Device Audit Activity Events

Stay organized with collections Save and categorize content based on your preferences.

This document lists the events and parameters for various types of Device Audit activity events. You can retrieve these events by calling Activities.list() with applicationName=mobile.

Device Applications

Device applications events in Mobile device. Events of this type are returned with type=device_applications.

Device application change

Event details
Event name APPLICATION_EVENT
Parameters
APK_SHA256_HASH

string

Parameter to indicate the SHA-256 hash of an application.

APPLICATION_ID

string

Parameter to indicate the Application Id.

APPLICATION_STATE

string

Parameter to indicate the application install/uninstall/update done on device. Possible values:

  • INSTALLED
    Application install event.
  • NOT_PHA
    Potentially harmful application not flagged event.
  • PHA
    Potentially harmful application detection event.
  • UNINSTALLED
    Application uninstall event.
  • UPDATED
    Application version update event.
DEVICE_ID

string

Parameter to indicate the Device Id.

DEVICE_MODEL

string

Parameter to indicate the device model.

DEVICE_TYPE

string

Parameter to indicate the device type. Possible values:

  • ANDROID
    Android.
  • ASSISTANT
    Assistant.
  • DESKTOP_CHROME
    Desktop Chrome.
  • iOS
    iOS.
  • LINUX
    Linux.
  • MAC
    Mac.
  • WINDOWS
    Windows.
IOS_VENDOR_ID

string

Parameter to indicate the iOS Vendor Id.

NEW_VALUE

string

Parameter to indicate the new value.

PHA_CATEGORY

string

Potentially harmful app category reported by SafetyNet. Possible values:

  • BACKDOOR
    EnumParameter to indicate that application package potentially contains a backdoor.
  • CALL_FRAUD
    EnumParameter to indicate that application package potentially contains call fraud.
  • DATA_COLLECTION
    EnumParameter to indicate that application package potentially contains data collection capabilities.
  • DENIAL_OF_SERVICE
    EnumParameter to indicate that application package potentially contains denial of service logic.
  • FRAUDWARE
    EnumParameter to indicate that application package is potentially fraudware.
  • GENERIC_MALWARE
    EnumParameter to indicate that application package is potentially malware.
  • HARMFUL_SITE
    EnumParameter to indicate that application package potentially contains harmful sites.
  • HOSTILE_DOWNLOADER
    EnumParameter to indicate that application package is potentially a hostile downloader.
  • NON_ANDROID_THREAT
    EnumParameter to indicate that application package potentially contains threats to non-Android systems.
  • PHISHING
    EnumParameter to indicate that application package potentially contains phishing.
  • PRIVILEGE_ESCALATION
    EnumParameter to indicate that application package potentially contains privilege escalation capabilities.
  • RANSOMWARE
    EnumParameter to indicate that application package is potentially ransomware.
  • ROOTING
    EnumParameter to indicate that application package potentially contains rooting capabilities.
  • SPAM
    EnumParameter to indicate that application package potentially contains spam.
  • SPYWARE
    EnumParameter to indicate that application package is potentially spyware.
  • TOLL_FRAUD
    EnumParameter to indicate that application package potentially contains toll fraud.
  • TRACKING
    EnumParameter to indicate that application package potentially contains tracking logic.
  • TROJAN
    EnumParameter to indicate that application package potentially contains a trojan.
  • UNCOMMON
    EnumParameter to indicate that application package is uncommon.
  • WAP_FRAUD
    EnumParameter to indicate that application package potentially contains WAP fraud.
  • WINDOWS_MALWARE
    EnumParameter to indicate that application package potentially contains windows malware.
RESOURCE_ID

string

Parameter to indicate the unique resource id of a device.

SECURITY_EVENT_ID

integer

Security event id.

SERIAL_NUMBER

string

Parameter to indicate the Serial number.

USER_EMAIL

string

Parameter to indicate the User email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=APPLICATION_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{APPLICATION_ID} version {NEW_VALUE} was {APPLICATION_STATE} {actor}'s {DEVICE_MODEL}

Device application report

Event details
Event name APPLICATION_REPORT_EVENT
Parameters
APPLICATION_ID

string

Parameter to indicate the Application Id.

APPLICATION_MESSAGE

string

Parameter to indicate the message sent by an application report.

APPLICATION_REPORT_KEY

string

Parameter to indicate the key of an application message.

