `ALLOW_STRONG_AUTHENTICATION` `CHANGE_TWO_STEP_VERIFICATION_FREQUENCY` `CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION` `CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION` `CHANGE_TWO_STEP_VERIFICATION_START_DATE` `WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED` `ENFORCE_STRONG_AUTHENTICATION`
`admin`	`NEW_VALUE`	`additional.fields [new_value]`	If the `event.name` log field value is equal to one of the following values, then the `NEW_VALUE` log field is mapped to the `additional.fields` UDM field: `CHANGE_DOMAIN_DEFAULT_TIMEZONE` `CHANGE_DOMAIN_DEFAULT_LOCALE` `TOGGLE_SERVICE_ENABLED` `MOVE_ORG_UNIT` `EDIT_ORG_UNIT_NAME` `ALLOW_STRONG_AUTHENTICATION` `CHANGE_TWO_STEP_VERIFICATION_FREQUENCY` `CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION` `CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION` `CHANGE_TWO_STEP_VERIFICATION_START_DATE` `WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED` `ENFORCE_STRONG_AUTHENTICATION`
`admin`	`NEW_VALUE`	`target.user.attribute.labels [new_value]`
`admin`	`NEW_VALUE`	`target.user.user_display_name`	If the `event.name` log field value is equal to one of the following values, then the `NEW_VALUE` log field is mapped to the `target.user.user_display_name` UDM field: `CHANGE_DISPLAY_NAME` `RENAME_USER`
`admin`	`NEW_VALUE`	`target.user.first_name`	If the `event.name` log field value is equal to `CHANGE_FIRST_NAME`, then the `NEW_VALUE` log field is mapped to the `target.user.first_name` UDM field.
`admin`	`NEW_VALUE`	`target.user.last_name`	If the `event.name` log field value is equal to `CHANGE_LAST_NAME`, then the `NEW_VALUE` log field is mapped to the `target.user.last_name` UDM field.
`admin`	`OLD_VALUE`	`target.resource.attribute.labels [old_value]`	If the `event.name` log field value is equal to one of the following values, then the `OLD_VALUE` log field is mapped to the `target.resource.attribute.labels` UDM field: `CHANGE_MOBILE_APPLICATION_SETTINGS` `CREATE_APPLICATION_SETTING` `CHANGE_APPLICATION_SETTING` `CHANGE_DOCS_SETTING` `CHANGE_CALENDAR_SETTING`
`admin`	`OLD_VALUE`	`target.labels [old_value]` (deprecated)	If the `event.name` log field value is equal to one of the following values, then the `OLD_VALUE` log field is mapped to the `target.labels` UDM field: `CHANGE_DOMAIN_DEFAULT_TIMEZONE` `CHANGE_DOMAIN_DEFAULT_LOCALE` `TOGGLE_SERVICE_ENABLED` `MOVE_ORG_UNIT` `EDIT_ORG_UNIT_NAME` `ALLOW_STRONG_AUTHENTICATION` `CHANGE_TWO_STEP_VERIFICATION_FREQUENCY` `CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION` `CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION` `CHANGE_TWO_STEP_VERIFICATION_START_DATE` `WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED` `ENFORCE_STRONG_AUTHENTICATION`
`admin`	`OLD_VALUE`	`additional.fields [old_value]`	If the `event.name` log field value is equal to one of the following values, then the `OLD_VALUE` log field is mapped to the `additional.fields` UDM field: `CHANGE_DOMAIN_DEFAULT_TIMEZONE` `CHANGE_DOMAIN_DEFAULT_LOCALE` `TOGGLE_SERVICE_ENABLED` `MOVE_ORG_UNIT` `EDIT_ORG_UNIT_NAME` `ALLOW_STRONG_AUTHENTICATION` `CHANGE_TWO_STEP_VERIFICATION_FREQUENCY` `CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION` `CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION` `CHANGE_TWO_STEP_VERIFICATION_START_DATE` `WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED` `ENFORCE_STRONG_AUTHENTICATION`
`admin`	`OLD_VALUE`	`target.user.attribute.labels [old_value]`
`admin`	`BULK_UPLOAD_FAIL_USERS_NUMBER`	`target.user.attribute.labels [bulk_upload_fail_users_number]`
`admin`	`BULK_UPLOAD_TOTAL_USERS_NUMBER`	`target.user.attribute.labels [bulk_upload_total_users_number]`
`admin`	`SYSTEM_DEFINED_RULE_NAME`	`security_result.rule_name`	If the `event.name` log field value is equal to `SYSTEM_DEFINED_RULE_UPDATED`, then the `SYSTEM_DEFINED_RULE_NAME` log field is mapped to the `security_result.rule_name` UDM field.
`admin`	`ALERT_NAME`	`security_result.rule_name`
`admin`	`SECURITY_CENTER_RULE_NAME`	`security_result.rule_name`
`admin`	`DOMAIN_NAME`	`target.domain.name`
`admin`	`USER_CUSTOM_FIELD`	`target.user.attribute.labels [user_custom_field]`
`admin`	`BEGIN_DATE_TIME`	`target.resource.attribute.labels [begin_date_time]`
`admin`	`EMAIL_MONITOR_DEST_EMAIL`	`target.resource.attribute.labels [email_monitor_dest_email]`
`admin`	`EMAIL_MONITOR_LEVEL_CHAT`	`target.resource.attribute.labels [email_monitor_level_chat]`
`admin`	`EMAIL_MONITOR_LEVEL_DRAFT_EMAIL`	`target.resource.attribute.labels [email_monitor_level_draft_email]`
`admin`	`EMAIL_MONITOR_LEVEL_INCOMING_EMAIL`	`target.resource.attribute.labels [email_monitor_level_incoming_email]`
`admin`	`EMAIL_MONITOR_LEVEL_OUTGOING_EMAIL`	`target.resource.attribute.labels [email_monitor_level_outgoing_email]`
`admin`	`END_DATE_TIME`	`target.resource.attribute.labels [end_date_time]`
`admin`	`APPLICATION_NAME`	`target.application`	If the `event.name` log field value is equal to one of the following values, then the `APPLICATION_NAME` log field is mapped to the `target.application` UDM field: `CREATE_EMAIL_MONITOR` `DELETE_EMAIL_MONITOR` `REMOVE_APPLICATION` `ADD_APPLICATION` `CREATE_APPLICATION_SETTING`
`admin`	`SERVICE_NAME`	`target.application`	If the `event.name` log field value is equal to `TOGGLE_SERVICE_ENABLED`, then the `SERVICE_NAME` log field is mapped to the `target.application` UDM field.
`admin`	`REAUTH_APPLICATION`	`target.application`	If the `event.name` log field value is equal to `SESSION_CONTROL_SETTINGS_CHANGE`, then the `REAUTH_APPLICATION` log field is mapped to the `target.application` UDM field.
`admin`	`OAUTH2_SERVICE_NAME`	`target.application`	If the `event.name` log field value is equal to `DISALLOW_SERVICE_FOR_OAUTH2_ACCESS`, then the `OAUTH2_SERVICE_NAME` log field is mapped to the `target.application` UDM field.
`admin`	`OAUTH2_APP_NAME`	`target.application`	If the `event.name` log field value is equal to one of the following values, then the `OAUTH2_APP_NAME` log field is mapped to the `target.application` UDM field: `ADD_TO_TRUSTED_OAUTH2_APPS` `ADD_TO_BLOCKED_OAUTH2_APPS`
`admin`	`REQUEST_ID`	`target.labels [request_id]` (deprecated)
`admin`	`REQUEST_ID`	`additional.fields [request_id]`
`admin`	`GMAIL_RESET_REASON`	`security_result.summary`
`admin`	`USER_NICKNAME`	`target.user.attribute.labels[nickname]`
`admin`	`EMAIL_EXPORT_INCLUDE_DELETED`	`target.resource.attribute.labels [email_export_include_deleted]`
`admin`	`EMAIL_EXPORT_PACKAGE_CONTENT`	`target.resource.attribute.labels [email_export_package_content]`
`admin`	`SEARCH_QUERY_FOR_DUMP`	`target.resource.attribute.labels [search_query_for_dump]`
`admin`	`BIRTHDATE`	`target.user.attribute.labels [birthdate]`
`admin`	`ORG_UNIT_NAME`	`target.labels[org_unit_name]` (deprecated)	If the `event.name` log field value is equal to one of the following values, then the `ORG_UNIT_NAME` log field is mapped to the `target.labels` UDM field: `TOGGLE_SERVICE_ENABLED` `CREATE_ORG_UNIT` `MOVE_ORG_UNIT` `EDIT_ORG_UNIT_NAME` `REMOVE_ORG_UNIT` `UNASSIGN_CUSTOM_LOGO` `ASSIGN_CUSTOM_LOGO` `EDIT_ORG_UNIT_DESCRIPTION` `CHANGE_TWO_STEP_VERIFICATION_FREQUENCY` `CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION` `CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION` `CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS` `CHANGE_TWO_STEP_VERIFICATION_START_DATE` `WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED`
`admin`	`ORG_UNIT_NAME`	`additional.fields[org_unit_name]`	If the `event.name` log field value is equal to one of the following values, then the `ORG_UNIT_NAME` log field is mapped to the `additional.fields` UDM field: `TOGGLE_SERVICE_ENABLED` `CREATE_ORG_UNIT` `MOVE_ORG_UNIT` `EDIT_ORG_UNIT_NAME` `REMOVE_ORG_UNIT` `UNASSIGN_CUSTOM_LOGO` `ASSIGN_CUSTOM_LOGO` `EDIT_ORG_UNIT_DESCRIPTION` `CHANGE_TWO_STEP_VERIFICATION_FREQUENCY` `CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION` `CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION` `CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS` `CHANGE_TWO_STEP_VERIFICATION_START_DATE` `WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED`
`admin`	`ORG_UNIT_NAME`	`about.labels[org_unit_name]` (deprecated)
`admin`	`ORG_UNIT_NAME`	`additional.fields[org_unit_name]`
`admin`	`ROLE_ID`	`target.resource.attribute.labels[role_id]`
`admin`	`ROLE_NAME`	`target.resource.attribute.roles.name`
`admin`	`API_SCOPES`	`target.user.attribute.labels[api_scopes]`
`admin`	`API_CLIENT_NAME`	`target.user.userid`	If the `API_CLIENT_NAME` log field value matches the regular expression `^(.){1,256}$`, then the `API_CLIENT_NAME` log field is mapped to the `target.user.userid` UDM field.
`admin`	`API_CLIENT_NAME`	`target.user.attribute.labels[api_client_name]`	If the `API_CLIENT_NAME` log field value doesn't match the regular expression `^(.){1,256}$`, then the `API_CLIENT_NAME` log field is mapped to the `target.user.attribute.labels[api_client_name]` UDM field.
`admin`	`EMAIL_LOG_SEARCH_END_DATE`	`about.labels[email_log_search_end_date]` (deprecated)
`admin`	`EMAIL_LOG_SEARCH_END_DATE`	`additional.fields[email_log_search_end_date]`
`admin`	`EMAIL_LOG_SEARCH_MSG_ID`	`network.email.mail_id`
`admin`	`EMAIL_LOG_SEARCH_RECIPIENT`	`network.email.to`
`admin`	`EMAIL_LOG_SEARCH_SENDER`	`network.email.from`
`admin`	`EMAIL_LOG_SEARCH_SMTP_RECIPIENT_IP`	`about.labels[email_log_search_smtp_recipient_ip]` (deprecated)
`admin`	`EMAIL_LOG_SEARCH_SMTP_RECIPIENT_IP`	`additional.fields[email_log_search_smtp_recipient_ip]`
`admin`	`EMAIL_LOG_SEARCH_SMTP_SENDER_IP`	`about.labels[email_log_search_smtp_sender_ip]` (deprecated)
`admin`	`EMAIL_LOG_SEARCH_SMTP_SENDER_IP`	`additional.fields[email_log_search_smtp_sender_ip]`
`admin`	`EMAIL_LOG_SEARCH_START_DATE`	`about.labels[email_log_search_start_date]` (deprecated)
`admin`	`EMAIL_LOG_SEARCH_START_DATE`	`additional.fields[email_log_search_start_date]`
`admin`	`ALERT_ID`	`security_result.detection_fields[alert_id]`
`admin`	`INVESTIGATION_DATA_SOURCE`	`security_result.detection_fields[investigation_data_source]`
`admin`	`INVESTIGATION_QUERY`	`security_result.detection_fields[investigation_query]`
`admin`	`GROUP_EMAIL`	`target.group.email_addresses`
`admin`	`PRODUCT_NAME`	`target.resource.attribute.labels[product_name]`
`admin`	`INVESTIGATION_ACTION`	`security_result.detection_fields[investigation_action]`
`admin`	`INVESTIGATION_ENTITY_IDS`	`security_result.detection_fields[investigation_entity_ids]`
`admin`	`INVESTIGATION_OBJECT_IDENTIFIER`	`security_result.detection_fields[investigation_object_identifier]`
`admin`	`INVESTIGATION_URL_DISPLAY_TEXT`	`security_result.detection_fields[investigation_display_text]`
`admin`	`CHART_NAME`	`about.labels [chart_name]` (deprecated)
`admin`	`CHART_NAME`	`additional.fields [chart_name]`
`admin`	`CHART_FILTERS`	`about.labels [chart_filters]` (deprecated)
`admin`	`CHART_FILTERS`	`additional.fields [chart_filters]`
`admin`	`START_DATE`	`about.labels [start_date]` (deprecated)
`admin`	`START_DATE`	`additional.fields [start_date]`
`admin`	`END_DATE`	`about.labels [end_date]` (deprecated)
`admin`	`END_DATE`	`additional.fields [end_date]`
`admin`		`target.resource.resource_type`	If the `event.name` log field value is not equal to one of the following values, then the `target.resource.resource_type` UDM field is set to `SETTING`: `EMAIL_LOG_SEARCH` `ALERT_CENTER_LIST_FEEDBACK` `ALERT_CENTER_GET_SIT_LINK` `ALERT_CENTER_LIST_RELATED_ALERTS` `ALERT_CENTER_LIST_CHANGE` `SECURITY_INVESTIGATION_QUERY` `SECURITY_INVESTIGATION_ACTION` `SECURITY_INVESTIGATION_OBJECT_CREATE_DRAFT_INVESTIGATION` `SECURITY_CHART_DRILLDOWN` `CHANGE_DEVICE_STATE` `SECURITY_INVESTIGATION_ACTION_COMPLETION` If the `event.name` log field value is equal to `GENERATE_CERTIFICATE`, then the `target.resource.resource_type` UDM field is set to `CREDENTIAL`.
`admin`	`SYSTEM_DEFINED_RULE_ACTION_STATUS_CHANGE`	`security_result.rule_labels[system_defined_rule_action_status_change]`
`admin`	`SYSTEM_DEFINED_RULE_ACTION_SEVERITY_CHANGE`	`security_result.rule_labels[system_defined_rule_action_severity_change]`
`admin`	`SYSTEM_DEFINED_RULE_ACTION_RECEIVERS_CHANGE`	`security_result.rule_labels[system_defined_rule_action_receivers_change]`
`admin`	`COMPANY_DEVICE_ID`	`target.asset_id`
`admin`	`APPLICATION_ENABLED`	`target.labels[application_enabled]` (deprecated)
`admin`	`APPLICATION_ENABLED`	`additional.fields[application_enabled]`
`admin`	`DISTRIBUTION_ENTITY_NAME`	`target.labels[distribution_entity_name]` (deprecated)
`admin`	`DISTRIBUTION_ENTITY_NAME`	`additional.fields[distribution_entity_name]`
`admin`	`DISTRIBUTION_ENTITY_TYPE`	`target.labels[distribution_entity_type]` (deprecated)
`admin`	`DISTRIBUTION_ENTITY_TYPE`	`additional.fields[distribution_entity_type]`
`admin`	`MOBILE_APP_PACKAGE_ID`	`target.labels[mobile_app_package_id]` (deprecated)
`admin`	`MOBILE_APP_PACKAGE_ID`	`additional.fields[mobile_app_package_id]`
`admin`	`APPLICATION_EDITION`	`target.labels[application_edition]` (deprecated)
`admin`	`APPLICATION_EDITION`	`additional.fields[application_edition]`
`admin`	`REAUTH_SETTING_NEW`	`target.labels[reauth_setting_new]` (deprecated)
`admin`	`REAUTH_SETTING_NEW`	`additional.fields[reauth_setting_new]`
`admin`	`REAUTH_SETTING_OLD`	`target.labels[reauth_setting_old]` (deprecated)
`admin`	`REAUTH_SETTING_OLD`	`additional.fields[reauth_setting_old]`
`admin`	`ALLOWED_TWO_STEP_VERIFICATION_METHOD`	`target.labels[allowed_2sv_method]` (deprecated)
`admin`	`ALLOWED_TWO_STEP_VERIFICATION_METHOD`	`additional.fields[allowed_2sv_method]`
`admin`	`CERTIFICATE_TYPE`	`target.resource.resource_subtype`
`admin`	`SAML2_SERVICE_PROVIDER_ENTITY_ID`	`about.labels[saml2_service_provider_entity_id]` (deprecated)
`admin`	`SAML2_SERVICE_PROVIDER_ENTITY_ID`	`additional.fields[saml2_service_provider_entity_id]`
`admin`	`SAML2_SERVICE_PROVIDER_NAME`	`about.labels[saml2_service_provider_name]` (deprecated)
`admin`	`SAML2_SERVICE_PROVIDER_NAME`	`additional.fields[saml2_service_provider_name]`
`admin`	`SERVICE_ACCOUNT_EMAIL`	`about.user.email_addresses`
`admin`		`about.user.account_type`	If the `event.name` log field value is equal to `ENABLE_DIRECTORY_SYNC` and the `SERVICE_ACCOUNT_EMAIL` log field value is not empty, then the `about.user.account_type` UDM field is set to `SERVICE_ACCOUNT_TYPE`.
`admin`	`DEVICE_NEW_STATE`	`target.asset.attribute.labels[device_new_state]`
`admin`	`DEVICE_PREVIOUS_STATE`	`target.asset.attribute.labels[device_previous_state]`
`admin`	`DEVICE_SERIAL_NUMBER`	`target.asset.hardware.serial_number`
`admin`	`INVESTIGATION_ACTION_NUM_ATTEMPTED`	`security_result.detection_fields[investigation_action_num_attempt]`
`admin`	`INVESTIGATION_ACTION_NUM_SUCCESS`	`security_result.detection_fields[investigation_action_num_success]`
`admin`	`INVESTIGATION_ACTION_NUM_FAILED`	`security_result.detection_fields[investigation_action_num_failed]`
`admin`	`INVESTIGATION_ACTION_IDENTIFIER`	`security_result.detection_fields[investigation_action_identifier]`
`admin`	`INVESTIGATION_ACTION_ID`	`security_result.detection_fields[investigation_action_id]`
`admin`	`SETTING_DESCRIPTION`	`target.resource.attribute.labels[setting_description]`
`admin`	`USER_DEFINED_SETTING_NAME`	`target.resource.attribute.labels[user_defined_setting_name]`
`admin`	`ACTION_TYPE`	`security_result.action_details`
`admin`		`security_result.action`	If the `ACTION_TYPE` log field value is equal to `BLOCK`, then the `security_result.action` UDM field is set to `BLOCK`. Else, the `security_result.action` UDM field is set to `ALLOW`.
`admin`	`ACTION_ID`	`security_result.detection_fields[action_id]`
`admin`	`OAUTH2_APP_ID`	`additional.fields [oauth2_app_id]`
`admin`	`OAUTH2_APP_TYPE`	`additional.fields [oauth2_app_type]`
`admin`	`ACCESS_LEVEL_TITLE`	`target.resource.attribute.labels [access_level_title]`
`admin`	`ACCESS_LEVEL_CURR_STATE`	`target.resource.attribute.labels [access_level_curr_state]`
`admin`	`ACCESS_LEVEL_PREV_STATE`	`target.resource.attribute.labels [access_level_prev_state]`
`admin`	`AUTH_PRINCIPLE_EMAIL`	`principal.user.email_addresses`	If the `actor.email` log field value is not equal to the `AUTH_PRINCIPLE_EMAIL`, then the `AUTH_PRINCIPLE_EMAIL` log field is mapped to the `principal.user.email_addresses` UDM field.
`admin`	`INVESTIGATION_ADMIN_EMAIL`	`principal.user.email_addresses`	If the `actor.email` log field value is not equal to the `INVESTIGATION_ADMIN_EMAIL`, then the `INVESTIGATION_ADMIN_EMAIL` log field is mapped to the `principal.user.email_addresses` UDM field.
`admin`		`target.resource.resource_type`	If the `event.name` log field value is equal to `UPDATE_ACCESS_LEVEL_V2`, then the `target.resource.resource_type` UDM field is set to `ACCESS_POLICY`.
`admin`	APP_RESOURCE_ID	`additional.fields [app_resource_id]`
`admin`	SECURITY_CENTER_RULE_TRIGGER_WINDOW	`security_result.rule_labels[security_center_rule_trigger_window]`
`admin`	SECURITY_CENTER_RULE_CONDITION	`security_result.rule_labels[security_center_rule_condition]`
`admin`	SECURITY_CENTER_RULE_THRESHOLD	`security_result.rule_labels[security_center_rule_threshold]`
`admin`	SECURITY_CENTER_RULE_TIME_FRAME	`security_result.rule_labels[security_center_rule_time_frame]`
`admin`	SECURITY_CENTER_RULE_ACTION	`security_result.rule_labels[security_center_rule_action]`
`admin`	QUARANTINE_NAME	`additional.fields[quarantine_name]`
`jamboard`	`CURRENT_JAMBOARD_NAME`	`target.asset.attribute.labels [current_jamboard_name]`	If the `event.name` log field value is equal to one of the following values, then the `CURRENT_JAMBOARD_NAME` log field is mapped to the `target.asset.attribute.labels` UDM field: `DEVICE_LICENSE_ENROLLMENT_CHANGE` `DEVICE_OTA_UPDATE_REQUESTED` `DEVICE_PROVISIONING_CHANGE` `DEVICE_REBOOT_REQUESTED` `ADB_ENABLED_STATE_CHANGE` `DEVICE_ADDITIONAL_IMES_CHANGE` `DEVICE_LOGGING_CHANGE` `DEMO_MODE_AVAILABILITY_CHANGE` `DEMO_MODE_CHANGE` `FINGER_ERASING_CHANGE` `DEVICE_LANGUAGE_CHANGE` `DEVICE_LOCATION_CHANGE` `DEVICE_NAME_CHANGE` `DEVICE_NOTE_CHANGE` `DEVICE_PAIRING_CHANGE` `SCREENSAVER_TIMEOUT_CHANGE` `DEVICE_SETTING_LOCKED` `DEVICE_SETTING_UNLOCKED` `VIDEOCONF_ENABLED_CHANGE` `DEVICE_UPDATE`
`jamboard`	`JAMBOARD_ID`	`target.asset.asset_id`
`jamboard`	`LICENSE_ENROLLMENT_STATE`	`target.asset.attribute.labels [license_enrollment_state]`
`jamboard`	`PROVISION_STATE`	`target.asset.attribute.labels [provision_state]`
`jamboard`	`ON_OFF`	`target.asset.attribute.labels [on_off]`
`jamboard`	`NEW_ADDITIONAL_IMES`	`target.asset.attribute.labels [new_additional_imes]`
`jamboard`	`OLD_ADDITIONAL_IMES`	`target.asset.attribute.labels [old_additional_imes]`
`jamboard`	`NEW_DEMO_MODE_AVAILABILITY`	`target.asset.attribute.labels [new_demo_mode_availability]`
`jamboard`	`OLD_DEMO_MODE_AVAILABILITY`	`target.asset.attribute.labels [old_demo_mode_availability]`
`jamboard`	`NEW_LANGUAGE`	`target.asset.attribute.labels [new_language]`
`jamboard`	`OLD_LANGUAGE`	`target.asset.attribute.labels [old_language]`
`jamboard`	`NEW_LOCATION`	`target.asset.location.name`	If the `event.name` log field value is equal to `DEVICE_LOCATION_CHANGE`, then the `NEW_LOCATION` log field is mapped to the `target.asset.location.name` UDM field.
`jamboard`	`OLD_LOCATION`	`target.asset.attribute.labels [old_location]`
`jamboard`	`OLD_JAMBOARD_NAME`	`target.asset.attribute.labels [old_jamboard_name]`
`jamboard`	`NEW_NOTE`	`target.resource.attribute.labels [new_note]`
`jamboard`	`OLD_NOTE`	`target.resource.attribute.labels [old_note]`
`jamboard`	`DEVICE_TYPE`	`target.asset.attribute.labels [device_type]`
`jamboard`	`NEW_DEVICE`	`target.asset.attribute.labels [new_device]`
`jamboard`	`OLD_DEVICE`	`target.asset.attribute.labels [old_device]`
`jamboard`	`NEW_TIMEOUT_VALUE`	`target.asset.attribute.labels [new_timeout_value]`
`jamboard`	`OLD_TIMEOUT_VALUE`	`target.asset.attribute.labels [old_timeout_value]`
`jamboard`	`JAMBOARD_SETTING`	`target.asset.attribute.labels [jamboard_setting]`
`jamboard`	`COMPONENT`	`target.asset.attribute.labels [component]`
`jamboard`	`NEW_VERSION`	`target.asset.software.version`	If the `event.name` log field value is equal to `DEVICE_UPDATE`, then the `NEW_VERSION` log field is mapped to the `target.asset.software.version` UDM field.
`jamboard`	`OLD_VERSION`	`target.asset.attribute.labels [old_version]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.value[description]`	`metadata.description`
`gmail`	`events.parameters[delivery].msgValue[event_info].parameter.intValue[timestamp_usec]`	`metadata.event_timestamp`
`gmail`	`events.parameters[delivery].msgValue[event_info].parameter.intValue[mail_event_type]`	`metadata.product_event_type`
`gmail`	`id.applicationName`	`metadata.product_name`
`gmail`		`metadata.vendor_name`	The `metadata.vendor_name` UDM field is set to `Google Workspace`.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.value[rfc2822_message_id]`	`network.email.mail_id`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.value[subject]`	`network.email.subject`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.intValue[payload_size]`	`network.sent_bytes`
`gmail`	`events.parameters[delivery].msgValue[event_info].parameter.intValue[elapsed_time_usec]`	`network.session_duration`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_tls_state]`	`network.smtp.is_tls`	If this log field value is equal to `0`, then the `network.smtp.is_tls` UDM field is set to `false`. Else, if this log field value is equal to `1`, then the `network.smtp.is_tls` UDM field is set to `true`.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.value[address]`	`network.smtp.rcpt_to`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_response_reason]`	`network.smtp.server_response`	If this log field value is equal to `1`, then the `network.smtp.server_response` UDM field is set to `events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]` - `Default reason messages are rejected or accepted`. Else, if this log field value is equal to `3`, then the `network.smtp.server_response` UDM field is set to `events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]` - `Malware`. Else, if this log field value is equal to `4`, then the `network.smtp.server_response` UDM field is set to `events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]` - `DMARC policy`. Else, if this log field value is equal to `5`, then the `network.smtp.server_response` UDM field is set to `events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]` - `Unsupported attachment (by Gmail)`. Else, if this log field value is equal to `6`, then the `network.smtp.server_response` UDM field is set to `events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]` - `Receive limit exceeded`. Else, if this log field value is equal to `7`, then the `network.smtp.server_response` UDM field is set to `events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]` - `Account over quota`. Else, if this log field value is equal to `8`, then the `network.smtp.server_response` UDM field is set to `events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]` - `Bad PTR record`. Else, if this log field value is equal to `9`, then the `network.smtp.server_response` UDM field is set to `events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]` - `Recipient doesn't exist`. Else, if this log field value is equal to `10`, then the `network.smtp.server_response` UDM field is set to `events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]` - `Customer policy`. Else, if this log field value is equal to `12`, then the `network.smtp.server_response` UDM field is set to `events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]` - `RFC violation`. Else, if this log field value is equal to `13`, then the `network.smtp.server_response` UDM field is set to `events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]` - `Blatant spam`. Else, if this log field value is equal to `14`, then the `network.smtp.server_response` UDM field is set to `events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]` - `Denial of service`. Else, if this log field value is equal to `15`, then the `network.smtp.server_response` UDM field is set to `events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]` - `Malicious or spammy links`. Else, if this log field value is equal to `16`, then the `network.smtp.server_response` UDM field is set to `events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]` - `Low IP reputation`. Else, if this log field value is equal to `17`, then the `network.smtp.server_response` UDM field is set to `events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]` - `Low domain reputation`. Else, if this log field value is equal to `18`, then the `network.smtp.server_response` UDM field is set to `events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]` - `IP listed in public Real-time Blackhole List (RBL)`. Else, if this log field value is equal to `19`, then the `network.smtp.server_response` UDM field is set to `events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]` - `Temporarily rejected due to DoS limits`. Else, if this log field value is equal to `20`, then the `network.smtp.server_response` UDM field is set to `events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.intValue[smtp_reply_code]` - `Permanently rejected due to DoS limits`.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[smtp_tls_cipher]`	`network.tls.cipher`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[smtp_tls_version]`	`network.tls.version`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[client_host_zone]`	`principal.administrative_domain`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[source].parameter.value[service]`	`principal.application`
