Google IAM Events
Events that Trigger (Re)Scan
Create Events
- create_group - A new group is created.
- create_user - A new user is created.
Update Events
- 2sv_disable - Two-step verification is disabled.
- 2sv_enroll - Two-step verification is enrolled.
- password_edit - A user's password is modified.
- recovery_email_edit - A recovery email is changed.
- recovery_phone_edit - A recovery phone number is changed.
- recovery_secret_qa_edit - A recovery question or answer is changed.
- account_disabled_password_leak - A user account is disabled due to a password leak.
- account_disabled_generic - A user account is disabled.
- account_disabled_spamming - A user account is disabled due to spamming.
- account_disabled_spamming_through_relay - A user account is disabled for spamming via relay.
- accept_invitation - A user accepts an invitation.
- add_info_setting - An informational setting is added.
- add_member - A new member is added to a group.
- add_member_role - A role is assigned to a member.
- add_security_setting - A security setting is added.
- add_service_account_permission - A permission is assigned to a service account.
- approve_join_request - A join request is approved.
- ban_member_with_moderation - A member is banned.
- change_info_setting - An informational setting is modified.
- change_security_setting - A security setting is changed.
- change_group_setting - A group setting is modified.
- change_group_name - A group's name is changed.
- change_first_name - A user's first name is changed.
- change_password - A user's password is changed.
- suspend_user - A user is suspended.
- unsuspend_user - A user is unsuspended.
- update_group_settings - A group's settings are updated.
- user_license_assignment - A license is assigned to a user.
- user_license_revoke - A license is revoked from a user.
- add_group_member - A member is added to a group.
- remove_group_member - A member is removed from a group.
- change_user_access - User access permissions are changed.
- change_acl_editors - The list of editors for a document is changed.
Delete Events
- delete_group - A group is deleted.
- delete_user - A user is deleted.
- archive_user - A user is archived.
- unarchive_user - A user is unarchived.
Other Processed Events
- login_success - A user successfully logs in.
- login_failure - A login attempt fails.
- login_challenge - A login challenge occurs.
- application_login_failure - An application login fails.
- application_login_success - An application login succeeds.
- alert_center_view - The alert center is accessed.
- request_to_join - A request to join a group is sent.
- request_to_join_via_mail - A request to join a group via email is sent.
- approval_requested - An approval request is made.
- approval_canceled - An approval request is canceled.
- approval_comment_added - A comment is added to an approval request.
- approval_completed - An approval request is completed.
- approval_due_time_change - The due time of an approval request is changed.
- approval_reviewer_change - The reviewer of an approval request is changed.
- approval_reviewer_responded - A reviewer responds to an approval request.
- deny_access_request - An access request is denied.
- expire_access_request - An access request expires.
- shared_drive_membership_change - Membership in a shared drive is changed.
- shared_drive_settings_change - Shared drive settings are changed.
- apply_security_update - A security update is applied.
- remove_security_update - A security update is removed.
- shared_drive_apply_security_update - A security update is applied to a shared drive.
- shared_drive_remove_security_update - A security update is removed from a shared drive.
- suspicious_login - A suspicious login is detected.
- suspicious_login_less_secure_app - A suspicious login from a less secure app is detected.
- suspicious_programmatic_login - A suspicious programmatic login is detected.
- user_signed_out_due_to_suspicious_session_cookie - A user is signed out due to a suspicious session cookie.