# SuspiciousActivity

- [JSON representation](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/SuspiciousActivity#SCHEMA_REPRESENTATION)
- [SuspiciousActivitySecurityDetail](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/SuspiciousActivity#SuspiciousActivitySecurityDetail)
  - [JSON representation](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/SuspiciousActivity#SuspiciousActivitySecurityDetail.SCHEMA_REPRESENTATION)

A mobile suspicious activity alert. Derived from audit logs.

| JSON representation |
|---|
| ``` { "email": string, "events": [ { object (`https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/SuspiciousActivity#SuspiciousActivitySecurityDetail`) } ] } ``` |

| Fields ||
|---|---|
| `email` | `string` The email of the user this alert was created for. |
| `events[]` | ``object (`https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/SuspiciousActivity#SuspiciousActivitySecurityDetail`)`` Required. The list of security events. |

## SuspiciousActivitySecurityDetail

Detailed information of a single MDM suspicious activity event.

| JSON representation |
|---|
| ``` { "deviceId": string, "serialNumber": string, "deviceType": string, "deviceModel": string, "resourceId": string, "iosVendorId": string, "deviceProperty": string, "oldValue": string, "newValue": string } ``` |

| Fields ||
|---|---|
| `deviceId` | `string` Required. The device ID. |
| `serialNumber` | `string` The serial number of the device. |
| `deviceType` | `string` The type of the device. |
| `deviceModel` | `string` The model of the device. |
| `resourceId` | `string` The device resource ID. |
| `iosVendorId` | `string` Required for iOS, empty for others. |
| `deviceProperty` | `string` The device property which was changed. |
| `oldValue` | `string` The old value of the device property before the change. |
| `newValue` | `string` The new value of the device property after the change. |