Device Audit Activity Events

This document lists the events and parameters for various types of Device Audit activity events. You can retrieve these events by calling Activities.list() with applicationName=mobile.

Device Applications

Device applications events in Mobile device. Events of this type are returned with type=device_applications.

Device application change

Event details
Event name APPLICATION_EVENT
Parameters
APK_SHA256_HASH

string

Parameter to indicate the SHA-256 hash of an application.

APPLICATION_ID

string

Parameter to indicate the Application Id.

APPLICATION_STATE

string

Parameter to indicate the application install/uninstall/update done on device. Possible values:

  • INSTALLED
    Application install event.
  • NOT_PHA
    Potentially harmful application not flagged event.
  • PHA
    Potentially harmful application detection event.
  • UNINSTALLED
    Application uninstall event.
  • UPDATED
    Application version update event.
DEVICE_ID

string

Parameter to indicate the Device Id.

DEVICE_MODEL

string

Parameter to indicate the device model.

DEVICE_TYPE

string

Parameter to indicate the device type. Possible values:

  • ANDROID
    Android.
  • ASSISTANT
    Assistant.
  • DESKTOP_CHROME
    Desktop Chrome.
  • iOS
    iOS.
  • LINUX
    Linux.
  • MAC
    Mac.
  • WINDOWS
    Windows.
IOS_VENDOR_ID

string

Parameter to indicate the iOS Vendor Id.

NEW_VALUE

string

Parameter to indicate the new value.

PHA_CATEGORY

string

Potentially harmful app category reported by SafetyNet. Possible values:

  • BACKDOOR
    EnumParameter to indicate that application package potentially contains a backdoor.
  • CALL_FRAUD
    EnumParameter to indicate that application package potentially contains call fraud.
  • DATA_COLLECTION
    EnumParameter to indicate that application package potentially contains data collection capabilities.
  • DENIAL_OF_SERVICE
    EnumParameter to indicate that application package potentially contains denial of service logic.
  • FRAUDWARE
    EnumParameter to indicate that application package is potentially fraudware.
  • GENERIC_MALWARE
    EnumParameter to indicate that application package is potentially malware.
  • HARMFUL_SITE
    EnumParameter to indicate that application package potentially contains harmful sites.
  • HOSTILE_DOWNLOADER
    EnumParameter to indicate that application package is potentially a hostile downloader.
  • NON_ANDROID_THREAT
    EnumParameter to indicate that application package potentially contains threats to non-Android systems.
  • PHISHING
    EnumParameter to indicate that application package potentially contains phishing.
  • PRIVILEGE_ESCALATION
    EnumParameter to indicate that application package potentially contains privilege escalation capabilities.
  • RANSOMWARE
    EnumParameter to indicate that application package is potentially ransomware.
  • ROOTING
    EnumParameter to indicate that application package potentially contains rooting capabilities.
  • SPAM
    EnumParameter to indicate that application package potentially contains spam.
  • SPYWARE
    EnumParameter to indicate that application package is potentially spyware.
  • TOLL_FRAUD
    EnumParameter to indicate that application package potentially contains toll fraud.
  • TRACKING
    EnumParameter to indicate that application package potentially contains tracking logic.
  • TROJAN
    EnumParameter to indicate that application package potentially contains a trojan.
  • UNCOMMON
    EnumParameter to indicate that application package is uncommon.
  • WAP_FRAUD
    EnumParameter to indicate that application package potentially contains WAP fraud.
  • WINDOWS_MALWARE
    EnumParameter to indicate that application package potentially contains windows malware.
RESOURCE_ID

string

Parameter to indicate the unique resource id of a device.

SECURITY_EVENT_ID

integer

Security event id.

SERIAL_NUMBER

string

Parameter to indicate the Serial number.

USER_EMAIL

string

Parameter to indicate the User email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=APPLICATION_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{APPLICATION_ID} version {NEW_VALUE} was {APPLICATION_STATE} {actor}'s {DEVICE_MODEL}

Device application report

Event details
Event name APPLICATION_REPORT_EVENT
Parameters
APPLICATION_ID

string

Parameter to indicate the Application Id.

APPLICATION_MESSAGE

string

Parameter to indicate the message sent by an application report.

APPLICATION_REPORT_KEY

string

Parameter to indicate the key of an application message.

