Chrome Audit Activity Events

This document lists the events and parameters for various types of Chrome Audit activity events. You can retrieve these events by calling Activities.list() with applicationName=chrome.

Add or remove user

A type for ChromeOS add or remove user events. Events of this type are returned with type=CHROME_OS_ADD_REMOVE_USER_TYPE.

ChromeOS user added

User added from ChromeOS.

Event details
Event name CHROME_OS_ADD_USER
Parameters
DEVICE_NAME

string

Device name event parameter.

DEVICE_PLATFORM

string

Device platform event parameter.

DEVICE_USER

string

Device user name event parameter.

DIRECTORY_DEVICE_ID

string

Directory API device ID of the device or browser on which the event happened.

EVENT_REASON

string

Event reason event parameter. Possible values:

  • CHROME_OS_DATA_LOST_DETECTED
    ChromeOS reporting data error detected.
  • CHROME_OS_DEV_MODE
    Reason for switching from verified to developer mode events.
  • CHROME_OS_VERIFIED_MODE
    Reason for switching from developer to verified mode events.
  • CHROMEOS_AFFILIATED_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_AFFILIATED_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_AFFILIATED_USER_ADDED
    An affiliated user was added to ChromeOS.
  • CHROMEOS_AFFILIATED_USER_REMOVED
    An affiliated user was removed from ChromeOS.
  • CHROMEOS_GUEST_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_GUEST_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_LOGIN_LOGOUT_UNKNOWN
    Reason a Login/Logout event was recorded.
  • CHROMEOS_UNAFFILIATED_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_UNAFFILIATED_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_UNAFFILIATED_USER_ADDED
    An unaffiliated user was added to ChromeOS.
  • CHROMEOS_UNAFFILIATED_USER_REMOVED
    An unaffiliated user was removed from ChromeOS.
  • CONTENT_UNSCANNED_DLP_SCAN_FAILED
    The reason for the unscanned content event is a failure to scan for DLP.
  • CONTENT_UNSCANNED_FILE_PASSWORD_PROTECTED
    The reason for the unscanned content event is a password protected file.
  • CONTENT_UNSCANNED_FILE_TOO_LARGE
    The reason for the unscanned content event is a file too large.
  • CONTENT_UNSCANNED_MALWARE_SCAN_FAILED
    The reason for the unscanned content event is a failure to scan for malware.
  • CONTENT_UNSCANNED_MALWARE_SCAN_UNSUPPORTED_FILE_TYPE
    The reason for the unscanned content event is a file of an unsupported type for malware scan.
  • CONTENT_UNSCANNED_SERVICE_UNAVAILABLE
    The reason for the unscanned content event is a service unavailable.
  • CONTENT_UNSCANNED_TIMEOUT
    The reason for the unscanned content event that the request timed out.
  • CONTENT_UNSCANNED_TOO_MANY_REQUESTS
    The reason for the unscanned content event is that too many requests were sent.
  • EVENT_REASON_DLP_EVENT
    ChromeOS Dlp Event is the reason for the event.
  • EVENT_REASON_UNSPECIFIED
    The reason for the event was not specified.
  • MALWARE_TRANSFER_DANGEROUS
    The reason for the malware transfer event is a dangerous file.
  • MALWARE_TRANSFER_DANGEROUS_FILE_TYPE
    The reason for the malware transfer event is a dangerous file type.
  • MALWARE_TRANSFER_DANGEROUS_HOST
    The reason for the malware transfer event is a dangerous host.
  • MALWARE_TRANSFER_DANGEROUS_URL
    The reason for the malware transfer event is a dangerous URL.
  • MALWARE_TRANSFER_UNCOMMON
    The reason for the malware transfer event is an uncommon transfer.
  • MALWARE_TRANSFER_UNKNOWN
    The reason for the malware transfer event is unknown.
  • MALWARE_TRANSFER_UNWANTED_SOFTWARE
    The reason for the malware transfer event is an unwanted software file.
  • PASSWORD_REUSED_PHISHING_URL
    The password reuse event happened on a phishing URL.
  • PASSWORD_REUSED_UNAUTHORIZED_SITE
    The password reuse event happened on an unauthorized site.
  • UNSAFE_SITE_VISIT_MALWARE
    The reason for the unsafe site visit event is malware.
  • UNSAFE_SITE_VISIT_SOCIAL_ENGINEERING
    The reason for the unsafe site visit event is social engineering.
  • UNSAFE_SITE_VISIT_SSL_ERROR
    The reason for the unsafe site visit event is an SSL error.
  • UNSAFE_SITE_VISIT_UNWANTED_SOFTWARE
    The reason for the unsafe site visit event is unwanted software.
TIMESTAMP

integer

The server timestamp of the Chrome Safe Browsing event.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/chrome?eventName=CHROME_OS_ADD_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{DEVICE_USER} has been added to ChromeOS device {DEVICE_NAME}

ChromeOS user removed

User removed from ChromeOS.

Event details
Event name CHROME_OS_REMOVE_USER
Parameters
DEVICE_NAME

string

Device name event parameter.

DEVICE_PLATFORM

string

Device platform event parameter.

DEVICE_USER

string

Device user name event parameter.

DIRECTORY_DEVICE_ID

string

Directory API device ID of the device or browser on which the event happened.

EVENT_REASON

string

Event reason event parameter. Possible values:

  • CHROME_OS_DATA_LOST_DETECTED
    ChromeOS reporting data error detected.
  • CHROME_OS_DEV_MODE
    Reason for switching from verified to developer mode events.
  • CHROME_OS_VERIFIED_MODE
    Reason for switching from developer to verified mode events.
  • CHROMEOS_AFFILIATED_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_AFFILIATED_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_AFFILIATED_USER_ADDED
    An affiliated user was added to ChromeOS.
  • CHROMEOS_AFFILIATED_USER_REMOVED
    An affiliated user was removed from ChromeOS.
  • CHROMEOS_GUEST_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_GUEST_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_LOGIN_LOGOUT_UNKNOWN
    Reason a Login/Logout event was recorded.
  • CHROMEOS_UNAFFILIATED_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_UNAFFILIATED_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_UNAFFILIATED_USER_ADDED
    An unaffiliated user was added to ChromeOS.
  • CHROMEOS_UNAFFILIATED_USER_REMOVED
    An unaffiliated user was removed from ChromeOS.
  • CONTENT_UNSCANNED_DLP_SCAN_FAILED
    The reason for the unscanned content event is a failure to scan for DLP.
  • CONTENT_UNSCANNED_FILE_PASSWORD_PROTECTED
    The reason for the unscanned content event is a password protected file.
  • CONTENT_UNSCANNED_FILE_TOO_LARGE
    The reason for the unscanned content event is a file too large.
  • CONTENT_UNSCANNED_MALWARE_SCAN_FAILED
    The reason for the unscanned content event is a failure to scan for malware.
  • CONTENT_UNSCANNED_MALWARE_SCAN_UNSUPPORTED_FILE_TYPE
    The reason for the unscanned content event is a file of an unsupported type for malware scan.
  • CONTENT_UNSCANNED_SERVICE_UNAVAILABLE
    The reason for the unscanned content event is a service unavailable.
  • CONTENT_UNSCANNED_TIMEOUT
    The reason for the unscanned content event that the request timed out.
  • CONTENT_UNSCANNED_TOO_MANY_REQUESTS
    The reason for the unscanned content event is that too many requests were sent.
  • EVENT_REASON_DLP_EVENT
    ChromeOS Dlp Event is the reason for the event.
  • EVENT_REASON_UNSPECIFIED
    The reason for the event was not specified.
  • MALWARE_TRANSFER_DANGEROUS
    The reason for the malware transfer event is a dangerous file.
  • MALWARE_TRANSFER_DANGEROUS_FILE_TYPE
    The reason for the malware transfer event is a dangerous file type.
  • MALWARE_TRANSFER_DANGEROUS_HOST
    The reason for the malware transfer event is a dangerous host.
  • MALWARE_TRANSFER_DANGEROUS_URL
    The reason for the malware transfer event is a dangerous URL.
  • MALWARE_TRANSFER_UNCOMMON
    The reason for the malware transfer event is an uncommon transfer.
  • MALWARE_TRANSFER_UNKNOWN
    The reason for the malware transfer event is unknown.
  • MALWARE_TRANSFER_UNWANTED_SOFTWARE
    The reason for the malware transfer event is an unwanted software file.
  • PASSWORD_REUSED_PHISHING_URL
    The password reuse event happened on a phishing URL.
  • PASSWORD_REUSED_UNAUTHORIZED_SITE
    The password reuse event happened on an unauthorized site.
  • UNSAFE_SITE_VISIT_MALWARE
    The reason for the unsafe site visit event is malware.
  • UNSAFE_SITE_VISIT_SOCIAL_ENGINEERING
    The reason for the unsafe site visit event is social engineering.
  • UNSAFE_SITE_VISIT_SSL_ERROR
    The reason for the unsafe site visit event is an SSL error.
  • UNSAFE_SITE_VISIT_UNWANTED_SOFTWARE
    The reason for the unsafe site visit event is unwanted software.
REMOVE_USER_REASON

string

Parameter explaining why a user was removed from a device. Possible values:

  • DEVICE_EPHEMERAL_USERS_ENABLED
    Reason why a user was removed from a device.
  • LOCAL_USER_INITIATED
    Reason why a user was removed from a device.
  • LOCAL_USER_INITIATED_ON_REQUIRED_UPDATE
    Reason why a user was removed from a device.
  • REMOTE_ADMIN_INITIATED
    Reason why a user was removed from a device.
  • USER_REMOVED_UNKNOWN_REASON
    Reason why a user was removed from a device.
TIMESTAMP

integer

The server timestamp of the Chrome Safe Browsing event.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/chrome?eventName=CHROME_OS_REMOVE_USER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{DEVICE_USER} has been removed from ChromeOS device {DEVICE_NAME} due to {REMOVE_USER_REASON}

Change device boot mode

A type for device boot mode change events. Events of this type are returned with type=DEVICE_BOOT_STATE_CHANGE_TYPE.

Device boot state change

ChromeOS device boot mode changed.

Event details
Event name DEVICE_BOOT_STATE_CHANGE
Parameters
DEVICE_NAME

string

Device name event parameter.

DEVICE_PLATFORM

string

Device platform event parameter.

DIRECTORY_DEVICE_ID

string

Directory API device ID of the device or browser on which the event happened.