APPLICATION_REPORT_SEVERITY

string

Parameter to indicate the severity of a report. Possible values:

  • ERROR
    EnumParameter to indicate the application report severity is error.
  • INFO
    EnumParameter to indicate the application report severity is informational.
  • UNKNOWN
    EnumParameter to indicate the application report severity is unknown.
APPLICATION_REPORT_TIMESTAMP

integer

Parameter to indicate the timestamp of a report.

DEVICE_APP_COMPLIANCE

string

Parameter to indicate the managed app compliance state with managed application configurations. Possible values:

  • COMPLIANT
    Compliant devices.
  • NON_COMPLIANT
    Non-compliant devices.
DEVICE_ID

string

Parameter to indicate the Device Id.

DEVICE_MODEL

string

Parameter to indicate the device model.

DEVICE_TYPE

string

Parameter to indicate the device type. Possible values:

  • ANDROID
    Android.
  • ASSISTANT
    Assistant.
  • DESKTOP_CHROME
    Desktop Chrome.
  • iOS
    iOS.
  • LINUX
    Linux.
  • MAC
    Mac.
  • WINDOWS
    Windows.
RESOURCE_ID

string

Parameter to indicate the unique resource id of a device.

SERIAL_NUMBER

string

Parameter to indicate the Serial number.

USER_EMAIL

string

Parameter to indicate the User email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=APPLICATION_REPORT_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{APPLICATION_ID} reported a status of severity:{APPLICATION_REPORT_SEVERITY} for application key:{APPLICATION_REPORT_KEY} with the message:'{APPLICATION_MESSAGE}' at {APPLICATION_REPORT_TIMESTAMP}

Device Updates

Device update events in Mobile device. Events of this type are returned with type=device_updates.

Account registration change

Event details
Event name DEVICE_REGISTER_UNREGISTER_EVENT
Parameters
ACCOUNT_STATE

string

Parameter to indicate the account state on the device, eg: registered/unregistered. Possible values:

  • REGISTERED
    Register type event.
  • UNREGISTERED
    Unregister type event.
BASIC_INTEGRITY

string

Parameter to indicate whether the device passes the basic integrity check.

CTS_PROFILE_MATCH

string

Parameter to indicate whether the device passes the CTS profile match.

DEVICE_ID

string

Parameter to indicate the Device Id.

DEVICE_MODEL

string

Parameter to indicate the device model.

DEVICE_TYPE

string

Parameter to indicate the device type. Possible values:

  • ANDROID
    Android.
  • ASSISTANT
    Assistant.
  • DESKTOP_CHROME
    Desktop Chrome.
  • iOS
    iOS.
  • LINUX
    Linux.
  • MAC
    Mac.
  • WINDOWS
    Windows.
IOS_VENDOR_ID

string

Parameter to indicate the iOS Vendor Id.

OS_VERSION

string

Parameter to indicate the OS version.

REGISTER_PRIVILEGE

string

Parameter to indicate Device Policy app's privilege on the user's device. Possible values:

  • DEVICE_ADMINISTRATOR
    Device administrator privilege.
  • DEVICE_OWNER
    Device owner privilege.
  • PROFILE_OWNER
    Work profile privilege.
RESOURCE_ID

string

Parameter to indicate the unique resource id of a device.

SECURITY_PATCH_LEVEL

string

Parameter to indicate the security patch Level.

SERIAL_NUMBER

string

Parameter to indicate the Serial number.

USER_EMAIL

string

Parameter to indicate the User email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=DEVICE_REGISTER_UNREGISTER_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{actor}'s account {ACCOUNT_STATE} {DEVICE_MODEL} {REGISTER_PRIVILEGE}

Advanced Policy Sync event

Advanced Policy Sync events.

Event details
Event name ADVANCED_POLICY_SYNC_EVENT
Parameters
DEVICE_ID

string

Parameter to indicate the Device Id.

DEVICE_MODEL

string

Parameter to indicate the device model.

DEVICE_TYPE

string

Parameter to indicate the device type. Possible values:

  • ANDROID
    Android.
  • ASSISTANT
    Assistant.
  • DESKTOP_CHROME
    Desktop Chrome.
  • iOS
    iOS.
  • LINUX
    Linux.
  • MAC
    Mac.
  • WINDOWS
    Windows.
NEW_VALUE

string

Parameter to indicate the new value.

