## Alert sources and types

Listed in the table below are the possible values for the `source` field,
corresponding alert type names for `type` field and data types for the `data` field.

Learn more about these alert types from our
[support documentation](https://support.google.com/a/answer/9104585).

| Alert `source` | Alert `type in API` | Alert `type in Admin console` | Alert `data` |
|---|---|---|---|
| `Access Approvals` | `Access Approvals request` | `Access Approvals request` | [`AccessApproval`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/AccessApproval) |
| `Domain wide takeout` | `Customer takeout initiated` | `Domain data export initiated` | [`DomainWideTakeoutInitiated`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/DomainWideTakeoutInitiated) |
| `Gmail phishing` | `Malware reclassification` | `Malware message detected post-delivery` | [`MailPhishing`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/MailPhishing) |
| `Gmail phishing` | `Misconfigured whitelist` | `Phishing in inboxes due to bad whitelist` | [`BadWhitelist`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/BadWhitelist) |
| `Gmail phishing` | `Phishing reclassification` | `Phishing message detected post-delivery` | [`MailPhishing`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/MailPhishing) |
| `Gmail phishing` | `Suspicious message reported` | `Suspicious message reported` | [`MailPhishing`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/MailPhishing) |
| `Gmail phishing` | `User reported phishing` | `User reported phishing` | [`MailPhishing`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/MailPhishing) Customers who were part of Alert Center EAP may see the following deprecated type in their old alerts: [`PhishingSpike`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/PhishingSpike) |
| `Gmail phishing` | `User reported spam spike` | `Spike in user reported spam` | [`MailPhishing`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/MailPhishing) |
| `Google identity` | `Leaked password` | `Leaked password` | [`AccountWarning`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/AccountWarning) |
| `Google identity` | `Suspicious login` | `Suspicious login blocked` | [`AccountWarning`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/AccountWarning) |
| `Google identity` | `Suspicious login (less secure app)` | `Suspicious login from a less secure app` | [`AccountWarning`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/AccountWarning) |
| `Google identity` | `Suspicious programmatic login` | `Suspicious programmatic login` | [`AccountWarning`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/AccountWarning) |
| `Google identity` | `User suspended` | `User suspended` | [`AccountWarning`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/AccountWarning) |
| `Google identity` | `User suspended (spam)` | `User suspended for spamming` | [`AccountWarning`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/AccountWarning) |
| `Google identity` | `User suspended (spam through relay)` | `User suspended for spamming through relay` | [`AccountWarning`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/AccountWarning) |
| `Google identity` | `User suspended (suspicious activity)` | `User suspended due to suspicious activity` | [`AccountWarning`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/AccountWarning) |
| `Google Operations` | `Google Operations` | `Google Operations` | [`GoogleOperations`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/GoogleOperations) |
| `Google Voice` | `Configuration problem` | `Google Voice configuration problem` | [`VoiceMisconfiguration`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/VoiceMisconfiguration) |
| `State Sponsored Attack` | `Government attack warning` | `Government-backed attacks` | [`StateSponsoredAttack`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/StateSponsoredAttack) |
| `Mobile device management` | `Device compromised` | `Device compromised` | [`DeviceCompromised`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/DeviceCompromised) |
| `Mobile device management` | `Suspicious activity` | `Suspicious device activity` | [`SuspiciousActivity`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/SuspiciousActivity) |
| `Mobile device management` | `APNS certificate is expiring soon` | `APNS certificate is expiring soon` | [`ApnsCertificateExpirationInfo`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/ApnsCertificateExpirationInfo) |
| `Mobile device management` | `APNS certificate has expired` | `APNS certificate has expired` | [`ApnsCertificateExpirationInfo`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/ApnsCertificateExpirationInfo) |
| `AppMaker Editor` | `AppMaker Default Cloud SQL setup` | `App Maker Cloud SQL setup` | [`AppMakerSqlSetupNotification`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/AppMakerSqlSetupNotification) |
| `Security Center rules` | `Activity Rule` | `Activity Rule` | [`ActivityRule`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/ActivityRule) |