APPLICATION_REPORT_SEVERITY

string

Parameter to indicate the severity of a report. Possible values:

  • ERROR
    EnumParameter to indicate the application report severity is error.
  • INFO
    EnumParameter to indicate the application report severity is informational.
  • UNKNOWN
    EnumParameter to indicate the application report severity is unknown.
APPLICATION_REPORT_TIMESTAMP

integer

Parameter to indicate the timestamp of a report.

DEVICE_APP_COMPLIANCE

string

Parameter to indicate the managed app compliance state with managed application configurations. Possible values:

  • COMPLIANT
    Compliant devices.
  • NON_COMPLIANT
    Non-compliant devices.
DEVICE_ID

string

Parameter to indicate the Device Id.

DEVICE_MODEL

string

Parameter to indicate the device model.

DEVICE_TYPE

string

Parameter to indicate the device type. Possible values:

  • ANDROID
    Android.
  • ASSISTANT
    Assistant.
  • DESKTOP_CHROME
    Desktop Chrome.
  • iOS
    iOS.
  • LINUX
    Linux.
  • MAC
    Mac.
  • WINDOWS
    Windows.
RESOURCE_ID

string

Parameter to indicate the unique resource id of a device.

SERIAL_NUMBER

string

Parameter to indicate the Serial number.

USER_EMAIL

string

Parameter to indicate the User email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=APPLICATION_REPORT_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{APPLICATION_ID} reported a status of severity:{APPLICATION_REPORT_SEVERITY} for application key:{APPLICATION_REPORT_KEY} with the message:'{APPLICATION_MESSAGE}'

Device Updates

Device update events in Mobile device. Events of this type are returned with type=device_updates.

Account registration change

Event details
Event name DEVICE_REGISTER_UNREGISTER_EVENT
Parameters
ACCOUNT_STATE

string

Parameter to indicate the account state on the device, eg: registered/unregistered. Possible values:

  • REGISTERED
    Register type event.
  • UNREGISTERED
    Unregister type event.
BASIC_INTEGRITY

string

Parameter to indicate whether the device passes the basic integrity check.

CTS_PROFILE_MATCH

string

Parameter to indicate whether the device passes the CTS profile match.

DEVICE_ID

string

Parameter to indicate the Device Id.

DEVICE_MODEL

string

Parameter to indicate the device model.

DEVICE_TYPE

string

Parameter to indicate the device type. Possible values:

  • ANDROID
    Android.
  • ASSISTANT
    Assistant.
  • DESKTOP_CHROME
    Desktop Chrome.
  • iOS
    iOS.
  • LINUX
    Linux.
  • MAC
    Mac.
  • WINDOWS
    Windows.
IOS_VENDOR_ID

string

Parameter to indicate the iOS Vendor Id.

OS_VERSION

string

Parameter to indicate the OS version.

REGISTER_PRIVILEGE

string

Parameter to indicate Device Policy app's privilege on the user's device. Possible values:

  • DEVICE_ADMINISTRATOR
    Device administrator privilege.
  • DEVICE_OWNER
    Device owner privilege.
  • PROFILE_OWNER
    Work profile privilege.
RESOURCE_ID

string

Parameter to indicate the unique resource id of a device.

SECURITY_PATCH_LEVEL

string

Parameter to indicate the security patch Level.

SERIAL_NUMBER

string

Parameter to indicate the Serial number.

USER_EMAIL

string

Parameter to indicate the User email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=DEVICE_REGISTER_UNREGISTER_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{actor}'s account {ACCOUNT_STATE} {DEVICE_MODEL} {REGISTER_PRIVILEGE}

Advanced Policy Sync event

Advanced Policy Sync events.

Event details
Event name ADVANCED_POLICY_SYNC_EVENT
Parameters
DEVICE_ID

string

Parameter to indicate the Device Id.

DEVICE_MODEL

string

Parameter to indicate the device model.

DEVICE_TYPE

string

Parameter to indicate the device type. Possible values:

  • ANDROID
    Android.
  • ASSISTANT
    Assistant.
  • DESKTOP_CHROME
    Desktop Chrome.
  • iOS
    iOS.
  • LINUX
    Linux.
  • MAC
    Mac.
  • WINDOWS
    Windows.
NEW_VALUE

string

Parameter to indicate the new value.

OS_EDITION

string

Parameter to indicate the Windows OS edition.

