Event Names

Each application generates a variety of audit events that represent different user actions or system activities. The Event Name field allows you to specify which particular event(s) you want to monitor within the selected application. By choosing a specific event name, you can focus the trigger on relevant activities, making your automation more precise and efficient.

If left empty, the trigger will activate for all events generated by the chosen application.

Detailed lists of available event names for each application are provided for your reference:

<!DOCTYPE html>

Application Events

Application	Event Name	Description
Access Transparency	ACCESS `ACCESS`	A Google Workspace resource was accessed by Google.
Admin Console (applicationName=`admin`)	CHANGE\_APPLICATION\_SETTING `CHANGE\_APPLICATION\_SETTING`	An admin changed an application setting. (e.g. “Setting X changed from A to B”)
	CREATE\_APPLICATION\_SETTING `CREATE\_APPLICATION\_SETTING`	An application setting was created.
	DELETE\_APPLICATION\_SETTING `DELETE\_APPLICATION\_SETTING`	An application setting was deleted.
	REORDER\_GROUP\_BASED\_POLICIES\_EVENT `REORDER\_GROUP\_BASED\_POLICIES\_EVENT`	Group-based policy priorities were changed.
	GPLUS\_PREMIUM\_FEATURES `GPLUS\_PREMIUM\_FEATURES`	Google+ premium features setting changed.
	CREATE\_MANAGED\_CONFIGURATION `CREATE\_MANAGED\_CONFIGURATION`	A managed configuration was created.
	DELETE\_MANAGED\_CONFIGURATION `DELETE\_MANAGED\_CONFIGURATION`	A managed configuration was deleted.
	UPDATE\_MANAGED\_CONFIGURATION `UPDATE\_MANAGED\_CONFIGURATION`	A managed configuration was updated.
	FLASHLIGHT\_EDU\_NON\_FEATURED\_SERVICES\_SELECTED `FLASHLIGHT\_EDU\_NON\_FEATURED\_SERVICES\_SELECTED`	Non-featured services were selected (edu).
	UPDATE\_SMART\_FEATURES `UPDATE\_SMART\_FEATURES`	Smart features/personalization setting was updated.
Calendar (Calendar App)	CREATE\_BUILDING `CREATE\_BUILDING`	A building resource was created.
	DELETE\_BUILDING `DELETE\_BUILDING`	A building resource was deleted.
	UPDATE\_BUILDING `UPDATE\_BUILDING`	A building resource was updated.
	CREATE\_CALENDAR\_RESOURCE `CREATE\_CALENDAR\_RESOURCE`	A calendar resource was created.
	DELETE\_CALENDAR\_RESOURCE `DELETE\_CALENDAR\_RESOURCE`	A calendar resource was deleted.
	CREATE\_CALENDAR\_RESOURCE\_FEATURE `CREATE\_CALENDAR\_RESOURCE\_FEATURE`	A calendar resource feature was created.
	DELETE\_CALENDAR\_RESOURCE\_FEATURE `DELETE\_CALENDAR\_RESOURCE\_FEATURE`	A calendar resource feature was deleted.
	UPDATE\_CALENDAR\_RESOURCE\_FEATURE `UPDATE\_CALENDAR\_RESOURCE\_FEATURE`	A calendar resource feature was updated.
	RENAME\_CALENDAR\_RESOURCE `RENAME\_CALENDAR\_RESOURCE`	A calendar resource was renamed.
	UPDATE\_CALENDAR\_RESOURCE `UPDATE\_CALENDAR\_RESOURCE`	A calendar resource was updated.
	CHANGE\_CALENDAR\_SETTING `CHANGE\_CALENDAR\_SETTING`	A calendar setting was changed.
	CANCEL\_CALENDAR\_EVENTS `CANCEL\_CALENDAR\_EVENTS`	A cancellation request for events was created.
	RELEASE\_CALENDAR\_RESOURCES `RELEASE\_CALENDAR\_RESOURCES`	A release resources request was created.
Chat (Hangouts Chat)	add\_room\_member `add\_room\_member`	A member was added to a chat room.
	attachment\_download `attachment\_download`	A file attachment was downloaded from a chat message.
	attachment\_upload `attachment\_upload`	A file attachment was uploaded to a chat message.
	block\_room `block\_room`	A chat room was blocked.
	block\_user `block\_user`	A user was blocked in chat.
	conversation\_read `conversation\_read`	A conversation was marked as read.
	custom\_status\_updated `custom\_status\_updated`	A user’s custom status was updated.
	direct\_message\_started `direct\_message\_started`	A direct chat message was started between users.