EVENT_REASON

string

Event reason event parameter. Possible values:

  • CHROME_OS_DATA_LOST_DETECTED
    ChromeOS reporting data error detected.
  • CHROME_OS_DEV_MODE
    Reason for switching from verified to developer mode events.
  • CHROME_OS_VERIFIED_MODE
    Reason for switching from developer to verified mode events.
  • CHROMEOS_AFFILIATED_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_AFFILIATED_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_AFFILIATED_USER_ADDED
    An affiliated user was added to ChromeOS.
  • CHROMEOS_AFFILIATED_USER_REMOVED
    An affiliated user was removed from ChromeOS.
  • CHROMEOS_GUEST_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_GUEST_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_LOGIN_LOGOUT_UNKNOWN
    Reason a Login/Logout event was recorded.
  • CHROMEOS_UNAFFILIATED_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_UNAFFILIATED_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_UNAFFILIATED_USER_ADDED
    An unaffiliated user was added to ChromeOS.
  • CHROMEOS_UNAFFILIATED_USER_REMOVED
    An unaffiliated user was removed from ChromeOS.
  • CONTENT_UNSCANNED_DLP_SCAN_FAILED
    The reason for the unscanned content event is a failure to scan for DLP.
  • CONTENT_UNSCANNED_FILE_PASSWORD_PROTECTED
    The reason for the unscanned content event is a password protected file.
  • CONTENT_UNSCANNED_FILE_TOO_LARGE
    The reason for the unscanned content event is a file too large.
  • CONTENT_UNSCANNED_MALWARE_SCAN_FAILED
    The reason for the unscanned content event is a failure to scan for malware.
  • CONTENT_UNSCANNED_MALWARE_SCAN_UNSUPPORTED_FILE_TYPE
    The reason for the unscanned content event is a file of an unsupported type for malware scan.
  • CONTENT_UNSCANNED_SERVICE_UNAVAILABLE
    The reason for the unscanned content event is a service unavailable.
  • CONTENT_UNSCANNED_TIMEOUT
    The reason for the unscanned content event that the request timed out.
  • CONTENT_UNSCANNED_TOO_MANY_REQUESTS
    The reason for the unscanned content event is that too many requests were sent.
  • EVENT_REASON_DLP_EVENT
    ChromeOS Dlp Event is the reason for the event.
  • EVENT_REASON_UNSPECIFIED
    The reason for the event was not specified.
  • MALWARE_TRANSFER_DANGEROUS
    The reason for the malware transfer event is a dangerous file.
  • MALWARE_TRANSFER_DANGEROUS_FILE_TYPE
    The reason for the malware transfer event is a dangerous file type.
  • MALWARE_TRANSFER_DANGEROUS_HOST
    The reason for the malware transfer event is a dangerous host.
  • MALWARE_TRANSFER_DANGEROUS_URL
    The reason for the malware transfer event is a dangerous URL.
  • MALWARE_TRANSFER_UNCOMMON
    The reason for the malware transfer event is an uncommon transfer.
  • MALWARE_TRANSFER_UNKNOWN
    The reason for the malware transfer event is unknown.
  • MALWARE_TRANSFER_UNWANTED_SOFTWARE
    The reason for the malware transfer event is an unwanted software file.
  • PASSWORD_REUSED_PHISHING_URL
    The password reuse event happened on a phishing URL.
  • PASSWORD_REUSED_UNAUTHORIZED_SITE
    The password reuse event happened on an unauthorized site.
  • UNSAFE_SITE_VISIT_MALWARE
    The reason for the unsafe site visit event is malware.
  • UNSAFE_SITE_VISIT_SOCIAL_ENGINEERING
    The reason for the unsafe site visit event is social engineering.
  • UNSAFE_SITE_VISIT_SSL_ERROR
    The reason for the unsafe site visit event is an SSL error.
  • UNSAFE_SITE_VISIT_UNWANTED_SOFTWARE
    The reason for the unsafe site visit event is unwanted software.
NEW_BOOT_MODE

string

New device boot mode. Possible values:

  • DEVELOPER
    Device boot mode state.
  • UNKNOWN
    Device boot mode state.
  • VERIFIED
    Device boot mode state.
PREVIOUS_BOOT_MODE

string

Previous device boot mode. Possible values:

  • DEVELOPER
    Device boot mode state.
  • UNKNOWN
    Device boot mode state.
  • VERIFIED
    Device boot mode state.
TIMESTAMP

integer

The server timestamp of the Chrome Safe Browsing event.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/chrome?eventName=DEVICE_BOOT_STATE_CHANGE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Device boot mode has changed from {PREVIOUS_BOOT_MODE} to {NEW_BOOT_MODE} mode for ChromeOS device {DEVICE_NAME}

ChromeOS login or logout event type

A type for chromeos login events. Events of this type are returned with type=CHROME_OS_LOGIN_LOGOUT_TYPE.

ChromeOS login failure

ChromeOS Login Failure Event name.

Event details
Event name CHROME_OS_LOGIN_FAILURE_EVENT
Parameters
DEVICE_NAME

string

Device name event parameter.

DEVICE_PLATFORM

string

Device platform event parameter.

DEVICE_USER

string

Device user name event parameter.

DIRECTORY_DEVICE_ID

string

Directory API device ID of the device or browser on which the event happened.

EVENT_REASON

string

Event reason event parameter. Possible values:

  • CHROME_OS_DATA_LOST_DETECTED
    ChromeOS reporting data error detected.
  • CHROME_OS_DEV_MODE
    Reason for switching from verified to developer mode events.
  • CHROME_OS_VERIFIED_MODE
    Reason for switching from developer to verified mode events.
  • CHROMEOS_AFFILIATED_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_AFFILIATED_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_AFFILIATED_USER_ADDED
    An affiliated user was added to ChromeOS.
  • CHROMEOS_AFFILIATED_USER_REMOVED
    An affiliated user was removed from ChromeOS.
  • CHROMEOS_GUEST_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_GUEST_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_LOGIN_LOGOUT_UNKNOWN
    Reason a Login/Logout event was recorded.
  • CHROMEOS_UNAFFILIATED_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_UNAFFILIATED_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_UNAFFILIATED_USER_ADDED
    An unaffiliated user was added to ChromeOS.
  • CHROMEOS_UNAFFILIATED_USER_REMOVED
    An unaffiliated user was removed from ChromeOS.
  • CONTENT_UNSCANNED_DLP_SCAN_FAILED
    The reason for the unscanned content event is a failure to scan for DLP.
  • CONTENT_UNSCANNED_FILE_PASSWORD_PROTECTED
    The reason for the unscanned content event is a password protected file.
  • CONTENT_UNSCANNED_FILE_TOO_LARGE
    The reason for the unscanned content event is a file too large.
  • CONTENT_UNSCANNED_MALWARE_SCAN_FAILED
    The reason for the unscanned content event is a failure to scan for malware.
  • CONTENT_UNSCANNED_MALWARE_SCAN_UNSUPPORTED_FILE_TYPE
    The reason for the unscanned content event is a file of an unsupported type for malware scan.
  • CONTENT_UNSCANNED_SERVICE_UNAVAILABLE
    The reason for the unscanned content event is a service unavailable.
  • CONTENT_UNSCANNED_TIMEOUT
    The reason for the unscanned content event that the request timed out.
  • CONTENT_UNSCANNED_TOO_MANY_REQUESTS
    The reason for the unscanned content event is that too many requests were sent.
  • EVENT_REASON_DLP_EVENT
    ChromeOS Dlp Event is the reason for the event.
  • EVENT_REASON_UNSPECIFIED
    The reason for the event was not specified.
  • MALWARE_TRANSFER_DANGEROUS
    The reason for the malware transfer event is a dangerous file.
  • MALWARE_TRANSFER_DANGEROUS_FILE_TYPE
    The reason for the malware transfer event is a dangerous file type.
  • MALWARE_TRANSFER_DANGEROUS_HOST
    The reason for the malware transfer event is a dangerous host.
  • MALWARE_TRANSFER_DANGEROUS_URL
    The reason for the malware transfer event is a dangerous URL.
  • MALWARE_TRANSFER_UNCOMMON
    The reason for the malware transfer event is an uncommon transfer.
  • MALWARE_TRANSFER_UNKNOWN
    The reason for the malware transfer event is unknown.
  • MALWARE_TRANSFER_UNWANTED_SOFTWARE
    The reason for the malware transfer event is an unwanted software file.
  • PASSWORD_REUSED_PHISHING_URL
    The password reuse event happened on a phishing URL.
  • PASSWORD_REUSED_UNAUTHORIZED_SITE
    The password reuse event happened on an unauthorized site.
  • UNSAFE_SITE_VISIT_MALWARE
    The reason for the unsafe site visit event is malware.
  • UNSAFE_SITE_VISIT_SOCIAL_ENGINEERING
    The reason for the unsafe site visit event is social engineering.
  • UNSAFE_SITE_VISIT_SSL_ERROR
    The reason for the unsafe site visit event is an SSL error.
  • UNSAFE_SITE_VISIT_UNWANTED_SOFTWARE
    The reason for the unsafe site visit event is unwanted software.
LOGIN_FAILURE_REASON

string

Login failure event reason parameter. Possible values:

  • AUTHENTICATION_ERROR
    Reason why a login failure occurred.
  • COULD_NOT_MOUNT_TMPFS
    Reason why a login failure occurred.
  • MISSING_CRYPTOHOME
    Reason why a login failure occurred.
  • OWNER_REQUIRED
    Reason why a login failure occurred.
  • TPM_ERROR
    Reason why a login failure occurred.
  • TPM_UPDATE_REQUIRED
    Reason why a login failure occurred.
  • UNKNOWN_FAILURE
    Reason why a login failure occurred.
  • UNRECOVERABLE_CRYPTOHOME
    Reason why a login failure occurred.
TIMESTAMP

integer

The server timestamp of the Chrome Safe Browsing event.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/chrome?eventName=CHROME_OS_LOGIN_FAILURE_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{DEVICE_USER} has attempted and failed to log into ChromeOS device {DEVICE_NAME} due to {LOGIN_FAILURE_REASON}

ChromeOS login or logout

ChromeOS Login Logout Event name.

Event details
Event name CHROME_OS_LOGIN_LOGOUT_EVENT
Parameters
DEVICE_NAME

string

Device name event parameter.

DEVICE_PLATFORM

string

Device platform event parameter.

DEVICE_USER

string

Device user name event parameter.

DIRECTORY_DEVICE_ID

string

Directory API device ID of the device or browser on which the event happened.

EVENT_REASON

string

Event reason event parameter. Possible values:

  • CHROME_OS_DATA_LOST_DETECTED
    ChromeOS reporting data error detected.
  • CHROME_OS_DEV_MODE
    Reason for switching from verified to developer mode events.
  • CHROME_OS_VERIFIED_MODE
    Reason for switching from developer to verified mode events.
  • CHROMEOS_AFFILIATED_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_AFFILIATED_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_AFFILIATED_USER_ADDED
    An affiliated user was added to ChromeOS.
  • CHROMEOS_AFFILIATED_USER_REMOVED
    An affiliated user was removed from ChromeOS.
  • CHROMEOS_GUEST_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_GUEST_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_LOGIN_LOGOUT_UNKNOWN
    Reason a Login/Logout event was recorded.
  • CHROMEOS_UNAFFILIATED_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_UNAFFILIATED_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_UNAFFILIATED_USER_ADDED
    An unaffiliated user was added to ChromeOS.
  • CHROMEOS_UNAFFILIATED_USER_REMOVED
    An unaffiliated user was removed from ChromeOS.
  • CONTENT_UNSCANNED_DLP_SCAN_FAILED
    The reason for the unscanned content event is a failure to scan for DLP.
  • CONTENT_UNSCANNED_FILE_PASSWORD_PROTECTED
    The reason for the unscanned content event is a password protected file.
  • CONTENT_UNSCANNED_FILE_TOO_LARGE
    The reason for the unscanned content event is a file too large.
  • CONTENT_UNSCANNED_MALWARE_SCAN_FAILED
    The reason for the unscanned content event is a failure to scan for malware.
  • CONTENT_UNSCANNED_MALWARE_SCAN_UNSUPPORTED_FILE_TYPE
    The reason for the unscanned content event is a file of an unsupported type for malware scan.
  • CONTENT_UNSCANNED_SERVICE_UNAVAILABLE
    The reason for the unscanned content event is a service unavailable.
  • CONTENT_UNSCANNED_TIMEOUT
    The reason for the unscanned content event that the request timed out.
  • CONTENT_UNSCANNED_TOO_MANY_REQUESTS
    The reason for the unscanned content event is that too many requests were sent.
  • EVENT_REASON_DLP_EVENT
    ChromeOS Dlp Event is the reason for the event.
  • EVENT_REASON_UNSPECIFIED
    The reason for the event was not specified.
  • MALWARE_TRANSFER_DANGEROUS
    The reason for the malware transfer event is a dangerous file.
  • MALWARE_TRANSFER_DANGEROUS_FILE_TYPE
    The reason for the malware transfer event is a dangerous file type.
  • MALWARE_TRANSFER_DANGEROUS_HOST
    The reason for the malware transfer event is a dangerous host.
  • MALWARE_TRANSFER_DANGEROUS_URL
    The reason for the malware transfer event is a dangerous URL.
  • MALWARE_TRANSFER_UNCOMMON
    The reason for the malware transfer event is an uncommon transfer.
  • MALWARE_TRANSFER_UNKNOWN
    The reason for the malware transfer event is unknown.
  • MALWARE_TRANSFER_UNWANTED_SOFTWARE
    The reason for the malware transfer event is an unwanted software file.
  • PASSWORD_REUSED_PHISHING_URL
    The password reuse event happened on a phishing URL.
  • PASSWORD_REUSED_UNAUTHORIZED_SITE
    The password reuse event happened on an unauthorized site.
  • UNSAFE_SITE_VISIT_MALWARE
    The reason for the unsafe site visit event is malware.
  • UNSAFE_SITE_VISIT_SOCIAL_ENGINEERING
    The reason for the unsafe site visit event is social engineering.
  • UNSAFE_SITE_VISIT_SSL_ERROR
    The reason for the unsafe site visit event is an SSL error.
  • UNSAFE_SITE_VISIT_UNWANTED_SOFTWARE
    The reason for the unsafe site visit event is unwanted software.
TIMESTAMP

