Google Workspace login audit
Google Workspace login audit. Admin SDK Reports API login activity.
Source and collection
Product audit API or configured diagnostic export.
Use scoped audit-reading permissions; preserve pagination/cursors, tenant context and event identifiers.
Native example and provenance
upstream test fixture. Published example; no independent capture provenance claimed.
Original publisher / pinned upstream fixture — line 1
One complete record selected; values unchanged.
Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031
Download the exact sample · Offline research kit
SHA-256: 2651d5ec483ba038f8b32efdaadbad62d9dfe02154d215afee462b49571323e0
{"kind":"admin#reports#activity","id":{"time":"2020-10-02T15:00:00Z","uniqueQualifier":1,"applicationName":"login","customerId":"1"},"actor":{"callerType":"USER","email":"foo@bar.com","profileId":1},"ownerDomain":"elastic.com","ipAddress":"67.43.156.13","events":{"type":"account_warning","name":"account_disabled_password_leak","parameters":[{"name":"affected_email_address","value":"foo@elastic.co"}]}}
Structure and field interpretation
| Field/path | Serialized type |
|---|---|
kind | str |
id.time | str |
id.uniqueQualifier | int |
id.applicationName | str |
id.customerId | str |
actor.callerType | str |
actor.email | str |
actor.profileId | int |
ownerDomain | str |
ipAddress | str |
events.type | str |
events.name | str |
events.parameters | array |
events.parameters[0].name | str |
events.parameters[0].value | str |
- Event identity
- Use the source event ID and tenant scope to deduplicate.
- Event type
- Select the schema for this category/action.
- Timestamp
- Retain both event and ingestion time where available.
Investigation uses
- Inspect event names and typed parameters with actor and source IP.
- Compare actor and target context with approved changes and other authentication evidence.
Validation boundaries
A single Activity may contain multiple events and typed parameters.
This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.
For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.
Related sources
Ecosystem connections
- Telemetry Library — ATT&CK data components
- Detection Rules — candidate detection content
- Threat hunting — from intelligence to validated defense
- Practical security learning paths
- AdversaryGraph — evidence-led investigation
References
Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.