`gmail`	`events.parameters[delivery].msgValue[message_owner].parameter.value[customer_domain]`	`principal.domain.name`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[client_ip]`	`principal.ip`
`gmail`	`actor.gaiaId`	`principal.labels[actor_gaiaid]` (deprecated)
`gmail`	`actor.gaiaId`	`additional.fields[actor_gaiaid]`
`gmail`	`actor.orgunitPath`	`principal.labels[actor_orgunitpath]` (deprecated)
`gmail`	`actor.orgunitPath`	`additional.fields[actor_orgunitpath]`
`gmail`	`events.parameters[delivery].msgValue[message_owner].parameter.multiIntValue[gaia_ids]`	`principal.labels[message_owner_gaia_id]` (deprecated)
`gmail`	`events.parameters[delivery].msgValue[message_owner].parameter.multiIntValue[gaia_ids]`	`additional.fields[message_owner_gaia_id]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[source].parameter.value[selector]`	`principal.labels[source_selector]` (deprecated)
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[source].parameter.value[selector]`	`additional.fields[source_selector]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[source].parameter.value[from_header_address],events.parameters[delivery].msgValue[message_owner].parameter.multiStrValue[addresses]`	`principal.user.email_addresses`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[source].parameter.value[address]`	`principal.user.email_addresses`
`gmail`	`events.parameters[delivery].msgValue[message_owner].parameter.multiStrValue[addresses]`	`principal.user.email_addresses`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[source].parameter.value[from_header_displayname]`	`principal.user.user_display_name`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[source].parameter.intValue[user_id]`	`principal.user.userid`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.value[flattened_destinations]`	`target.labels[flattened_destinations]` (deprecated)
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.value[flattened_destinations]`	`additional.fields[flattened_destinations]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.value[service]`	`target.application`	This log field is mapped to `target.application` UDM field when index value in `events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination]` is equal to `0`. For every other index value, this log field is mapped to the `about.application`.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.intValue[rcpt_response]`	`target.labels[destination_rcpt_response]` (deprecated)	This log field is mapped to `target.labels.value` UDM field and `target.labels.key` is set to `destination_rcpt_response`, when index value in `events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination]` is equal to `0`. For every other index value, this log field is mapped to `about.labels.value` UDM field and `about.labels.key` is set to `destination_rcpt_response`.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.intValue[rcpt_response]`	`additional.fields[destination_rcpt_response]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.value[selector]`	`target.labels[destination_selector]` (deprecated)	This log field is mapped to `target.labels.value` UDM field and `target.labels.key` is set to `destination_selector`, when index value in `events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination]` is equal to `0`. For every other index value, this log field is mapped to `about.labels.value` UDM field and `about.labels.key` is set to `destination_selector`.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.value[selector]`	`additional.fields[destination_selector]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.boolValue[smime_decryption_success]`	`target.labels[destination_smime_decryption_success]` (deprecated)	This log field is mapped to `target.labels.value` UDM field and `target.labels.key` is set to `destination_smime_decryption_success`, when index value in `events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination]` is equal to `0`. For every other index value, this log field is mapped to `about.labels.value` UDM field and `about.labels.key` is set to `destination_smime_decryption_success`.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.boolValue[smime_decryption_success]`	`additional.fields[destination_smime_decryption_success]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.boolValue[smime_extraction_success]`	`target.labels[destination_smime_extraction_success]` (deprecated)	This log field is mapped to `target.labels.value` UDM field and `target.labels.key` is set to `destination_smime_extraction_success`, when index value in `events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination]` is equal to `0`. For every other index value, this log field is mapped to `about.labels.value` UDM field and `about.labels.key` is set to `destination_smime_extraction_success`.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.boolValue[smime_extraction_success]`	`additional.fields[destination_smime_extraction_success]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.boolValue[smime_parsing_success]`	`target.labels[destination_smime_parsing_success]` (deprecated)	This log field is mapped to `target.labels.value` UDM field and `target.labels.key` is set to `destination_smime_parsing_success`, when index value in `events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination]` is equal to `0`. For every other index value, this log field is mapped to `about.labels.value` UDM field and `about.labels.key` is set to `destination_smime_parsing_success`.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.boolValue[smime_parsing_success]`	`additional.fields[destination_smime_parsing_success]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.boolValue[smime_signature_verification_success]`	`target.labels[destination_smime_signature_verification_success]` (deprecated)	This log field is mapped to `target.labels.value` UDM field and `target.labels.key` is set to `destination_smime_signature_verification_success`, when index value in `events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination]` is equal to `0`. For every other index value, this log field is mapped to `about.labels.value` UDM field and `about.labels.key` is set to `destination_smime_signature_verification_success`.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.boolValue[smime_signature_verification_success]`	`additional.fields[destination_smime_signature_verification_success]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.value[address]`	`target.user.email_addresses`	This log field is mapped to `target.user.email_addresses` UDM field when index value in `events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination]` is equal to `0`. For every other index value, this log field is mapped to the `about.user.email_addresses`.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination].parameter.intValue[user_id]`	`target.user.userid`	This log field is mapped to `target.user.userid` UDM field when index value in `events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[destination]` is equal to `0`. For every other index value, this log field is mapped to the `about.user.userid`.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[smtp_out_remote_host]`	`intermediary.hostname`
`gmail`	`events.parameters[delivery].msgValue[server_info].parameter.value[host_name]`	`intermediary.hostname`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[failed_smtp_out_connect_ip]`	`intermediary.ip`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[smtp_in_connect_ip]`	`intermediary.ip`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[smtp_out_connect_ip]`	`intermediary.ip`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[smtp_user_agent_ip]`	`intermediary.ip`
`gmail`	`events.parameters[delivery].msgValue[server_info].parameter.value[job_name]`	`intermediary.labels[job_name]` (deprecated)
`gmail`	`events.parameters[delivery].msgValue[server_info].parameter.value[job_name]`	`additional.fields[job_name]`
`gmail`	`events.parameters[delivery].msgValue[server_info].parameter.intValue[server_type]`	`intermediary.labels[server_type]` (deprecated)
`gmail`	`events.parameters[delivery].msgValue[server_info].parameter.intValue[server_type]`	`additional.fields[server_type]`
`gmail`	`events.parameters[delivery].msgValue[server_info].parameter.value[service_pool]`	`intermediary.labels[service_pool]` (deprecated)
`gmail`	`events.parameters[delivery].msgValue[server_info].parameter.value[service_pool]`	`additional.fields[service_pool]`
`gmail`	`events.parameters[delivery].msgValue[server_info].parameter.intValue[task_number]`	`intermediary.labels[task_number]` (deprecated)
`gmail`	`events.parameters[delivery].msgValue[server_info].parameter.intValue[task_number]`	`additional.fields[task_number]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.value[policy_holder_address]`	`security_result.about.user.email_addresses`	If this log field value doesn't match the regular expression `^.+@.+$`, then it is mapped to the `security_result.about.administrative_domain` UDM field. Else, it is mapped to the `security_result.about.administrative_domain` UDM field.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[consequence].parameter.value[policy_holder_email]`	`security_result.about.user.email_addresses`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[consequence].parameter.intValue[policy_holder_user_id]`	`security_result.about.user.userid`
`gmail`		`security_result.action`	If the `events.parameters[delivery].msgValue[event_info].parameter.boolValue[success]` log field value is equal to `true`, then the `security_result.action` UDM field is set to `ALLOW`. Else, the `security_result.action` UDM field is set to `BLOCK`.
`gmail`	`events.parameters[delivery].msgValue[event_info].parameter.boolValue[success]`	`security_result.action_details`
`gmail`		`security_result.category`	If the `events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[attachment].parameter.intValue[malware_family]` log field value is not empty, then the `security_result.category` UDM field is set to `SOFTWARE_MALICIOUS`. If the `events.parameters[delivery].msgValue[message_info].parameter.boolValue[is_spam]` log field value is equal to `true`, then the `security_result.category` UDM field is set to `MAIL_SPAM`.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[attachment].parameter.intValue[malware_family]`	`security_result.category_details`	If this log field value is equal to `1`, then the `security_result.category_details` UDM field is set to `1 - A known malicious program type of malware`. Else, if this log field value is equal to `2`, then the `security_result.category_details` UDM field is set to `2 - A virus or worm type of malware`. Else, if this log field value is equal to `3`, then the `security_result.category_details` UDM field is set to `3 - Possible harmful email content`. Else, if this log field value is equal to `4`, then the `security_result.category_details` UDM field is set to `4 - Possible unwanted email content`. Else, if this log field value is equal to `5`, then the `security_result.category_details` UDM field is set to `5 - Other type of malware`.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.value[flattened_triggered_rule_info]`	`security_result.detection_fields[flattened_triggered_rule_info]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[is_internal]`	`security_result.detection_fields[is_internal]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[is_intra_domain]`	`security_result.detection_fields[is_intra_domain]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.boolValue[is_policy_check_for_sender]`	`security_result.detection_fields[is_policy_check_for_sender]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.boolValue[is_spam]`	`security_result.detection_fields[is_spam]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.intValue[smtp_replay_error]`	`security_result.detection_fields[smtp_replay_error]`	If this log field value is equal to `1`, then the `security_result.detection_fields.key` UDM field is set to `smtp_replay_error` and the `security_result.detection_fields.value` UDM field is set to `1 - Authentication error`. Else, if this log field value is equal to `2`, then the `security_result.detection_fields.key` UDM field is set to `smtp_replay_error` and the `2 - Daily rate limit was exceeded.` log field is mapped to the `security_result.detection_fields.value` UDM field. Else, if this log field value is equal to `3`, then the `security_result.detection_fields.key` UDM field is set to `smtp_replay_error` and the `3 - Peak rate limit was exceeded.` log field is mapped to the `security_result.detection_fields.value` UDM field. Else, if this log field value is equal to `4`, then the `security_result.detection_fields.key` UDM field is set to `smtp_replay_error` and the `4 - SMTP relay was abused.` log field is mapped to the `security_result.detection_fields.value` UDM field. Else, if this log field value is equal to `5`, then the `security_result.detection_fields.key` UDM field is set to `smtp_replay_error` and the `5 - Per-user rate limit was exceeded.` log field is mapped to the `security_result.detection_fields.value` UDM field.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.intValue[classification_reason]`	`security_result.detection_fields[spam_info_classification_reason]`	If this log field value is equal to `1`, then the `security_result.detection_fields.key` UDM field is set to `spam_info_classification_reason` and the `security_result.detection_fields.value` UDM field is set to `1 - Default spam classification reason`. Else, if this log field value is equal to `2`, then the `security_result.detection_fields.key` UDM field is set to `spam_info_classification_reason` and the `security_result.detection_fields.value` UDM field is set to `2 - Message classified because of sender's past actions`. Else, if this log field value is equal to `3`, then the `security_result.detection_fields.key` UDM field is set to `spam_info_classification_reason` and the `security_result.detection_fields.value` UDM field is set to `3 - Suspicious content`. Else, if this log field value is equal to `4`, then the `security_result.detection_fields.key` UDM field is set to `spam_info_classification_reason` and the `security_result.detection_fields.value` UDM field is set to `4 - Suspicious link`. Else, if this log field value is equal to `5`, then the `security_result.detection_fields.key` UDM field is set to `spam_info_classification_reason` and the `security_result.detection_fields.value` UDM field is set to `5 - Suspicious attachment`. Else, if this log field value is equal to `6`, then the `security_result.detection_fields.key` UDM field is set to `spam_info_classification_reason` and the `security_result.detection_fields.value` UDM field is set to `6 - Custom policy defined in Google Workspace Admin Console > Gmail settings`. Else, if this log field value is equal to `7`, then the `security_result.detection_fields.key` UDM field is set to `spam_info_classification_reason` and the `security_result.detection_fields.value` UDM field is set to `7 - DMARC`. Else, if this log field value is equal to `8`, then the `security_result.detection_fields.key` UDM field is set to `spam_info_classification_reason` and the `security_result.detection_fields.value` UDM field is set to `8 - Domain in public RBLs`. Else, if this log field value is equal to `9`, then the `security_result.detection_fields.key` UDM field is set to `spam_info_classification_reason` and the `security_result.detection_fields.value` UDM field is set to `9 - RFC standards violation`. Else, if this log field value is equal to `10`, then the `security_result.detection_fields.key` UDM field is set to `spam_info_classification_reason` and the `security_result.detection_fields.value` UDM field is set to `10 - Gmail policy violation`. Else, if this log field value is equal to `11`, then the `security_result.detection_fields.key` UDM field is set to `spam_info_classification_reason` and the `security_result.detection_fields.value` UDM field is set to `11 - Machine learning verdict`. Else, if this log field value is equal to `12`, then the `security_result.detection_fields.key` UDM field is set to `spam_info_classification_reason` and the `security_result.detection_fields.value` UDM field is set to `12 - Sender reputation`. Else, if this log field value is equal to `13`, then the `security_result.detection_fields.key` UDM field is set to `spam_info_classification_reason` and the `security_result.detection_fields.value` UDM field is set to `13 - Blatant spam`. Else, if this log field value is equal to `14`, then the `security_result.detection_fields.key` UDM field is set to `spam_info_classification_reason` and the `security_result.detection_fields.value` UDM field is set to `14 - Advanced phishing and malware protection`.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.intValue[classification_timestamp_usec]`	`security_result.detection_fields[spam_info_classification_timestamp_usec]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.boolValue[delayed_for_deepscan]`	`security_result.detection_fields[spam_info_delayed_for_deepscan]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.intValue[disposition]`	`security_result.detection_fields[spam_info_disposition]`	If this log field value is equal to `1`, then the `security_result.detection_fields.key` UDM field is set to `spam_info_disposition` and the `security_result.detection_fields.value` UDM field is set to `1 - Message considered clean (not spam or malware)`. Else, if this log field value is equal to `2`, then the `security_result.detection_fields.key` UDM field is set to `spam_info_disposition` and the `security_result.detection_fields.value` UDM field is set to `2 - Spam`. Else, if this log field value is equal to `3`, then the `security_result.detection_fields.key` UDM field is set to `spam_info_disposition` and the `security_result.detection_fields.value` UDM field is set to `3 - Phishing`. Else, if this log field value is equal to `4`, then the `security_result.detection_fields.key` UDM field is set to `spam_info_disposition` and the `security_result.detection_fields.value` UDM field is set to `4 - Suspicious`. Else, if this log field value is equal to `5`, then the `security_result.detection_fields.key` UDM field is set to `spam_info_disposition` and the `security_result.detection_fields.value` UDM field is set to `5 - Malware`.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.value[ip_whitelist_entry]`	`security_result.detection_fields[spam_info_ip_whitelist_entry]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.multiMsgValue[safety_settings_info].parameter.intValue[safety_settings_action]`	`security_result.detection_fields[spam_info_safety_setting_action]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[spam_info].parameter.multiMsgValue[safety_settings_info].parameter.intValue[safety_settings_condition]`	`security_result.detection_fields[spam_info_safety_settings_condition]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[string_match].parameter.value[attachment_name]`	`security_result.detection_fields[triggered_rule_info_string_match_attachment_name]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[string_match].parameter.value[matched_string]`	`security_result.detection_fields[triggered_rule_info_string_match_matched_string]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[string_match].parameter.intValue[source]`	`security_result.detection_fields[triggered_rule_info_string_match_source]`	If this log field value is equal to `0`, then the `security_result.detection_fields.key` UDM field is set to `triggered_rule_info_string_match_source` and the `security_result.detection_fields.value` UDM field is set to `0 - Unknown`. Else, if this log field value is equal to `1`, then the `security_result.detection_fields.key` UDM field is set to `triggered_rule_info_string_match_source` and the `security_result.detection_fields.value` UDM field is set to `1 - Message body` or `including text format attachments`. Else, if this log field value is equal to `2`, then the `security_result.detection_fields.key` UDM field is set to `triggered_rule_info_string_match_source` and the `security_result.detection_fields.value` UDM field is set to `2 - Binary format attachments`. Else, if this log field value is equal to `3`, then the `security_result.detection_fields.key` UDM field is set to `triggered_rule_info_string_match_source` and the `security_result.detection_fields.value` UDM field is set to `3 - Message headers`. Else, if this log field value is equal to `4`, then the `security_result.detection_fields.key` UDM field is set to `triggered_rule_info_string_match_source` and the `security_result.detection_fields.value` UDM field is set to `4 - Subject`. Else, if this log field value is equal to `5`, then the `security_result.detection_fields.key` UDM field is set to `triggered_rule_info_string_match_source` and the `security_result.detection_fields.value` UDM field is set to `5 - Sender header`. Else, if this log field value is equal to `6`, then the `security_result.detection_fields.key` UDM field is set to `triggered_rule_info_string_match_source` and the `security_result.detection_fields.value` UDM field is set to `6 - Recipient header`. Else, if this log field value is equal to `7`, then the `security_result.detection_fields.key` UDM field is set to `triggered_rule_info_string_match_source` and the `security_result.detection_fields.value` UDM field is set to `7 - Raw message`.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.intValue[upload_error_category]`	`security_result.detection_fields[upload_error_category]`	If this log field value is equal to `0`, then the `security_result.detection_fields.key` UDM field is set to `upload_error_category` and the `security_result.detection_fields.value` UDM field is set to `0 - Uncategorized transient error`. Else, if this log field value is equal to `1`, then the `security_result.detection_fields.key` UDM field is set to `upload_error_category` and the `security_result.detection_fields.value` UDM field is set to `1 - Recipient account is too busy`. Else, if this log field value is equal to `2`, then the `security_result.detection_fields.key` UDM field is set to `upload_error_category` and the `security_result.detection_fields.value` UDM field is set to `2 - DNS error resolving recipient domain`. Else, if this log field value is equal to `3`, then the `security_result.detection_fields.key` UDM field is set to `upload_error_category` and the `security_result.detection_fields.value` UDM field is set to `3 - Recipient's server refused connection`. Else, if this log field value is equal to `4`, then the `security_result.detection_fields.key` UDM field is set to `upload_error_category` and the `security_result.detection_fields.value` UDM field is set to `4 - Recipient is out of storage`.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.intValue[rule_id]`	`security_result.rule_id`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[consequence].parameter.intValue[action]`	`security_result.rule_labels[triggered_rule_info_consequence_action]`	If this log field value is equal to `0`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_action` and the `security_result.rule_labels.value` UDM field is set to `0 - Consequence is a no-op`. Else, if this log field value is equal to `3`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_action` and the `security_result.rule_labels.value` UDM field is set to `3 - Put message in Admin Quarantine`. Else, if this log field value is equal to `4`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_action` and the `security_result.rule_labels.value` UDM field is set to `4 - Modify the primary delivery target`. Else, if this log field value is equal to `5`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_action` and the `security_result.rule_labels.value` UDM field is set to `5 - Add a delivery target`. Else, if this log field value is equal to `6`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_action` and the `security_result.rule_labels.value` UDM field is set to `6 - Added a message header`. Else, if this log field value is equal to `7`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_action` and the `security_result.rule_labels.value` UDM field is set to `7 - Overwrite the envelope recipient`. Else, if this log field value is equal to `9`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_action` and the `security_result.rule_labels.value` UDM field is set to `9 - Add message to specified message set`. Else, if this log field value is equal to `10`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_action` and the `security_result.rule_labels.value` UDM field is set to `10 - Modify the message labels`. Else, if this log field value is equal to `11`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_action` and the `security_result.rule_labels.value` UDM field is set to `11 - Prefix text to message subject`. Else, if this log field value is equal to `12`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_action` and the `security_result.rule_labels.value` UDM field is set to `12 - Add a footer to the message`. Else, if this log field value is equal to `13`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_action` and the `security_result.rule_labels.value` UDM field is set to `13 - Strip the message body`. Else, if this log field value is equal to `14`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_action` and the `14 - Store a copy of the message in the user's mailbox` or `according to comprehensive mail storage setting.