OS_VERSION

string

Parameter to indicate the OS version.

POLICY_NAME

string

Parameter to indicate the policy name.

POLICY_SYNC_RESULT

string

Parameter to indicate the policy status. Possible values:

  • POLICY_SYNC_ABORTED
    EnumParameter to indicate that policy sync is aborted.
  • POLICY_SYNC_FAILED
    EnumParameter to indicate that policy sync is failed.
  • POLICY_SYNC_SUCCEEDED
    EnumParameter to indicate that policy sync is successful.
POLICY_SYNC_TYPE

string

Parameter to indicate the policy sync type. Possible values:

  • POLICY_APPLIED_TYPE
    EnumParameter to indicate that policy is applied.
  • POLICY_REMOVED_TYPE
    EnumParameter to indicate that policy is removed.
RESOURCE_ID

string

Parameter to indicate the unique resource id of a device.

SERIAL_NUMBER

string

Parameter to indicate the Serial number.

USER_EMAIL

string

Parameter to indicate the User email.

VALUE

string

Parameter to indicate the value of a field.

WINDOWS_SYNCML_POLICY_STATUS_CODE

string

Parameter to indicate the policy status code.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=ADVANCED_POLICY_SYNC_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{POLICY_SYNC_TYPE} {POLICY_NAME} {NEW_VALUE}{VALUE} {DEVICE_TYPE} policy {POLICY_SYNC_RESULT} on {actor}'s {DEVICE_MODEL} with serial id {SERIAL_NUMBER}

Device Action event

Device Action events.

Event details
Event name DEVICE_ACTION_EVENT
Parameters
ACTION_EXECUTION_STATUS

string

The execution status of an action. Possible values:

  • ACTION_REJECTED_BY_USER
    Action Rejected by User action execution status.
  • CANCELLED
    Cancelled action execution status.
  • EXECUTED
    Executed action execution status.
  • FAILED
    Failed action execution status.
  • PENDING
    Pending action execution status.
  • SENT_TO_DEVICE
    Sent to Device action execution status.
  • UNKNOWN
    Display name for Unknown action execution status.
ACTION_ID

string

Unique identifier for an action.

ACTION_TYPE

string

The type of an action. Possible values:

  • ACCOUNT_WIPE
    Account Wipe action type.
  • ALLOW_ACCESS
    Allow Access action type.
  • APPROVE
    Approve action type.
  • BLOCK
    Block action type.
  • COLLECT_BUGREPORT
    Collect Bugreport action type.
  • DEVICE_WIPE
    Device Wipe action type.
  • DISALLOW_ACCESS
    Disallow Access action type.
  • LOCATE_DEVICE
    Locate Device action type.
  • LOCK_DEVICE
    Lock Device action type.
  • REMOVE_APP_FROM_DEVICE
    Remove App action type.
  • REMOVE_IOS_PROFILE
    Remove iOS Profile action type.
  • RESET_PIN
    Reset PIN action type.
  • REVOKE_TOKEN
    Revoke Token action type.
  • RING_DEVICE
    Ring Device action type.
  • SIGN_OUT_USER
    Sign out user action type.
  • SYNC_DEVICE
    Sync Device action type.
  • UNENROLL
    Unenrolls a device from Windows Advanced management.
  • UNKNOWN
    Unknown action type.
DEVICE_ID

string

Parameter to indicate the Device Id.

DEVICE_MODEL

string

Parameter to indicate the device model.

DEVICE_TYPE

string

Parameter to indicate the device type. Possible values:

  • ANDROID
    Android.
  • ASSISTANT
    Assistant.
  • DESKTOP_CHROME
    Desktop Chrome.
  • iOS
    iOS.
  • LINUX
    Linux.
  • MAC
    Mac.
  • WINDOWS
    Windows.
IOS_VENDOR_ID

string

Parameter to indicate the iOS Vendor Id.

RESOURCE_ID

string

Parameter to indicate the unique resource id of a device.

SERIAL_NUMBER

string

Parameter to indicate the Serial number.

