Device Audit Activity Events

This document lists the events and parameters for various types of Device Audit activity events. You can retrieve these events by calling Activities.list() with applicationName=mobile.

Device Applications

Device applications events in Mobile device. Events of this type are returned with type=device_applications.

Device application change

Event details
Event name	APPLICATION_EVENT
Parameters	APK_SHA256_HASH string Parameter to indicate the SHA-256 hash of an application. APPLICATION_ID string Parameter to indicate the Application Id. APPLICATION_STATE string Parameter to indicate the application install/uninstall/update done on device. Possible values: INSTALLED Application install event. NOT_PHA Potentially harmful application not flagged event. PHA Potentially harmful application detection event. UNINSTALLED Application uninstall event. UPDATED Application version update event. DEVICE_ID string Parameter to indicate the Device Id. DEVICE_MODEL string Parameter to indicate the device model. DEVICE_TYPE string Parameter to indicate the device type. Possible values: ANDROID Android. ASSISTANT Assistant. DESKTOP_CHROME Desktop Chrome. iOS iOS. LINUX Linux. MAC Mac. WINDOWS Windows. IOS_VENDOR_ID string Parameter to indicate the iOS Vendor Id. NEW_VALUE string Parameter to indicate the new value. PHA_CATEGORY string Potentially harmful app category reported by SafetyNet. Possible values: BACKDOOR EnumParameter to indicate that application package potentially contains a backdoor. CALL_FRAUD EnumParameter to indicate that application package potentially contains call fraud. DATA_COLLECTION EnumParameter to indicate that application package potentially contains data collection capabilities. DENIAL_OF_SERVICE EnumParameter to indicate that application package potentially contains denial of service logic. FRAUDWARE EnumParameter to indicate that application package is potentially fraudware. GENERIC_MALWARE EnumParameter to indicate that application package is potentially malware. HARMFUL_SITE EnumParameter to indicate that application package potentially contains harmful sites. HOSTILE_DOWNLOADER EnumParameter to indicate that application package is potentially a hostile downloader. NON_ANDROID_THREAT EnumParameter to indicate that application package potentially contains threats to non-Android systems. PHISHING EnumParameter to indicate that application package potentially contains phishing. PRIVILEGE_ESCALATION EnumParameter to indicate that application package potentially contains privilege escalation capabilities. RANSOMWARE EnumParameter to indicate that application package is potentially ransomware. ROOTING EnumParameter to indicate that application package potentially contains rooting capabilities. SPAM EnumParameter to indicate that application package potentially contains spam. SPYWARE EnumParameter to indicate that application package is potentially spyware. TOLL_FRAUD EnumParameter to indicate that application package potentially contains toll fraud. TRACKING EnumParameter to indicate that application package potentially contains tracking logic. TROJAN EnumParameter to indicate that application package potentially contains a trojan. UNCOMMON EnumParameter to indicate that application package is uncommon. WAP_FRAUD EnumParameter to indicate that application package potentially contains WAP fraud. WINDOWS_MALWARE EnumParameter to indicate that application package potentially contains windows malware. RESOURCE_ID string Parameter to indicate the unique resource id of a device. SECURITY_EVENT_ID integer Security event id. SERIAL_NUMBER string Parameter to indicate the Serial number. USER_EMAIL string Parameter to indicate the User email.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=APPLICATION_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{APPLICATION_ID} version {NEW_VALUE} was {APPLICATION_STATE} {actor}'s {DEVICE_MODEL}

Device application report

Event details
Event name	APPLICATION_REPORT_EVENT
Parameters	APPLICATION_ID string Parameter to indicate the Application Id. APPLICATION_MESSAGE string Parameter to indicate the message sent by an application report. APPLICATION_REPORT_KEY string Parameter to indicate the key of an application message. APPLICATION_REPORT_SEVERITY string Parameter to indicate the severity of a report. Possible values: ERROR EnumParameter to indicate the application report severity is error. INFO EnumParameter to indicate the application report severity is informational. UNKNOWN EnumParameter to indicate the application report severity is unknown. APPLICATION_REPORT_TIMESTAMP integer Parameter to indicate the timestamp of a report. DEVICE_APP_COMPLIANCE string Parameter to indicate the managed app compliance state with managed application configurations. Possible values: COMPLIANT Compliant devices. NON_COMPLIANT Non-compliant devices. DEVICE_ID string Parameter to indicate the Device Id. DEVICE_MODEL string Parameter to indicate the device model. DEVICE_TYPE string Parameter to indicate the device type. Possible values: ANDROID Android. ASSISTANT Assistant. DESKTOP_CHROME Desktop Chrome. iOS iOS. LINUX Linux. MAC Mac. WINDOWS Windows. RESOURCE_ID string Parameter to indicate the unique resource id of a device. SERIAL_NUMBER string Parameter to indicate the Serial number. USER_EMAIL string Parameter to indicate the User email.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=APPLICATION_REPORT_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{APPLICATION_ID} reported a status of severity:{APPLICATION_REPORT_SEVERITY} for application key:{APPLICATION_REPORT_KEY} with the message:'{APPLICATION_MESSAGE}'