` log field is mapped to the `security_result.rule_labels.value` UDM field. Else, if this log field value is equal to `15`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_action` and the `security_result.rule_labels.value` UDM field is set to `15 - Replace attachment with canned text`. Else, if this log field value is equal to `16`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_action` and the `security_result.rule_labels.value` UDM field is set to `16 - Require secure message delivery`. Else, if this log field value is equal to `17`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_action` and the `security_result.rule_labels.value` UDM field is set to `17 - Message can't be delivered and bounced`. Else, if this log field value is equal to `18`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_action` and the `security_result.rule_labels.value` UDM field is set to `18 - Archive to Google Vault for recipients`. Else, if this log field value is equal to `20`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_action` and the `security_result.rule_labels.value` UDM field is set to `20 - Encrypt outbound message using S/MIME`. Else, if this log field value is equal to `21`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_action` and the `21 - Change the recipient user when message is received at SMTP.` log field is mapped to the `security_result.rule_labels.value` UDM field.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[consequence].parameter.value[reason]`	`security_result.rule_labels[triggered_rule_info_consequence_reason]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[consequence].parameter.multiMsgValue[subconsequence].parameter.value[action]`	`security_result.rule_labels[triggered_rule_info_consequence_subconsequence_action]`	If this log field value is equal to `0`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_subconsequence_action` and the `security_result.rule_labels.value` UDM field is set to `0 - Consequence is a no-op`. Else, if this log field value is equal to `3`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_subconsequence_action` and the `security_result.rule_labels.value` UDM field is set to `3 - Put message in Admin Quarantine`. Else, if this log field value is equal to `4`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_subconsequence_action` and the `security_result.rule_labels.value` UDM field is set to `4 - Modify the primary delivery target`. Else, if this log field value is equal to `5`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_subconsequence_action` and the `security_result.rule_labels.value` UDM field is set to `5 - Add a delivery target`. Else, if this log field value is equal to `6`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_subconsequence_action` and the `security_result.rule_labels.value` UDM field is set to `6 - Added a message header`. Else, if this log field value is equal to `7`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_subconsequence_action` and the `security_result.rule_labels.value` UDM field is set to `7 - Overwrite the envelope recipient`. Else, if this log field value is equal to `9`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_subconsequence_action` and the `security_result.rule_labels.value` UDM field is set to `9 - Add message to specified message set`. Else, if this log field value is equal to `10`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_subconsequence_action` and the `security_result.rule_labels.value` UDM field is set to `10 - Modify the message labels`. Else, if this log field value is equal to `11`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_subconsequence_action` and the `security_result.rule_labels.value` UDM field is set to `11 - Prefix text to message subject`. Else, if this log field value is equal to `12`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_subconsequence_action` and the `security_result.rule_labels.value` UDM field is set to `12 - Add a footer to the message`. Else, if this log field value is equal to `13`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_subconsequence_action` and the `security_result.rule_labels.value` UDM field is set to `13 - Strip the message body`. Else, if this log field value is equal to `14`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_subconsequence_action` and the `14 - Store a copy of the message in the user's mailbox` or `according to comprehensive mail storage setting.` log field is mapped to the `security_result.rule_labels.value` UDM field. Else, if this log field value is equal to `15`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_subconsequence_action` and the `security_result.rule_labels.value` UDM field is set to `15 - Replace attachment with canned text`. Else, if this log field value is equal to `16`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_subconsequence_action` and the `security_result.rule_labels.value` UDM field is set to `16 - Require secure message delivery`. Else, if this log field value is equal to `17`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_subconsequence_action` and the `security_result.rule_labels.value` UDM field is set to `17 - Message can't be delivered and bounced`. Else, if this log field value is equal to `18`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_subconsequence_action` and the `security_result.rule_labels.value` UDM field is set to `18 - Archive to Google Vault for recipients`. Else, if this log field value is equal to `20`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_subconsequence_action` and the `security_result.rule_labels.value` UDM field is set to `20 - Encrypt outbound message using S/MIME`. Else, if this log field value is equal to `21`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_consequence_subconsequence_action` and the `21 - Change the recipient user when message is received at SMTP.` log field is mapped to the `security_result.rule_labels.value` UDM field.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[consequence].parameter.multiMsgValue[subconsequence].parameter.value[reason]`	`security_result.rule_labels[triggered_rule_info_consequence_subconsequence_reason]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.intValue[policy_id]`	`security_result.rule_labels[triggered_rule_info_policy_id]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.value[spam_label_modifier]`	`security_result.rule_labels[triggered_rule_info_spam_label_modifier]`	If this log field value is equal to `0`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_spam_label_modifier` and the `0 - No action—the rule honored the Gmail spam classification verdict.` log field is mapped to the `security_result.rule_labels.value` UDM field. Else, if this log field value is equal to `1`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_spam_label_modifier` and the `1 - Spam—the rule classified the message as spam.` log field is mapped to the `security_result.rule_labels.value` UDM field. Else, if this log field value is equal to `2`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_spam_label_modifier` and the `2 - Not spam—the rule classified the message as not spam.` log field is mapped to the `security_result.rule_labels.value` UDM field.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[string_match].parameter.value[match_expression]`	`security_result.rule_labels[triggered_rule_info_string_match_match_expression]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[string_match].parameter.value[predefined_detector_name]`	`security_result.rule_labels[triggered_rule_info_string_match_predefined_detector_name]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.multiMsgValue[string_match].parameter.intValue[type]`	`security_result.rule_labels[triggered_rule_info_string_match_type]`	If this log field value is equal to `0`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_string_match_type` and the `security_result.rule_labels.value` UDM field is set to `0 - Undefined`. Else, if this log field value is equal to `1`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_string_match_type` and the `security_result.rule_labels.value` UDM field is set to `1 - Regular expression match`. Else, if this log field value is equal to `2`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_string_match_type` and the `security_result.rule_labels.value` UDM field is set to `2 - Predefined detector match`. Else, if this log field value is equal to `3`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_string_match_type` and the `security_result.rule_labels.value` UDM field is set to `3 - Simple content match`. Else, if this log field value is equal to `4`, then the `security_result.rule_labels.key` UDM field is set to `triggered_rule_info_string_match_type` and the `security_result.rule_labels.value` UDM field is set to `4 - Non-ASCII match`.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.value[rule_name]`	`security_result.rule_name`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[triggered_rule_info].parameter.intValue[rule_type]`	`security_result.rule_type`	If this log field value is equal to `0`, then the `security_result.rule_type` UDM field is set to `0 - Walled garden`. Else, if this log field value is equal to `7`, then the `security_result.rule_type` UDM field is set to `7 - Objectionable content`. Else, if this log field value is equal to `8`, then the `security_result.rule_type` UDM field is set to `8 - Content compliance`. Else, if this log field value is equal to `10`, then the `security_result.rule_type` UDM field is set to `10 - Received mail routing`. Else, if this log field value is equal to `11`, then the `security_result.rule_type` UDM field is set to `11 - Sent mail routing`. Else, if this log field value is equal to `12`, then the `security_result.rule_type` UDM field is set to `12 - Spam override`. Else, if this log field value is equal to `14`, then the `security_result.rule_type` UDM field is set to `14 - Blocked senders`. Else, if this log field value is equal to `15`, then the `security_result.rule_type` UDM field is set to `15 - Append footer`. Else, if this log field value is equal to `16`, then the `security_result.rule_type` UDM field is set to `16 - Attachment compliance`. Else, if this log field value is equal to `17`, then the `security_result.rule_type` UDM field is set to `17 - TLS compliance`. Else, if this log field value is equal to `18`, then the `security_result.rule_type` UDM field is set to `18 - Domain default routing`. Else, if this log field value is equal to `19`, then the `security_result.rule_type` UDM field is set to `19 - Inbound email journal acceptance in Vault`. Else, if this log field value is equal to `20`, then the `security_result.rule_type` UDM field is set to `20 - Outbound relay`. Else, if this log field value is equal to `21`, then the `security_result.rule_type` UDM field is set to `21 - Quarantine summary`. Else, if this log field value is equal to `22`, then the `security_result.rule_type` UDM field is set to `22 - Alternate secure route`. Else, if this log field value is equal to `23`, then the `security_result.rule_type` UDM field is set to `23 - Alias table`. Else, if this log field value is equal to `24`, then the `security_result.rule_type` UDM field is set to `24 - Comprehensive mail storage`. Else, if this log field value is equal to `25`, then the `security_result.rule_type` UDM field is set to `25 - Routing rule`. Else, if this log field value is equal to `26`, then the `security_result.rule_type` UDM field is set to `26 - Inbound gateway`. Else, if this log field value is equal to `27`, then the `security_result.rule_type` UDM field is set to `27 - S/MIME`. Else, if this log field value is equal to `28`, then the `security_result.rule_type` UDM field is set to `28 - Third-party email archiving`. Else, if this log field value is equal to `31`, then the `security_result.rule_type` UDM field is set to `31 - S/MIME restrict delivery`.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.multiMsgValue[authenticated_domain].parameter.value[name]`	`about.domain.name`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[attachment].parameter.value[file_extension_type]`	`about.file.file_type`	FILE_TYPE_ string added before this log field value and converted it to uppercase, then If this log field value present in File.FileType then, this log field is mapped to `about.file.file_type` UDM field.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[attachment].parameter.value[file_extension_type]`	`about.file.mime_type`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.multiMsgValue[detected_file_types].parameter.value[mime_type]`	`about.file.mime_type`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[attachment].parameter.value[sha256]`	`about.file.sha256`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[ip_geo_city]`	`about.ip_geo_artifact.location.city`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[ip_geo_country]`	`about.ip_geo_artifact.location.country_or_region`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.intValue[action_type]`	`about.labels[action_type]` (deprecated)	If this log field value is equal to `1`, then the `about.labels` UDM field is set to `1 - Message received by inbound SMTP server.` Else, if this log field value is equal to `2`, then the `about.labels` UDM field is set to `2 - Message accepted by Gmail and prepared for delivery.` Else, if this log field value is equal to `3`, then the `about.labels` UDM field is set to `3 - Message was handled by Gmail.` Else, if this log field value is equal to `10`, then the `about.labels` UDM field is set to `10 - Message sent out by outbound SMTP server.` Else, if this log field value is equal to `14`, then the `about.labels` UDM field is set to `14 - A temporary error occurred when Gmail tried to deliver the message` or `and the message has been scheduled for retry.` Else, if this log field value is equal to `18`, then the `about.labels` UDM field is set to `18 - Message could not be delivered and bounced.` Else, if this log field value is equal to `19`, then the `about.labels` UDM field is set to `19 - Message was dropped by Gmail.` Else, if this log field value is equal to `45`, then the `about.labels` UDM field is set to `45 - Message was accepted for delivery by the Google Groups subsystem.` Else, if this log field value is equal to `46`, then the `about.labels` UDM field is set to `46 - Message's recipient address was a Google Group` or `and the recipient was expanded to each member of the Google Group that has message delivery enabled.` Else, if this log field value is equal to `48`, then the `about.labels` UDM field is set to `48 - Message received by inbound SMTP server for relay.` Else, if this log field value is equal to `49`, then the `about.labels` UDM field is set to `49 - Message sent through relay by outbound SMTP server.` Else, if this log field value is equal to `51`, then the `about.labels` UDM field is set to `51 - Message was written to Google Groups storage.` Else, if this log field value is equal to `54`, then the `about.labels` UDM field is set to `54 - Message was rejected by the Google Groups storage system.` Else, if this log field value is equal to `55`, then the `about.labels` UDM field is set to `55 - Message was re-inserted into Gmail by policies that modify the primary delivery route or envelope recipient.` Else, if this log field value is equal to `68`, then the `about.labels` UDM field is set to `68 - Message accepted by Gmail and prepared for delivery.` Else, if this log field value is equal to `69`, then the `about.labels` UDM field is set to `69 - A user changed the message's spam classification in Gmail.` Else, if this log field value is equal to `70`, then the `about.labels` UDM field is set to `70 - The message was reclassified as spam or phishing after it was delivered to Gmail.` Else, if this log field value is equal to `71`, then the `about.labels` UDM field is set to `71 - A user took an action in the inbox after receiving the message. Post-delivery actions include opening a message` or `clicking a link in a message` or `and downloading an attachment. BigQuery export doesn't provide details about the action.`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.intValue[action_type]`	`additional.fields[action_type]`	If this log field value is equal to `1`, then the `additional.fields` UDM field is set to `1 - Message received by inbound SMTP server.` Else, if this log field value is equal to `2`, then the `additional.fields` UDM field is set to `2 - Message accepted by Gmail and prepared for delivery.` Else, if this log field value is equal to `3`, then the `additional.fields` UDM field is set to `3 - Message was handled by Gmail.` Else, if this log field value is equal to `10`, then the `additional.fields` UDM field is set to `10 - Message sent out by outbound SMTP server.` Else, if this log field value is equal to `14`, then the `additional.fields` UDM field is set to `14 - A temporary error occurred when Gmail tried to deliver the message` or `and the message has been scheduled for retry.` Else, if this log field value is equal to `18`, then the `additional.fields` UDM field is set to `18 - Message could not be delivered and bounced.` Else, if this log field value is equal to `19`, then the `additional.fields` UDM field is set to `19 - Message was dropped by Gmail.` Else, if this log field value is equal to `45`, then the `additional.fields` UDM field is set to `45 - Message was accepted for delivery by the Google Groups subsystem.` Else, if this log field value is equal to `46`, then the `additional.fields` UDM field is set to `46 - Message's recipient address was a Google Group` or `and the recipient was expanded to each member of the Google Group that has message delivery enabled.` Else, if this log field value is equal to `48`, then the `additional.fields` UDM field is set to `48 - Message received by inbound SMTP server for relay.` Else, if this log field value is equal to `49`, then the `additional.fields` UDM field is set to `49 - Message sent through relay by outbound SMTP server.` Else, if this log field value is equal to `51`, then the `additional.fields` UDM field is set to `51 - Message was written to Google Groups storage.` Else, if this log field value is equal to `54`, then the `additional.fields` UDM field is set to `54 - Message was rejected by the Google Groups storage system.` Else, if this log field value is equal to `55`, then the `additional.fields` UDM field is set to `55 - Message was re-inserted into Gmail by policies that modify the primary delivery route or envelope recipient.` Else, if this log field value is equal to `68`, then the `additional.fields` UDM field is set to `68 - Message accepted by Gmail and prepared for delivery.` Else, if this log field value is equal to `69`, then the `additional.fields` UDM field is set to `69 - A user changed the message's spam classification in Gmail.` Else, if this log field value is equal to `70`, then the `additional.fields` UDM field is set to `70 - The message was reclassified as spam or phishing after it was delivered to Gmail.` Else, if this log field value is equal to `71`, then the `additional.fields` UDM field is set to `71 - A user took an action in the inbox after receiving the message. Post-delivery actions include opening a message` or `clicking a link in a message` or `and downloading an attachment. BigQuery export doesn't provide details about the action.`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.multiMsgValue[authenticated_domain].parameter.intValue[type]`	`about.labels[authenticated_domain_type]` (deprecated)	If this log field value is equal to `1`, then the `about.labels` UDM field is set to `1 - SPF`. Else, if this log field value is equal to `2`, then the `about.labels` UDM field is set to `2 - DKIM`. Else, if this log field value is equal to `3`, then the `about.labels` UDM field is set to `3 - DKIM_PROXY`. Else, if this log field value is equal to `4`, then the `about.labels` UDM field is set to `4 - XOAR_SPF`. Else, if this log field value is equal to `5`, then the `about.labels` UDM field is set to `5 - XOAR_DKIM`. Else, if this log field value is equal to `6`, then the `about.labels` UDM field is set to `6 - ARC_SPF`. Else, if this log field value is equal to `7`, then the `about.labels` UDM field is set to `7 - ARC_DKIM`.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.multiMsgValue[authenticated_domain].parameter.intValue[type]`	`additional.fields[authenticated_domain_type]`	If this log field value is equal to `1`, then the `additional.fields` UDM field is set to `1 - SPF`. Else, if this log field value is equal to `2`, then the `additional.fields` UDM field is set to `2 - DKIM`. Else, if this log field value is equal to `3`, then the `additional.fields` UDM field is set to `3 - DKIM_PROXY`. Else, if this log field value is equal to `4`, then the `additional.fields` UDM field is set to `4 - XOAR_SPF`. Else, if this log field value is equal to `5`, then the `additional.fields` UDM field is set to `5 - XOAR_DKIM`. Else, if this log field value is equal to `6`, then the `additional.fields` UDM field is set to `6 - ARC_SPF`. Else, if this log field value is equal to `7`, then the `additional.fields` UDM field is set to `7 - ARC_DKIM`.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.intValue[delivery_timestamp_usec]`	`about.labels[delivery_timestamp_usec]` (deprecated)
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.intValue[delivery_timestamp_usec]`	`additional.fields[delivery_timestamp_usec]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.multiMsgValue[detected_file_types].parameter.intValue[category]`	`about.labels[detected_file_types_category]` (deprecated)	If this log field value is equal to `1`, then the `about.labels` UDM field is set to `1 - Unrecognized file type`. Else, if this log field value is equal to `2`, then the `about.labels` UDM field is set to `2 - Microsoft Office documents, including word processing, spreadsheet, presentation, and database documents. Includes PDF files. The file might or might not be encrypted`. Else, if this log field value is equal to `3`, then the `about.labels` UDM field is set to `3 - Video and multimedia, for example, MPEG, Quicktime, WMV`. Else, if this log field value is equal to `4`, then the `about.labels` UDM field is set to `4 - Music and audio, for example, MP3, AAC, WAV`. Else, if this log field value is equal to `5`, then the `about.labels` UDM field is set to `5 - Images, for example, JPEG, BMP, GIF`. Else, if this log field value is equal to `6`, then the `about.labels` UDM field is set to `6 - Archives, for example, ZIP, TAR, TGZ`. Else, if this log field value is equal to `7`, then the `about.labels` UDM field is set to `7 - Executables, for example EXE, COM, JS`. Else, if this log field value is equal to `8`, then the `about.labels` UDM field is set to `8 - Office documents that are encrypted`. Else, if this log field value is equal to `9`, then the `about.labels` UDM field is set to `9 - Office documents that are not encrypted`.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.multiMsgValue[detected_file_types].parameter.intValue[category]`	`additional.fields[detected_file_types_category]`	If this log field value is equal to `1`, then the `additional.fields` UDM field is set to `1 - Unrecognized file type`. Else, if this log field value is equal to `2`, then the `additional.fields` UDM field is set to `2 - Microsoft Office documents, including word processing, spreadsheet, presentation, and database documents. Includes PDF files. The file might or might not be encrypted`. Else, if this log field value is equal to `3`, then the `additional.fields` UDM field is set to `3 - Video and multimedia, for example, MPEG, Quicktime, WMV`. Else, if this log field value is equal to `4`, then the `additional.fields` UDM field is set to `4 - Music and audio, for example, MP3, AAC, WAV`. Else, if this log field value is equal to `5`, then the `additional.fields` UDM field is set to `5 - Images, for example, JPEG, BMP, GIF`. Else, if this log field value is equal to `6`, then the `additional.fields` UDM field is set to `6 - Archives, for example, ZIP, TAR, TGZ`. Else, if this log field value is equal to `7`, then the `additional.fields` UDM field is set to `7 - Executables, for example EXE, COM, JS`. Else, if this log field value is equal to `8`, then the `additional.fields` UDM field is set to `8 - Office documents that are encrypted`. Else, if this log field value is equal to `9`, then the `additional.fields` UDM field is set to `9 - Office documents that are not encrypted`.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[dkim_pass]`	`about.labels[dkim_pass]` (deprecated)
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[dkim_pass]`	`additional.fields[dkim_pass]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[dmarc_pass]`	`about.labels[dmarc_pass]` (deprecated)