	emoji\_created `emoji\_created`	A custom emoji was added to chat.
	emoji\_deleted `emoji\_deleted`	A custom emoji was removed from chat.
	history\_turned\_off `history\_turned\_off`	Chat history was turned off for a room.
	history\_turned\_on `history\_turned\_on`	Chat history was turned on for a room.
	invite\_accept `invite\_accept`	A chat invitation was accepted.
	invite\_decline `invite\_decline`	A chat invitation was declined.
	invite\_send `invite\_send`	A chat invitation was sent.
	message\_deleted `message\_deleted`	A chat message was deleted.
	message\_edited `message\_edited`	A chat message was edited.
	message\_posted `message\_posted`	A chat message was posted.
	message\_report\_resolved `message\_report\_resolved`	A reported chat message issue was resolved.
	message\_reported `message\_reported`	A chat message was reported by a user.
	reaction\_added `reaction\_added`	A reaction (emoji) was added to a message.
	reaction\_removed `reaction\_removed`	A reaction (emoji) was removed from a message.
	remove\_room\_member `remove\_room\_member`	A member was removed from a chat room.
	room\_created `room\_created`	A chat room was created.
	room\_deleted `room\_deleted`	A chat room was deleted.
	room\_details\_updated `room\_details\_updated`	Chat room details were updated.
	room\_name\_updated `room\_name\_updated`	A chat room’s name was changed.
	room\_unblocked `room\_unblocked`	A blocked chat room was unblocked.
Google Drive	create `create`	A Drive item was created.
	delete `delete`	A Drive item was deleted.
	edit `edit`	A Drive item was edited (renamed or updated).
	view `view`	A Drive item was viewed or previewed.
	permission\_change `permission\_change`	Sharing permissions on a Drive item were changed.
	comment\_create `comment\_create`	A comment was added to a Drive file.
	comment\_delete `comment\_delete`	A comment was deleted from a Drive file.
	comment\_read `comment\_read`	A comment was marked as read on a Drive file.
	restriction\_change `restriction\_change`	A security restriction on a Drive file (e.g. link sharing) changed.
GCP (Cloud Platform)	IMPORT\_SSH\_PUBLIC\_KEY `IMPORT\_SSH\_PUBLIC\_KEY`	User added an SSH public key (Cloud OS Login).
	DELETE\_POSIX\_ACCOUNT `DELETE\_POSIX\_ACCOUNT`	User deleted a POSIX account (Cloud OS Login).
	DELETE\_SSH\_PUBLIC\_KEY `DELETE\_SSH\_PUBLIC\_KEY`	User deleted an SSH public key (Cloud OS Login).
	GET\_SSH\_PUBLIC\_KEY `GET\_SSH\_PUBLIC\_KEY`	User retrieved an SSH public key (Cloud OS Login).
	GET\_LOGIN\_PROFILE `GET\_LOGIN\_PROFILE`	User retrieved their login profile (Cloud OS Login).
	UPDATE\_SSH\_PUBLIC\_KEY `UPDATE\_SSH\_PUBLIC\_KEY`	User updated an SSH public key (Cloud OS Login).
Currents (Google+)	comment\_created `comment\_created`	A comment was created on a post or comment.
	comment\_deleted `comment\_deleted`	A comment was deleted.
	comment\_edited `comment\_edited`	A comment was edited.
	like\_added `like\_added`	A +1 (like) was added to a post or comment.
	like\_removed `like\_removed`	A +1 (like) was removed from a post or comment.
	poll\_vote\_added `poll\_vote\_added`	A vote was added to a poll.
	poll\_vote\_removed `poll\_vote\_removed`	A vote was removed from a poll.
	post\_created `post\_created`	A post was created.
	post\_deleted `post\_deleted`	A post was deleted.
	post\_deleted\_by\_content\_admin `post\_deleted\_by\_content\_admin`	A post was deleted by a content admin.
	post\_edited `post\_edited`	A post was edited.
Groups	change\_acl\_permission `change\_acl\_permission`	A group’s permissions (ACL) were changed.
	change\_basic\_setting `change\_basic\_setting`	A basic setting of a group was changed.
	create\_group `create\_group`	A group was created.
	delete\_group `delete\_group`	A group was deleted.