Device Updates

Device update events in Mobile device. Events of this type are returned with type=device_updates.

Account registration change

Event details
Event name	DEVICE_REGISTER_UNREGISTER_EVENT
Parameters	ACCOUNT_STATE string Parameter to indicate the account state on the device, eg: registered/unregistered. Possible values: REGISTERED Register type event. UNREGISTERED Unregister type event. BASIC_INTEGRITY string Parameter to indicate whether the device passes the basic integrity check. CTS_PROFILE_MATCH string Parameter to indicate whether the device passes the CTS profile match. DEVICE_ID string Parameter to indicate the Device Id. DEVICE_MODEL string Parameter to indicate the device model. DEVICE_TYPE string Parameter to indicate the device type. Possible values: ANDROID Android. ASSISTANT Assistant. DESKTOP_CHROME Desktop Chrome. iOS iOS. LINUX Linux. MAC Mac. WINDOWS Windows. IOS_VENDOR_ID string Parameter to indicate the iOS Vendor Id. OS_VERSION string Parameter to indicate the OS version. REGISTER_PRIVILEGE string Parameter to indicate Device Policy app's privilege on the user's device. Possible values: DEVICE_ADMINISTRATOR Device administrator privilege. DEVICE_OWNER Device owner privilege. PROFILE_OWNER Work profile privilege. RESOURCE_ID string Parameter to indicate the unique resource id of a device. SECURITY_PATCH_LEVEL string Parameter to indicate the security patch Level. SERIAL_NUMBER string Parameter to indicate the Serial number. USER_EMAIL string Parameter to indicate the User email.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=DEVICE_REGISTER_UNREGISTER_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor}'s account {ACCOUNT_STATE} {DEVICE_MODEL} {REGISTER_PRIVILEGE}

Advanced Policy Sync event

Advanced Policy Sync events.

Event details
Event name	ADVANCED_POLICY_SYNC_EVENT
Parameters	DEVICE_ID string Parameter to indicate the Device Id. DEVICE_MODEL string Parameter to indicate the device model. DEVICE_TYPE string Parameter to indicate the device type. Possible values: ANDROID Android. ASSISTANT Assistant. DESKTOP_CHROME Desktop Chrome. iOS iOS. LINUX Linux. MAC Mac. WINDOWS Windows. NEW_VALUE string Parameter to indicate the new value. OS_EDITION string Parameter to indicate the Windows OS edition. OS_VERSION string Parameter to indicate the OS version. POLICY_NAME string Parameter to indicate the policy name. POLICY_SYNC_RESULT string Parameter to indicate the policy status. Possible values: POLICY_SYNC_ABORTED EnumParameter to indicate that policy sync is aborted. POLICY_SYNC_FAILED EnumParameter to indicate that policy sync is failed. POLICY_SYNC_SUCCEEDED EnumParameter to indicate that policy sync is successful. POLICY_SYNC_TYPE string Parameter to indicate the policy sync type. Possible values: POLICY_APPLIED_TYPE EnumParameter to indicate that policy is applied. POLICY_REMOVED_TYPE EnumParameter to indicate that policy is removed. RESOURCE_ID string Parameter to indicate the unique resource id of a device. SERIAL_NUMBER string Parameter to indicate the Serial number. USER_EMAIL string Parameter to indicate the User email. VALUE string Parameter to indicate the value of a field. WINDOWS_SYNCML_POLICY_STATUS_CODE string Parameter to indicate the policy status code.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=ADVANCED_POLICY_SYNC_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{POLICY_SYNC_TYPE} {POLICY_NAME} {NEW_VALUE}{VALUE} {DEVICE_TYPE} policy {POLICY_SYNC_RESULT} on {actor}'s {DEVICE_MODEL} with serial id {SERIAL_NUMBER}

Device Action event

Device Action events.