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[dmarc_pass]`	`additional.fields[dmarc_pass]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[dmarc_published_domain]`	`about.labels[dmarc_published_domain]` (deprecated)
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.value[dmarc_published_domain]`	`additional.fields[dmarc_published_domain]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.msgValue[exchange_journal_info].parameter.multiStrValue[recipients]`	`about.labels[exchange_journal_info_recipients]` (deprecated)
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.msgValue[exchange_journal_info].parameter.multiStrValue[recipients]`	`additional.fields[exchange_journal_info_recipients]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.msgValue[exchange_journal_info].parameter.value[rfc822_message_id]`	`about.labels[exchange_journal_info_rfc822_message_id]` (deprecated)
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.msgValue[exchange_journal_info].parameter.value[rfc822_message_id]`	`additional.fields[exchange_journal_info_rfc822_message_id]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.msgValue[exchange_journal_info].parameter.intValue[timestamp]`	`about.labels[exchange_journal_info_timestamp]` (deprecated)
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.msgValue[exchange_journal_info].parameter.intValue[timestamp]`	`additional.fields[exchange_journal_info_timestamp]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.msgValue[exchange_journal_info].parameter.multiStrValue[unknown_recipients]`	`about.labels[exchange_journal_info_unknown_recipients]` (deprecated)
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[structured_policy_log_info].parameter.msgValue[exchange_journal_info].parameter.multiStrValue[unknown_recipients]`	`additional.fields[exchange_journal_info_unknown_recipients]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.intValue[internal_message_id]`	`about.labels[internal_message_id]` (deprecated)
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.intValue[internal_message_id]`	`additional.fields[internal_message_id]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiStrValue[link_domain]`	`about.labels[link_domain]` (deprecated)
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiStrValue[link_domain]`	`additional.fields[link_domain]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[message_set].parameter.intValue[type]`	`about.labels[message_set_type]` (deprecated)	If this log field value is equal to `1`, then the `about.labels` UDM field is set to `1 - Message is inbound (received from outside your domains). This message set doesn't appear with message set 10.` Else, if this log field value is equal to `2`, then the `about.labels` UDM field is set to `2 - Message is outbound (sent to a recipient outside your domains). This message set doesn't appear with message set 10.` Else, if this log field value is equal to `4`, then the `about.labels` UDM field is set to `4 - Message contains objectionable content, as defined by one of your policies.` Else, if this log field value is equal to `6`, then the `about.labels` UDM field is set to `6 - Message triggered the walled garden rule you configured that restricts messages to authorized addresses or domains.` Else, if this log field value is equal to `7`, then the `about.labels` UDM field is set to `7 - Gmail classified the message as spam.` Else, if this log field value is equal to `8`, then the `about.labels` UDM field is set to `8 - Message being sent (outgoing message)`. Else, if this log field value is equal to `9`, then the `about.labels` UDM field is set to `9 - Message being received (incoming message)`. Else, if this log field value is equal to `10`, then the `about.labels` UDM field is set to `10 - Message that is internal to your domains`. Else, if this log field value is equal to `11`, then the `about.labels` UDM field is set to `11 - Message has a sender or recipients outside your domains.` Else, if this log field value is equal to `12`, then the `about.labels` UDM field is set to `12 - Message has some recipients inside your domain and some recipients outside your domain. This message set might appear when:` Else, if this log field value is equal to `13`, then the `about.labels` UDM field is set to `13 - The type of the message set is unknown.` Else, if this log field value is equal to `15`, then the `about.labels` UDM field is set to `15 - The policy being checked against is tied to a Gmail user.` Else, if this log field value is equal to `18`, then the `about.labels` UDM field is set to `18 - Message doesn't have a default route.` Else, if this log field value is equal to `19`, then the `about.labels` UDM field is set to `19 - The address list you configured for domain default routing matches the correspondent of the message.` Else, if this log field value is equal to `20`, then the `about.labels` UDM field is set to `20 - Message is from an address in your blocked senders list.` Else, if this log field value is equal to `21`, then the `about.labels` UDM field is set to `21 - Message was sent over TLS and the SSL certificate is valid.` Else, if this log field value is equal to `22`, then the `about.labels` UDM field is set to `22 - Message was sent over TLS.` Else, if this log field value is equal to `24`, then the `about.labels` UDM field is set to `24 - The recipient of this message is unknown.` Else, if this log field value is equal to `25`, then the `about.labels` UDM field is set to `25 - Message is a non-delivery report responding to a message that was not delivered.` Else, if this log field value is equal to `26`, then the `about.labels` UDM field is set to `26 - Message triggered a rerouting rule, which you configured in domain default routing.` Else, if this log field value is equal to `27`, then the `about.labels` UDM field is set to `27 - Sender successfully passed SPF/DKIM/DMARC authentication. If the sender isn't authenticated, the sender domain is untrusted and the message is not considered internal.` Else, if this log field value is equal to `28`, then the `about.labels` UDM field is set to `28 - Exchange journal is archiving the message to Google Vault.` Else, if this log field value is equal to `29`, then the `about.labels` UDM field is set to `29 - Message was routed through SMTP relay.` Else, if this log field value is equal to `30`, then the `about.labels` UDM field is set to `30 - A recipient of the message matched one of the enumerated recipients (instead of a regular expression pattern) you configured for domain routing, or domain default routing.` Else, if this log field value is equal to `31`, then the `about.labels` UDM field is set to `31 - Message matched a domain default routing condition you configured.` Else, if this log field value is equal to `32`, then the `about.labels` UDM field is set to `32 - Message was created from an Exchange journal message for archiving to Google Vault.` Else, if this log field value is equal to `33`, then the `about.labels` UDM field is set to `33 - Message has to be transmitted through a secure connection, such as TLS.` Else, if this log field value is equal to `34`, then the `about.labels` UDM field is set to `34 - The policy being checked against is tied to a group instead of an individual Gmail user.` Else, if this log field value is equal to `35`, then the `about.labels` UDM field is set to `35 - Message could not be authenticated in SMTP relay because it has an empty SMTP envelope-from address or is possibly an Exchange Journal message. It will be checked later at SMTP RCPT command time.` Else, if this log field value is equal to `36`, then the `about.labels` UDM field is set to `36 - Message has aggressive spam filtering enabled.` Else, if this log field value is equal to `37`, then the `about.labels` UDM field is set to `37 - Message is authenticated for SMTP relay.` Else, if this log field value is equal to `39`, then the `about.labels` UDM field is set to `39 - Sender is from an authenticated domain for relay.` Else, if this log field value is equal to `40`, then the `about.labels` UDM field is set to `40 - Message is from a Google Workspace user in the domain being authenticated for relay.` Else, if this log field value is equal to `41`, then the `about.labels` UDM field is set to `41 - Sender has successfully authenticated with SMTP AUTH, and Gmail is trying to authenticate SMTP relay for the sender's domain.` Else, if this log field value is equal to `42`, then the `about.labels` UDM field is set to `42 - Message was sent from an address that isn't authenticated.` Else, if this log field value is equal to `43`, then the `about.labels` UDM field is set to `43 - Message was rerouted through an alias table.` Else, if this log field value is equal to `44`, then the `about.labels` UDM field is set to `44 - Message triggered a rule that changes the route of the mail flow.` Else, if this log field value is equal to `45`, then the `about.labels` UDM field is set to `45 - Message is to a catch-all account and is being relayed to an on-premise server. System-of-record policies won't be applied to it.` Else, if this log field value is equal to `46`, then the `about.labels` UDM field is set to `46 - Message bypassed the spam filter.` Else, if this log field value is equal to `47`, then the `about.labels` UDM field is set to `47 - Message was detected to be spam by tag-and-deliver information in the inbound gateway settings.` Else, if this log field value is equal to `48`, then the `about.labels` UDM field is set to `48 - Message was not checked for spam (by SMTP) due to a spam-override policy.` Else, if this log field value is equal to `49`, then the `about.labels` UDM field is set to `49 - Always override spam rejection for the message.` Else, if this log field value is equal to `50`, then the `about.labels` UDM field is set to `50 - Message matches a domain routing condition you configured.` Else, if this log field value is equal to `51`, then the `about.labels` UDM field is set to `51 - Message triggered a rerouting rule that you configured for domain routing.` Else, if this log field value is equal to `55`, then the `about.labels` UDM field is set to `55 - Message was created by the Exchange Journal generation setting.` Else, if this log field value is equal to `57`, then the `about.labels` UDM field is set to `57 - Message was received from an inbound gateway rule that you configured.` Else, if this log field value is equal to `60`, then the `about.labels` UDM field is set to `60 - Message is protected with Gmail confidential mode.` Else, if this log field value is equal to `61`, then the `about.labels` UDM field is set to `61 - Message was caught by Security sandbox.` Else, if this log field value is equal to `62`, then the `about.labels` UDM field is set to `62 - The address list you configured for domain default routing matches the SMTP envelope recipient instead of the correspondent of the message.` Else, if this log field value is equal to `63`, then the `about.labels` UDM field is set to `63 - Message triggered a domain-level rerouting rule, which you configured for domain routing, or domain default routing`.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.multiMsgValue[message_set].parameter.intValue[type]`	`additional.fields[message_set_type]`	If this log field value is equal to `1`, then the `additional.fields` UDM field is set to `1 - Message is inbound (received from outside your domains). This message set doesn't appear with message set 10.` Else, if this log field value is equal to `2`, then the `additional.fields` UDM field is set to `2 - Message is outbound (sent to a recipient outside your domains). This message set doesn't appear with message set 10.` Else, if this log field value is equal to `4`, then the `additional.fields` UDM field is set to `4 - Message contains objectionable content, as defined by one of your policies.` Else, if this log field value is equal to `6`, then the `additional.fields` UDM field is set to `6 - Message triggered the walled garden rule you configured that restricts messages to authorized addresses or domains.` Else, if this log field value is equal to `7`, then the `additional.fields` UDM field is set to `7 - Gmail classified the message as spam.` Else, if this log field value is equal to `8`, then the `additional.fields` UDM field is set to `8 - Message being sent (outgoing message)`. Else, if this log field value is equal to `9`, then the `additional.fields` UDM field is set to `9 - Message being received (incoming message)`. Else, if this log field value is equal to `10`, then the `additional.fields` UDM field is set to `10 - Message that is internal to your domains`. Else, if this log field value is equal to `11`, then the `additional.fields` UDM field is set to `11 - Message has a sender or recipients outside your domains.` Else, if this log field value is equal to `12`, then the `additional.fields` UDM field is set to `12 - Message has some recipients inside your domain and some recipients outside your domain. This message set might appear when:` Else, if this log field value is equal to `13`, then the `additional.fields` UDM field is set to `13 - The type of the message set is unknown.` Else, if this log field value is equal to `15`, then the `additional.fields` UDM field is set to `15 - The policy being checked against is tied to a Gmail user.` Else, if this log field value is equal to `18`, then the `additional.fields` UDM field is set to `18 - Message doesn't have a default route.` Else, if this log field value is equal to `19`, then the `additional.fields` UDM field is set to `19 - The address list you configured for domain default routing matches the correspondent of the message.` Else, if this log field value is equal to `20`, then the `additional.fields` UDM field is set to `20 - Message is from an address in your blocked senders list.` Else, if this log field value is equal to `21`, then the `additional.fields` UDM field is set to `21 - Message was sent over TLS and the SSL certificate is valid.` Else, if this log field value is equal to `22`, then the `additional.fields` UDM field is set to `22 - Message was sent over TLS.` Else, if this log field value is equal to `24`, then the `additional.fields` UDM field is set to `24 - The recipient of this message is unknown.` Else, if this log field value is equal to `25`, then the `additional.fields` UDM field is set to `25 - Message is a non-delivery report responding to a message that was not delivered.` Else, if this log field value is equal to `26`, then the `additional.fields` UDM field is set to `26 - Message triggered a rerouting rule, which you configured in domain default routing.` Else, if this log field value is equal to `27`, then the `additional.fields` UDM field is set to `27 - Sender successfully passed SPF/DKIM/DMARC authentication. If the sender isn't authenticated, the sender domain is untrusted and the message is not considered internal.` Else, if this log field value is equal to `28`, then the `additional.fields` UDM field is set to `28 - Exchange journal is archiving the message to Google Vault.` Else, if this log field value is equal to `29`, then the `additional.fields` UDM field is set to `29 - Message was routed through SMTP relay.` Else, if this log field value is equal to `30`, then the `additional.fields` UDM field is set to `30 - A recipient of the message matched one of the enumerated recipients (instead of a regular expression pattern) you configured for domain routing, or domain default routing.` Else, if this log field value is equal to `31`, then the `additional.fields` UDM field is set to `31 - Message matched a domain default routing condition you configured.` Else, if this log field value is equal to `32`, then the `additional.fields` UDM field is set to `32 - Message was created from an Exchange journal message for archiving to Google Vault.` Else, if this log field value is equal to `33`, then the `additional.fields` UDM field is set to `33 - Message has to be transmitted through a secure connection, such as TLS.` Else, if this log field value is equal to `34`, then the `additional.fields` UDM field is set to `34 - The policy being checked against is tied to a group instead of an individual Gmail user.` Else, if this log field value is equal to `35`, then the `additional.fields` UDM field is set to `35 - Message could not be authenticated in SMTP relay because it has an empty SMTP envelope-from address or is possibly an Exchange Journal message. It will be checked later at SMTP RCPT command time.` Else, if this log field value is equal to `36`, then the `additional.fields` UDM field is set to `36 - Message has aggressive spam filtering enabled.` Else, if this log field value is equal to `37`, then the `additional.fields` UDM field is set to `37 - Message is authenticated for SMTP relay.` Else, if this log field value is equal to `39`, then the `additional.fields` UDM field is set to `39 - Sender is from an authenticated domain for relay.` Else, if this log field value is equal to `40`, then the `additional.fields` UDM field is set to `40 - Message is from a Google Workspace user in the domain being authenticated for relay.` Else, if this log field value is equal to `41`, then the `additional.fields` UDM field is set to `41 - Sender has successfully authenticated with SMTP AUTH, and Gmail is trying to authenticate SMTP relay for the sender's domain.` Else, if this log field value is equal to `42`, then the `additional.fields` UDM field is set to `42 - Message was sent from an address that isn't authenticated.` Else, if this log field value is equal to `43`, then the `additional.fields` UDM field is set to `43 - Message was rerouted through an alias table.` Else, if this log field value is equal to `44`, then the `additional.fields` UDM field is set to `44 - Message triggered a rule that changes the route of the mail flow.` Else, if this log field value is equal to `45`, then the `additional.fields` UDM field is set to `45 - Message is to a catch-all account and is being relayed to an on-premise server. System-of-record policies won't be applied to it.` Else, if this log field value is equal to `46`, then the `additional.fields` UDM field is set to `46 - Message bypassed the spam filter.` Else, if this log field value is equal to `47`, then the `additional.fields` UDM field is set to `47 - Message was detected to be spam by tag-and-deliver information in the inbound gateway settings.` Else, if this log field value is equal to `48`, then the `additional.fields` UDM field is set to `48 - Message was not checked for spam (by SMTP) due to a spam-override policy.` Else, if this log field value is equal to `49`, then the `additional.fields` UDM field is set to `49 - Always override spam rejection for the message.` Else, if this log field value is equal to `50`, then the `additional.fields` UDM field is set to `50 - Message matches a domain routing condition you configured.` Else, if this log field value is equal to `51`, then the `additional.fields` UDM field is set to `51 - Message triggered a rerouting rule that you configured for domain routing.` Else, if this log field value is equal to `55`, then the `additional.fields` UDM field is set to `55 - Message was created by the Exchange Journal generation setting.` Else, if this log field value is equal to `57`, then the `additional.fields` UDM field is set to `57 - Message was received from an inbound gateway rule that you configured.` Else, if this log field value is equal to `60`, then the `additional.fields` UDM field is set to `60 - Message is protected with Gmail confidential mode.` Else, if this log field value is equal to `61`, then the `additional.fields` UDM field is set to `61 - Message was caught by Security sandbox.` Else, if this log field value is equal to `62`, then the `additional.fields` UDM field is set to `62 - The address list you configured for domain default routing matches the SMTP envelope recipient instead of the correspondent of the message.` Else, if this log field value is equal to `63`, then the `additional.fields` UDM field is set to `63 - Message triggered a domain-level rerouting rule, which you configured for domain routing, or domain default routing`.
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.intValue[moderation_reason]`	`about.labels[moderation_reason]` (deprecated)
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.intValue[moderation_reason]`	`additional.fields[moderation_reason]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.intValue[moderation_status]`	`about.labels[moderation_status]` (deprecated)
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.intValue[moderation_status]`	`additional.fields[moderation_status]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.intValue[num_message_attachments]`	`about.labels[num_message_attachments]` (deprecated)
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.intValue[num_message_attachments]`	`additional.fields[num_message_attachments]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.intValue[sequence_number]`	`about.labels[sequence_number]` (deprecated)
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.intValue[sequence_number]`	`additional.fields[sequence_number]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.intValue[smime_content_type]`	`about.labels[smime_content_type]` (deprecated)	If this log field value is equal to `0`, then the `about.labels` UDM field is set to `0 - Message does not have a recognized S/MIME Content-Type.` Else, if this log field value is equal to `1`, then the `about.labels` UDM field is set to `1 - An S/MIME message with a detached signature Indicated by content type multipart/signed with parameter protocol=application/pkcs7-signature.` Else, if this log field value is equal to `2`, then the `about.labels` UDM field is set to `2 - An S/MIME message with an opaque signature Indicated by content type application/pkcs7-mime or application/x-pkcs7-mime with parameter smime-type=signed-data.` Else, if this log field value is equal to `3`, then the `about.labels` UDM field is set to `3 - An S/MIME message that is encrypted Indicated by content type application/pkcs7-mime or application/x-pkcs7-mime with parameter smime-type=enveloped-data.` Else, if this log field value is equal to `4`, then the `about.labels` UDM field is set to `4 - An S/MIME message that is compressed Indicated by content type application/pkcs7-mime or application/x-pkcs7-mime with parameter smime-type=compressed-data.`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.intValue[smime_content_type]`	`additional.fields[smime_content_type]`	If this log field value is equal to `0`, then the `additional.fields` UDM field is set to `0 - Message does not have a recognized S/MIME Content-Type.` Else, if this log field value is equal to `1`, then the `additional.fields` UDM field is set to `1 - An S/MIME message with a detached signature Indicated by content type multipart/signed with parameter protocol=application/pkcs7-signature.` Else, if this log field value is equal to `2`, then the `additional.fields` UDM field is set to `2 - An S/MIME message with an opaque signature Indicated by content type application/pkcs7-mime or application/x-pkcs7-mime with parameter smime-type=signed-data.` Else, if this log field value is equal to `3`, then the `additional.fields` UDM field is set to `3 - An S/MIME message that is encrypted Indicated by content type application/pkcs7-mime or application/x-pkcs7-mime with parameter smime-type=enveloped-data.` Else, if this log field value is equal to `4`, then the `additional.fields` UDM field is set to `4 - An S/MIME message that is compressed Indicated by content type application/pkcs7-mime or application/x-pkcs7-mime with parameter smime-type=compressed-data.`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.boolValue[smime_encrypt_message]`	`about.labels[smime_encrypt_message]` (deprecated)
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.boolValue[smime_encrypt_message]`	`additional.fields[smime_encrypt_message]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.boolValue[smime_extraction_success]`	`about.labels[smime_extraction_success]` (deprecated)
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.boolValue[smime_extraction_success]`	`additional.fields[smime_extraction_success]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.boolValue[smime_packaging_success]`	`about.labels[smime_packaging_success]` (deprecated)
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.boolValue[smime_packaging_success]`	`additional.fields[smime_packaging_success]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.boolValue[smime_sign_message]`	`about.labels[smime_sign_message]` (deprecated)
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.boolValue[smime_sign_message]`	`additional.fields[smime_sign_message]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[spf_pass]`	`about.labels[spf_pass]` (deprecated)
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[spf_pass]`	`additional.fields[spf_pass]`
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[tls_required_but_unavailable]`	`about.labels[tls_required_but_unavailable]` (deprecated)
`gmail`	`events.parameters[delivery].msgValue[message_info].parameter.msgValue[connection_info].parameter.boolValue[tls_required_but_unavailable]`	`additional.fields[tls_required_but_unavailable]`