OS_EDITION

string

Parameter to indicate the Windows OS edition.

OS_VERSION

string

Parameter to indicate the OS version.

POLICY_NAME

string

Parameter to indicate the policy name.

POLICY_SYNC_RESULT

string

Parameter to indicate the policy status. Possible values:

  • POLICY_SYNC_ABORTED
    EnumParameter to indicate that policy sync is aborted.
  • POLICY_SYNC_FAILED
    EnumParameter to indicate that policy sync is failed.
  • POLICY_SYNC_SUCCEEDED
    EnumParameter to indicate that policy sync is successful.
POLICY_SYNC_TYPE

string

Parameter to indicate the policy sync type. Possible values:

  • POLICY_APPLIED_TYPE
    EnumParameter to indicate that policy is applied.
  • POLICY_REMOVED_TYPE
    EnumParameter to indicate that policy is removed.
RESOURCE_ID

string

Parameter to indicate the unique resource id of a device.

SERIAL_NUMBER

string

Parameter to indicate the Serial number.

USER_EMAIL

string

Parameter to indicate the User email.

VALUE

string

Parameter to indicate the value of a field.

WINDOWS_SYNCML_POLICY_STATUS_CODE

string

Parameter to indicate the policy status code.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=ADVANCED_POLICY_SYNC_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{POLICY_SYNC_TYPE} {POLICY_NAME} {NEW_VALUE}{VALUE} {DEVICE_TYPE} policy {POLICY_SYNC_RESULT} on {actor}'s {DEVICE_MODEL} with serial id {SERIAL_NUMBER}

Device Action event

Device Action events.

Event details
Event name DEVICE_ACTION_EVENT
Parameters
ACTION_EXECUTION_STATUS

string

The execution status of an action. Possible values:

  • ACTION_REJECTED_BY_USER
    Action Rejected by User action execution status.
  • CANCELLED
    Cancelled action execution status.
  • EXECUTED
    Executed action execution status.
  • FAILED
    Failed action execution status.
  • PENDING
    Pending action execution status.
  • SENT_TO_DEVICE
    Sent to Device action execution status.
  • UNKNOWN
    Display name for Unknown action execution status.
ACTION_ID

string

Unique identifier for an action.

ACTION_TYPE

string

The type of an action. Possible values:

  • ACCOUNT_WIPE
    Account Wipe action type.
  • ALLOW_ACCESS
    Allow Access action type.
  • APPROVE
    Approve action type.
  • BLOCK
    Block action type.
  • COLLECT_BUGREPORT
    Collect Bugreport action type.
  • DEVICE_WIPE
    Device Wipe action type.
  • DISALLOW_ACCESS
    Disallow Access action type.
  • LOCATE_DEVICE
    Locate Device action type.
  • LOCK_DEVICE
    Lock Device action type.
  • REMOVE_APP_FROM_DEVICE
    Remove App action type.
  • REMOVE_IOS_PROFILE
    Remove iOS Profile action type.
  • RESET_PIN
    Reset PIN action type.
  • REVOKE_TOKEN
    Revoke Token action type.
  • RING_DEVICE
    Ring Device action type.
  • SIGN_OUT_USER
    Sign out user action type.
  • SYNC_DEVICE
    Sync Device action type.
  • UNENROLL
    Unenrolls a device from Windows Advanced management.
  • UNKNOWN
    Unknown action type.
DEVICE_ID

string

Parameter to indicate the Device Id.

DEVICE_MODEL

string

Parameter to indicate the device model.

DEVICE_TYPE

string

Parameter to indicate the device type. Possible values:

  • ANDROID
    Android.
  • ASSISTANT
    Assistant.
  • DESKTOP_CHROME
    Desktop Chrome.
  • iOS
    iOS.
  • LINUX
    Linux.
  • MAC
    Mac.
  • WINDOWS
    Windows.
IOS_VENDOR_ID

string

Parameter to indicate the iOS Vendor Id.

RESOURCE_ID

string

Parameter to indicate the unique resource id of a device.

SERIAL_NUMBER

string

Parameter to indicate the Serial number.

