BatchUsageLogEvents

{
  "eventId": string,
  "eventTime": string,
  "eventType": enum (EventType),

  // Union field event can be only one of the following:
  "adbShellCommandEvent": {
    object (AdbShellCommandEvent)
  },
  "adbShellInteractiveEvent": {
    object (AdbShellInteractiveEvent)
  },
  "appProcessStartEvent": {
    object (AppProcessStartEvent)
  },
  "keyguardDismissedEvent": {
    object (KeyguardDismissedEvent)
  },
  "keyguardDismissAuthAttemptEvent": {
    object (KeyguardDismissAuthAttemptEvent)
  },
  "keyguardSecuredEvent": {
    object (KeyguardSecuredEvent)
  },
  "filePulledEvent": {
    object (FilePulledEvent)
  },
  "filePushedEvent": {
    object (FilePushedEvent)
  },
  "certAuthorityInstalledEvent": {
    object (CertAuthorityInstalledEvent)
  },
  "certAuthorityRemovedEvent": {
    object (CertAuthorityRemovedEvent)
  },
  "certValidationFailureEvent": {
    object (CertValidationFailureEvent)
  },
  "cryptoSelfTestCompletedEvent": {
    object (CryptoSelfTestCompletedEvent)
  },
  "keyDestructionEvent": {
    object (KeyDestructionEvent)
  },
  "keyGeneratedEvent": {
    object (KeyGeneratedEvent)
  },
  "keyImportEvent": {
    object (KeyImportEvent)
  },
  "keyIntegrityViolationEvent": {
    object (KeyIntegrityViolationEvent)
  },
  "loggingStartedEvent": {
    object (LoggingStartedEvent)
  },
  "loggingStoppedEvent": {
    object (LoggingStoppedEvent)
  },
  "logBufferSizeCriticalEvent": {
    object (LogBufferSizeCriticalEvent)
  },
  "mediaMountEvent": {
    object (MediaMountEvent)
  },
  "mediaUnmountEvent": {
    object (MediaUnmountEvent)
  },
  "osShutdownEvent": {
    object (OsShutdownEvent)
  },
  "osStartupEvent": {
    object (OsStartupEvent)
  },
  "remoteLockEvent": {
    object (RemoteLockEvent)
  },
  "wipeFailureEvent": {
    object (WipeFailureEvent)
  },
  "connectEvent": {
    object (ConnectEvent)
  },
  "dnsEvent": {
    object (DnsEvent)
  }
  // End of list of possible types for union field event.
}

string (int64 format)

Unique id of the event.

string (Timestamp format)

Device timestamp when the event was logged.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

enum (EventType)

The particular usage log event type that was reported on the device. Use this to determine which event field to access.

object (AdbShellCommandEvent)

A shell command was issued over ADB via “adb shell command”. Part of SECURITY_LOGS.

object (AdbShellInteractiveEvent)

An ADB interactive shell was opened via “adb shell”. Part of SECURITY_LOGS.

object (AppProcessStartEvent)

An app process was started. Part of SECURITY_LOGS.

object (KeyguardDismissedEvent)

The keyguard was dismissed. Part of SECURITY_LOGS.

object (KeyguardDismissAuthAttemptEvent)

An attempt was made to unlock the device. Part of SECURITY_LOGS.

object (KeyguardSecuredEvent)

The device was locked either by user or timeout. Part of SECURITY_LOGS.

object (FilePulledEvent)

A file was downloaded from the device. Part of SECURITY_LOGS.

object (FilePushedEvent)

A file was uploaded onto the device. Part of SECURITY_LOGS.

object (CertAuthorityInstalledEvent)

A new root certificate was installed into the system's trusted credential storage. Part of SECURITY_LOGS.

object (CertAuthorityRemovedEvent)

A root certificate was removed from the system's trusted credential storage. Part of SECURITY_LOGS.

object (CertValidationFailureEvent)

An X.509v3 certificate failed to validate, currently this validation is performed on the Wi-FI access point and failure may be due to a mismatch upon server certificate validation. However it may in the future include other validation events of an X.509v3 certificate. Part of SECURITY_LOGS.

object (CryptoSelfTestCompletedEvent)

Validates whether Android’s built-in cryptographic library (BoringSSL) is valid. Should always succeed on device boot, if it fails, the device should be considered untrusted. Part of SECURITY_LOGS.

object (KeyDestructionEvent)

A cryptographic key including user installed, admin installed and system maintained private key is removed from the device either by the user or management. Part of SECURITY_LOGS.

object (KeyGeneratedEvent)

A cryptographic key including user installed, admin installed and system maintained private key is installed on the device either by the user or management. Part of SECURITY_LOGS.

object (KeyImportEvent)