Referência de mapeamento de campo: tipos de registro WORKSPACE_ALERTS para o tipo de evento do UDM

A tabela a seguir lista os tipos de registro WORKSPACE_ALERTS e os tipos de evento do UDM correspondentes.

Event Identifier	Event Type	Security Category
`Customer takeout initiated`	`STATUS_UPDATE`
`Malware reclassification`	`EMAIL_TRANSACTION`	`MAIL_PHISHING`
`Misconfigured whitelist`	`EMAIL_TRANSACTION`	`MAIL_PHISHING`
`Phishing reclassification`	`EMAIL_TRANSACTION`	`MAIL_PHISHING`
`Suspicious message reported`	`EMAIL_TRANSACTION`	`MAIL_PHISHING`
`User reported phishing`	`EMAIL_TRANSACTION`	`MAIL_PHISHING`
`User reported spam spike`	`EMAIL_TRANSACTION`	`MAIL_PHISHING`
`Leaked password`	`USER_LOGIN`	`ACL_VIOLATION`
`Suspicious login`	`USER_LOGIN`	`ACL_VIOLATION`
`Suspicious login (less secure app)`	`USER_LOGIN`	`ACL_VIOLATION`
`Suspicious programmatic login`	`USER_LOGIN`	`ACL_VIOLATION`
`User suspended`	`USER_UNCATEGORIZED`	`ACL_VIOLATION`
`User suspended (spam)`	`USER_UNCATEGORIZED`	`ACL_VIOLATION`
`User suspended (spam through relay)`	`USER_UNCATEGORIZED`	`ACL_VIOLATION`
`User suspended (suspicious activity)`	`USER_UNCATEGORIZED`	`ACL_VIOLATION`
`Google Operations`	`STATUS_UPDATE`
`Configuration problem`	`STATUS_UNCATEGORIZED`
`Government attack warning`	`STATUS_UNCATEGORIZED`
`Device compromised`	`GENERIC_EVENT`
`Suspicious activity`	`USER_UNCATEGORIZED`
`AppMaker Default Cloud SQL setup`	`USER_RESOURCE_ACCESS`
`Activity Rule`	`STATUS_UNCATEGORIZED / USER_UNCATEGORIZED / EMAIL_UNCATEGORIZED`	`POLICY_VIOLATION`
`Data Loss Prevention`	`USER_UNCATEGORIZED`	`POLICY_VIOLATION`
`Apps outage`	`STATUS_UPDATE`
`Primary admin changed`	`USER_UNCATEGORIZED`
`SSO profile added`	`USER_RESOURCE_CREATION`
`SSO profile updated`	`USER_RESOURCE_UPDATE_CONTENT`
`SSO profile deleted`	`USER_RESOURCE_DELETION`
`Super admin password reset`	`USER_CHANGE_PASSWORD`
`User deleted`	`USER_DELETION`
`New user added`	`USER_CREATION`
`User password changed`	`USER_CHANGE_PASSWORD`
`Users Admin privilege revoked`	`USER_CHANGE_PERMISSIONS`
`Suspended user made active`	`USER_UNCATEGORIZED`
`User granted Admin privilege`	`USER_CHANGE_PERMISSIONS`
`User suspended (Administrator email alert)`	`USER_UNCATEGORIZED`
`Drive settings changed`	`USER_RESOURCE_ACCESS`
`Calendar settings changed`	`USER_RESOURCE_ACCESS`
`Reporting Rule`	`STATUS_UPDATE`