USER_EMAIL

string

Parameter to indicate the User email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=DEVICE_ACTION_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{ACTION_TYPE} with id {ACTION_ID} on {actor}'s {DEVICE_MODEL} was {ACTION_EXECUTION_STATUS}

Device compliance status

Event details
Event name DEVICE_COMPLIANCE_CHANGED_EVENT
Parameters
DEVICE_COMPLIANCE

string

Parameter to indicate the device compliance state with set policies. Possible values:

  • COMPLIANT
    Compliant devices.
  • NON_COMPLIANT
    Non-compliant devices.
DEVICE_DEACTIVATION_REASON

string

Parameter to indicate the reason for the deactivation of the mobile device. Possible values:

  • CAMERA_NOT_DISABLED
    The device has been deactivated because camera is not disabled on the device.
  • DEVICE_BLOCKED_BY_ADMIN
    The device has been deactivated because it has been blocked by the admin.
  • DEVICE_COMPROMISED
    Device is compromised.
  • DEVICE_MODEL_NOT_ALLOWED
    The device has been deactivated because the device model is not allowed by the admin.
  • DEVICE_NOT_ENCRYPTED
    The device has been deactivated because the device is not encrypted.
  • DEVICE_POLICY_APP_REQUIRED
    The device has been deactivated because the Device Policy App is not installed.
  • DMAGENT_NOT_DEVICE_OWNER
    The device has been deactivated because it's Device Policy app is not device owner.
  • DMAGENT_NOT_LATEST
    The device has been deactivated because it does not have the latest version of the Device Policy app.
  • DMAGENT_NOT_PROFILE_OR_DEVICE_OWNER
    The device has been deactivated because it's Device Policy app is neither profile owner nor device owner.
  • IOS_ROOTED_STATUS_STALE
    The device has been deactivated because the iOS rooted status is stale.
  • KEYGUARD_NOT_DISABLED
    The device has been deactivated because lock screen widgets are not disabled on the device.
  • OS_VERSION_TOO_OLD
    The device has been deactivated because the operating system version is older than required by the admin.
  • PASSWORD_POLICY_NOT_SATISFIED
    The device has been deactivated because the password policy is not satisfied.
  • SECURITY_PATCH_TOO_OLD
    The device has been deactivated because the security patch on the device is older than required by the admin.
  • SYNC_DISABLED
    The device has been deactivated because sync is not enabled for this device.
DEVICE_ID

string

Parameter to indicate the Device Id.

DEVICE_MODEL

string

Parameter to indicate the device model.

DEVICE_TYPE

string

Parameter to indicate the device type. Possible values:

  • ANDROID
    Android.
  • ASSISTANT
    Assistant.
  • DESKTOP_CHROME
    Desktop Chrome.
  • iOS
    iOS.
  • LINUX
    Linux.
  • MAC
    Mac.
  • WINDOWS
    Windows.
RESOURCE_ID

string

Parameter to indicate the unique resource id of a device.

SERIAL_NUMBER

string

Parameter to indicate the Serial number.

USER_EMAIL

string

Parameter to indicate the User email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=DEVICE_COMPLIANCE_CHANGED_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{actor}'s {DEVICE_MODEL} is {DEVICE_COMPLIANCE} {DEVICE_DEACTIVATION_REASON}

Device OS update

Event details
Event name OS_UPDATED_EVENT
Parameters
DEVICE_ID

string

Parameter to indicate the Device Id.

DEVICE_MODEL

string

Parameter to indicate the device model.

DEVICE_TYPE

string

Parameter to indicate the device type. Possible values:

  • ANDROID
    Android.
  • ASSISTANT
    Assistant.
  • DESKTOP_CHROME
    Desktop Chrome.
  • iOS
    iOS.
  • LINUX
    Linux.
  • MAC
    Mac.
  • WINDOWS
    Windows.
IOS_VENDOR_ID

string

Parameter to indicate the iOS Vendor Id.

NEW_VALUE

string

Parameter to indicate the new value.

OLD_VALUE

string

Parameter to indicate the old value.

OS_PROPERTY

string

Parameter to indicate OS Property, eg: OS version. Possible values:

  • BASEBAND_VERSION
    Device baseband version.
  • BUILD_NUMBER
    Build number.
  • KERNEL_VERSION
    Kernel version.
  • OS_VERSION
    OS version.
  • SECURITY_PATCH
    OS security patch.
RESOURCE_ID

string

Parameter to indicate the unique resource id of a device.