	always\_post\_from\_user `always\_post\_from\_user`	A setting “posts from user will always be posted” was applied.
	invite\_user `invite\_user`	A user was invited to a group.
	reject\_join\_request `reject\_join\_request`	A group join request was rejected.
	reinvite\_user `reinvite\_user`	A user was re-invited to a group.
	remove\_user `remove\_user`	A user was removed from a group.
	unsubscribe\_via\_mail `unsubscribe\_via\_mail`	A user unsubscribed from a group via email command.
Jamboard	device\_license\_enrollment\_change (alias) – A device’s license enrollment was changed. (see Jamboard docs)
	device\_provisioning\_change – A device’s provisioning setting was changed.
	device\_reboot\_requested – A reboot was requested for the device.
	export\_jamboard\_fleet – A request was made to export Jamboard fleet data.
	device\_additional\_keyboards\_change – Additional keyboards setting changed.
	device\_cloud\_logging\_change – Cloud logging was turned on/off.
	device\_demo\_mode\_availability\_change – Demo Mode setting changed.
	device\_language\_change – Jamboard UI language was changed.
	device\_location\_change – Jamboard location setting was changed.
	device\_name\_change – Jamboard’s name was changed.
	device\_note\_change – Jamboard’s note was changed.
	device\_pairing\_change – Paired device was changed.
	device\_screensaver\_timeout\_change – Screensaver timeout was changed.
	device\_videoconferencing\_change – Videoconferencing enablement changed.
	device\_update – Device status or settings updated.
Login	2sv\_disable `2sv\_disable`	Two-step (2SV) verification was disabled.
	2sv\_enroll `2sv\_enroll`	Two-step (2SV) verification was enrolled/activated.
	password\_edit `password\_edit`	A user changed their account password.
	recovery\_email\_edit `recovery\_email\_edit`	A user changed their account recovery email.
	recovery\_phone\_edit `recovery\_phone\_edit`	A user changed their recovery phone number.
	recovery\_secret\_qa\_edit `recovery\_secret\_qa\_edit`	A user changed their secret question/answer.
	titanium\_enroll `titanium\_enroll`	Advanced Protection enrolled (Titanium).
	titanium\_unenroll `titanium\_unenroll`	Advanced Protection unenrolled.
	email\_forwarding\_out\_of\_domain `email\_forwarding\_out\_of\_domain`	Out-of-domain email forwarding was enabled.
	failed\_login – A login attempt failed (SAML).
	successful\_login – A login attempt succeeded (SAML).
Meet	abuse\_report\_submitted – An abuse report was submitted in Meet.
	broadcast\_activity – Broadcast activity occurred in Meet.
	endpoint\_left – An endpoint left a meeting.
	livestream\_watched – A viewer watched a Meet livestream.
	dialed\_out – An endpoint dialed out to a PSTN number.
	invitation\_sent – A meeting invitation was sent.
	knocking\_accepted – An endpoint accepted knocking requests.
	knocking\_denied – An endpoint denied knocking requests.
	poll\_answered – A poll was answered.
	poll\_created – A poll was created.
	presentation\_started – A presentation was started.
	presentation\_stopped – A presentation was stopped.
	question\_created – A Q&A question was created.
	question\_responded – A Q&A question was answered.
	recording\_activity – Recording started or stopped.
	ring\_answered – A ring invitation was answered.
	ring\_missed – A ring invitation was missed.
	ring\_sent – A ring invitation was sent.
	transcription\_activity – Transcription started or stopped.
	watermarking\_active – Watermarking became active.
	watermarking\_starting – Watermarking is starting.
	watermarking\_stopped – Watermarking stopped.
Rules	action\_complete `action\_complete`	A rule-based action was completed.
	label\_applied `label\_applied`	A label was applied by a rule.
	label\_field\_value\_changed `label\_field\_value\_changed`	A label’s field value changed by a rule.