Referência de mapeamento de campo: WORKSPACE_ALERTS

A tabela a seguir lista os campos de registro do tipo de registro WORKSPACE_ALERTS e os campos de UDM correspondentes.

Log field	UDM mapping	Logic
`data.domainId.customerPrimaryDomain`	`about.administrative_domain`
`data.messages.attachmentsSha256Hash`	`about.file.sha256`
`data.mergeInfo.newAlertId`	`about.labels[new_alert_id]` (deprecated)
`data.mergeInfo.newAlertId`	`additional.fields[new_alert_id]`
`data.mergeInfo.newIncidentTrackingId`	`about.labels[new_incident_tracking_id]` (deprecated)
`data.mergeInfo.newIncidentTrackingId`	`additional.fields[new_incident_tracking_id]`
`data.nextUpdateTime`	`about.labels[next_update_time]` (deprecated)
`data.nextUpdateTime`	`additional.fields[next_update_time]`
`data.resolutionTime`	`about.labels[resolution_time]` (deprecated)
`data.resolutionTime`	`additional.fields[resolution_time]`
`data.status`	`about.labels[status]` (deprecated)
`data.status`	`additional.fields[status]`
`data.incidentTrackingId`	`about.labels[tracking_id]` (deprecated)
`data.incidentTrackingId`	`additional.fields[tracking_id]`
`customerId`	`about.resource.product_object_id`	If the `customerId` log field value is not empty, then the `customerId` log field is mapped to the `about.resource.product_object_id` UDM field. Else, the `metadata.customerId` log field is mapped to the `about.resource.product_object_id` UDM field.
`metadata.customerId`	`about.resource.product_object_id`	If the `customerId` log field value is not empty, then the `customerId` log field is mapped to the `about.resource.product_object_id` UDM field. Else, the `metadata.customerId` log field is mapped to the `about.resource.product_object_id` UDM field.
	`about.resource.resource_type`	The `about.resource.resource_type` UDM field is set to `CLOUD_ORGANIZATION`.
`data.dashboardUri`	`about.url`
`data.attachmentData.csv.dataRows.entries`	`additional.fields.entries`
`data.attachmentData.csv.headers`	`additional.fields.header`
	`event.idm.is_alert`	The `event.idm.is_alert` UDM field is set to `TRUE`.
	`event.idm.is_significant`	If the `data.@type` log field value is equal to `ActivityRule` and the `metadata.severity` log field value is equal to `HIGH`, then the `event.idm.is_significant` UDM field is set to `true`.
	`extensions.auth.mechanism`	If the `data.@type` log field value is equal to `AccountWarning`, then the `extensions.auth.mechanism` UDM field is set to `USERNAME_PASSWORD`.
	`extensions.auth.type`	If the `data.@type` log field value is equal to `AccountWarning`, then the `extensions.auth.type` UDM field is set to `SSO`.
`data.description`	`metadata.description`
`createTime`	`metadata.event_timestamp`
`data.@type`	`metadata.product_event_type`
`etag`	`metadata.product_log_id`	If the `etag` log field value is not empty, then the `etag` log field is mapped to the `metadata.product_log_id` UDM field. Else, the `alertId` log field is mapped to the `metadata.product_log_id` UDM field.
`metadata.etag`	`metadata.product_log_id`	If the `metadata.etag` log field value is not empty, then the `metadata.etag` log field is mapped to the `metadata.product_log_id` UDM field. Else, the `alertId` log field is mapped to the `metadata.product_log_id` UDM field.
	`metadata.product_name`	The `metadata.product_name` UDM field is set to `WORKSPACE_ALERTS`.
	`metadata.vendor_name`	The `metadata.vendor_name` UDM field is set to `GOOGLE`.
`data.maliciousEntity.fromHeader`	`network.email.from`
`data.messages.messageId`	`network.email.mail_id`
`data.messages.subjectText`	`network.email.subject`
`data.messages.recipient`	`network.email.to`
`data.ruleViolationInfo.recipients`	`network.email.to`	If the `data.ruleViolationInfo.recipients` log field value matches the regular expression pattern `^.+@.+$`, then the `data.ruleViolationInfo.recipients` log field is mapped to the `network.email.to` UDM field.
`data.ruleViolationInfo.recipients`	`additional.fields[recipients]`	If the `data.ruleViolationInfo.recipients` log field value is equal to `anyone`, then the `data.ruleViolationInfo.recipients` log field is mapped to the `additional.fields` UDM field.
`data.ruleViolationInfo.recipients`	`target.domain.name`	If the `data.ruleViolationInfo.recipients` log field value matches the regular expression pattern `^[a-zA-Z0-9][a-zA-Z0-9-]{1,61}[a-zA-Z0-9](?:\.[a-zA-Z]{2,})+$`, then the first occurrence of the matching value in the `data.ruleViolationInfo.recipients` log field is mapped to the `target.domain.name` UDM field and the other occurrences are mapped to the `additional.fields[domain_recipients]` UDM field.
`data.sourceIp`	`principal.ip`
`data.loginDetails.ipAddress`	`principal.ip`
`data.maliciousEntity.displayName`	`principal.labels[malicious_entity_display_name]` (deprecated)
`data.maliciousEntity.displayName`	`additional.fields[malicious_entity_display_name]`
`data.requestInfo.appDeveloperEmail`	`principal.user.email_addresses`
`data.actorEmail`	`principal.user.email_addresses`
`data.ruleViolationInfo.triggeringUserEmail`	`principal.user.email_addresses`
`data.email`	`principal.user.email_addresses`
`data.domain`	`security_result.about.administrative_domain`
`metadata.assignee`	`security_result.about.labels[assignee]` (deprecated)
`metadata.assignee`	`additional.fields[assignee]`
`data.header`	`security_result.about.labels[header]` (deprecated)
`data.header`	`additional.fields[header]`
`data.ruleViolationInfo.suppressedActionTypes`	`security_result.about.labels[suppressed_action_types]` (deprecated)
`data.ruleViolationInfo.suppressedActionTypes`	`additional.fields[suppressed_action_types]`
`data.title`	`security_result.about.labels[title]` (deprecated)
`data.title`	`additional.fields[title]`
`alertId`	`security_result.about.object_reference`
`data.affectedUserEmails`	`security_result.about.user.email_addresses`
`data.ruleViolationInfo.triggeredActionTypes`	`security_result.action_details`
	`security_result.action_type`	If the `data.ruleViolationInfo.triggeredActionTypes` log field value is equal to `ACTION_TYPE_UNSPECIFIED`, then the `security_result.action_type` UDM field is set to `UNKNOWN_ACTION`. If the `data.ruleViolationInfo.triggeredActionTypes` log field value is equal to `DRIVE_BLOCK_EXTERNAL_SHARING`, then the `security_result.action_type` UDM field is set to `BLOCK`. If the `data.ruleViolationInfo.triggeredActionTypes` log field value is equal to `DRIVE_WARN_ON_EXTERNAL_SHARING` or `ALERT` or `RULE_ACTIVATE` or `RULE_DEACTIVATE`, then the `security_result.action_type` UDM field is set to `ALLOW`.
	`security_result.category`	If the `source` log field value is equal to `Gmail Phishing`, then the `security_result.category` UDM field is set to `MAIL_PHISHING`. If the `source` log field value is equal to `Google Identity`, then the `security_result.category` UDM field is set to `ACL_VIOLATION`. If the `source` log field value is equal to `Security Center rules` or `Data Loss Prevention`, then the `security_result.category` UDM field is set to `POLICY_VIOLATION`.
`source`	`security_result.category_details`
`data.actionNames`	`security_result.detection_fields[action_names]`
`data.alertDetails`	`security_result.detection_fields[alert_details]`
`data.createTime`	`security_result.detection_fields[create_time]`
`data.messages.date`	`security_result.detection_fields[date]`	If the `source` log field value is equal to `Gmail phishing`, then the `data.messages.date` log field is mapped to the `security_result.detection_fields` UDM field.
`data.events.deviceCompromisedState`	`security_result.detection_fields[device_compromised_state]`
`data.displayName`	`security_result.detection_fields[display_name]`
`data.eventTime`	`security_result.detection_fields[event_time]`
`data.isInternal`	`security_result.detection_fields[is_internal]`
`data.loginDetails.loginTime`	`security_result.detection_fields[login_time]`
`data.messages.md5HashMessageBody`	`security_result.detection_fields[md5_hash_message_body]`	If the `source` log field value is equal to `Gmail phishing`, then the `data.messages.md5HashMessageBody` log field is mapped to the `security_result.detection_fields` UDM field.
`data.messages.md5hashsubject`	`security_result.detection_fields[md5_hash_subject]`	If the `source` log field value is equal to `Gmail phishing`, then the `data.messages.md5hashsubject` log field is mapped to the `security_result.detection_fields` UDM field.
`data.messages.messageBodySnippet`	`security_result.detection_fields[message_body_snippet]`
`metadata.status`	`security_result.detection_fields[metadata_status]`
`data.query`	`security_result.detection_fields[query]`
`securityInvestigationToolLink`	`security_result.detection_fields[security_investigation_tool_link]`
`startTime`	`security_result.detection_fields[start_time]`
`data.supersededAlerts`	`security_result.detection_fields[superseded_alerts]`
`data.supersedingAlert`	`security_result.detection_fields[superseding_alert]`
`data.systemActionType`	`security_result.detection_fields[system_action_type]`
`data.threshold`	`security_result.detection_fields[threshold]`
`data.triggerSource`	`security_result.detection_fields[trigger_source]`
`data.ruleViolationInfo.trigger`	`security_result.detection_fields[trigger]`
`data.updateTime`	`security_result.detection_fields[update_time]`
`data.windowSize`	`security_result.detection_fields[windows_size]`
`data.ruleViolationInfo.ruleInfo.resourceName`	`security_result.rule_id`
`data.ruleViolationInfo.matchInfo.userDefinedDetector.displayName`	`security_result.rule_labels[detector_display_name]`
`data.ruleViolationInfo.matchInfo.predefinedDetector.detectorName`	`security_result.rule_labels[detector_name]`
`data.ruleViolationInfo.matchInfo.userDefinedDetector.resourceName`	`security_result.rule_labels[detector_resource_name]`
`data.name`	`security_result.rule_name`
`data.ruleViolationInfo.ruleInfo.displayName`	`security_result.rule_name`
`metadata.severity`	`security_result.severity`
`type`	`security_result.summary`
`data.type`	`security_result.summary`	If the `type` log field value is empty, then the `data.type` log field is mapped to the `security_result.summary` UDM field.
	`security_result.alert_state`	The `security_result.alert_state` UDM field is set to `ALERTING`.
`data.requestInfo.appKey`	`target.application`
`data.events.deviceId`	`target.asset.asset_id`
`data.events.deviceProperty`	`target.asset.attribute.labels[device_property]`
`data.events.iosVendorId`	`target.asset.attribute.labels[ios_vendor_id]`
`data.events.newValue`	`target.asset.attribute.labels[new_value]`
`data.events.oldValue`	`target.asset.attribute.labels[old_value]`
`data.events.resourceId`	`target.asset.attribute.labels[resource_id]`
`data.events.deviceModel`	`target.asset.hardware.model`
`data.events.serialNumber`	`target.asset.hardware.serial_number`
`data.events.deviceType`	`target.asset.type`
`data.primaryAdminChangedEvent.domain`	`target.domain.name`
`data.ssoProfileUpdatedEvent.inboundSsoProfileChanges`	`target.labels[inbound_sso_profile_changes]` (deprecated)
`data.ssoProfileUpdatedEvent.inboundSsoProfileChanges`	`additional.fields[inbound_sso_profile_changes]`
`data.requestInfo.numberOfRequests`	`target.labels[number_of_requests]` (deprecated)
`data.requestInfo.numberOfRequests`	`additional.fields[number_of_requests]`
`data.primaryAdminChangedEvent.previousAdminEmail`	`target.labels[previous_admin_email]` (deprecated)
`data.primaryAdminChangedEvent.previousAdminEmail`	`additional.fields[previous_admin_email]`
`data.products`	`target.labels[product]` (deprecated)
`data.products`	`additional.fields[product]`
`data.ruleViolationInfo.resourceInfo.resourceTitle`	`target.labels[resource_title]` (deprecated)
`data.ruleViolationInfo.resourceInfo.resourceTitle`	`additional.fields[resource_title]`
`data.takeoutRequestId`	`target.labels[takeout_request_id]` (deprecated)
`data.takeoutRequestId`	`additional.fields[takeout_request_id]`
`data.ruleViolationInfo.dataSource`	`target.resource.name`
`data.ssoProfileCreatedEvent.inboundSsoProfileName`	`target.resource.name`
`data.ssoProfileUpdatedEvent.inboundSsoProfileName`	`target.resource.name`
`data.ssoProfileDeletedEvent.inboundSsoProfileName`	`target.resource.name`
`data.ruleViolationInfo.resourceInfo.documentId`	`target.resource.product_object_id`
	`target.resource.resource_type`	If the `data.@type` log field value is equal to `DlpRuleViolation`, then the `target.resource.resource_type` UDM field is set to `STORAGE_OBJECT`. If the `data.@type` log field value is equal to `AppMakerSqlSetupNotification`, then the `target.resource.resource_type` UDM field is set to `DATABASE`. If the `data.type` log field value is equal to `SSO profile added` or `SSO profile updated` or `SSO profile deleted`, then the `target.resource.resource_type` UDM field is set to `SETTING`.
`data.maliciousEntity.entity.emailAddress`	`target.user.email_addresses`
`data.email`	`target.user.email_addresses`	If the `data.@type` log field value is equal to `StateSponsoredAttack`, `DeviceCompromised`, or `AccountWarning`, then the `data.email` log field is mapped to the `target.user.email_addresses` UDM field. Else, the `data.email` log field is mapped to the `principal.user.email_addresses` UDM field.
`data.primaryAdminChangedEvent.updatedAdminEmail`	`target.user.email_addresses`
`data.superAdminPasswordResetEvent.userEmail`	`target.user.email_addresses`
`data.maliciousEntity.entity.displayName`	`target.user.user_display_name`
`data.ruleViolationInfo.triggeredActionInfo`