SERIAL_NUMBER

string

Parameter to indicate the Serial number.

USER_EMAIL

string

Parameter to indicate the User email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=OS_UPDATED_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{OS_PROPERTY} updated on {actor}'s {DEVICE_MODEL} from {OLD_VALUE} to {NEW_VALUE}

Device ownership

Device ownership events.

Event details
Event name DEVICE_OWNERSHIP_CHANGE_EVENT
Parameters
DEVICE_ID

string

Parameter to indicate the Device Id.

DEVICE_MODEL

string

Parameter to indicate the device model.

DEVICE_OWNERSHIP

string

Parameter to indicate the ownership of mobile device. Possible values:

  • COMPANY_OWNED
    The ownership of this device has been changed to company owned.
  • USER_OWNED
    The ownership of this device has been changed to user owned.
DEVICE_TYPE

string

Parameter to indicate the device type. Possible values:

  • ANDROID
    Android.
  • ASSISTANT
    Assistant.
  • DESKTOP_CHROME
    Desktop Chrome.
  • iOS
    iOS.
  • LINUX
    Linux.
  • MAC
    Mac.
  • WINDOWS
    Windows.
NEW_DEVICE_ID

string

Parameter to indicate the new Device Id.

RESOURCE_ID

string

Parameter to indicate the unique resource id of a device.

SERIAL_NUMBER

string

Parameter to indicate the Serial number.

USER_EMAIL

string

Parameter to indicate the User email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=DEVICE_OWNERSHIP_CHANGE_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Ownership of {actor}'s {DEVICE_MODEL} has changed to {DEVICE_OWNERSHIP}, with new device id {NEW_DEVICE_ID}

Device settings change

Event details
Event name DEVICE_SETTINGS_UPDATED_EVENT
Parameters
DEVICE_ID

string

Parameter to indicate the Device Id.

DEVICE_MODEL

string

Parameter to indicate the device model.

DEVICE_SETTING

string

Parameter to indicate device settings, eg: USB debugging setting. Possible values:

  • DEVELOPER_OPTIONS
    Developer options.
  • UNKNOWN_SOURCES
    Unknown sources.
  • USB_DEBUGGING
    USB debugging.
  • VERIFY_APPS
    Verify apps.
DEVICE_TYPE

string

Parameter to indicate the device type. Possible values:

  • ANDROID
    Android.
  • ASSISTANT
    Assistant.
  • DESKTOP_CHROME
    Desktop Chrome.
  • iOS
    iOS.
  • LINUX
    Linux.
  • MAC
    Mac.
  • WINDOWS
    Windows.
NEW_VALUE

string

Parameter to indicate the new value. Possible values:

  • OFF
    off.
  • ON
    on.
OLD_VALUE

string

Parameter to indicate the old value. Possible values:

  • OFF
    off.
  • ON
    on.
RESOURCE_ID

string

Parameter to indicate the unique resource id of a device.

SERIAL_NUMBER

string

Parameter to indicate the Serial number.

USER_EMAIL

string

Parameter to indicate the User email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=DEVICE_SETTINGS_UPDATED_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{DEVICE_SETTING} changed from {OLD_VALUE} to {NEW_VALUE} by {actor} on {DEVICE_MODEL}

Device status changed on Apple portal

Event details
Event name APPLE_DEP_DEVICE_UPDATE_ON_APPLE_PORTAL_EVENT
Parameters
DEVICE_STATUS_ON_APPLE_PORTAL

string

Parameter to indicate the device status on Apple portal. Possible values:

  • ADDED
    EnumParameter to indicate the device is added on Apple portal.
  • DELETED
    EnumParameter to indicate the device is deleted on Apple portal.
SERIAL_NUMBER

string

Parameter to indicate the Serial number.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=APPLE_DEP_DEVICE_UPDATE_ON_APPLE_PORTAL_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Device with serial number {SERIAL_NUMBER} {DEVICE_STATUS_ON_APPLE_PORTAL} through Apple Device Enrollment

Device Sync

Device Sync events.

Event details
Event name DEVICE_SYNC_EVENT
Parameters
BASIC_INTEGRITY

string

Parameter to indicate whether the device passes the basic integrity check.

CTS_PROFILE_MATCH

string

Parameter to indicate whether the device passes the CTS profile match.

DEVICE_ID

string

Parameter to indicate the Device Id.