USER_EMAIL

string

Parameter to indicate the User email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=DEVICE_ACTION_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{ACTION_TYPE} with id {ACTION_ID} on {actor}'s {DEVICE_MODEL} was {ACTION_EXECUTION_STATUS}

Device compliance status

Event details
Event name DEVICE_COMPLIANCE_CHANGED_EVENT
Parameters
DEVICE_COMPLIANCE

string

Parameter to indicate the device compliance state with set policies. Possible values:

  • COMPLIANT
    Compliant devices.
  • NON_COMPLIANT
    Non-compliant devices.
DEVICE_DEACTIVATION_REASON

string

Parameter to indicate the reason for the deactivation of the mobile device. Possible values:

  • CAMERA_NOT_DISABLED
    The device has been deactivated because camera is not disabled on the device.
  • DEVICE_BLOCKED_BY_ADMIN
    The device has been deactivated because it has been blocked by the admin.
  • DEVICE_COMPROMISED
    Device is compromised.
  • DEVICE_MODEL_NOT_ALLOWED
    The device has been deactivated because the device model is not allowed by the admin.
  • DEVICE_NOT_ENCRYPTED
    The device has been deactivated because the device is not encrypted.
  • DEVICE_POLICY_APP_REQUIRED
    The device has been deactivated because the Device Policy App is not installed.
  • DMAGENT_NOT_DEVICE_OWNER
    The device has been deactivated because it's Device Policy app is not device owner.
  • DMAGENT_NOT_LATEST
    The device has been deactivated because it does not have the latest version of the Device Policy app.
  • DMAGENT_NOT_PROFILE_OR_DEVICE_OWNER
    The device has been deactivated because it's Device Policy app is neither profile owner nor device owner.
  • IOS_ROOTED_STATUS_STALE
    The device has been deactivated because the iOS rooted status is stale.
  • KEYGUARD_NOT_DISABLED
    The device has been deactivated because lock screen widgets are not disabled on the device.
  • OS_VERSION_TOO_OLD
    The device has been deactivated because the operating system version is older than required by the admin.
  • PASSWORD_POLICY_NOT_SATISFIED
    The device has been deactivated because the password policy is not satisfied.
  • SECURITY_PATCH_TOO_OLD
    The device has been deactivated because the security patch on the device is older than required by the admin.
  • SYNC_DISABLED
    The device has been deactivated because sync is not enabled for this device.
DEVICE_ID

string

Parameter to indicate the Device Id.

DEVICE_MODEL

string

Parameter to indicate the device model.

DEVICE_TYPE

string

Parameter to indicate the device type. Possible values:

  • ANDROID
    Android.
  • ASSISTANT
    Assistant.
  • DESKTOP_CHROME
    Desktop Chrome.
  • iOS
    iOS.
  • LINUX
    Linux.
  • MAC
    Mac.
  • WINDOWS
    Windows.
RESOURCE_ID

string

Parameter to indicate the unique resource id of a device.

SERIAL_NUMBER

string

Parameter to indicate the Serial number.

USER_EMAIL

string

Parameter to indicate the User email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=DEVICE_COMPLIANCE_CHANGED_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{actor}'s {DEVICE_MODEL} is {DEVICE_COMPLIANCE} {DEVICE_DEACTIVATION_REASON}

Device OS update

Event details
Event name OS_UPDATED_EVENT
Parameters
DEVICE_ID

string

Parameter to indicate the Device Id.

DEVICE_MODEL

string

Parameter to indicate the device model.

DEVICE_TYPE

string

Parameter to indicate the device type. Possible values:

  • ANDROID
    Android.
  • ASSISTANT
    Assistant.
  • DESKTOP_CHROME
    Desktop Chrome.
  • iOS
    iOS.
  • LINUX
    Linux.
  • MAC
    Mac.
  • WINDOWS
    Windows.
IOS_VENDOR_ID

string

Parameter to indicate the iOS Vendor Id.

NEW_VALUE

string

Parameter to indicate the new value.

OLD_VALUE

string

Parameter to indicate the old value.

OS_PROPERTY

string

Parameter to indicate OS Property, eg: OS version. Possible values:

  • BASEBAND_VERSION
    Device baseband version.
  • BUILD_NUMBER
    Build number.
  • KERNEL_VERSION
    Kernel version.
  • OS_VERSION
    OS version.
  • SECURITY_PATCH
    OS security patch.
RESOURCE_ID

string

Parameter to indicate the unique resource id of a device.

SERIAL_NUMBER

string

Parameter to indicate the Serial number.