Event details
Event name	DEVICE_ACTION_EVENT
Parameters	ACTION_EXECUTION_STATUS string The execution status of an action. Possible values: ACTION_REJECTED_BY_USER Action Rejected by User action execution status. CANCELLED Cancelled action execution status. EXECUTED Executed action execution status. FAILED Failed action execution status. PENDING Pending action execution status. SENT_TO_DEVICE Sent to Device action execution status. UNKNOWN Display name for Unknown action execution status. ACTION_ID string Unique identifier for an action. ACTION_TYPE string The type of an action. Possible values: ACCOUNT_WIPE Account Wipe action type. ALLOW_ACCESS Allow Access action type. APPROVE Approve action type. BLOCK Block action type. COLLECT_BUGREPORT Collect Bugreport action type. DEVICE_WIPE Device Wipe action type. DISALLOW_ACCESS Disallow Access action type. LOCATE_DEVICE Locate Device action type. LOCK_DEVICE Lock Device action type. REMOVE_APP_FROM_DEVICE Remove App action type. REMOVE_IOS_PROFILE Remove iOS Profile action type. RESET_PIN Reset PIN action type. REVOKE_TOKEN Revoke Token action type. RING_DEVICE Ring Device action type. SIGN_OUT_USER Sign out user action type. SYNC_DEVICE Sync Device action type. UNENROLL Unenrolls a device from Windows Advanced management. UNKNOWN Unknown action type. DEVICE_ID string Parameter to indicate the Device Id. DEVICE_MODEL string Parameter to indicate the device model. DEVICE_TYPE string Parameter to indicate the device type. Possible values: ANDROID Android. ASSISTANT Assistant. DESKTOP_CHROME Desktop Chrome. iOS iOS. LINUX Linux. MAC Mac. WINDOWS Windows. IOS_VENDOR_ID string Parameter to indicate the iOS Vendor Id. RESOURCE_ID string Parameter to indicate the unique resource id of a device. SERIAL_NUMBER string Parameter to indicate the Serial number. USER_EMAIL string Parameter to indicate the User email.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=DEVICE_ACTION_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{ACTION_TYPE} with id {ACTION_ID} on {actor}'s {DEVICE_MODEL} was {ACTION_EXECUTION_STATUS}

Device compliance status

Event details
Event name	DEVICE_COMPLIANCE_CHANGED_EVENT
Parameters	DEVICE_COMPLIANCE string Parameter to indicate the device compliance state with set policies. Possible values: COMPLIANT Compliant devices. NON_COMPLIANT Non-compliant devices. DEVICE_DEACTIVATION_REASON string Parameter to indicate the reason for the deactivation of the mobile device. Possible values: CAMERA_NOT_DISABLED The device has been deactivated because camera is not disabled on the device. DEVICE_BLOCKED_BY_ADMIN The device has been deactivated because it has been blocked by the admin. DEVICE_COMPROMISED Device is compromised. DEVICE_MODEL_NOT_ALLOWED The device has been deactivated because the device model is not allowed by the admin. DEVICE_NOT_ENCRYPTED The device has been deactivated because the device is not encrypted. DEVICE_POLICY_APP_REQUIRED The device has been deactivated because the Device Policy App is not installed. DMAGENT_NOT_DEVICE_OWNER The device has been deactivated because it's Device Policy app is not device owner. DMAGENT_NOT_LATEST The device has been deactivated because it does not have the latest version of the Device Policy app. DMAGENT_NOT_PROFILE_OR_DEVICE_OWNER The device has been deactivated because it's Device Policy app is neither profile owner nor device owner. IOS_ROOTED_STATUS_STALE The device has been deactivated because the iOS rooted status is stale. KEYGUARD_NOT_DISABLED The device has been deactivated because lock screen widgets are not disabled on the device. OS_VERSION_TOO_OLD The device has been deactivated because the operating system version is older than required by the admin. PASSWORD_POLICY_NOT_SATISFIED The device has been deactivated because the password policy is not satisfied. SECURITY_PATCH_TOO_OLD The device has been deactivated because the security patch on the device is older than required by the admin. SYNC_DISABLED The device has been deactivated because sync is not enabled for this device. DEVICE_ID string Parameter to indicate the Device Id. DEVICE_MODEL string Parameter to indicate the device model. DEVICE_TYPE string Parameter to indicate the device type. Possible values: ANDROID Android. ASSISTANT Assistant. DESKTOP_CHROME Desktop Chrome. iOS iOS. LINUX Linux. MAC Mac. WINDOWS Windows. RESOURCE_ID string Parameter to indicate the unique resource id of a device. SERIAL_NUMBER string Parameter to indicate the Serial number. USER_EMAIL string Parameter to indicate the User email.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=DEVICE_COMPLIANCE_CHANGED_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor}'s {DEVICE_MODEL} is {DEVICE_COMPLIANCE} {DEVICE_DEACTIVATION_REASON}