| `Data Loss Prevention` | `Data Loss Prevention` | `Data Loss Prevention (DLP)` | [`DlpRuleViolation`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/DlpRuleViolation) |
| `Apps outage` | `Apps outage` | `Apps outage` | [`AppsOutage`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/AppsOutage) |
| `Sensitive Admin Action` | `Primary admin changed` | `Primary admin changed` | [`SensitiveAdminAction`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/SensitiveAdminAction) |
| `Sensitive Admin Action` | `SSO profile added` | `SSO profile added` | [`SensitiveAdminAction`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/SensitiveAdminAction) |
| `Sensitive Admin Action` | `SSO profile updated` | `SSO profile updated` | [`SensitiveAdminAction`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/SensitiveAdminAction) |
| `Sensitive Admin Action` | `SSO profile deleted` | `SSO profile deleted` | [`SensitiveAdminAction`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/SensitiveAdminAction) |
| `Sensitive Admin Action` | `Super admin password reset` | `Super admin password reset` | [`SensitiveAdminAction`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/SensitiveAdminAction) |
| `Google Mandatory Service Announcement` | `MSA Billing` | `Google Mandatory Service Announcement - Billing` | [`MandatoryServiceAnnouncement`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/MandatoryServiceAnnouncement) |
| `Google Mandatory Service Announcement` | `MSA Legal` | `Google Mandatory Service Announcement - Legal` | [`MandatoryServiceAnnouncement`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/MandatoryServiceAnnouncement) |
| `Google Mandatory Service Announcement` | `MSA Product` | `Google Mandatory Service Announcement - Product` | [`MandatoryServiceAnnouncement`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/MandatoryServiceAnnouncement) |
| `Google Mandatory Service Announcement` | `MSA Security` | `Google Mandatory Service Announcement - Security` | [`MandatoryServiceAnnouncement`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/MandatoryServiceAnnouncement) |
| `Customer abuse` | `Customer abuse detected` | `Customer abuse detected` | [`AbuseDetected`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/AbuseDetected) |
| `App Settings Changed` | `Calendar settings changed` | `Calendar settings changed` | [`AppSettingsChanged`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/AppSettingsChanged) |
| `App Settings Changed` | `Drive settings changed` | `Drive settings changed` | [`AppSettingsChanged`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/AppSettingsChanged) |
| `App Settings Changed` | `Email settings changed` | `Email settings changed` | [`AppSettingsChanged`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/AppSettingsChanged) |
| `App Settings Changed` | `Mobile settings changed` | `Mobile settings changed` | [`AppSettingsChanged`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/AppSettingsChanged) |
| `User Changes` | `New user Added` | `New user added` | [`UserChanges`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/UserChanges) |
| `User Changes` | `Suspended user made active` | `Suspended user made active` | [`UserChanges`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/UserChanges) |
| `User Changes` | `User deleted` | `User deleted` | [`UserChanges`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/UserChanges) |
| `User Changes` | `User granted Admin privilege` | `User granted Admin privilege` | [`UserChanges`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/UserChanges) |
| `User Changes` | `User suspended (Administrator email alert)` | `User suspended (by admin)` | [`UserChanges`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/UserChanges) |
| `User Changes` | `Users Admin privilege revoked` | `User's Admin privilege revoked` | [`UserChanges`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/UserChanges) |
| `User Changes` | `Users password changed` | `User's password changed` | [`UserChanges`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/UserChanges) |
| `Reporting Rule` | `Reporting Rule` | `Reporting Rule` | [`ReportingRule`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/ReportingRule) |
| `Google identity` | `Account suspension warning` | `Account suspension warning` | [`AccountSuspensionWarning`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/AccountSuspensionWarning) |
| `Client Side Encryption` | `Client-side encryption service unavailable` | `Client-side encryption service unavailable` | [`ClientSideEncryptionServiceUnavailable`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/ClientSideEncryptionServiceUnavailable) |
| `Drive Counter Abuse` | `Potential ransomware detected` | `Potential ransomware detected` | [`DriveSyncStateChanged`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/DriveSyncStateChanged) |
| `Drive Counter Abuse` | `File syncing resumed` | `File syncing resumed` | [`DriveSyncStateChanged`](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/DriveSyncStateChanged) |