USER_EMAIL

string

Parameter to indicate the User email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=OS_UPDATED_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{OS_PROPERTY} updated on {actor}'s {DEVICE_MODEL} from {OLD_VALUE} to {NEW_VALUE}

Device ownership

Device ownership events.

Event details
Event name DEVICE_OWNERSHIP_CHANGE_EVENT
Parameters
DEVICE_ID

string

Parameter to indicate the Device Id.

DEVICE_MODEL

string

Parameter to indicate the device model.

DEVICE_OWNERSHIP

string

Parameter to indicate the ownership of mobile device. Possible values:

  • COMPANY_OWNED
    The ownership of this device has been changed to company owned.
  • USER_OWNED
    The ownership of this device has been changed to user owned.
DEVICE_TYPE

string

Parameter to indicate the device type. Possible values:

  • ANDROID
    Android.
  • ASSISTANT
    Assistant.
  • DESKTOP_CHROME
    Desktop Chrome.
  • iOS
    iOS.
  • LINUX
    Linux.
  • MAC
    Mac.
  • WINDOWS
    Windows.
NEW_DEVICE_ID

string

Parameter to indicate the new Device Id.

RESOURCE_ID

string

Parameter to indicate the unique resource id of a device.

SERIAL_NUMBER

string

Parameter to indicate the Serial number.

USER_EMAIL

string

Parameter to indicate the User email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=DEVICE_OWNERSHIP_CHANGE_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Ownership of {actor}'s {DEVICE_MODEL} has changed to {DEVICE_OWNERSHIP}, with new device id {NEW_DEVICE_ID}

Device settings change

Event details
Event name DEVICE_SETTINGS_UPDATED_EVENT
Parameters
DEVICE_ID

string

Parameter to indicate the Device Id.

DEVICE_MODEL

string

Parameter to indicate the device model.

DEVICE_SETTING

string

Parameter to indicate device settings, eg: USB debugging setting. Possible values:

  • DEVELOPER_OPTIONS
    Developer options.
  • UNKNOWN_SOURCES
    Unknown sources.
  • USB_DEBUGGING
    USB debugging.
  • VERIFY_APPS
    Verify apps.
DEVICE_TYPE

string

Parameter to indicate the device type. Possible values:

  • ANDROID
    Android.
  • ASSISTANT
    Assistant.
  • DESKTOP_CHROME
    Desktop Chrome.
  • iOS
    iOS.
  • LINUX
    Linux.
  • MAC
    Mac.
  • WINDOWS
    Windows.
NEW_VALUE

string

Parameter to indicate the new value. Possible values:

  • OFF
    off.
  • ON
    on.
OLD_VALUE

string

Parameter to indicate the old value. Possible values:

  • OFF
    off.
  • ON
    on.
RESOURCE_ID

string

Parameter to indicate the unique resource id of a device.

SERIAL_NUMBER

string

Parameter to indicate the Serial number.

USER_EMAIL

string

Parameter to indicate the User email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=DEVICE_SETTINGS_UPDATED_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{DEVICE_SETTING} changed from {OLD_VALUE} to {NEW_VALUE} by {actor} on {DEVICE_MODEL}

Device status changed on Apple portal

Event details
Event name APPLE_DEP_DEVICE_UPDATE_ON_APPLE_PORTAL_EVENT
Parameters
DEVICE_STATUS_ON_APPLE_PORTAL

string

Parameter to indicate the device status on Apple portal. Possible values:

  • ADDED
    EnumParameter to indicate the device is added on Apple portal.
  • DELETED
    EnumParameter to indicate the device is deleted on Apple portal.
SERIAL_NUMBER

string

Parameter to indicate the Serial number.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=APPLE_DEP_DEVICE_UPDATE_ON_APPLE_PORTAL_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Device with serial number {SERIAL_NUMBER} {DEVICE_STATUS_ON_APPLE_PORTAL} through Apple Device Enrollment

Device Sync

Device Sync events.

Event details
Event name DEVICE_SYNC_EVENT
Parameters
BASIC_INTEGRITY

string

Parameter to indicate whether the device passes the basic integrity check.

CTS_PROFILE_MATCH

string

Parameter to indicate whether the device passes the CTS profile match.

DEVICE_ID

string

Parameter to indicate the Device Id.

DEVICE_MODEL

string

Parameter to indicate the device model.