integer

The server timestamp of the Chrome Safe Browsing event.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/chrome?eventName=CHROME_OS_LOGIN_LOGOUT_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{DEVICE_USER} successfully logged in or out of device {DEVICE_NAME}

ChromeOS login success

ChromeOS Login Event name.

Event details
Event name CHROME_OS_LOGIN_EVENT
Parameters
DEVICE_NAME

string

Device name event parameter.

DEVICE_PLATFORM

string

Device platform event parameter.

DEVICE_USER

string

Device user name event parameter.

DIRECTORY_DEVICE_ID

string

Directory API device ID of the device or browser on which the event happened.

EVENT_REASON

string

Event reason event parameter. Possible values:

  • CHROME_OS_DATA_LOST_DETECTED
    ChromeOS reporting data error detected.
  • CHROME_OS_DEV_MODE
    Reason for switching from verified to developer mode events.
  • CHROME_OS_VERIFIED_MODE
    Reason for switching from developer to verified mode events.
  • CHROMEOS_AFFILIATED_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_AFFILIATED_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_AFFILIATED_USER_ADDED
    An affiliated user was added to ChromeOS.
  • CHROMEOS_AFFILIATED_USER_REMOVED
    An affiliated user was removed from ChromeOS.
  • CHROMEOS_GUEST_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_GUEST_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_LOGIN_LOGOUT_UNKNOWN
    Reason a Login/Logout event was recorded.
  • CHROMEOS_UNAFFILIATED_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_UNAFFILIATED_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_UNAFFILIATED_USER_ADDED
    An unaffiliated user was added to ChromeOS.
  • CHROMEOS_UNAFFILIATED_USER_REMOVED
    An unaffiliated user was removed from ChromeOS.
  • CONTENT_UNSCANNED_DLP_SCAN_FAILED
    The reason for the unscanned content event is a failure to scan for DLP.
  • CONTENT_UNSCANNED_FILE_PASSWORD_PROTECTED
    The reason for the unscanned content event is a password protected file.
  • CONTENT_UNSCANNED_FILE_TOO_LARGE
    The reason for the unscanned content event is a file too large.
  • CONTENT_UNSCANNED_MALWARE_SCAN_FAILED
    The reason for the unscanned content event is a failure to scan for malware.
  • CONTENT_UNSCANNED_MALWARE_SCAN_UNSUPPORTED_FILE_TYPE
    The reason for the unscanned content event is a file of an unsupported type for malware scan.
  • CONTENT_UNSCANNED_SERVICE_UNAVAILABLE
    The reason for the unscanned content event is a service unavailable.
  • CONTENT_UNSCANNED_TIMEOUT
    The reason for the unscanned content event that the request timed out.
  • CONTENT_UNSCANNED_TOO_MANY_REQUESTS
    The reason for the unscanned content event is that too many requests were sent.
  • EVENT_REASON_DLP_EVENT
    ChromeOS Dlp Event is the reason for the event.
  • EVENT_REASON_UNSPECIFIED
    The reason for the event was not specified.
  • MALWARE_TRANSFER_DANGEROUS
    The reason for the malware transfer event is a dangerous file.
  • MALWARE_TRANSFER_DANGEROUS_FILE_TYPE
    The reason for the malware transfer event is a dangerous file type.
  • MALWARE_TRANSFER_DANGEROUS_HOST
    The reason for the malware transfer event is a dangerous host.
  • MALWARE_TRANSFER_DANGEROUS_URL
    The reason for the malware transfer event is a dangerous URL.
  • MALWARE_TRANSFER_UNCOMMON
    The reason for the malware transfer event is an uncommon transfer.
  • MALWARE_TRANSFER_UNKNOWN
    The reason for the malware transfer event is unknown.
  • MALWARE_TRANSFER_UNWANTED_SOFTWARE
    The reason for the malware transfer event is an unwanted software file.
  • PASSWORD_REUSED_PHISHING_URL
    The password reuse event happened on a phishing URL.
  • PASSWORD_REUSED_UNAUTHORIZED_SITE
    The password reuse event happened on an unauthorized site.
  • UNSAFE_SITE_VISIT_MALWARE
    The reason for the unsafe site visit event is malware.
  • UNSAFE_SITE_VISIT_SOCIAL_ENGINEERING
    The reason for the unsafe site visit event is social engineering.
  • UNSAFE_SITE_VISIT_SSL_ERROR
    The reason for the unsafe site visit event is an SSL error.
  • UNSAFE_SITE_VISIT_UNWANTED_SOFTWARE
    The reason for the unsafe site visit event is unwanted software.
TIMESTAMP

integer

The server timestamp of the Chrome Safe Browsing event.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/chrome?eventName=CHROME_OS_LOGIN_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{DEVICE_USER} has successfully logged into ChromeOS device {DEVICE_NAME}

ChromeOS logout

ChromeOS Logout Event name.

Event details
Event name CHROME_OS_LOGOUT_EVENT
Parameters
DEVICE_NAME

string

Device name event parameter.

DEVICE_PLATFORM

string

Device platform event parameter.

DEVICE_USER

string

Device user name event parameter.

DIRECTORY_DEVICE_ID

string

Directory API device ID of the device or browser on which the event happened.

EVENT_REASON

string

Event reason event parameter. Possible values:

  • CHROME_OS_DATA_LOST_DETECTED
    ChromeOS reporting data error detected.
  • CHROME_OS_DEV_MODE
    Reason for switching from verified to developer mode events.
  • CHROME_OS_VERIFIED_MODE
    Reason for switching from developer to verified mode events.
  • CHROMEOS_AFFILIATED_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_AFFILIATED_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_AFFILIATED_USER_ADDED
    An affiliated user was added to ChromeOS.
  • CHROMEOS_AFFILIATED_USER_REMOVED
    An affiliated user was removed from ChromeOS.
  • CHROMEOS_GUEST_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_GUEST_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_LOGIN_LOGOUT_UNKNOWN
    Reason a Login/Logout event was recorded.
  • CHROMEOS_UNAFFILIATED_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_UNAFFILIATED_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_UNAFFILIATED_USER_ADDED
    An unaffiliated user was added to ChromeOS.
  • CHROMEOS_UNAFFILIATED_USER_REMOVED
    An unaffiliated user was removed from ChromeOS.
  • CONTENT_UNSCANNED_DLP_SCAN_FAILED
    The reason for the unscanned content event is a failure to scan for DLP.
  • CONTENT_UNSCANNED_FILE_PASSWORD_PROTECTED
    The reason for the unscanned content event is a password protected file.
  • CONTENT_UNSCANNED_FILE_TOO_LARGE
    The reason for the unscanned content event is a file too large.
  • CONTENT_UNSCANNED_MALWARE_SCAN_FAILED
    The reason for the unscanned content event is a failure to scan for malware.
  • CONTENT_UNSCANNED_MALWARE_SCAN_UNSUPPORTED_FILE_TYPE
    The reason for the unscanned content event is a file of an unsupported type for malware scan.
  • CONTENT_UNSCANNED_SERVICE_UNAVAILABLE
    The reason for the unscanned content event is a service unavailable.
  • CONTENT_UNSCANNED_TIMEOUT
    The reason for the unscanned content event that the request timed out.
  • CONTENT_UNSCANNED_TOO_MANY_REQUESTS
    The reason for the unscanned content event is that too many requests were sent.
  • EVENT_REASON_DLP_EVENT
    ChromeOS Dlp Event is the reason for the event.
  • EVENT_REASON_UNSPECIFIED
    The reason for the event was not specified.
  • MALWARE_TRANSFER_DANGEROUS
    The reason for the malware transfer event is a dangerous file.
  • MALWARE_TRANSFER_DANGEROUS_FILE_TYPE
    The reason for the malware transfer event is a dangerous file type.
  • MALWARE_TRANSFER_DANGEROUS_HOST
    The reason for the malware transfer event is a dangerous host.
  • MALWARE_TRANSFER_DANGEROUS_URL
    The reason for the malware transfer event is a dangerous URL.
  • MALWARE_TRANSFER_UNCOMMON
    The reason for the malware transfer event is an uncommon transfer.
  • MALWARE_TRANSFER_UNKNOWN
    The reason for the malware transfer event is unknown.
  • MALWARE_TRANSFER_UNWANTED_SOFTWARE
    The reason for the malware transfer event is an unwanted software file.
  • PASSWORD_REUSED_PHISHING_URL
    The password reuse event happened on a phishing URL.
  • PASSWORD_REUSED_UNAUTHORIZED_SITE
    The password reuse event happened on an unauthorized site.
  • UNSAFE_SITE_VISIT_MALWARE
    The reason for the unsafe site visit event is malware.
  • UNSAFE_SITE_VISIT_SOCIAL_ENGINEERING
    The reason for the unsafe site visit event is social engineering.
  • UNSAFE_SITE_VISIT_SSL_ERROR
    The reason for the unsafe site visit event is an SSL error.
  • UNSAFE_SITE_VISIT_UNWANTED_SOFTWARE
    The reason for the unsafe site visit event is unwanted software.
TIMESTAMP

integer

The server timestamp of the Chrome Safe Browsing event.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/chrome?eventName=CHROME_OS_LOGOUT_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
{DEVICE_USER} has successfully logged out from ChromeOS device {DEVICE_NAME}

ChromeOS reporting data error type

A type for ChromeOS reporting data error events. Events of this type are returned with type=CHROME_OS_REPORTING_DATA_LOST_TYPE.

ChromeOS reporting data error

ChromeOS reporting data error event name.

Event details
Event name CHROME_OS_REPORTING_DATA_LOST
Parameters
DEVICE_NAME

string

Device name event parameter.

DEVICE_PLATFORM

string

Device platform event parameter.

DIRECTORY_DEVICE_ID

string

Directory API device ID of the device or browser on which the event happened.