Referência de mapeamento de campo: WORKSPACE_GROUPS

A tabela a seguir lista os campos de registro do tipo de registro WORKSPACE_GROUPS e os campos de UDM correspondentes.

Log field	UDM mapping	Logic
`adminCreated`	`entity.group.attribute.labels[admin_created]`	If the `adminCreated` log field value is equal to `true`, then the `admin_created.value` UDM field is set to `true`. Else, the `admin_created.value` UDM field is set to `false`.
`description`	`metadata.description`
`directMembersCount`	`entity.group.attribute.labels[direct_members_count]`
`email`	`entity.group.email_addresses`
`nonEditableAliases`	`entity.group.email_addresses`
`aliases`	`entity.group.email_addresses`
`etag`	`entity.labels[etag]` (deprecated)
`etag`	`additional.fields[etag]`
`id`	`entity.group.product_object_id`
`kind`	`entity.labels[kind]` (deprecated)
`kind`	`additional.fields[kind]`
`name`	`entity.group.group_display_name`
	`metadata.vendor_name`	The `metadata.vendor_name` UDM field is set to `GOOGLE`.
	`metadata.product_name`	The `metadata.product_name` UDM field is set to `WORKSPACE GROUPS`.
	`metadata.entity_type`	The `metadata.entity_type` UDM field is set to `GROUP`.

Referência de mapeamento de campo: WORKSPACE_USERS

A tabela a seguir lista os campos de registro do tipo WORKSPACE_USERS e os campos correspondentes do UDM.

Log field	UDM mapping	Logic
`addresses.country`	`entity.user.personal_address.country_or_region`
`addresses.countryCode`	`entity.user.attribute.labels[addresses_country_code]`
`addresses.customType`	`entity.user.attribute.labels[addresses_custom_type]`
`addresses.extendedAddress`	`entity.user.attribute.labels[addresses_extended_address]`
`addresses.formatted`	`entity.user.office_address.name`	The `addresses.formatted` log field is mapped to the `user.office_address.name` UDM field if the following conditions are met: The `message` log field value matches the regular expression pattern `addresses.?formatted`. The `addresses.type` log field value is equal to `work`. The `addresses.formatted` log field value is not* empty.
`addresses.locality`	`entity.user.attribute.labels[addresses_locality]`
`addresses.poBox`	`entity.user.attribute.labels[addresses_pobox]`
`addresses.postalCode`	`entity.user.attribute.labels[addresses_postal_code]`
`addresses.primary`	`entity.user.attribute.labels[addresses_primary]`
`addresses.region`	`entity.user.attribute.labels[addresses_region]`
`addresses.sourceIsStructured`	`entity.user.attribute.labels[addresses_source_is_structured]`
`addresses.streetAddress`	`entity.user.attribute.labels[addresses_street_address]`
`addresses.type`	`entity.user.attribute.labels[addresses_type]`
`agreedToTerms`	`entity.user.attribute.labels[agreed_to_terms]`
`aliases`	`entity.user.attribute.labels[aliases_email]`
`changePasswordAtNextLogin`	`entity.user.attribute.labels[change_password_at_next_login]`	If the `changePasswordAtNextLogin` log field value is equal to `true`, then the `change_password_at_next_login.value` UDM field is set to `true`. Else, the `change_password_at_next_login.value` UDM field is set to `false`.
`creationTime`	`entity.user.attribute.creation_time`
`customerId`	`entity.user.attribute.labels[customer_id]`
`deletionTime`	`entity.user.attribute.labels[deletion_time]`
`emails.customType`	`entity.user.attribute.labels[email_acustom_type]`
`emails.primary`	`entity.user.attribute.labels[email_primary]`
`emails.type`	`entity.user.attribute.labels[email_type]`
`etag`	`entity.labels[etag]` (deprecated)
`etag`	`additional.fields[etag]`
`externalIds.customType`	`entity.user.attribute.labels[external_id_custom_type]`
`externalIds.type`	`entity.user.attribute.labels[external_id_type]`
`externalIds.value`	`entity.user.employee_id`	If the `externalIds.type` log field value is equal to `organization`, then the `externalIds.value` log field is mapped to the `user.employee_id` UDM field.
`gender.addressMeAs`	`entity.user.attribute.labels[gender_address_me_as]`
`gender.customGender`	`entity.user.attribute.labels[custom_gender]`
`gender.type`	`entity.user.attribute.labels[gender]`
`hashFunction`	`entity.user.attribute.labels[hash_function]`
`id`	`entity.user.product_object_id`
`ims.customProtocol`	`entity.user.attribute.labels[ims_custom_protocol]`
`ims.customType`	`entity.user.attribute.labels[ims_custom_type]`
`ims.im`	`entity.user.attribute.labels[ims_im]`
`ims.primary`	`entity.user.attribute.labels[ims_primary]`
`ims.protocol`	`entity.user.attribute.labels[ims_protocol]`
`ims.type`	`entity.user.attribute.labels[ims_type]`
`includeInGlobalAddressList`	`entity.user.attribute.labels[included_in_global_address_list]`	If the `includeInGlobalAddressList` log field value is equal to `true`, then the `included_in_global_address_list.value` UDM field is set to `true`, else, then the `included_in_global_address_list.value` UDM field is set to `false`.
`ipWhitelisted`	`entity.user.attribute.labels[ip_whitelisted]`
`isAdmin`	`entity.user.attribute.labels[is_admin]`
`isDelegatedAdmin`	`entity.user.attribute.labels[is_delegated_admin]`
	`user.attribute.roles.type`	If the `isAdmin` log field value or the `isDelegatedAdmin` log field value is equal to `true`, then the `user.attribute.roles.type` UDM field is set to `ADMINISTRATOR`.
`isEnforcedIn2Sv`	`entity.user.attribute.labels[is_enforced_in_2sv]`	If the `isEnforcedIn2Sv` log field value is equal to `true`, then the `is_enforced_in_2sv.value` UDM field is set to `true`, else, then the `is_enforced_in_2sv.value` UDM field is set to `false`.
`isEnrolledIn2Sv`	`entity.user.attribute.labels[is_enrolled_in_2sv]`	If the `isEnrolledIn2Sv` log field value is equal to `true`, then the `is_enrolled_in_2sv.value` UDM field is set to `true`, else, then the `is_enrolled_in_2sv.value` UDM field is set to `false`.
`isMailboxSetup`	`entity.user.attribute.labels[is_mailbox_setup]`	If the `isMailboxSetup` log field value is equal to `true`, then the `is_mail_box_setup.value` UDM field is set to `true`, else, then the `is_mail_box_setup.value` UDM field is set to `false`.
`keywords.customType`	`entity.user.attribute.labels[keywords_custom_type]`
`keywords.type`	`entity.user.attribute.labels[keywords_type]`
`keywords.value`	`entity.user.attribute.labels[keywords_value]`
`kind`	`entity.labels[kind]` (deprecated)
`kind`	`additional.fields[kind]`
`languages.customLanguage`	`entity.user.attribute.labels[language_custom_language]`
`languages.languageCode`	`entity.user.attribute.labels[language_code]`
`languages.preference`	`entity.user.attribute.labels[preferred_language]`
`lastLoginTime`	`entity.user.last_login_time`
`locations.area`	`entity.user.office_address.country_or_region`
`locations.buildingId`	`entity.user.attribute.labels[locations_buildingId]`
`locations.customType`	`entity.user.attribute.labels[locations_customType]`
`locations.deskCode`	`entity.user.officel_address.desk_name`
`locations.floorName`	`entity.user.office_address.floor_name`
`locations.floorSection`	`entity.user.attribute.labels[locations_floorSection]`
`locations.type`	`entity.user.attribute.labels[locations_type]`
`name.familyName`	`entity.user.last_name`
`name.fullName`	`entity.user.user_display_name`
`name.givenName`	`entity.user.first_name`
`notes.contentType`	`entity.user.attribute.labels[notes_content_type]`
`notes.value`	`entity.user.attribute.labels[notes_value]`
`organizations.costCenter`	`entity.user.attribute.labels[organization_cost_center]`
`organizations.customType`	`entity.user.attribute.labels[organization_custom_type]`
`organizations.department`	`entity.user.department`	The `organizations.department` log field is mapped to the `user.department` UDM field if the following conditions are met: The `message` log field value matches the regular expression pattern `organizations.?department`. The `org.department` log field value is not* empty.
`organizations.description`	`entity.user.attribute.labels [organizations_description]`
`organizations.domain`	`entity.user.attribute.labels[organization_domain]`
`organizations.fullTimeEquivalent`	`entity.user.attribute.labels[organization_full_time_equivalent]`
`organizations.location`	`entity.user.attribute.labels[organization_location]`
`organizations.name`	`entity.user.attribute.labels[organization_name]`
`organizations.primary`	`entity.user.attribute.labels[organization_primary]`
`organizations.symbol`	`entity.user.attribute.labels[organization_symbol]`
`organizations.title`	`entity.user.title`
`organizations.type`	`entity.user.attribute.labels[organization_type]`
`orgUnitPath`	`entity.user.attribute.labels[org_unit_path]`
`password`	`entity.user.attribute.labels[password]`
`phones.customType`	`entity.user.attribute.labels[phone_custom_type]`
`phones.primary`	`entity.user.attribute.labels[phone_primary]`
`phones.type`	`entity.user.attribute.labels[phone_type]`
`phones.value`	`entity.user.phone_numbers`	If the `phones.value` log field value matches the regular expression pattern `(^the +.0-9 log field value*)`, then the `phones.value` log field is mapped to the `user.phone_numbers` UDM field.
`recoveryPhone`	`entity.user.phone_numbers`
`posixAccounts.accountId`	`entity.user.attribute.labels[posix_account_id]`
`posixAccounts.gecos`	`entity.user.attribute.labels[posix_account_gecos]`
`posixAccounts.gid`	`entity.user.group_identifiers`
`posixAccounts.homeDirectory`	`entity.user.attribute.labels[posix_account_home_directory]`
`posixAccounts.operatingSystemType`	`entity.platform`	If the `posixAccounts.operatingSystemType` log field value is equal to `linux`, then the `entity.platform` UDM field is set to `LINUX`. If the `posixAccounts.operatingSystemType` log field value is equal to `windows`, then the `entity.platform` UDM field is set to `WINDOWS`. Else, the `entity.platform` UDM field is set to `UNKNOWN_PLATFORM`.
`posixAccounts.primary`	`entity.user.attribute.labels[posix_account_primary]`
`posixAccounts.shell`	`entity.user.attribute.labels[posix_account_shell]`
`posixAccounts.systemId`	`entity.asset.asset_id`
`posixAccounts.uid`	`entity.user.attribute.labels[posix_account_uid]`
`posixAccounts.username`	`entity.user.userid`	If the `posixAccounts.username` log field value is not empty, then the `posixAccounts.username` log field is mapped to the `entity.user.userid` UDM field.
`primaryEmail`	`entity.user.email_addresses`
`recoveryEmail`	`entity.user.email_addresses`
`nonEditableAliases`	`entity.user.email_addresses`
`emails.address`	`entity.user.email_addresses`	If the `emails.address` log field value is not equal to `primaryEmail`, then the `emails.address` log field is mapped to the `entity.user.email_addresses` UDM field.
`relations.customType`	`entity.user.attribute.labels[relations_custom_type]`
`relations.type`	`entity.user.attribute.labels[relation_type]`
`relations.value`	`entity.user.managers.email_addresses`	If the `relation.type` log field value is equal to `manager`, then the `relations.value` log field is mapped to the `user.managers.email_addresses` UDM field. Else, the `relations.value` log field is mapped to the `user.attribute.labels` UDM field.
`relations.value`	`entity.user.attribute.labels[relations_type]`	If the `relation.type` log field value is equal to `manager`, then the `relations.value` log field is mapped to the `user.managers.email_addresses` UDM field. Else, the `relations.value` log field is mapped to the `user.attribute.labels` UDM field.
`sshPublicKeys.expirationTimeUsec`	`entity.user.attribute.labels[ssh_key_expiration_timec]`
`sshPublicKeys.fingerprint`	`entity.user.attribute.labels[ssh_key_fingerprint]`
`sshPublicKeys.key`	`entity.user.attribute.labels[ssh_key]`
`suspended`	`entity.user.user_authentication_status`	If the `suspended` log field value is equal to `true` and the `archived` log field value is not equal to `true`, then the `entity.user.user_authentication_status` UDM field is set to `SUSPENDED`. If the `archived` log field value is equal to `true`, then the `entity.user.user_authentication_status` UDM field is set to `DELETED`. Else, the `entity.user.user_authentication_status` UDM field is set to `ACTIVE`.
`archived`	`entity.user.user_authentication_status`	If the `suspended` log field value is equal to `true` and the `archived` log field value is not equal to `true`, then the `entity.user.user_authentication_status` UDM field is set to `SUSPENDED`. If the `archived` log field value is equal to `true`, then the `entity.user.user_authentication_status` UDM field is set to `DELETED`. Else, the `entity.user.user_authentication_status` UDM field is set to `ACTIVE`.
`suspensionReason`	`entity.user.attribute.labels[suspension_reason]`
`thumbnailPhotoEtag`	`entity.user.attribute.labels[thumbnail_photo_etag]`
`thumbnailPhotoUrl`	`entity.url`
`websites.customType`	`entity.user.attribute.labels[websites_custom_type]`
`websites.primary`	`entity.user.attribute.labels[websites_primary]`
`websites.type`	`entity.user.attribute.labels[websites_type]`
`websites.value`	`entity.user.attribute.labels[websites_value]`
	`metadata.vendor_name`	The `metadata.vendor_name` UDM field is set to `GOOGLE`.
	`metadata.product_name`	The `metadata.product_name` UDM field is set to `Cloud Identity`.
	`metadata.entity_type`	The `metadata.entity_type` UDM field is set to `USER`.