DEVICE_TYPE

string

Parameter to indicate the device type. Possible values:

  • ANDROID
    Android.
  • ASSISTANT
    Assistant.
  • DESKTOP_CHROME
    Desktop Chrome.
  • iOS
    iOS.
  • LINUX
    Linux.
  • MAC
    Mac.
  • WINDOWS
    Windows.
IOS_VENDOR_ID

string

Parameter to indicate the iOS Vendor Id.

OS_VERSION

string

Parameter to indicate the OS version.

RESOURCE_ID

string

Parameter to indicate the unique resource id of a device.

SECURITY_PATCH_LEVEL

string

Parameter to indicate the security patch Level.

SERIAL_NUMBER

string

Parameter to indicate the Serial number.

USER_EMAIL

string

Parameter to indicate the User email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=DEVICE_SYNC_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{actor}'s account synced on {DEVICE_MODEL}

Risk signal change

Event details
Event name RISK_SIGNAL_UPDATED_EVENT
Parameters
DEVICE_ID

string

Parameter to indicate the Device Id.

DEVICE_MODEL

string

Parameter to indicate the device model.

DEVICE_TYPE

string

Parameter to indicate the device type. Possible values:

  • ANDROID
    Android.
  • ASSISTANT
    Assistant.
  • DESKTOP_CHROME
    Desktop Chrome.
  • iOS
    iOS.
  • LINUX
    Linux.
  • MAC
    Mac.
  • WINDOWS
    Windows.
IOS_VENDOR_ID

string

Parameter to indicate the iOS Vendor Id.

NEW_VALUE

string

Parameter to indicate the new value.

OLD_VALUE

string

Parameter to indicate the old value.

RESOURCE_ID

string

Parameter to indicate the unique resource id of a device.

RISK_SIGNAL

string

Parameter to indicate the risk signal, e.g. CTS profile match. Possible values:

  • BASIC_INTEGRITY
    EnumParameter to indicate whether the device passes the basic integrity check.
  • CTS_PROFILE_MATCH
    EnumParameter to indicate whether the device passes the CTS profile match.
SERIAL_NUMBER

string

Parameter to indicate the Serial number.

USER_EMAIL

string

Parameter to indicate the User email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=RISK_SIGNAL_UPDATED_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{RISK_SIGNAL} updated on {actor}'s {DEVICE_MODEL} from {OLD_VALUE} to {NEW_VALUE}

Work profile support

Event details
Event name ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT
Parameters
DEVICE_ID

string

Parameter to indicate the Device Id.

DEVICE_MODEL

string

Parameter to indicate the device model.

DEVICE_TYPE

string

Parameter to indicate the device type. Possible values:

  • ANDROID
    Android.
  • ASSISTANT
    Assistant.
  • DESKTOP_CHROME
    Desktop Chrome.
  • iOS
    iOS.
  • LINUX
    Linux.
  • MAC
    Mac.
  • WINDOWS
    Windows.
RESOURCE_ID

string

Parameter to indicate the unique resource id of a device.

SERIAL_NUMBER

string

Parameter to indicate the Serial number.

USER_EMAIL

string

Parameter to indicate the User email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=ANDROID_WORK_PROFILE_SUPPORT_ENABLED_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Work profile is supported on {actor}'s {DEVICE_MODEL}

Suspicious Activity

Suspicious activity events in Mobile device. Events of this type are returned with type=suspicious_activity.

Device compromise

Device compromised.

Event details
Event name DEVICE_COMPROMISED_EVENT
Parameters
DEVICE_COMPROMISED_STATE

string

Parameter to indicate the compromised state of device. Possible values:

  • COMPROMISED
    Device is compromised.
  • NOT_COMPROMISED
    Device is no longer compromised.
DEVICE_ID

string

Parameter to indicate the Device Id.

DEVICE_MODEL

string

Parameter to indicate the device model.

DEVICE_TYPE

string

Parameter to indicate the device type. Possible values:

  • ANDROID
    Android.
  • ASSISTANT
    Assistant.
  • DESKTOP_CHROME
    Desktop Chrome.
  • iOS
    iOS.
  • LINUX
    Linux.
  • MAC
    Mac.
  • WINDOWS
    Windows.
IOS_VENDOR_ID

string

Parameter to indicate the iOS Vendor Id.

RESOURCE_ID

string

Parameter to indicate the unique resource id of a device.

