Google Workspace Alert types

Alert sources and types

Listed in the table below are the possible values for the source field, corresponding alert type names for type field and data types for the data field.

Learn more about these alert types from our support documentation.

Alert source Alert type in API Alert type in Admin console Alert data
Access Approvals Access Approvals request Access Approvals request AccessApproval
Domain wide takeout Customer takeout initiated Domain data export initiated DomainWideTakeoutInitiated
Gmail phishing Malware reclassification Malware message detected post-delivery MailPhishing
Misconfigured whitelist Phishing in inboxes due to bad whitelist BadWhitelist
Phishing reclassification Phishing message detected post-delivery MailPhishing
Suspicious message reported Suspicious message reported MailPhishing
User reported phishing User reported phishing MailPhishing

Customers who were part of Alert Center EAP may see the following deprecated type in their old alerts: PhishingSpike

User reported spam spike Spike in user reported spam MailPhishing
Google identity Leaked password Leaked password AccountWarning
Suspicious login Suspicious login blocked AccountWarning
Suspicious login (less secure app) Suspicious login from a less secure app AccountWarning
Suspicious programmatic login Suspicious programmatic login AccountWarning
User suspended User suspended AccountWarning
User suspended (spam) User suspended for spamming AccountWarning
User suspended (spam through relay) User suspended for spamming through relay AccountWarning
User suspended (suspicious activity) User suspended due to suspicious activity AccountWarning
Google Operations Google Operations Google Operations GoogleOperations
Google Voice Configuration problem Google Voice configuration problem VoiceMisconfiguration
State Sponsored Attack Government attack warning Government-backed attacks StateSponsoredAttack
Mobile device management Device compromised Device compromised DeviceCompromised
Suspicious activity Suspicious device activity SuspiciousActivity
APNS certificate is expiring soon APNS certificate is expiring soon ApnsCertificateExpirationInfo
APNS certificate has expired APNS certificate has expired ApnsCertificateExpirationInfo
AppMaker Editor AppMaker Default Cloud SQL setup App Maker Cloud SQL setup AppMakerSqlSetupNotification
Security Center rules Activity Rule Activity Rule ActivityRule
Data Loss Prevention Data Loss Prevention Data Loss Prevention (DLP) DlpRuleViolation
Apps outage Apps outage Apps outage AppsOutage
Sensitive Admin Action Primary admin changed Primary admin changed SensitiveAdminAction
SSO profile added SSO profile added SensitiveAdminAction
SSO profile updated SSO profile updated SensitiveAdminAction
SSO profile deleted SSO profile deleted SensitiveAdminAction
Super admin password reset Super admin password reset SensitiveAdminAction
Google Mandatory Service Announcement MSA Billing Google Mandatory Service Announcement - Billing MandatoryServiceAnnouncement
MSA Legal Google Mandatory Service Announcement - Legal MandatoryServiceAnnouncement
MSA Product Google Mandatory Service Announcement - Product MandatoryServiceAnnouncement
MSA Security Google Mandatory Service Announcement - Security MandatoryServiceAnnouncement
Customer abuse Customer abuse detected Customer abuse detected AbuseDetected
App Settings Changed Calendar settings changed Calendar settings changed AppSettingsChanged
Drive settings changed Drive settings changed AppSettingsChanged
Email settings changed Email settings changed AppSettingsChanged
Mobile settings changed Mobile settings changed AppSettingsChanged
User Changes New user Added New user added UserChanges
Suspended user made active Suspended user made active UserChanges
User deleted User deleted UserChanges
User granted Admin privilege User granted Admin privilege UserChanges
User suspended (Administrator email alert) User suspended (by admin) UserChanges
Users Admin privilege revoked User's Admin privilege revoked UserChanges
Users password changed User's password changed UserChanges
Reporting Rule Reporting Rule Reporting Rule ReportingRule
Google identity Account suspension warning Account suspension warning AccountSuspensionWarning
Chrome Chrome devices auto-update expiration warning Chrome devices auto-update expiration warning ChromeOsFutureExpiringDevices