DEVICE_MODEL

string

Parameter to indicate the device model.

DEVICE_TYPE

string

Parameter to indicate the device type. Possible values:

  • ANDROID
    Android.
  • ASSISTANT
    Assistant.
  • DESKTOP_CHROME
    Desktop Chrome.
  • iOS
    iOS.
  • LINUX
    Linux.
  • MAC
    Mac.
  • WINDOWS
    Windows.
IOS_VENDOR_ID

string

Parameter to indicate the iOS Vendor Id.

OS_VERSION

string

Parameter to indicate the OS version.

RESOURCE_ID

string

Parameter to indicate the unique resource id of a device.

SECURITY_PATCH_LEVEL

string

Parameter to indicate the security patch Level.

SERIAL_NUMBER

string

Parameter to indicate the Serial number.

USER_EMAIL

string

Parameter to indicate the User email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=DEVICE_SYNC_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{actor}'s account synced on {DEVICE_MODEL}

Risk signal change

Event details
Event name RISK_SIGNAL_UPDATED_EVENT
Parameters
DEVICE_ID

string

Parameter to indicate the Device Id.

DEVICE_MODEL

string

Parameter to indicate the device model.

DEVICE_TYPE

string

Parameter to indicate the device type. Possible values:

  • ANDROID
    Android.
  • ASSISTANT
    Assistant.
  • DESKTOP_CHROME
    Desktop Chrome.
  • iOS
    iOS.
  • LINUX
    Linux.
  • MAC
    Mac.
  • WINDOWS
    Windows.
IOS_VENDOR_ID

string

Parameter to indicate the iOS Vendor Id.

NEW_VALUE

string

Parameter to indicate the new value.

OLD_VALUE

string

Parameter to indicate the old value.

RESOURCE_ID

string

Parameter to indicate the unique resource id of a device.

RISK_SIGNAL

string

Parameter to indicate the risk signal, e.g. CTS profile match. Possible values:

  • BASIC_INTEGRITY
    EnumParameter to indicate whether the device passes the basic integrity check.
  • CTS_PROFILE_MATCH
    EnumParameter to indicate whether the device passes the CTS profile match.
SERIAL_NUMBER

string

Parameter to indicate the Serial number.

USER_EMAIL

string

Parameter to indicate the User email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=RISK_SIGNAL_UPDATED_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{RISK_SIGNAL} updated on {actor}'s {DEVICE_MODEL} from {OLD_VALUE} to {NEW_VALUE}

Work profile support

Event details
Event name ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT
Parameters
DEVICE_ID

string

Parameter to indicate the Device Id.

DEVICE_MODEL

string

Parameter to indicate the device model.

DEVICE_TYPE

string

Parameter to indicate the device type. Possible values:

  • ANDROID
    Android.
  • ASSISTANT
    Assistant.
  • DESKTOP_CHROME
    Desktop Chrome.
  • iOS
    iOS.
  • LINUX
    Linux.
  • MAC
    Mac.
  • WINDOWS
    Windows.
RESOURCE_ID

string

Parameter to indicate the unique resource id of a device.

SERIAL_NUMBER

string

Parameter to indicate the Serial number.

USER_EMAIL

string

Parameter to indicate the User email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Work profile is supported on {actor}'s {DEVICE_MODEL}

Suspicious Activity

Suspicious activity events in Mobile device. Events of this type are returned with type=suspicious_activity.

Device compromise

Device compromised.

Event details
Event name DEVICE_COMPROMISED_EVENT
Parameters
DEVICE_COMPROMISED_STATE

string

Parameter to indicate the compromised state of device. Possible values:

  • COMPROMISED
    Device is compromised.
  • NOT_COMPROMISED
    Device is no longer compromised.
DEVICE_ID

string

Parameter to indicate the Device Id.

DEVICE_MODEL

string

Parameter to indicate the device model.

DEVICE_TYPE

string

Parameter to indicate the device type. Possible values:

  • ANDROID
    Android.
  • ASSISTANT
    Assistant.
  • DESKTOP_CHROME
    Desktop Chrome.
  • iOS
    iOS.
  • LINUX
    Linux.
  • MAC
    Mac.
  • WINDOWS
    Windows.
IOS_VENDOR_ID

string

Parameter to indicate the iOS Vendor Id.

RESOURCE_ID

string

Parameter to indicate the unique resource id of a device.