Device OS update

Event details
Event name	OS_UPDATED_EVENT
Parameters	DEVICE_ID string Parameter to indicate the Device Id. DEVICE_MODEL string Parameter to indicate the device model. DEVICE_TYPE string Parameter to indicate the device type. Possible values: ANDROID Android. ASSISTANT Assistant. DESKTOP_CHROME Desktop Chrome. iOS iOS. LINUX Linux. MAC Mac. WINDOWS Windows. IOS_VENDOR_ID string Parameter to indicate the iOS Vendor Id. NEW_VALUE string Parameter to indicate the new value. OLD_VALUE string Parameter to indicate the old value. OS_PROPERTY string Parameter to indicate OS Property, eg: OS version. Possible values: BASEBAND_VERSION Device baseband version. BUILD_NUMBER Build number. KERNEL_VERSION Kernel version. OS_VERSION OS version. SECURITY_PATCH OS security patch. RESOURCE_ID string Parameter to indicate the unique resource id of a device. SERIAL_NUMBER string Parameter to indicate the Serial number. USER_EMAIL string Parameter to indicate the User email.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=OS_UPDATED_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{OS_PROPERTY} updated on {actor}'s {DEVICE_MODEL} from {OLD_VALUE} to {NEW_VALUE}

Device ownership

Device ownership events.

Event details
Event name	DEVICE_OWNERSHIP_CHANGE_EVENT
Parameters	DEVICE_ID string Parameter to indicate the Device Id. DEVICE_MODEL string Parameter to indicate the device model. DEVICE_OWNERSHIP string Parameter to indicate the ownership of mobile device. Possible values: COMPANY_OWNED The ownership of this device has been changed to company owned. USER_OWNED The ownership of this device has been changed to user owned. DEVICE_TYPE string Parameter to indicate the device type. Possible values: ANDROID Android. ASSISTANT Assistant. DESKTOP_CHROME Desktop Chrome. iOS iOS. LINUX Linux. MAC Mac. WINDOWS Windows. NEW_DEVICE_ID string Parameter to indicate the new Device Id. RESOURCE_ID string Parameter to indicate the unique resource id of a device. SERIAL_NUMBER string Parameter to indicate the Serial number. USER_EMAIL string Parameter to indicate the User email.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=DEVICE_OWNERSHIP_CHANGE_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Ownership of {actor}'s {DEVICE_MODEL} has changed to {DEVICE_OWNERSHIP}, with new device id {NEW_DEVICE_ID}

Device settings change

Event details
Event name	DEVICE_SETTINGS_UPDATED_EVENT
Parameters	DEVICE_ID string Parameter to indicate the Device Id. DEVICE_MODEL string Parameter to indicate the device model. DEVICE_SETTING string Parameter to indicate device settings, eg: USB debugging setting. Possible values: DEVELOPER_OPTIONS Developer options. UNKNOWN_SOURCES Unknown sources. USB_DEBUGGING USB debugging. VERIFY_APPS Verify apps. DEVICE_TYPE string Parameter to indicate the device type. Possible values: ANDROID Android. ASSISTANT Assistant. DESKTOP_CHROME Desktop Chrome. iOS iOS. LINUX Linux. MAC Mac. WINDOWS Windows. NEW_VALUE string Parameter to indicate the new value. Possible values: OFF off. ON on. OLD_VALUE string Parameter to indicate the old value. Possible values: OFF off. ON on. RESOURCE_ID string Parameter to indicate the unique resource id of a device. SERIAL_NUMBER string Parameter to indicate the Serial number. USER_EMAIL string Parameter to indicate the User email.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=DEVICE_SETTINGS_UPDATED_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{DEVICE_SETTING} changed from {OLD_VALUE} to {NEW_VALUE} by {actor} on {DEVICE_MODEL}