A cryptographic key including user installed, admin installed and system maintained private key is imported on the device either by the user or management. Part of SECURITY_LOGS.

object (KeyIntegrityViolationEvent)

A cryptographic key including user installed, admin installed and system maintained private key is determined to be corrupted due to storage corruption, hardware failure or some OS issue. Part of SECURITY_LOGS.

object (LoggingStartedEvent)

usageLog policy has been enabled. Part of SECURITY_LOGS.

object (LoggingStoppedEvent)

usageLog policy has been disabled. Part of SECURITY_LOGS.

object (LogBufferSizeCriticalEvent)

The audit log buffer has reached 90% of its capacity, therefore older events may be dropped. Part of SECURITY_LOGS.

object (MediaMountEvent)

Removable media was mounted. Part of SECURITY_LOGS.

object (MediaUnmountEvent)

Removable media was unmounted. Part of SECURITY_LOGS.

object (OsShutdownEvent)

Device was shutdown. Part of SECURITY_LOGS.

object (OsStartupEvent)

Device was started. Part of SECURITY_LOGS.

object (RemoteLockEvent)

The device or profile has been remotely locked via the LOCK command. Part of SECURITY_LOGS.

object (WipeFailureEvent)

The work profile or company-owned device failed to wipe when requested. This could be user initiated or admin initiated e.g. delete was received. Part of SECURITY_LOGS.

object (ConnectEvent)

A TCP connect event was initiated through the standard network stack. Part of NETWORK_ACTIVITY_LOGS.

object (DnsEvent)

A DNS lookup event was initiated through the standard network stack. Part of NETWORK_ACTIVITY_LOGS.

{
  "success": boolean,
  "strongAuthMethodUsed": boolean
}

boolean

Whether the unlock attempt was successful.

boolean

Whether a strong form of authentication (password, PIN, or pattern) was used to unlock device.

{
  "filePath": string
}

string

The path of the file being pulled.

{
  "filePath": string
}

string

The path of the file being pushed.

{
  "certificate": string,
  "userId": integer,
  "success": boolean
}

string

Subject of the certificate.

integer

The user in which the certificate install event happened. Only available for devices running Android 11 and above.

boolean

Whether the installation event succeeded.

{
  "certificate": string,
  "userId": integer,
  "success": boolean
}

string

Subject of the certificate.

integer

The user in which the certificate removal event occurred. Only available for devices running Android 11 and above.

boolean

Whether the removal succeeded.

{
  "failureReason": string
}

string

The reason why certification validation failed.

{
  "success": boolean
}

boolean

Whether the test succeeded.

{
  "keyAlias": string,
  "applicationUid": integer,
  "success": boolean
}

string

Alias of the key.

integer

UID of the application which owns the key.

boolean

Whether the operation was successful.

{
  "keyAlias": string,
  "applicationUid": integer,
  "success": boolean
}

string

Alias of the key.

integer

UID of the application which generated the key.

boolean

Whether the operation was successful.

{
  "keyAlias": string,
  "applicationUid": integer,
  "success": boolean
}

string

Alias of the key.

integer

UID of the application which imported the key

boolean

Whether the operation was successful.

{
  "keyAlias": string,
  "applicationUid": integer
}

string

Alias of the key.

integer

UID of the application which owns the key

{
  "mountPoint": string,
  "volumeLabel": string
}

string

Mount point.

string

Volume label. Redacted to empty string on organization-owned managed profile devices.

{
  "mountPoint": string,
  "volumeLabel": string
}

string

Mount point.

string

Volume label. Redacted to empty string on organization-owned managed profile devices.

{
  "verifiedBootState": enum (VerifiedBootState),
  "verityMode": enum (DmVerityMode)
}

enum (VerifiedBootState)

Verified Boot state.

enum (DmVerityMode)

dm-verity mode.

{
  "adminPackageName": string,
  "adminUserId": integer,
  "targetUserId": integer
}

string

Package name of the admin app requesting the change.

integer

User ID of the admin app from the which the change was requested.

integer

User ID in which the change was requested in.

{
  "destinationIpAddress": string,
  "destinationPort": integer,
  "packageName": string
}

string

The destination IP address of the connect call.

integer

The destination port of the connect call.

string

The package name of the UID that performed the connect call.

{
  "hostname": string,
  "ipAddresses": [
    string
  ],
  "totalIpAddressesReturned": string,
  "packageName": string
}

string

The hostname that was looked up.

string

The (possibly truncated) list of the IP addresses returned for DNS lookup (max 10 IPv4 or IPv6 addresses).

string (int64 format)

The number of IP addresses returned from the DNS lookup event. May be higher than the amount of ipAddresses if there were too many addresses to log.

string

The package name of the UID that performed the DNS lookup.