EVENT_REASON

string

Event reason event parameter. Possible values:

  • CHROME_OS_DATA_LOST_DETECTED
    ChromeOS reporting data error detected.
  • CHROME_OS_DEV_MODE
    Reason for switching from verified to developer mode events.
  • CHROME_OS_VERIFIED_MODE
    Reason for switching from developer to verified mode events.
  • CHROMEOS_AFFILIATED_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_AFFILIATED_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_AFFILIATED_USER_ADDED
    An affiliated user was added to ChromeOS.
  • CHROMEOS_AFFILIATED_USER_REMOVED
    An affiliated user was removed from ChromeOS.
  • CHROMEOS_GUEST_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_GUEST_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_LOGIN_LOGOUT_UNKNOWN
    Reason a Login/Logout event was recorded.
  • CHROMEOS_UNAFFILIATED_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_UNAFFILIATED_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_UNAFFILIATED_USER_ADDED
    An unaffiliated user was added to ChromeOS.
  • CHROMEOS_UNAFFILIATED_USER_REMOVED
    An unaffiliated user was removed from ChromeOS.
  • CONTENT_UNSCANNED_DLP_SCAN_FAILED
    The reason for the unscanned content event is a failure to scan for DLP.
  • CONTENT_UNSCANNED_FILE_PASSWORD_PROTECTED
    The reason for the unscanned content event is a password protected file.
  • CONTENT_UNSCANNED_FILE_TOO_LARGE
    The reason for the unscanned content event is a file too large.
  • CONTENT_UNSCANNED_MALWARE_SCAN_FAILED
    The reason for the unscanned content event is a failure to scan for malware.
  • CONTENT_UNSCANNED_MALWARE_SCAN_UNSUPPORTED_FILE_TYPE
    The reason for the unscanned content event is a file of an unsupported type for malware scan.
  • CONTENT_UNSCANNED_SERVICE_UNAVAILABLE
    The reason for the unscanned content event is a service unavailable.
  • CONTENT_UNSCANNED_TIMEOUT
    The reason for the unscanned content event that the request timed out.
  • CONTENT_UNSCANNED_TOO_MANY_REQUESTS
    The reason for the unscanned content event is that too many requests were sent.
  • EVENT_REASON_DLP_EVENT
    ChromeOS Dlp Event is the reason for the event.
  • EVENT_REASON_UNSPECIFIED
    The reason for the event was not specified.
  • MALWARE_TRANSFER_DANGEROUS
    The reason for the malware transfer event is a dangerous file.
  • MALWARE_TRANSFER_DANGEROUS_FILE_TYPE
    The reason for the malware transfer event is a dangerous file type.
  • MALWARE_TRANSFER_DANGEROUS_HOST
    The reason for the malware transfer event is a dangerous host.
  • MALWARE_TRANSFER_DANGEROUS_URL
    The reason for the malware transfer event is a dangerous URL.
  • MALWARE_TRANSFER_UNCOMMON
    The reason for the malware transfer event is an uncommon transfer.
  • MALWARE_TRANSFER_UNKNOWN
    The reason for the malware transfer event is unknown.
  • MALWARE_TRANSFER_UNWANTED_SOFTWARE
    The reason for the malware transfer event is an unwanted software file.
  • PASSWORD_REUSED_PHISHING_URL
    The password reuse event happened on a phishing URL.
  • PASSWORD_REUSED_UNAUTHORIZED_SITE
    The password reuse event happened on an unauthorized site.
  • UNSAFE_SITE_VISIT_MALWARE
    The reason for the unsafe site visit event is malware.
  • UNSAFE_SITE_VISIT_SOCIAL_ENGINEERING
    The reason for the unsafe site visit event is social engineering.
  • UNSAFE_SITE_VISIT_SSL_ERROR
    The reason for the unsafe site visit event is an SSL error.
  • UNSAFE_SITE_VISIT_UNWANTED_SOFTWARE
    The reason for the unsafe site visit event is unwanted software.
TIMESTAMP

integer

The server timestamp of the Chrome Safe Browsing event.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/chrome?eventName=CHROME_OS_REPORTING_DATA_LOST&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
An event was expected to be reported but failed to complete for device {DEVICE_NAME}

Chrome Safe Browsing password event type

A type for any Chrome Safe Browsing password events. Events of this type are returned with type=SAFE_BROWSING_PASSWORD_ALERT.

Password changed

Chrome Safe Browsing password changed event name.

Event details
Event name PASSWORD_CHANGED
Parameters
BROWSER_VERSION

string

Browser version event parameter.

CLIENT_TYPE

string

Event client type parameter. Possible values:

  • CHROME_BROWSER
    The client is a Chrome browser.
  • CHROME_OS_DEVICE
    The client is a ChromeOS device.
  • CHROME_PROFILE
    The client is a Chrome profile.
  • CLIENT_TYPE_UNSPECIFIED
    The client type is unknown.
DEVICE_ID

string

Device id event name.

DEVICE_NAME

string

Device name event parameter.

DEVICE_PLATFORM

string

Device platform event parameter.

DEVICE_USER

string

Device user name event parameter.

DIRECTORY_DEVICE_ID

string

Directory API device ID of the device or browser on which the event happened.

PROFILE_USER_NAME

string

GSuite user name of the profile.

TIMESTAMP

integer

The server timestamp of the Chrome Safe Browsing event.

TRIGGER_USER

string

Trigger user event parameter.

USER_AGENT

string

User agent event parameter.

VIRTUAL_DEVICE_ID

string

Virtual device ID of the browser on which the event happened.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/chrome?eventName=PASSWORD_CHANGED&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Password changed for {TRIGGER_USER}

Password reuse

Chrome Safe Browsing password reuse event name.

Event details
Event name PASSWORD_REUSE
Parameters
BROWSER_VERSION

string

Browser version event parameter.

CLIENT_TYPE

string

Event client type parameter. Possible values:

  • CHROME_BROWSER
    The client is a Chrome browser.
  • CHROME_OS_DEVICE
    The client is a ChromeOS device.
  • CHROME_PROFILE
    The client is a Chrome profile.
  • CLIENT_TYPE_UNSPECIFIED
    The client type is unknown.
DEVICE_ID

string

Device id event name.

DEVICE_NAME

string

Device name event parameter.

DEVICE_PLATFORM

string

Device platform event parameter.

DEVICE_USER

string

Device user name event parameter.

DIRECTORY_DEVICE_ID

string

Directory API device ID of the device or browser on which the event happened.

EVENT_REASON

string

Event reason event parameter. Possible values:

  • CHROME_OS_DATA_LOST_DETECTED
    ChromeOS reporting data error detected.
  • CHROME_OS_DEV_MODE
    Reason for switching from verified to developer mode events.
  • CHROME_OS_VERIFIED_MODE
    Reason for switching from developer to verified mode events.
  • CHROMEOS_AFFILIATED_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_AFFILIATED_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_AFFILIATED_USER_ADDED
    An affiliated user was added to ChromeOS.
  • CHROMEOS_AFFILIATED_USER_REMOVED
    An affiliated user was removed from ChromeOS.
  • CHROMEOS_GUEST_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_GUEST_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_LOGIN_LOGOUT_UNKNOWN
    Reason a Login/Logout event was recorded.
  • CHROMEOS_UNAFFILIATED_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_UNAFFILIATED_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_UNAFFILIATED_USER_ADDED
    An unaffiliated user was added to ChromeOS.
  • CHROMEOS_UNAFFILIATED_USER_REMOVED
    An unaffiliated user was removed from ChromeOS.
  • CONTENT_UNSCANNED_DLP_SCAN_FAILED
    The reason for the unscanned content event is a failure to scan for DLP.
  • CONTENT_UNSCANNED_FILE_PASSWORD_PROTECTED
    The reason for the unscanned content event is a password protected file.
  • CONTENT_UNSCANNED_FILE_TOO_LARGE
    The reason for the unscanned content event is a file too large.
  • CONTENT_UNSCANNED_MALWARE_SCAN_FAILED
    The reason for the unscanned content event is a failure to scan for malware.
  • CONTENT_UNSCANNED_MALWARE_SCAN_UNSUPPORTED_FILE_TYPE
    The reason for the unscanned content event is a file of an unsupported type for malware scan.
  • CONTENT_UNSCANNED_SERVICE_UNAVAILABLE
    The reason for the unscanned content event is a service unavailable.
  • CONTENT_UNSCANNED_TIMEOUT
    The reason for the unscanned content event that the request timed out.
  • CONTENT_UNSCANNED_TOO_MANY_REQUESTS
    The reason for the unscanned content event is that too many requests were sent.
  • EVENT_REASON_DLP_EVENT
    ChromeOS Dlp Event is the reason for the event.
  • EVENT_REASON_UNSPECIFIED
    The reason for the event was not specified.
  • MALWARE_TRANSFER_DANGEROUS
    The reason for the malware transfer event is a dangerous file.
  • MALWARE_TRANSFER_DANGEROUS_FILE_TYPE
    The reason for the malware transfer event is a dangerous file type.
  • MALWARE_TRANSFER_DANGEROUS_HOST
    The reason for the malware transfer event is a dangerous host.
  • MALWARE_TRANSFER_DANGEROUS_URL
    The reason for the malware transfer event is a dangerous URL.
  • MALWARE_TRANSFER_UNCOMMON
    The reason for the malware transfer event is an uncommon transfer.
  • MALWARE_TRANSFER_UNKNOWN
    The reason for the malware transfer event is unknown.
  • MALWARE_TRANSFER_UNWANTED_SOFTWARE
    The reason for the malware transfer event is an unwanted software file.
  • PASSWORD_REUSED_PHISHING_URL
    The password reuse event happened on a phishing URL.
  • PASSWORD_REUSED_UNAUTHORIZED_SITE
    The password reuse event happened on an unauthorized site.
  • UNSAFE_SITE_VISIT_MALWARE
    The reason for the unsafe site visit event is malware.
  • UNSAFE_SITE_VISIT_SOCIAL_ENGINEERING
    The reason for the unsafe site visit event is social engineering.
  • UNSAFE_SITE_VISIT_SSL_ERROR
    The reason for the unsafe site visit event is an SSL error.
  • UNSAFE_SITE_VISIT_UNWANTED_SOFTWARE
    The reason for the unsafe site visit event is unwanted software.
EVENT_RESULT

string

Event result event parameter. Possible values:

  • ALLOWED
    The user was allowed to continue after the event.
  • BLOCKED
    The user was blocked from continuing after the event.
  • BLOCKED
    A scan resulted in a blocking of a potential data leakage.
  • BYPASSED
    The user bypassed the event.
  • DETECTED
    A scan resulted in a detection of a potential security threat.
  • REPORTED
    A scan resulted in a reporting of a potential data leakage.
  • WARNED
    The user was warned about the event.
PROFILE_USER_NAME

string

GSuite user name of the profile.

TIMESTAMP

integer

The server timestamp of the Chrome Safe Browsing event.

TRIGGER_USER

string

Trigger user event parameter.

URL

string

The URL that event happened on.

USER_AGENT

string

User agent event parameter.

VIRTUAL_DEVICE_ID

string

Virtual device ID of the browser on which the event happened.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/chrome?eventName=PASSWORD_REUSE&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Password reuse for {TRIGGER_USER}

ChromeOS Dlp Event

A type for ChromeOS DlpEvent events, indicating that one defined DLP rule has been hit. Events of this type are returned with type=DLP_EVENTS_TYPE.

Data access control

ChromeOS Dlp Event name.