Device status changed on Apple portal

Event details
Event name	APPLE_DEP_DEVICE_UPDATE_ON_APPLE_PORTAL_EVENT
Parameters	DEVICE_STATUS_ON_APPLE_PORTAL string Parameter to indicate the device status on Apple portal. Possible values: ADDED EnumParameter to indicate the device is added on Apple portal. DELETED EnumParameter to indicate the device is deleted on Apple portal. SERIAL_NUMBER string Parameter to indicate the Serial number.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=APPLE_DEP_DEVICE_UPDATE_ON_APPLE_PORTAL_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Device with serial number {SERIAL_NUMBER} {DEVICE_STATUS_ON_APPLE_PORTAL} through Apple Device Enrollment

Device Sync

Device Sync events.

Event details
Event name	DEVICE_SYNC_EVENT
Parameters	BASIC_INTEGRITY string Parameter to indicate whether the device passes the basic integrity check. CTS_PROFILE_MATCH string Parameter to indicate whether the device passes the CTS profile match. DEVICE_ID string Parameter to indicate the Device Id. DEVICE_MODEL string Parameter to indicate the device model. DEVICE_TYPE string Parameter to indicate the device type. Possible values: ANDROID Android. ASSISTANT Assistant. DESKTOP_CHROME Desktop Chrome. iOS iOS. LINUX Linux. MAC Mac. WINDOWS Windows. IOS_VENDOR_ID string Parameter to indicate the iOS Vendor Id. OS_VERSION string Parameter to indicate the OS version. RESOURCE_ID string Parameter to indicate the unique resource id of a device. SECURITY_PATCH_LEVEL string Parameter to indicate the security patch Level. SERIAL_NUMBER string Parameter to indicate the Serial number. USER_EMAIL string Parameter to indicate the User email.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=DEVICE_SYNC_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor}'s account synced on {DEVICE_MODEL}

Risk signal change

Event details
Event name	RISK_SIGNAL_UPDATED_EVENT
Parameters	DEVICE_ID string Parameter to indicate the Device Id. DEVICE_MODEL string Parameter to indicate the device model. DEVICE_TYPE string Parameter to indicate the device type. Possible values: ANDROID Android. ASSISTANT Assistant. DESKTOP_CHROME Desktop Chrome. iOS iOS. LINUX Linux. MAC Mac. WINDOWS Windows. IOS_VENDOR_ID string Parameter to indicate the iOS Vendor Id. NEW_VALUE string Parameter to indicate the new value. OLD_VALUE string Parameter to indicate the old value. RESOURCE_ID string Parameter to indicate the unique resource id of a device. RISK_SIGNAL string Parameter to indicate the risk signal, e.g. CTS profile match. Possible values: BASIC_INTEGRITY EnumParameter to indicate whether the device passes the basic integrity check. CTS_PROFILE_MATCH EnumParameter to indicate whether the device passes the CTS profile match. SERIAL_NUMBER string Parameter to indicate the Serial number. USER_EMAIL string Parameter to indicate the User email.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=RISK_SIGNAL_UPDATED_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{RISK_SIGNAL} updated on {actor}'s {DEVICE_MODEL} from {OLD_VALUE} to {NEW_VALUE}

Work profile support

Event details
Event name	ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT
Parameters	DEVICE_ID string Parameter to indicate the Device Id. DEVICE_MODEL string Parameter to indicate the device model. DEVICE_TYPE string Parameter to indicate the device type. Possible values: ANDROID Android. ASSISTANT Assistant. DESKTOP_CHROME Desktop Chrome. iOS iOS. LINUX Linux. MAC Mac. WINDOWS Windows. RESOURCE_ID string Parameter to indicate the unique resource id of a device. SERIAL_NUMBER string Parameter to indicate the Serial number. USER_EMAIL string Parameter to indicate the User email.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	Work profile is supported on {actor}'s {DEVICE_MODEL}

Suspicious Activity

Suspicious activity events in Mobile device. Events of this type are returned with type=suspicious_activity.

Device compromise

Device compromised.

