Google Drive Audit Events
Google supports audit logs of the changes in various audit categories. This has ample information that can be used by Netskope to create Skope IT events. The audit categories are based on the type of Google account. There are two types of Google accounts:
Unlimited: If you have a Google account with unlimited storage, an enterprise-based poll is used. Following audit events are visible in Skope IT:
Google Drive events: Activities performed by users and administrators on their files such as create, edit, share, delete files.
Admin console events: Activities performed by administrators such as changing a configuration, adding a new user role, etc.
Login events: Three activities are captured - successful login, failed login, and logout.
Authorization token events: This audit category is specific to installing apps. Two activities are captured - installing an app and revoking an app.
Calendar events: Events such as creating, modifying, deleting an event, adding, or deleting a guest user for an event are captured.
Limited: If you have a Google account with limited storage, a user-based poll is used. Apart from Google Drive events, all events listed in the unlimited account are visible in Skope IT.
Note
If you have a a limited storage account, then Skope IT does not display file upload, download, view, edit, and share activities.
The following list of audit events are supported for Google Drive:
Event Name |
|---|
accept_invitation |
add_domain_alias |
add_event_guest |
add_group_member |
add_info_setting |
add_nickname |
add_privilege |
add_secondary_domain |
add_subscription |
add_to_folder |
add_user |
allow_asp_without_2sv |
always_post_from_user |
android_work_profile_support_enabled_event |
application_event |
approve_join_request |
assign_role |
authorize_api_client_access |
authorize |
ban_user_with_moderation |
bulk_upload_notification_sent |
bulk_upload |
cancel_user_invite |
change_account_auto_renewal |
change_acl_editors |
change_acl_permission |
change_advertisement_option |
change_application_setting |
change_basic_setting |
change_calendar_acls |
change_calendar_country |
change_calendar_description |
change_calendar_location |
change_calendar_setting |
change_calendar_timezone |
change_calendar_title |
change_chat_setting |
change_chrome_os_setting |
change_conflict_account_action |
change_contacts_setting |
change_custom_logo |
change_docs_setting |
change_document_access_scope |
change_document_visibility |
change_domain_default_locale |
change_domain_default_timezone |
change_domain_name |
change_domain_support_message |
change_email_settings |
change_event_guest_response |
change_event_start_time |
change_event_title |
change_event |
change_first_name |
change_group_description |
change_group_name |
change_group_setting |
change_identity_setting |
change_info_setting |
change_last_name |
change_license_auto_assign |
change_login_activity_trace |
change_login_background_color |
change_login_border_color |
change_mobile_setting |
change_new_members_restrictions_setting |
change_organization_name |
change_password_max_length |
change_password_min_length |
change_password_on_next_login |
change_password |
change_post_replies_setting |
change_renew_domain_registration |
change_sites_setting |
change_spam_moderation_setting |
change_sso_settings |
change_system_setting |
change_topic_setting |
change_user_access |
create_application_setting |
create_calendar_resource |
create_calendar |
create_data_transfer_request |
create_event |
create_group |
create_group |
create_org_unit |
create_role |
create_user |
create |
delete_application_setting |
delete_calendar_resource |
delete_calendar |
delete_event |
delete_group |
delete_group |
delete_role |
delete_subscription |
delete_user |
delete |
device_compromised_event |
device_ownership_change_event |
device_register_unregister_event |
device_settings_updated_event |
download_userlist_csv |
download |
edit_org_unit_description |
edit_org_unit_name |
edit |
enable_api_access |
enable_feedback_solicitation |
enable_service_or_feature_notification |
failed_password_attempts_event |
generate_pin |
gmail_reset_user |
grant_admin_privilege |
grant_delegated_admin_privileges |
invite_user |
join |
login_failure |
login_success |
logout |
mail_routing_destination_added |
mail_routing_destination_removed |
mix_record_verification_claim |
mobile_device_approve |
mobile_device_block |
mobile_device_cancel_wipe_then_approve |
mobile_device_cancel_wipe_then_block |
mobile_device_delete |
mobile_device_wipe |
moderate_message |
move_org_unit |
move_user_to_org_unit |
move |
org_all_users_license_assignment |
org_license_revoke |
org_users_license_assignment |
os_updated_event |
preview |
regenerate_oauth_consumer_secret |
reinvite_user |
reject_join_request |
remove_api_client_access |
remove_domain_alias |
remove_event_guest |
remove_from_folder |
remove_group_member |
remove_info_setting |
remove_nickname |
remove_org_unit |
remove_privilege |
remove_secondary_domain |
remove_user |
rename_calendar_resource |
rename_role |
rename_user |
rename |
request_to_join |
resend_user_invite |
reset_signin_cookies |
revoke_3lo_token |
revoke_admin_privilege |
revoke_asp |
revoke_invitation |
revoke_security_key |
revoke |
suspend_user |
suspicious_activity_event |
team_drive_membership_change |
toggle_allow_admin_password_reset |
toggle_auto_add_new_service |
toggle_automatic_contact_sharing |
toggle_contact_sharing |
toggle_enable_oauth_consumer_key |
toggle_enable_pre_release_features |
toggle_oauth_access_to_all_apis |
toggle_open_id_enabled |
toggle_outbound_relay |
toggle_service_enabled |
toggle_ssl |
toggle_sso_enabled |
toggle_use_custom_logo |
toggle_use_next_gen_control_panel |
transfer_document_ownership |
trash |
unassign_role |
undelete_user |
unsuspend_user |
untrash |
update_birthdate |
update_domain_primary_admin_email |
update_secondary_email |
upload_oauth_certificate |
upload |
user_invite |
user_license_assignment |
user_license_reassignment |
user_license_revoke |
verify_domain_alias_mx |
verify_domain_alias |
verify_secondary_domain_mx |
verify_secondary_domain |
view_temp_password |
view |