Event details
Event name DLP_EVENT
Parameters
BROWSER_VERSION

string

Browser version event parameter.

CLIENT_TYPE

string

Event client type parameter. Possible values:

  • CHROME_BROWSER
    The client is a Chrome browser.
  • CHROME_OS_DEVICE
    The client is a ChromeOS device.
  • CHROME_PROFILE
    The client is a Chrome profile.
  • CLIENT_TYPE_UNSPECIFIED
    The client type is unknown.
DEVICE_NAME

string

Device name event parameter.

DEVICE_PLATFORM

string

Device platform event parameter.

DEVICE_USER

string

Device user name event parameter.

EVENT_REASON

string

Event reason event parameter. Possible values:

  • CHROME_OS_DATA_LOST_DETECTED
    ChromeOS reporting data error detected.
  • CHROME_OS_DEV_MODE
    Reason for switching from verified to developer mode events.
  • CHROME_OS_VERIFIED_MODE
    Reason for switching from developer to verified mode events.
  • CHROMEOS_AFFILIATED_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_AFFILIATED_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_AFFILIATED_USER_ADDED
    An affiliated user was added to ChromeOS.
  • CHROMEOS_AFFILIATED_USER_REMOVED
    An affiliated user was removed from ChromeOS.
  • CHROMEOS_GUEST_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_GUEST_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_LOGIN_LOGOUT_UNKNOWN
    Reason a Login/Logout event was recorded.
  • CHROMEOS_UNAFFILIATED_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_UNAFFILIATED_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_UNAFFILIATED_USER_ADDED
    An unaffiliated user was added to ChromeOS.
  • CHROMEOS_UNAFFILIATED_USER_REMOVED
    An unaffiliated user was removed from ChromeOS.
  • CONTENT_UNSCANNED_DLP_SCAN_FAILED
    The reason for the unscanned content event is a failure to scan for DLP.
  • CONTENT_UNSCANNED_FILE_PASSWORD_PROTECTED
    The reason for the unscanned content event is a password protected file.
  • CONTENT_UNSCANNED_FILE_TOO_LARGE
    The reason for the unscanned content event is a file too large.
  • CONTENT_UNSCANNED_MALWARE_SCAN_FAILED
    The reason for the unscanned content event is a failure to scan for malware.
  • CONTENT_UNSCANNED_MALWARE_SCAN_UNSUPPORTED_FILE_TYPE
    The reason for the unscanned content event is a file of an unsupported type for malware scan.
  • CONTENT_UNSCANNED_SERVICE_UNAVAILABLE
    The reason for the unscanned content event is a service unavailable.
  • CONTENT_UNSCANNED_TIMEOUT
    The reason for the unscanned content event that the request timed out.
  • CONTENT_UNSCANNED_TOO_MANY_REQUESTS
    The reason for the unscanned content event is that too many requests were sent.
  • EVENT_REASON_DLP_EVENT
    ChromeOS Dlp Event is the reason for the event.
  • EVENT_REASON_UNSPECIFIED
    The reason for the event was not specified.
  • MALWARE_TRANSFER_DANGEROUS
    The reason for the malware transfer event is a dangerous file.
  • MALWARE_TRANSFER_DANGEROUS_FILE_TYPE
    The reason for the malware transfer event is a dangerous file type.
  • MALWARE_TRANSFER_DANGEROUS_HOST
    The reason for the malware transfer event is a dangerous host.
  • MALWARE_TRANSFER_DANGEROUS_URL
    The reason for the malware transfer event is a dangerous URL.
  • MALWARE_TRANSFER_UNCOMMON
    The reason for the malware transfer event is an uncommon transfer.
  • MALWARE_TRANSFER_UNKNOWN
    The reason for the malware transfer event is unknown.
  • MALWARE_TRANSFER_UNWANTED_SOFTWARE
    The reason for the malware transfer event is an unwanted software file.
  • PASSWORD_REUSED_PHISHING_URL
    The password reuse event happened on a phishing URL.
  • PASSWORD_REUSED_UNAUTHORIZED_SITE
    The password reuse event happened on an unauthorized site.
  • UNSAFE_SITE_VISIT_MALWARE
    The reason for the unsafe site visit event is malware.
  • UNSAFE_SITE_VISIT_SOCIAL_ENGINEERING
    The reason for the unsafe site visit event is social engineering.
  • UNSAFE_SITE_VISIT_SSL_ERROR
    The reason for the unsafe site visit event is an SSL error.
  • UNSAFE_SITE_VISIT_UNWANTED_SOFTWARE
    The reason for the unsafe site visit event is unwanted software.
EVENT_RESULT

string

Event result event parameter. Possible values:

  • ALLOWED
    The user was allowed to continue after the event.
  • BLOCKED
    The user was blocked from continuing after the event.
  • BLOCKED
    A scan resulted in a blocking of a potential data leakage.
  • BYPASSED
    The user bypassed the event.
  • DETECTED
    A scan resulted in a detection of a potential security threat.
  • REPORTED
    A scan resulted in a reporting of a potential data leakage.
  • WARNED
    The user was warned about the event.
TIMESTAMP

integer

The server timestamp of the Chrome Safe Browsing event.

TRIGGER_DESTINATION

string

A parameter that contains the destination of the rule which triggered the event.

TRIGGER_SOURCE

string

A parameter that contains the source of the rule which triggered the event.

TRIGGER_TYPE

string

Event trigger type parameter. Possible values:

  • CLIPBOARD
    ChromeOS Dlp Chlipboard rule triggered description.
  • DATA_TRANSFER_EVENT_TRIGGER_TYPE_UNSPECIFIED
    The data transfer trigger is unknown.
  • EPRIVACY
    ChromeOS Dlp Eprivacy Screen rule triggered description.
  • FILE_DOWNLOAD
    The data transfer trigger is a file download.
  • FILE_UPLOAD
    The data transfer trigger is a file upload.
  • PASSWORD_ENTRY
    The password breach trigger is a password entry by a user on a website.
  • PASSWORD_SAFETY_CHECK
    The password breach trigger is a safety check initiated by the user in settings.
  • PRINTING
    ChromeOS Dlp Printing rule triggered description.
  • SCREENCAST
    ChromeOS Dlp Screencast rule triggered description.
  • SCREENSHOT
    ChromeOS Dlp Screenshot rule triggered description.
  • UNDEFINED
    ChromeOS Dlp Undefined rule triggered description.
  • WEB_CONTENT_UPLOAD
    The data transfer trigger is a web content upload.
TRIGGERED_RULES_REASON

string

Triggered rules reason event parameter.

URL

string

The URL that event happened on.

USER_AGENT

string

User agent event parameter.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/chrome?eventName=DLP_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Data access control rule triggered by ChromeOS

Content transfer event type

A type for content transfer events. Events of this type are returned with type=CONTENT_TRANSFER_TYPE.

Content transfer

Content transfer event name.

Event details
Event name CONTENT_TRANSFER
Parameters
BROWSER_VERSION

string

Browser version event parameter.

CLIENT_TYPE

string

Event client type parameter. Possible values:

  • CHROME_BROWSER
    The client is a Chrome browser.
  • CHROME_OS_DEVICE
    The client is a ChromeOS device.
  • CHROME_PROFILE
    The client is a Chrome profile.
  • CLIENT_TYPE_UNSPECIFIED
    The client type is unknown.
CONTENT_HASH

string

Content hash event parameter.

CONTENT_NAME

string

Content name event parameter.

CONTENT_SIZE

integer

Content size event parameter.

CONTENT_TYPE

string

Content type event parameter.

CONTENT_TRANSFER_METHOD

string

The method for content transferring. Possible values:

  • FILE_PICKER
    The content is transferred using file picker.
  • DRAG_AND_DROP
    The content is transferred using drag and drop.
  • FILE_PASTE
    The content is transferred using file paste.
  • UNKNOWN
    The transfer method is unknown.
DEVICE_ID

string

Device id event name.

DEVICE_NAME

string

Device name event parameter.

DEVICE_PLATFORM

string

Device platform event parameter.

DEVICE_USER

string

Device user name event parameter.

DIRECTORY_DEVICE_ID

string

Directory API device ID of the device or browser on which the event happened.

EVENT_RESULT

string

Event result event parameter. Possible values:

  • ALLOWED
    The user was allowed to continue after the event.
  • BLOCKED
    The user was blocked from continuing after the event.
  • BLOCKED
    A scan resulted in a blocking of a potential data leakage.
  • BYPASSED
    The user bypassed the event.
  • DETECTED
    A scan resulted in a detection of a potential security threat.
  • REPORTED
    A scan resulted in a reporting of a potential data leakage.
  • WARNED
    The user was warned about the event.
PROFILE_USER_NAME

string

GSuite user name of the profile.

SCAN_ID

string

A parameter that contains the scan id of the content analysis scan which triggered the event.

TIMESTAMP

integer

The server timestamp of the Chrome Safe Browsing event.

TRIGGER_TYPE

string

Event trigger type parameter. Possible values:

  • CLIPBOARD
    ChromeOS Dlp Chlipboard rule triggered description.
  • DATA_TRANSFER_EVENT_TRIGGER_TYPE_UNSPECIFIED
    The data transfer trigger is unknown.
  • EPRIVACY
    ChromeOS Dlp Eprivacy Screen rule triggered description.
  • FILE_DOWNLOAD
    The data transfer trigger is a file download.
  • FILE_UPLOAD
    The data transfer trigger is a file upload.
  • PASSWORD_ENTRY
    The password breach trigger is a password entry by a user on a website.
  • PASSWORD_SAFETY_CHECK
    The password breach trigger is a safety check initiated by the user in settings.
  • PRINTING
    ChromeOS Dlp Printing rule triggered description.
  • SCREENCAST
    ChromeOS Dlp Screencast rule triggered description.
  • SCREENSHOT
    ChromeOS Dlp Screenshot rule triggered description.
  • UNDEFINED
    ChromeOS Dlp Undefined rule triggered description.
  • WEB_CONTENT_UPLOAD
    The data transfer trigger is a web content upload.
URL

string

The URL that event happened on.

USER_AGENT

string

User agent event parameter.

VIRTUAL_DEVICE_ID

string

Virtual device ID of the browser on which the event happened.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/chrome?eventName=CONTENT_TRANSFER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Content was transfered

Content unscanned event type

A type for conent unscanned events. Events of this type are returned with type=CONTENT_UNSCANNED_TYPE.

Content unscanned

Unscanned content event name.

Event details
Event name CONTENT_UNSCANNED
Parameters
BROWSER_VERSION

string

Browser version event parameter.

CLIENT_TYPE

string

Event client type parameter. Possible values:

  • CHROME_BROWSER
    The client is a Chrome browser.
  • CHROME_OS_DEVICE
    The client is a ChromeOS device.
  • CHROME_PROFILE
    The client is a Chrome profile.
  • CLIENT_TYPE_UNSPECIFIED
    The client type is unknown.
CONTENT_HASH

string

Content hash event parameter.

CONTENT_NAME

string

Content name event parameter.

CONTENT_SIZE

integer

Content size event parameter.

CONTENT_TYPE

string

Content type event parameter.

CONTENT_TRANSFER_METHOD

string

The method for content transferring. Possible values:

  • FILE_PICKER
    The content is transferred using file picker.
  • DRAG_AND_DROP
    The content is transferred using drag and drop.
  • FILE_PASTE
    The content is transferred using file paste.
  • UNKNOWN
    The transfer method is unknown.
DEVICE_ID

string

Device id event name.

DEVICE_NAME

string

Device name event parameter.