Event details
Event name	DEVICE_COMPROMISED_EVENT
Parameters	DEVICE_COMPROMISED_STATE string Parameter to indicate the compromised state of device. Possible values: COMPROMISED Device is compromised. NOT_COMPROMISED Device is no longer compromised. DEVICE_ID string Parameter to indicate the Device Id. DEVICE_MODEL string Parameter to indicate the device model. DEVICE_TYPE string Parameter to indicate the device type. Possible values: ANDROID Android. ASSISTANT Assistant. DESKTOP_CHROME Desktop Chrome. iOS iOS. LINUX Linux. MAC Mac. WINDOWS Windows. IOS_VENDOR_ID string Parameter to indicate the iOS Vendor Id. RESOURCE_ID string Parameter to indicate the unique resource id of a device. SERIAL_NUMBER string Parameter to indicate the Serial number. USER_EMAIL string Parameter to indicate the User email.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=DEVICE_COMPROMISED_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{actor}'s {DEVICE_MODEL} {DEVICE_COMPROMISED_STATE}

Failed screen unlock attempts

Event details
Event name	FAILED_PASSWORD_ATTEMPTS_EVENT
Parameters	DEVICE_ID string Parameter to indicate the Device Id. DEVICE_MODEL string Parameter to indicate the device model. DEVICE_TYPE string Parameter to indicate the device type. Possible values: ANDROID Android. ASSISTANT Assistant. DESKTOP_CHROME Desktop Chrome. iOS iOS. LINUX Linux. MAC Mac. WINDOWS Windows. FAILED_PASSWD_ATTEMPTS integer Parameter to indicate the number of failed screen unlock attempts. RESOURCE_ID string Parameter to indicate the unique resource id of a device. SERIAL_NUMBER string Parameter to indicate the Serial number. USER_EMAIL string Parameter to indicate the User email.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=FAILED_PASSWORD_ATTEMPTS_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{FAILED_PASSWD_ATTEMPTS} failed attempts to unlock {actor}'s {DEVICE_MODEL}

Suspicious activity

Event details
Event name	SUSPICIOUS_ACTIVITY_EVENT
Parameters	DEVICE_ID string Parameter to indicate the Device Id. DEVICE_MODEL string Parameter to indicate the device model. DEVICE_PROPERTY string Parameter to indicate the changed device property. Possible values: BASIC_INTEGRITY EnumParameter to indicate whether the device passes the basic integrity check. CTS_PROFILE_MATCH EnumParameter to indicate whether the device passes the CTS profile match. DEVICE_BOOTLOADER Bootloader version on the device. DEVICE_BRAND Device brand. DEVICE_HARDWARE Device hardware details. DEVICE_MANUFACTURER Manufacturer of the device. DEVICE_MODEL Device model. DMAGENT_PERMISSION Device Policy app's privilege on the device. IMEI_NUMBER IMEI number. MEID_NUMBER MEID number. SERIAL_NUMBER Serial number. WIFI_MAC_ADDRESS WiFi MAC address. DEVICE_TYPE string Parameter to indicate the device type. Possible values: ANDROID Android. ASSISTANT Assistant. DESKTOP_CHROME Desktop Chrome. iOS iOS. LINUX Linux. MAC Mac. WINDOWS Windows. IOS_VENDOR_ID string Parameter to indicate the iOS Vendor Id. NEW_VALUE string New value. The possible values listed below only apply when DEVICE_PROPERTY is set to DMAGENT_PERMISSION. For other properties this parameter will contain arbitrary string values. Possible values: DEVICE_ADMINISTRATOR Device administrator privilege. DEVICE_OWNER Device owner privilege. PROFILE_OWNER Profile owner privilege. UNKNOWN_PERMISSION Unknown privilege. OLD_VALUE string Old value. The possible values listed below only apply when DEVICE_PROPERTY is set to DMAGENT_PERMISSION. For other properties this parameter will contain arbitrary string values. Possible values: DEVICE_ADMINISTRATOR Device administrator privilege. DEVICE_OWNER Device owner privilege. PROFILE_OWNER Profile owner privilege. UNKNOWN_PERMISSION Unknown privilege. RESOURCE_ID string Parameter to indicate the unique resource id of a device. SERIAL_NUMBER string Parameter to indicate the Serial number. USER_EMAIL string Parameter to indicate the User email.
Sample request	GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=SUSPICIOUS_ACTIVITY_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format	{DEVICE_PROPERTY} changed on {actor}'s {DEVICE_MODEL} from {OLD_VALUE} to {NEW_VALUE}