	label\_removed `label\_removed`	A label was removed by a rule.
	rule\_match `rule\_match`	A rule matched content or condition.
	rule\_trigger `rule\_trigger`	A rule was triggered (executed).
SAML	failed\_login `failed\_login`	A SAML login attempt failed.
SAML	successful\_login `successful\_login`	A SAML login attempt succeeded.
OAuth Token	activity `activity`	Token access activity (other). The app was accessed with an OAuth token.
	authorize `authorize`	A user authorized access to an application’s data.
	request `request`	An application requested access to user’s data.
	revoke `revoke`	A user revoked an app’s access to their data.
User Accounts	2sv\_disable `2sv\_disable`	Two-step verification disabled (same as Login).
	2sv\_enroll `2sv\_enroll`	Two-step verification enabled.
	password\_edit `password\_edit`	Account password was changed.
	recovery\_email\_edit `recovery\_email\_edit`	Recovery email address changed.
	recovery\_phone\_edit `recovery\_phone\_edit`	Recovery phone number changed.
	recovery\_secret\_qa\_edit `recovery\_secret\_qa\_edit`	Secret question/answer changed.
	titanium\_enroll `titanium\_enroll`	Advanced Protection enrolled.
	titanium\_unenroll `titanium\_unenroll`	Advanced Protection unenrolled.
Context-Aware Access	access\_denied – Access was denied by context-aware policy.
Context-Aware Access	access\_denied\_internal\_error – Internal error while denying access.
Chrome	chromeos\_user\_added – A user was added on a Chrome OS device.
	chromeos\_user\_removed – A user was removed from a Chrome OS device.
	device\_boot\_state\_change – ChromeOS device boot mode changed.
	chromeos\_login\_failure – A ChromeOS login failed.
	chromeos\_login\_or\_logout – A login or logout occurred on a ChromeOS device.
	chromeos\_login\_success – A ChromeOS login succeeded.
	chromeos\_logout – A ChromeOS logout occurred.
	chromeos\_reporting\_data\_error – ChromeOS reporting error.
	password\_changed – Chrome password was changed.
	password\_reuse – A password reuse event occurred.
	data\_access\_control – A Data Loss Prevention action (Chrome) occurred.
	content\_transfer – Content transfer (Chrome DLP) event.
	content\_unscanned – Unsanctioned content transfer detected.
	extension\_request – A user requested a Chrome extension.
	login – A user logged in (Chrome sign-in).
	malware\_transfer – Malware data transfer detected.
	password\_breach – A password breach was detected.
	sensitive\_data\_transfer – Sensitive data transfer detected.
Data Studio	add\_report\_email\_delivery `add\_report\_email\_delivery`	Report email delivery was added.
	create `create`	An asset was created.
	data\_export `data\_export`	Data was exported (e.g. CSV export).
	delete `delete`	An asset was deleted.
	download\_report `download\_report`	A report was downloaded.
	edit `edit`	An asset was edited.
	parent\_workspace\_change `parent\_workspace\_change`	Parent workspace of an asset changed.
	restore `restore`	An asset was restored from trash.
	stop\_report\_email\_delivery `stop\_report\_email\_delivery`	Report email delivery was stopped.
	trash `trash`	An asset was moved to trash.
	update\_report\_email\_delivery `update\_report\_email\_delivery`	Report email delivery was updated.
	view `view`	An asset was viewed.
Keep	attachment\_deleted `attachment\_deleted`	A note’s attachment was removed.
	attachment\_uploaded `attachment\_uploaded`	A new attachment was added to a note.
	note\_content\_edited `note\_content\_edited`	A note’s title or body was edited.
	note\_created `note\_created`	A new note was created.
	note\_deleted `note\_deleted`	A note was deleted by its owner.
	permissions\_edited `permissions\_edited`	Sharing permissions on a note were changed.

Event Names

On this page