DEVICE_PLATFORM

string

Device platform event parameter.

DEVICE_USER

string

Device user name event parameter.

DIRECTORY_DEVICE_ID

string

Directory API device ID of the device or browser on which the event happened.

EVENT_REASON

string

Event reason event parameter. Possible values:

  • CHROME_OS_DATA_LOST_DETECTED
    ChromeOS reporting data error detected.
  • CHROME_OS_DEV_MODE
    Reason for switching from verified to developer mode events.
  • CHROME_OS_VERIFIED_MODE
    Reason for switching from developer to verified mode events.
  • CHROMEOS_AFFILIATED_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_AFFILIATED_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_AFFILIATED_USER_ADDED
    An affiliated user was added to ChromeOS.
  • CHROMEOS_AFFILIATED_USER_REMOVED
    An affiliated user was removed from ChromeOS.
  • CHROMEOS_GUEST_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_GUEST_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_LOGIN_LOGOUT_UNKNOWN
    Reason a Login/Logout event was recorded.
  • CHROMEOS_UNAFFILIATED_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_UNAFFILIATED_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_UNAFFILIATED_USER_ADDED
    An unaffiliated user was added to ChromeOS.
  • CHROMEOS_UNAFFILIATED_USER_REMOVED
    An unaffiliated user was removed from ChromeOS.
  • CONTENT_UNSCANNED_DLP_SCAN_FAILED
    The reason for the unscanned content event is a failure to scan for DLP.
  • CONTENT_UNSCANNED_FILE_PASSWORD_PROTECTED
    The reason for the unscanned content event is a password protected file.
  • CONTENT_UNSCANNED_FILE_TOO_LARGE
    The reason for the unscanned content event is a file too large.
  • CONTENT_UNSCANNED_MALWARE_SCAN_FAILED
    The reason for the unscanned content event is a failure to scan for malware.
  • CONTENT_UNSCANNED_MALWARE_SCAN_UNSUPPORTED_FILE_TYPE
    The reason for the unscanned content event is a file of an unsupported type for malware scan.
  • CONTENT_UNSCANNED_SERVICE_UNAVAILABLE
    The reason for the unscanned content event is a service unavailable.
  • CONTENT_UNSCANNED_TIMEOUT
    The reason for the unscanned content event that the request timed out.
  • CONTENT_UNSCANNED_TOO_MANY_REQUESTS
    The reason for the unscanned content event is that too many requests were sent.
  • EVENT_REASON_DLP_EVENT
    ChromeOS Dlp Event is the reason for the event.
  • EVENT_REASON_UNSPECIFIED
    The reason for the event was not specified.
  • MALWARE_TRANSFER_DANGEROUS
    The reason for the malware transfer event is a dangerous file.
  • MALWARE_TRANSFER_DANGEROUS_FILE_TYPE
    The reason for the malware transfer event is a dangerous file type.
  • MALWARE_TRANSFER_DANGEROUS_HOST
    The reason for the malware transfer event is a dangerous host.
  • MALWARE_TRANSFER_DANGEROUS_URL
    The reason for the malware transfer event is a dangerous URL.
  • MALWARE_TRANSFER_UNCOMMON
    The reason for the malware transfer event is an uncommon transfer.
  • MALWARE_TRANSFER_UNKNOWN
    The reason for the malware transfer event is unknown.
  • MALWARE_TRANSFER_UNWANTED_SOFTWARE
    The reason for the malware transfer event is an unwanted software file.
  • PASSWORD_REUSED_PHISHING_URL
    The password reuse event happened on a phishing URL.
  • PASSWORD_REUSED_UNAUTHORIZED_SITE
    The password reuse event happened on an unauthorized site.
  • UNSAFE_SITE_VISIT_MALWARE
    The reason for the unsafe site visit event is malware.
  • UNSAFE_SITE_VISIT_SOCIAL_ENGINEERING
    The reason for the unsafe site visit event is social engineering.
  • UNSAFE_SITE_VISIT_SSL_ERROR
    The reason for the unsafe site visit event is an SSL error.
  • UNSAFE_SITE_VISIT_UNWANTED_SOFTWARE
    The reason for the unsafe site visit event is unwanted software.
EVENT_RESULT

string

Event result event parameter. Possible values:

  • ALLOWED
    The user was allowed to continue after the event.
  • BLOCKED
    The user was blocked from continuing after the event.
  • BLOCKED
    A scan resulted in a blocking of a potential data leakage.
  • BYPASSED
    The user bypassed the event.
  • DETECTED
    A scan resulted in a detection of a potential security threat.
  • REPORTED
    A scan resulted in a reporting of a potential data leakage.
  • WARNED
    The user was warned about the event.
PROFILE_USER_NAME

string

GSuite user name of the profile.

TIMESTAMP

integer

The server timestamp of the Chrome Safe Browsing event.

TRIGGER_TYPE

string

Event trigger type parameter. Possible values:

  • CLIPBOARD
    ChromeOS Dlp Chlipboard rule triggered description.
  • DATA_TRANSFER_EVENT_TRIGGER_TYPE_UNSPECIFIED
    The data transfer trigger is unknown.
  • EPRIVACY
    ChromeOS Dlp Eprivacy Screen rule triggered description.
  • FILE_DOWNLOAD
    The data transfer trigger is a file download.
  • FILE_UPLOAD
    The data transfer trigger is a file upload.
  • PASSWORD_ENTRY
    The password breach trigger is a password entry by a user on a website.
  • PASSWORD_SAFETY_CHECK
    The password breach trigger is a safety check initiated by the user in settings.
  • PRINTING
    ChromeOS Dlp Printing rule triggered description.
  • SCREENCAST
    ChromeOS Dlp Screencast rule triggered description.
  • SCREENSHOT
    ChromeOS Dlp Screenshot rule triggered description.
  • UNDEFINED
    ChromeOS Dlp Undefined rule triggered description.
  • WEB_CONTENT_UPLOAD
    The data transfer trigger is a web content upload.
URL

string

The URL that event happened on.

USER_AGENT

string

User agent event parameter.

VIRTUAL_DEVICE_ID

string

Virtual device ID of the browser on which the event happened.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/chrome?eventName=CONTENT_UNSCANNED&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
The transfered content was not scanned because of {EVENT_REASON_ENUM_TYPE}

Extension request event type

A type for extension request events. Events of this type are returned with type=EXTENSION_REQUEST_TYPE.

Extension request

Extension request event name.

Event details
Event name EXTENSION_REQUEST
Parameters
APP_NAME

string

App name.

CLIENT_TYPE

string

Event client type parameter. Possible values:

  • CHROME_BROWSER
    The client is a Chrome browser.
  • CHROME_OS_DEVICE
    The client is a ChromeOS device.
  • CHROME_PROFILE
    The client is a Chrome profile.
  • CLIENT_TYPE_UNSPECIFIED
    The client type is unknown.
DEVICE_NAME

string

Device name event parameter.

DEVICE_USER

string

Device user name event parameter.

DIRECTORY_DEVICE_ID

string

Directory API device ID of the device or browser on which the event happened.

ORG_UNIT_NAME

string

Org unit name.

TIMESTAMP

integer

The server timestamp of the Chrome Safe Browsing event.

USER_JUSTIFICATION

string

A parameter that contains a justification message provided by users.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/chrome?eventName=EXTENSION_REQUEST&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Request for extension {APP_NAME} was received

Login event type

A type for login events. Events of this type are returned with type=LOGIN_EVENT_TYPE.

Login

Login event name.

Event details
Event name LOGIN_EVENT
Parameters
BROWSER_VERSION

string

Browser version event parameter.

CLIENT_TYPE

string

Event client type parameter. Possible values:

  • CHROME_BROWSER
    The client is a Chrome browser.
  • CHROME_OS_DEVICE
    The client is a ChromeOS device.
  • CHROME_PROFILE
    The client is a Chrome profile.
  • CLIENT_TYPE_UNSPECIFIED
    The client type is unknown.
DEVICE_NAME

string

Device name event parameter.

DEVICE_PLATFORM

string

Device platform event parameter.

DEVICE_USER

string

Device user name event parameter.

DIRECTORY_DEVICE_ID

string

Directory API device ID of the device or browser on which the event happened.

FEDERATED_ORIGIN

string

A parameter that contains the domain of the federated 3rd party provding the login flow.

IS_FEDERATED

boolean

A parameter that contains whether the login is through a federated 3rd party.

LOGIN_USER_NAME

string

A Parameter that contains the username used by the user when performing the login that triggered the login event report.

PROFILE_USER_NAME

string

GSuite user name of the profile.

TIMESTAMP

integer

The server timestamp of the Chrome Safe Browsing event.

URL

string

The URL that event happened on.

USER_AGENT

string

User agent event parameter.

VIRTUAL_DEVICE_ID

string

Virtual device ID of the browser on which the event happened.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/chrome?eventName=LOGIN_EVENT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
A login was performed

Malware transfer event type

A type for malware transfer events. Events of this type are returned with type=MALWARE_TRANSFER_TYPE.

Malware transfer

Malware data transfer event name.

Event details
Event name MALWARE_TRANSFER
Parameters
BROWSER_VERSION

string

Browser version event parameter.

CLIENT_TYPE

string

Event client type parameter. Possible values:

  • CHROME_BROWSER
    The client is a Chrome browser.
  • CHROME_OS_DEVICE
    The client is a ChromeOS device.
  • CHROME_PROFILE
    The client is a Chrome profile.
  • CLIENT_TYPE_UNSPECIFIED
    The client type is unknown.
CONTENT_HASH

string

Content hash event parameter.

CONTENT_NAME

string

Content name event parameter.

CONTENT_SIZE

integer

Content size event parameter.

CONTENT_TYPE

string

Content type event parameter.

CONTENT_TRANSFER_METHOD

string

The method for content transferring. Possible values:

  • FILE_PICKER
    The content is transferred using file picker.
  • DRAG_AND_DROP
    The content is transferred using drag and drop.
  • FILE_PASTE
    The content is transferred using file paste.
  • UNKNOWN
    The transfer method is unknown.
DEVICE_ID

string

Device id event name.

DEVICE_NAME

string

Device name event parameter.

DEVICE_PLATFORM

string

Device platform event parameter.

DEVICE_USER

string

Device user name event parameter.

DIRECTORY_DEVICE_ID

string

Directory API device ID of the device or browser on which the event happened.