Referência de mapeamento de campo: WORKSPACE_MOBILE_DEVICE

A tabela a seguir lista os campos de registro do tipo de registro WORKSPACE_MOBILE_DEVICES e os campos de UDM correspondentes.

Log field	UDM mapping	Logic
`adbStatus`	`entity.asset.attribute.labels[abd status]`
`applications.displayName`	`entity.asset.software.name`
`applications.packageName`	`entity.asset.attribute.labels[application_package_name]`
`applications.permission`	`entity.asset.software.permissions.name`
`applications.versionCode`	`entity.asset.attribute.labels[application_version_code]`
`applications.versionName`	`entity.asset.software.version`
`basebandVersion`	`entity.asset.attribute.labels[baseband_version]`
`bootloaderVersion`	`entity.asset.attribute.labels[bootloader_version]`
`brand`	`entity.asset.attribute.labels[brand]`
`buildNumber`	`entity.asset.attribute.labels[build_number]`
`defaultLanguage`	`entity.asset.attribute.labels[default_language]`
`developerOptionsStatus`	`entity.asset.attribute.labels[developer_options_status]`
`deviceCompromisedStatus`	`entity.asset.attribute.labels[device_compromised_status]`
`deviceId`	`entity.asset.asset_id`
`devicePasswordStatus`	`entity.asset.attribute.labels[device_password_status]`
`email`	`entity.user.email_addresses`
`encryptionStatus`	`entity.asset.attribute.labels[encryption_status]`
`etag`	`entity.labels[etag]` (deprecated)
`etag`	`additional.fields[etag]`
`firstSync`	`entity.asset.attribute.labels[first_sync]`
`hardware`	`entity.asset.attribute.labels[hardware]`
`hardwareId`	`entity.asset.attribute.labels[hardware_id]`
`imei`	`entity.asset.asset_id`
`deviceId`	`entity.asset.asset_id`	If the `imei` log field value is empty, then the `deviceId` log field is mapped to the `entity.asset.asset_id` UDM field.
`kernelVersion`	`entity.asset.attribute.labels[kernel_version]`
`kind`	`entity.labels[kind]` (deprecated)
`kind`	`additional.fields[kind]`
`lastSync`	`entity.asset.attribute.labels[last_sync]`
`managedAccountIsOnOwnerProfile`	`entity.asset.attribute.labels[managed_account_is_on_owner_profile]`
`manufacturer`	`entity.asset.hardware.manufacturer`
`meid`	`entity.asset.attribute.labels[meid]`
`model`	`entity.asset.hardware.model`
`name`	`entity.user.user_display_name`
`networkOperator`	`entity.asset.attribute.labels[network_operator]`
`os`	`entity.asset.platform_software.platform`	If the `os` log field value matches `iOS`, then the `entity.asset.platform_software.platform` UDM field is set to `IOS`. If the `os` log field value matches `Android`, then the `entity.asset.platform_software.platform` UDM field is set to `ANDROID`. Else, the `entity.asset.platform_software.platform` UDM field is set to `UNKNOWN_PLATFORM`.
`otherAccountsInfo[]`	`entity.asset.attribute.labels[other_accounts_info]`
`privilege`	`entity.asset.attribute.labels[privilege]`
`releaseVersion`	`entity.asset.attribute.labels[release_version]`
`resourceId`	`entity.asset.product_object_id`
`securityPatchLevel`	`entity.asset.platform_software.platform_patch_level`
`serialNumber`	`entity.asset.hardware.serial_number`
`status`	`entity.user.user_authentication_status`	If the `status` log field value is equal to `approved`, then the `entity.user.user_authentication_status` UDM field is set to `ACTIVE`. If the `status` log field value is equal to `unprovisined`, then the `entity.user.user_authentication_status` UDM field is set to `SUSPENDED`.
`supportsWorkProfile`	`entity.asset.attribute.labels[supports_work_profile]`
`type`	`entity.asset.attribute.labels[type]`
`unknownSourcesStatus`	`entity.asset.attribute.labels[unknown_sources_status]`
`userAgent`	`entity.asset.attribute.labels[user_agent]`
`wifiMacAddress`	`entity.asset.mac`
	`metadata.entity_type`	The `metadata.entity_type` UDM field is set to `ASSET`.
	`metadata.product_name`	The `metadata.product_name` UDM field is set to `WORKSPACE_MOBILE`.
	`metadata.vendor_name`	The `metadata.vendor_name` UDM field is set to `GOOGLE`.
	`relations.entity_type`	The `relations.entity_type` UDM field is set to `USER`.
	`relations.relationship`	The `relations.relationship` UDM field is set to `MEMBER`.

Referência de mapeamento de campo: WORKSPACE_CHROMEOS

A tabela a seguir lista os campos de registro do tipo de registro WORKSPACE_CHROMEOS e os campos de UDM correspondentes.

Log field	UDM mapping	Logic
`activeTimeRanges.activeTime`	`entity.asset.attribute.labels[active_time]`
`activeTimeRanges.date`	`entity.asset.attribute.labels[active_time_range_date]`
`annotatedAssetId`	`entity.asset.asset_id`	If the `annotatedAssetId` log field value is not empty, then the `ASSET ID: annotatedAssetId` log field is mapped to the `entity.asset.asset_id` UDM field.
`deviceId`	`entity.asset.asset_id`	If the `annotatedAssetId` log field value is empty, then the `CHROMEOS:deviceId` log field is mapped to the `entity.asset.asset_id` UDM field.
`annotatedLocation`	`entity.asset.location.name`
`annotatedUser`	`relations.entity.user.user_display_name`	If the `annotatedUser` log field value is not empty and the `annotatedUser` log field value does not match the regular expression `@`, then the `annotatedUser` log field is mapped to the `relations.entity.user.user_display_name` UDM field.
`autoUpdateExpiration`	`entity.asset.attribute.labels[auto_update_expiration]`
`bootMode`	`entity.asset.attribute.labels[boot_mode]`
`cpuInfo.architecture`	`entity.asset.attribute.labels[cpu_architecture]`
`cpuInfo.logicalCpus.cStates.displayName`	`entity.asset.attribute.labels[cpu_logical_cups_cstates_display_name]`
`cpuInfo.logicalCpus.cStates.sessionDuration`	`entity.asset.attribute.labels[cpu_logical_cups_cstates_session_duration]`
`cpuInfo.logicalCpus.currentScalingFrequencyKhz`	`entity.asset.attribute.labels[cpu_current_scaling_frequency]`
`cpuInfo.logicalCpus.idleDuration`	`entity.asset.attribute.labels[cpu_ideal_duration]`
`cpuInfo.logicalCpus.maxScalingFrequencyKhz`	`entity.asset.attribute.labels[cpu_max_scaling_frequency]`
`cpuInfo.maxClockSpeedKhz`	`entity.asset.attribute.labels[cpu_max_clock_speed]`
`cpuInfo.model`	`entity.asset.hardware.cpu_model`
`cpuStatusReports.cpuTemperatureInfo.label`	`entity.asset.attribute.labels[cpu_temperature_label]`
`cpuStatusReports.cpuTemperatureInfo.temperature`	`entity.asset.attribute.labels[cpu_temperature]`
`cpuStatusReports.cpuUtilizationPercentageInfo`	`entity.asset.attribute.labels[cpu_utilization_percentage_info]`
`cpuStatusReports.reportTime`	`entity.asset.attribute.labels[cpu_report_time]`
`deviceFiles.createTime`	`relations.entity.file.first_seen_time`
`deviceFiles.downloadUrl`	`relations.entity.file.full_path`
`deviceFiles.name`	`relations.entity.file.names`
`deviceFiles.type`	`relations.entity.file.mime_type`
	`relations.entity_type`	The `relations.entity_type` UDM field is set to `FILE`.
	`relations.relationship`	The `relations.relationship` UDM field is set to `MEMBER`.
`deviceId`	`entity.asset.product_object_id`
`diskVolumeReports.volumeInfo.storageFree`	`entity.asset.attribute.labels[volume_info_storage_free]`
`diskVolumeReports.volumeInfo.storageTotal`	`entity.asset.attribute.labels[volume_info_storage_total]`
`diskVolumeReports.volumeInfo.volumeId`	`entity.asset.attribute.labels[volume_id]`
`dockMacAddress`	`entity.asset.attribute.labels[dock_mac_address]`
`etag`	`entity.labels[etag]` (deprecated)
`etag`	`additional.fields[etag]`
`ethernetMacAddress0`	`entity.asset.attribute.labels[ethernet_mac_address]`
`firmwareVersion`	`entity.asset.attribute.labels[firmware_version]`
`kind`	`entity.labels[kind]` (deprecated)
`kind`	`additional.fields[kind]`
`lastEnrollmentTime`	`entity.asset.last_discover_time`
`lastKnownNetwork.ipAddress`	`entity.asset.ip`
`lastKnownNetwork.wanIpAddress`	`entity.asset.nat_ip`
`lastSync`	`entity.asset.system_last_update_time`
`macAddress`	`entity.asset.mac`
`ethernetMacAddress`	`entity.asset.mac`
`manufactureDate`	`entity.asset.attribute.labels[manufacture_date]`
`meid`	`entity.asset.attribute.labels[meid]`
`model`	`entity.asset.hardware.model`
`notes`	`entity.asset.attribute.labels[notes]`
`orderNumber`	`entity.asset.attribute.labels[order_number]`
`orgUnitId`	`entity.asset.attribute.labels[org_unit_id]`
`orgUnitPath`	`entity.user.attribute.labels[org_unit_path]`
`osVersion`	`entity.asset.attribute.labels[os_version]`
`platformVersion`	`entity.asset.platform_software.platform_version`
`annotatedUser`	`entity.user.email_addresses`	If the `annotatedUser` log field value is not empty and the `annotatedUser` log field value matches the regular expression `@`, then the `annotatedUser` log field is mapped to the `entity.user.email_addresses` UDM field.
`recentUsers.email`	`entity.user.email_addresses`
`recentUsers.type`	`relations.entity.user.attribute.roles.name`
	`relations.entity.user.attribute.roles.description`	If the `recentUsers.type` log field value is equal to `USER_TYPE_MANAGED`, then the `relations.entity.user.attribute.roles.description` UDM field is set to `The user is managed by the domain`. Else, if the `recentUsers.type` log field value is equal to `USER_TYPE_UNMANAGED`, then the `relations.entity.user.attribute.roles.description` UDM field is set to `The user is not managed by the domain`.
`screenshotFiles.createTime`	`relations.entity.file.first_seen_time`
`screenshotFiles.downloadUrl`	`relations.entity.file.full_path`
`screenshotFiles.name`	`relations.entity.file.names`
`screenshotFiles.type`	`relations.entity.file.mime_type`
`serialNumber`	`entity.asset.hardware.serial_number`
`status`	`entity.asset.deployment_status`	If the `status` log field value is equal to `DEPROVISIONED`, then the `entity.asset.deployment_status` UDM field is set to `DECOMMISSIONED`. Else, the `entity.asset.deployment_status` UDM field is set to `ACTIVE`.
`supportEndDate`	`entity.asset.attribute.labels[support_end_date]`
`systemRamFreeReports.reportTime`	`entity.asset.attribute.labels[system_ram_report_time]`
`systemRamFreeReports.systemRamFreeInfo`	`entity.asset.attribute.labels[system_ram_free_info]`
`systemRamTotal`	`entity.asset.hardware.ram`
`tpmVersionInfo.family`	`entity.asset.attribute.labels[tpm_ver_info_family]`
`tpmVersionInfo.firmwareVersion`	`entity.asset.attribute.labels[tpm_ver_info_firmware_version]`
`tpmVersionInfo.manufacturer`	`entity.asset.attribute.labels[tpm_ver_info_manufacturer]`
`tpmVersionInfo.specLevel`	`entity.asset.attribute.labels[tpm_ver_info_spec_level]`
`tpmVersionInfo.tpmModel`	`entity.asset.attribute.labels[tpm_ver_info_tpm_model]`
`tpmVersionInfo.vendorSpecific`	`entity.asset.attribute.labels[tpm_ver_info_vendor_specific]`
`willAutoRenew`	`entity.asset.attribute.labels[will_auto_renew]`
	`entity.asset.type`	The `entity.asset.type` UDM field is set to `WORKSTATION`.
	`metadata.entity_type`	The `metadata.entity_type` UDM field is set to `ASSET`.
	`metadata.product_name`	The `metadata.product_name` UDM field is set to `ChromeOS`.
	`metadata.vendor_name`	The `metadata.vendor_name` UDM field is set to `GOOGLE`.
	`relations.entity_type`	The `relations.entity_type` UDM field is set to `USER`.
	`relations.relationship`	The `relations.relationship` UDM field is set to `MEMBER`.

Referência de mapeamento de campo: WORKSPACE_PRIVILEGES

A tabela a seguir lista os campos de registro do tipo WORKSPACE_PRIVILEGES e os campos correspondentes do UDM.

Log field	UDM mapping
`roleAssignments.assignedTo`	`metadata.product_entity_id`
`roleAssignments.roleAssignmentId`	`entity.user.attribute.labels[role_assignment_id]`
`roleAssignments.roleDetails.roleDescription`	`entity.user.attribute.roles.description`
`roleAssignments.roleDetails.roleId`	`entity.user.attribute.labels[role_details_role_id]`
`roleAssignments.roleDetails.roleName`	`entity.user.attribute.roles.name`
`roleAssignments.roleDetails.rolePrivileges.details.childPrivileges.etag`
`roleAssignments.roleDetails.rolePrivileges.details.childPrivileges.isOuScopable`
`roleAssignments.roleDetails.rolePrivileges.details.childPrivileges.kind`
`roleAssignments.roleDetails.rolePrivileges.details.childPrivileges.privilegeName`	`entity.user.attribute.labels[%{rolePrivilege.privilegeName}_CHILD_PRIVILEGES]`
`roleAssignments.roleDetails.rolePrivileges.details.childPrivileges.serviceId`
`roleAssignments.roleDetails.rolePrivileges.details.childPrivileges.serviceName`
`roleAssignments.roleDetails.rolePrivileges.details.etag`	`entity.labels[etag]` (deprecated)
`roleAssignments.roleDetails.rolePrivileges.details.etag`	`additional.fields[etag]`
`roleAssignments.roleDetails.rolePrivileges.details.isOuScopable`	`entity.user.attribute.labels[is_ou_scopable]`
`roleAssignments.roleDetails.rolePrivileges.details.kind`	`entity.labels[kind]` (deprecated)
`roleAssignments.roleDetails.rolePrivileges.details.kind`	`additional.fields[kind]`
`roleAssignments.roleDetails.rolePrivileges.details.privilegeName`
`roleAssignments.roleDetails.rolePrivileges.details.serviceId`
`roleAssignments.roleDetails.rolePrivileges.details.serviceName`	`entity.user.attribute.labels[service_name]`
`roleAssignments.roleDetails.rolePrivileges.privilegeName`	`entity.user.attribute.permissions.name`
`roleAssignments.roleDetails.rolePrivileges.serviceId`	`entity.user.attribute.permissions.description`
`roleAssignments.roleId`	`entity.user.attribute.labels[role_id]`
`roleAssignments.scopeType`	`entity.user.attribute.labels[scope_type]`
`userId`	`entity.user.userid`
	`metadata.vendor_name`
	`metadata.product_name`
	`metadata.entity_type`

A seguir

Ingestão de dados no Google Security Operations