SERIAL_NUMBER

string

Parameter to indicate the Serial number.

USER_EMAIL

string

Parameter to indicate the User email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=DEVICE_COMPROMISED_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{actor}'s {DEVICE_MODEL} {DEVICE_COMPROMISED_STATE}

Failed screen unlock attempts

Event details
Event name FAILED_PASSWORD_ATTEMPTS_EVENT
Parameters
DEVICE_ID

string

Parameter to indicate the Device Id.

DEVICE_MODEL

string

Parameter to indicate the device model.

DEVICE_TYPE

string

Parameter to indicate the device type. Possible values:

  • ANDROID
    Android.
  • ASSISTANT
    Assistant.
  • DESKTOP_CHROME
    Desktop Chrome.
  • iOS
    iOS.
  • LINUX
    Linux.
  • MAC
    Mac.
  • WINDOWS
    Windows.
FAILED_PASSWD_ATTEMPTS

integer

Parameter to indicate the number of failed screen unlock attempts.

RESOURCE_ID

string

Parameter to indicate the unique resource id of a device.

SERIAL_NUMBER

string

Parameter to indicate the Serial number.

USER_EMAIL

string

Parameter to indicate the User email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=FAILED_PASSWORD_ATTEMPTS_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{FAILED_PASSWD_ATTEMPTS} failed attempts to unlock {actor}'s {DEVICE_MODEL}

Suspicious activity

Event details
Event name SUSPICIOUS_ACTIVITY_EVENT
Parameters
DEVICE_ID

string

Parameter to indicate the Device Id.

DEVICE_MODEL

string

Parameter to indicate the device model.

DEVICE_PROPERTY

string

Parameter to indicate the changed device property. Possible values:

  • BASIC_INTEGRITY
    EnumParameter to indicate whether the device passes the basic integrity check.
  • CTS_PROFILE_MATCH
    EnumParameter to indicate whether the device passes the CTS profile match.
  • DEVICE_BOOTLOADER
    Bootloader version on the device.
  • DEVICE_BRAND
    Device brand.
  • DEVICE_HARDWARE
    Device hardware details.
  • DEVICE_MANUFACTURER
    Manufacturer of the device.
  • DEVICE_MODEL
    Device model.
  • DMAGENT_PERMISSION
    Device Policy app's privilege on the device.
  • IMEI_NUMBER
    IMEI number.
  • MEID_NUMBER
    MEID number.
  • SERIAL_NUMBER
    Serial number.
  • WIFI_MAC_ADDRESS
    WiFi MAC address.
DEVICE_TYPE

string

Parameter to indicate the device type. Possible values:

  • ANDROID
    Android.
  • ASSISTANT
    Assistant.
  • DESKTOP_CHROME
    Desktop Chrome.
  • iOS
    iOS.
  • LINUX
    Linux.
  • MAC
    Mac.
  • WINDOWS
    Windows.
IOS_VENDOR_ID

string

Parameter to indicate the iOS Vendor Id.

NEW_VALUE

string

New value. The possible values listed below only apply when DEVICE_PROPERTY is set to DMAGENT_PERMISSION. For other properties this parameter will contain arbitrary string values. Possible values:

  • DEVICE_ADMINISTRATOR
    Device administrator privilege.
  • DEVICE_OWNER
    Device owner privilege.
  • PROFILE_OWNER
    Profile owner privilege.
  • UNKNOWN_PERMISSION
    Unknown privilege.
OLD_VALUE

string

Old value. The possible values listed below only apply when DEVICE_PROPERTY is set to DMAGENT_PERMISSION. For other properties this parameter will contain arbitrary string values. Possible values:

  • DEVICE_ADMINISTRATOR
    Device administrator privilege.
  • DEVICE_OWNER
    Device owner privilege.
  • PROFILE_OWNER
    Profile owner privilege.
  • UNKNOWN_PERMISSION
    Unknown privilege.
RESOURCE_ID

string

Parameter to indicate the unique resource id of a device.

SERIAL_NUMBER

string

Parameter to indicate the Serial number.

USER_EMAIL

string

Parameter to indicate the User email.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/mobile?eventName=SUSPICIOUS_ACTIVITY_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{DEVICE_PROPERTY} changed on {actor}'s {DEVICE_MODEL} from {OLD_VALUE} to {NEW_VALUE}