EVENT_REASON

string

Event reason event parameter. Possible values:

  • CHROME_OS_DATA_LOST_DETECTED
    ChromeOS reporting data error detected.
  • CHROME_OS_DEV_MODE
    Reason for switching from verified to developer mode events.
  • CHROME_OS_VERIFIED_MODE
    Reason for switching from developer to verified mode events.
  • CHROMEOS_AFFILIATED_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_AFFILIATED_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_AFFILIATED_USER_ADDED
    An affiliated user was added to ChromeOS.
  • CHROMEOS_AFFILIATED_USER_REMOVED
    An affiliated user was removed from ChromeOS.
  • CHROMEOS_GUEST_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_GUEST_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_LOGIN_LOGOUT_UNKNOWN
    Reason a Login/Logout event was recorded.
  • CHROMEOS_UNAFFILIATED_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_UNAFFILIATED_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_UNAFFILIATED_USER_ADDED
    An unaffiliated user was added to ChromeOS.
  • CHROMEOS_UNAFFILIATED_USER_REMOVED
    An unaffiliated user was removed from ChromeOS.
  • CONTENT_UNSCANNED_DLP_SCAN_FAILED
    The reason for the unscanned content event is a failure to scan for DLP.
  • CONTENT_UNSCANNED_FILE_PASSWORD_PROTECTED
    The reason for the unscanned content event is a password protected file.
  • CONTENT_UNSCANNED_FILE_TOO_LARGE
    The reason for the unscanned content event is a file too large.
  • CONTENT_UNSCANNED_MALWARE_SCAN_FAILED
    The reason for the unscanned content event is a failure to scan for malware.
  • CONTENT_UNSCANNED_MALWARE_SCAN_UNSUPPORTED_FILE_TYPE
    The reason for the unscanned content event is a file of an unsupported type for malware scan.
  • CONTENT_UNSCANNED_SERVICE_UNAVAILABLE
    The reason for the unscanned content event is a service unavailable.
  • CONTENT_UNSCANNED_TIMEOUT
    The reason for the unscanned content event that the request timed out.
  • CONTENT_UNSCANNED_TOO_MANY_REQUESTS
    The reason for the unscanned content event is that too many requests were sent.
  • EVENT_REASON_DLP_EVENT
    ChromeOS Dlp Event is the reason for the event.
  • EVENT_REASON_UNSPECIFIED
    The reason for the event was not specified.
  • MALWARE_TRANSFER_DANGEROUS
    The reason for the malware transfer event is a dangerous file.
  • MALWARE_TRANSFER_DANGEROUS_FILE_TYPE
    The reason for the malware transfer event is a dangerous file type.
  • MALWARE_TRANSFER_DANGEROUS_HOST
    The reason for the malware transfer event is a dangerous host.
  • MALWARE_TRANSFER_DANGEROUS_URL
    The reason for the malware transfer event is a dangerous URL.
  • MALWARE_TRANSFER_UNCOMMON
    The reason for the malware transfer event is an uncommon transfer.
  • MALWARE_TRANSFER_UNKNOWN
    The reason for the malware transfer event is unknown.
  • MALWARE_TRANSFER_UNWANTED_SOFTWARE
    The reason for the malware transfer event is an unwanted software file.
  • PASSWORD_REUSED_PHISHING_URL
    The password reuse event happened on a phishing URL.
  • PASSWORD_REUSED_UNAUTHORIZED_SITE
    The password reuse event happened on an unauthorized site.
  • UNSAFE_SITE_VISIT_MALWARE
    The reason for the unsafe site visit event is malware.
  • UNSAFE_SITE_VISIT_SOCIAL_ENGINEERING
    The reason for the unsafe site visit event is social engineering.
  • UNSAFE_SITE_VISIT_SSL_ERROR
    The reason for the unsafe site visit event is an SSL error.
  • UNSAFE_SITE_VISIT_UNWANTED_SOFTWARE
    The reason for the unsafe site visit event is unwanted software.
EVENT_RESULT

string

Event result event parameter. Possible values:

  • ALLOWED
    The user was allowed to continue after the event.
  • BLOCKED
    The user was blocked from continuing after the event.
  • BLOCKED
    A scan resulted in a blocking of a potential data leakage.
  • BYPASSED
    The user bypassed the event.
  • DETECTED
    A scan resulted in a detection of a potential security threat.
  • REPORTED
    A scan resulted in a reporting of a potential data leakage.
  • WARNED
    The user was warned about the event.
EVIDENCE_LOCKER_FILEPATH

string

A parameter that contains the filepath of the evidence locker.

PROFILE_USER_NAME

string

GSuite user name of the profile.

SCAN_ID

string

A parameter that contains the scan id of the content analysis scan which triggered the event.

SERVER_SCAN_STATUS

string

Status indicates the outcome of the event's server scan, which could be complete, require a manual audit due to configuration settings, or require a manual audit because the scan took too long. Possible values:

  • COMPLETED
    The scan was completed.
  • AUDIT_DUE_TO_CONFIG
    The scan was in audit mode due to the configuration.
  • AUDIT_DUE_TO_DEADLINE_EXCEEDED
    The scan exceeded the configured deadline and so was running in audit mode afterward.
  • UNKNOWN
    The scan status is unknown.
TIMESTAMP

integer

The server timestamp of the Chrome Safe Browsing event.

TRIGGER_TYPE

string

Event trigger type parameter. Possible values:

  • CLIPBOARD
    ChromeOS Dlp Chlipboard rule triggered description.
  • DATA_TRANSFER_EVENT_TRIGGER_TYPE_UNSPECIFIED
    The data transfer trigger is unknown.
  • EPRIVACY
    ChromeOS Dlp Eprivacy Screen rule triggered description.
  • FILE_DOWNLOAD
    The data transfer trigger is a file download.
  • FILE_UPLOAD
    The data transfer trigger is a file upload.
  • PASSWORD_ENTRY
    The password breach trigger is a password entry by a user on a website.
  • PASSWORD_SAFETY_CHECK
    The password breach trigger is a safety check initiated by the user in settings.
  • PRINTING
    ChromeOS Dlp Printing rule triggered description.
  • SCREENCAST
    ChromeOS Dlp Screencast rule triggered description.
  • SCREENSHOT
    ChromeOS Dlp Screenshot rule triggered description.
  • UNDEFINED
    ChromeOS Dlp Undefined rule triggered description.
  • WEB_CONTENT_UPLOAD
    The data transfer trigger is a web content upload.
URL

string

The URL that event happened on.

USER_AGENT

string

User agent event parameter.

USER_JUSTIFICATION

string

A parameter that contains a justification message provided by users.

VIRTUAL_DEVICE_ID

string

Virtual device ID of the browser on which the event happened.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/chrome?eventName=MALWARE_TRANSFER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Malware was detected in the transferred content for {TRIGGER_USER}

Password breach event type

A type for password breach events, indicating that one of the user's password was identified as being leaked. Events of this type are returned with type=PASSWORD_BREACH_TYPE.

Password breach

Password breach event name.

Event details
Event name PASSWORD_BREACH
Parameters
BROWSER_VERSION

string

Browser version event parameter.

CLIENT_TYPE

string

Event client type parameter. Possible values:

  • CHROME_BROWSER
    The client is a Chrome browser.
  • CHROME_OS_DEVICE
    The client is a ChromeOS device.
  • CHROME_PROFILE
    The client is a Chrome profile.
  • CLIENT_TYPE_UNSPECIFIED
    The client type is unknown.
DEVICE_NAME

string

Device name event parameter.

DEVICE_PLATFORM

string

Device platform event parameter.

DEVICE_USER

string

Device user name event parameter.

DIRECTORY_DEVICE_ID

string

Directory API device ID of the device or browser on which the event happened.

EVENT_REASON

string

Event reason event parameter. Possible values:

  • CHROME_OS_DATA_LOST_DETECTED
    ChromeOS reporting data error detected.
  • CHROME_OS_DEV_MODE
    Reason for switching from verified to developer mode events.
  • CHROME_OS_VERIFIED_MODE
    Reason for switching from developer to verified mode events.
  • CHROMEOS_AFFILIATED_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_AFFILIATED_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_AFFILIATED_USER_ADDED
    An affiliated user was added to ChromeOS.
  • CHROMEOS_AFFILIATED_USER_REMOVED
    An affiliated user was removed from ChromeOS.
  • CHROMEOS_GUEST_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_GUEST_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_LOGIN_LOGOUT_UNKNOWN
    Reason a Login/Logout event was recorded.
  • CHROMEOS_UNAFFILIATED_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_UNAFFILIATED_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_UNAFFILIATED_USER_ADDED
    An unaffiliated user was added to ChromeOS.
  • CHROMEOS_UNAFFILIATED_USER_REMOVED
    An unaffiliated user was removed from ChromeOS.
  • CONTENT_UNSCANNED_DLP_SCAN_FAILED
    The reason for the unscanned content event is a failure to scan for DLP.
  • CONTENT_UNSCANNED_FILE_PASSWORD_PROTECTED
    The reason for the unscanned content event is a password protected file.
  • CONTENT_UNSCANNED_FILE_TOO_LARGE
    The reason for the unscanned content event is a file too large.
  • CONTENT_UNSCANNED_MALWARE_SCAN_FAILED
    The reason for the unscanned content event is a failure to scan for malware.
  • CONTENT_UNSCANNED_MALWARE_SCAN_UNSUPPORTED_FILE_TYPE
    The reason for the unscanned content event is a file of an unsupported type for malware scan.
  • CONTENT_UNSCANNED_SERVICE_UNAVAILABLE
    The reason for the unscanned content event is a service unavailable.
  • CONTENT_UNSCANNED_TIMEOUT
    The reason for the unscanned content event that the request timed out.
  • CONTENT_UNSCANNED_TOO_MANY_REQUESTS
    The reason for the unscanned content event is that too many requests were sent.
  • EVENT_REASON_DLP_EVENT
    ChromeOS Dlp Event is the reason for the event.
  • EVENT_REASON_UNSPECIFIED
    The reason for the event was not specified.
  • MALWARE_TRANSFER_DANGEROUS
    The reason for the malware transfer event is a dangerous file.
  • MALWARE_TRANSFER_DANGEROUS_FILE_TYPE
    The reason for the malware transfer event is a dangerous file type.
  • MALWARE_TRANSFER_DANGEROUS_HOST
    The reason for the malware transfer event is a dangerous host.
  • MALWARE_TRANSFER_DANGEROUS_URL
    The reason for the malware transfer event is a dangerous URL.
  • MALWARE_TRANSFER_UNCOMMON
    The reason for the malware transfer event is an uncommon transfer.
  • MALWARE_TRANSFER_UNKNOWN
    The reason for the malware transfer event is unknown.
  • MALWARE_TRANSFER_UNWANTED_SOFTWARE
    The reason for the malware transfer event is an unwanted software file.
  • PASSWORD_REUSED_PHISHING_URL
    The password reuse event happened on a phishing URL.
  • PASSWORD_REUSED_UNAUTHORIZED_SITE
    The password reuse event happened on an unauthorized site.
  • UNSAFE_SITE_VISIT_MALWARE
    The reason for the unsafe site visit event is malware.
  • UNSAFE_SITE_VISIT_SOCIAL_ENGINEERING
    The reason for the unsafe site visit event is social engineering.
  • UNSAFE_SITE_VISIT_SSL_ERROR
    The reason for the unsafe site visit event is an SSL error.
  • UNSAFE_SITE_VISIT_UNWANTED_SOFTWARE
    The reason for the unsafe site visit event is unwanted software.
EVENT_RESULT

string

Event result event parameter. Possible values:

  • ALLOWED
    The user was allowed to continue after the event.
  • BLOCKED
    The user was blocked from continuing after the event.
  • BLOCKED
    A scan resulted in a blocking of a potential data leakage.
  • BYPASSED
    The user bypassed the event.
  • DETECTED
    A scan resulted in a detection of a potential security threat.
  • REPORTED
    A scan resulted in a reporting of a potential data leakage.
  • WARNED
    The user was warned about the event.
PROFILE_USER_NAME

string

GSuite user name of the profile.

TIMESTAMP

integer

The server timestamp of the Chrome Safe Browsing event.