SERIAL_NUMBER

string

Parameter to indicate the Serial number.

USER_EMAIL

string

Parameter to indicate the User email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=DEVICE_COMPROMISED_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{actor}'s {DEVICE_MODEL} {DEVICE_COMPROMISED_STATE}

Failed screen unlock attempts

Event details
Event name FAILED_PASSWORD_ATTEMPTS_EVENT
Parameters
DEVICE_ID

string

Parameter to indicate the Device Id.

DEVICE_MODEL

string

Parameter to indicate the device model.

DEVICE_TYPE

string

Parameter to indicate the device type. Possible values:

  • ANDROID
    Android.
  • ASSISTANT
    Assistant.
  • DESKTOP_CHROME
    Desktop Chrome.
  • iOS
    iOS.
  • LINUX
    Linux.
  • MAC
    Mac.
  • WINDOWS
    Windows.
FAILED_PASSWD_ATTEMPTS

integer

Parameter to indicate the number of failed screen unlock attempts.

RESOURCE_ID

string

Parameter to indicate the unique resource id of a device.

SERIAL_NUMBER

string

Parameter to indicate the Serial number.

USER_EMAIL

string

Parameter to indicate the User email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=FAILED_PASSWORD_ATTEMPTS_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{FAILED_PASSWD_ATTEMPTS} failed attempts to unlock {actor}'s {DEVICE_MODEL}

Suspicious activity

Event details
Event name SUSPICIOUS_ACTIVITY_EVENT
Parameters
DEVICE_ID

string

Parameter to indicate the Device Id.

DEVICE_MODEL

string

Parameter to indicate the device model.

DEVICE_PROPERTY

string

Parameter to indicate the changed device property. Possible values:

  • BASIC_INTEGRITY
    EnumParameter to indicate whether the device passes the basic integrity check.
  • CTS_PROFILE_MATCH
    EnumParameter to indicate whether the device passes the CTS profile match.
  • DEVICE_BOOTLOADER
    Bootloader version on the device.
  • DEVICE_BRAND
    Device brand.
  • DEVICE_HARDWARE
    Device hardware details.
  • DEVICE_MANUFACTURER
    Manufacturer of the device.
  • DEVICE_MODEL
    Device model.
  • DMAGENT_PERMISSION
    Device Policy app's privilege on the device.
  • IMEI_NUMBER
    IMEI number.
  • MEID_NUMBER
    MEID number.
  • SERIAL_NUMBER
    Serial number.
  • WIFI_MAC_ADDRESS
    WiFi MAC address.
DEVICE_TYPE

string

Parameter to indicate the device type. Possible values:

  • ANDROID
    Android.
  • ASSISTANT
    Assistant.
  • DESKTOP_CHROME
    Desktop Chrome.
  • iOS
    iOS.
  • LINUX
    Linux.
  • MAC
    Mac.
  • WINDOWS
    Windows.
IOS_VENDOR_ID

string

Parameter to indicate the iOS Vendor Id.

NEW_VALUE

string

New value. The possible values listed below only apply when DEVICE_PROPERTY is set to DMAGENT_PERMISSION. For other properties this parameter will contain arbitrary string values. Possible values:

  • DEVICE_ADMINISTRATOR
    Device administrator privilege.
  • DEVICE_OWNER
    Device owner privilege.
  • PROFILE_OWNER
    Profile owner privilege.
  • UNKNOWN_PERMISSION
    Unknown privilege.
OLD_VALUE

string

Old value. The possible values listed below only apply when DEVICE_PROPERTY is set to DMAGENT_PERMISSION. For other properties this parameter will contain arbitrary string values. Possible values:

  • DEVICE_ADMINISTRATOR
    Device administrator privilege.
  • DEVICE_OWNER
    Device owner privilege.
  • PROFILE_OWNER
    Profile owner privilege.
  • UNKNOWN_PERMISSION
    Unknown privilege.
RESOURCE_ID

string

Parameter to indicate the unique resource id of a device.

SERIAL_NUMBER

string

Parameter to indicate the Serial number.

USER_EMAIL

string

Parameter to indicate the User email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=SUSPICIOUS_ACTIVITY_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{DEVICE_PROPERTY} changed on {actor}'s {DEVICE_MODEL} from {OLD_VALUE} to {NEW_VALUE}