TRIGGER_TYPE

string

Event trigger type parameter. Possible values:

  • CLIPBOARD
    ChromeOS Dlp Chlipboard rule triggered description.
  • DATA_TRANSFER_EVENT_TRIGGER_TYPE_UNSPECIFIED
    The data transfer trigger is unknown.
  • EPRIVACY
    ChromeOS Dlp Eprivacy Screen rule triggered description.
  • FILE_DOWNLOAD
    The data transfer trigger is a file download.
  • FILE_UPLOAD
    The data transfer trigger is a file upload.
  • PASSWORD_ENTRY
    The password breach trigger is a password entry by a user on a website.
  • PASSWORD_SAFETY_CHECK
    The password breach trigger is a safety check initiated by the user in settings.
  • PRINTING
    ChromeOS Dlp Printing rule triggered description.
  • SCREENCAST
    ChromeOS Dlp Screencast rule triggered description.
  • SCREENSHOT
    ChromeOS Dlp Screenshot rule triggered description.
  • UNDEFINED
    ChromeOS Dlp Undefined rule triggered description.
  • WEB_CONTENT_UPLOAD
    The data transfer trigger is a web content upload.
TRIGGER_USER

string

Trigger user event parameter.

URL

string

The URL that event happened on.

USER_AGENT

string

User agent event parameter.

VIRTUAL_DEVICE_ID

string

Virtual device ID of the browser on which the event happened.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/chrome?eventName=PASSWORD_BREACH&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
A user's password was breached

Sensitive data transfer event type

A type for senstive data transfer events. Events of this type are returned with type=SENSITIVE_DATA_TRANSFER_TYPE.

Sensitive data transfer

Sensitive data transfer event name.

Event details
Event name SENSITIVE_DATA_TRANSFER
Parameters
BROWSER_VERSION

string

Browser version event parameter.

CLIENT_TYPE

string

Event client type parameter. Possible values:

  • CHROME_BROWSER
    The client is a Chrome browser.
  • CHROME_OS_DEVICE
    The client is a ChromeOS device.
  • CHROME_PROFILE
    The client is a Chrome profile.
  • CLIENT_TYPE_UNSPECIFIED
    The client type is unknown.
CONTENT_HASH

string

Content hash event parameter.

CONTENT_NAME

string

Content name event parameter.

CONTENT_SIZE

integer

Content size event parameter.

CONTENT_TYPE

string

Content type event parameter.

CONTENT_TRANSFER_METHOD

string

The method for content transferring. Possible values:

  • FILE_PICKER
    The content is transferred using file picker.
  • DRAG_AND_DROP
    The content is transferred using drag and drop.
  • FILE_PASTE
    The content is transferred using file paste.
  • UNKNOWN
    The transfer method is unknown.
DEVICE_ID

string

Device id event name.

DEVICE_NAME

string

Device name event parameter.

DEVICE_PLATFORM

string

Device platform event parameter.

DEVICE_USER

string

Device user name event parameter.

DIRECTORY_DEVICE_ID

string

Directory API device ID of the device or browser on which the event happened.

EVENT_RESULT

string

Event result event parameter. Possible values:

  • ALLOWED
    The user was allowed to continue after the event.
  • BLOCKED
    The user was blocked from continuing after the event.
  • BLOCKED
    A scan resulted in a blocking of a potential data leakage.
  • BYPASSED
    The user bypassed the event.
  • DETECTED
    A scan resulted in a detection of a potential security threat.
  • REPORTED
    A scan resulted in a reporting of a potential data leakage.
  • WARNED
    The user was warned about the event.
EVIDENCE_LOCKER_FILEPATH

string

A parameter that contains the filepath of the evidence locker.

PROFILE_USER_NAME

string

GSuite user name of the profile.

SCAN_ID

string

A parameter that contains the scan id of the content analysis scan which triggered the event.

SERVER_SCAN_STATUS

string

Status indicates the outcome of the event's server scan, which could be complete, require a manual audit due to configuration settings, or require a manual audit because the scan took too long. Possible values:

  • COMPLETED
    The scan was completed.
  • AUDIT_DUE_TO_CONFIG
    The scan was in audit mode due to the configuration.
  • AUDIT_DUE_TO_DEADLINE_EXCEEDED
    The scan exceeded the configured deadline and so was running in audit mode afterward.
  • UNKNOWN
    The scan status is unknown.
TIMESTAMP

integer

The server timestamp of the Chrome Safe Browsing event.

TRIGGER_TYPE

string

Event trigger type parameter. Possible values:

  • CLIPBOARD
    ChromeOS Dlp Chlipboard rule triggered description.
  • DATA_TRANSFER_EVENT_TRIGGER_TYPE_UNSPECIFIED
    The data transfer trigger is unknown.
  • EPRIVACY
    ChromeOS Dlp Eprivacy Screen rule triggered description.
  • FILE_DOWNLOAD
    The data transfer trigger is a file download.
  • FILE_UPLOAD
    The data transfer trigger is a file upload.
  • PASSWORD_ENTRY
    The password breach trigger is a password entry by a user on a website.
  • PASSWORD_SAFETY_CHECK
    The password breach trigger is a safety check initiated by the user in settings.
  • PRINTING
    ChromeOS Dlp Printing rule triggered description.
  • SCREENCAST
    ChromeOS Dlp Screencast rule triggered description.
  • SCREENSHOT
    ChromeOS Dlp Screenshot rule triggered description.
  • UNDEFINED
    ChromeOS Dlp Undefined rule triggered description.
  • WEB_CONTENT_UPLOAD
    The data transfer trigger is a web content upload.
TRIGGERED_RULES_REASON

string

Triggered rules reason event parameter.

URL

string

The URL that event happened on.

USER_AGENT

string

User agent event parameter.

USER_JUSTIFICATION

string

A parameter that contains a justification message provided by users.

VIRTUAL_DEVICE_ID

string

Virtual device ID of the browser on which the event happened.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/chrome?eventName=SENSITIVE_DATA_TRANSFER&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Sensitive data was detected in the transferred content for {TRIGGER_USER}

Unsafe site visit event type

A type for unsafe site visit events. Events of this type are returned with type=UNSAFE_SITE_VISIT_TYPE.

Unsafe site visit

Unsafe site visit event name.

Event details
Event name UNSAFE_SITE_VISIT
Parameters
BROWSER_VERSION

string

Browser version event parameter.

CLIENT_TYPE

string

Event client type parameter. Possible values:

  • CHROME_BROWSER
    The client is a Chrome browser.
  • CHROME_OS_DEVICE
    The client is a ChromeOS device.
  • CHROME_PROFILE
    The client is a Chrome profile.
  • CLIENT_TYPE_UNSPECIFIED
    The client type is unknown.
DEVICE_ID

string

Device id event name.

DEVICE_NAME

string

Device name event parameter.

DEVICE_PLATFORM

string

Device platform event parameter.

DEVICE_USER

string

Device user name event parameter.

DIRECTORY_DEVICE_ID

string

Directory API device ID of the device or browser on which the event happened.

EVENT_REASON

string

Event reason event parameter. Possible values:

  • CHROME_OS_DATA_LOST_DETECTED
    ChromeOS reporting data error detected.
  • CHROME_OS_DEV_MODE
    Reason for switching from verified to developer mode events.
  • CHROME_OS_VERIFIED_MODE
    Reason for switching from developer to verified mode events.
  • CHROMEOS_AFFILIATED_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_AFFILIATED_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_AFFILIATED_USER_ADDED
    An affiliated user was added to ChromeOS.
  • CHROMEOS_AFFILIATED_USER_REMOVED
    An affiliated user was removed from ChromeOS.
  • CHROMEOS_GUEST_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_GUEST_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_LOGIN_LOGOUT_UNKNOWN
    Reason a Login/Logout event was recorded.
  • CHROMEOS_UNAFFILIATED_LOGIN
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_UNAFFILIATED_LOGOUT
    Reason a Login/Logout Event was recorded.
  • CHROMEOS_UNAFFILIATED_USER_ADDED
    An unaffiliated user was added to ChromeOS.
  • CHROMEOS_UNAFFILIATED_USER_REMOVED
    An unaffiliated user was removed from ChromeOS.
  • CONTENT_UNSCANNED_DLP_SCAN_FAILED
    The reason for the unscanned content event is a failure to scan for DLP.
  • CONTENT_UNSCANNED_FILE_PASSWORD_PROTECTED
    The reason for the unscanned content event is a password protected file.
  • CONTENT_UNSCANNED_FILE_TOO_LARGE
    The reason for the unscanned content event is a file too large.
  • CONTENT_UNSCANNED_MALWARE_SCAN_FAILED
    The reason for the unscanned content event is a failure to scan for malware.
  • CONTENT_UNSCANNED_MALWARE_SCAN_UNSUPPORTED_FILE_TYPE
    The reason for the unscanned content event is a file of an unsupported type for malware scan.
  • CONTENT_UNSCANNED_SERVICE_UNAVAILABLE
    The reason for the unscanned content event is a service unavailable.
  • CONTENT_UNSCANNED_TIMEOUT
    The reason for the unscanned content event that the request timed out.
  • CONTENT_UNSCANNED_TOO_MANY_REQUESTS
    The reason for the unscanned content event is that too many requests were sent.
  • EVENT_REASON_DLP_EVENT
    ChromeOS Dlp Event is the reason for the event.
  • EVENT_REASON_UNSPECIFIED
    The reason for the event was not specified.
  • MALWARE_TRANSFER_DANGEROUS
    The reason for the malware transfer event is a dangerous file.
  • MALWARE_TRANSFER_DANGEROUS_FILE_TYPE
    The reason for the malware transfer event is a dangerous file type.
  • MALWARE_TRANSFER_DANGEROUS_HOST
    The reason for the malware transfer event is a dangerous host.
  • MALWARE_TRANSFER_DANGEROUS_URL
    The reason for the malware transfer event is a dangerous URL.
  • MALWARE_TRANSFER_UNCOMMON
    The reason for the malware transfer event is an uncommon transfer.
  • MALWARE_TRANSFER_UNKNOWN
    The reason for the malware transfer event is unknown.
  • MALWARE_TRANSFER_UNWANTED_SOFTWARE
    The reason for the malware transfer event is an unwanted software file.
  • PASSWORD_REUSED_PHISHING_URL
    The password reuse event happened on a phishing URL.
  • PASSWORD_REUSED_UNAUTHORIZED_SITE
    The password reuse event happened on an unauthorized site.
  • UNSAFE_SITE_VISIT_MALWARE
    The reason for the unsafe site visit event is malware.
  • UNSAFE_SITE_VISIT_SOCIAL_ENGINEERING
    The reason for the unsafe site visit event is social engineering.
  • UNSAFE_SITE_VISIT_SSL_ERROR
    The reason for the unsafe site visit event is an SSL error.
  • UNSAFE_SITE_VISIT_UNWANTED_SOFTWARE
    The reason for the unsafe site visit event is unwanted software.
EVENT_RESULT

string

Event result event parameter. Possible values:

  • ALLOWED
    The user was allowed to continue after the event.
  • BLOCKED
    The user was blocked from continuing after the event.
  • BLOCKED
    A scan resulted in a blocking of a potential data leakage.
  • BYPASSED
    The user bypassed the event.
  • DETECTED
    A scan resulted in a detection of a potential security threat.
  • REPORTED
    A scan resulted in a reporting of a potential data leakage.
  • WARNED
    The user was warned about the event.
PROFILE_USER_NAME

string

GSuite user name of the profile.

TIMESTAMP

integer

The server timestamp of the Chrome Safe Browsing event.

URL

string

The URL that event happened on.

USER_AGENT

string

User agent event parameter.

VIRTUAL_DEVICE_ID

string

Virtual device ID of the browser on which the event happened.

Sample request
GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/chrome?eventName=UNSAFE_SITE_VISIT&maxResults=10&access_token=YOUR_ACCESS_TOKEN
Admin Console message format
Unsafe site visit warning shown for {TRIGGER_USER}