Google Workspace Alert types

Alert sources and types

Listed in the table below are the possible values for the source field, corresponding alert type names for type field and data types for the data field.

Learn more about these alert types from our support documentation.

Alert `source`	Alert `type in API`	Alert `type in Admin console`	Alert `data`
`Access Approvals`	`Access Approvals request`	`Access Approvals request`	`AccessApproval`
`Domain wide takeout`	`Customer takeout initiated`	`Domain data export initiated`	`DomainWideTakeoutInitiated`
`Gmail phishing`	`Malware reclassification`	`Malware message detected post-delivery`	`MailPhishing`
	`Misconfigured whitelist`	`Phishing in inboxes due to bad whitelist`	`BadWhitelist`
	`Phishing reclassification`	`Phishing message detected post-delivery`	`MailPhishing`
	`Suspicious message reported`	`Suspicious message reported`	`MailPhishing`
	`User reported phishing`	`User reported phishing`	`MailPhishing` Customers who were part of Alert Center EAP may see the following deprecated type in their old alerts: `PhishingSpike`
	`User reported spam spike`	`Spike in user reported spam`	`MailPhishing`
`Google identity`	`Leaked password`	`Leaked password`	`AccountWarning`
	`Suspicious login`	`Suspicious login blocked`	`AccountWarning`
	`Suspicious login (less secure app)`	`Suspicious login from a less secure app`	`AccountWarning`
	`Suspicious programmatic login`	`Suspicious programmatic login`	`AccountWarning`
	`User suspended`	`User suspended`	`AccountWarning`
	`User suspended (spam)`	`User suspended for spamming`	`AccountWarning`
	`User suspended (spam through relay)`	`User suspended for spamming through relay`	`AccountWarning`
	`User suspended (suspicious activity)`	`User suspended due to suspicious activity`	`AccountWarning`
`Google Operations`	`Google Operations`	`Google Operations`	`GoogleOperations`
`Google Voice`	`Configuration problem`	`Google Voice configuration problem`	`VoiceMisconfiguration`
`State Sponsored Attack`	`Government attack warning`	`Government-backed attacks`	`StateSponsoredAttack`
`Mobile device management`	`Device compromised`	`Device compromised`	`DeviceCompromised`
	`Suspicious activity`	`Suspicious device activity`	`SuspiciousActivity`
	`APNS certificate is expiring soon`	`APNS certificate is expiring soon`	`ApnsCertificateExpirationInfo`
	`APNS certificate has expired`	`APNS certificate has expired`	`ApnsCertificateExpirationInfo`
`AppMaker Editor`	`AppMaker Default Cloud SQL setup`	`App Maker Cloud SQL setup`	`AppMakerSqlSetupNotification`
`Security Center rules`	`Activity Rule`	`Activity Rule`	`ActivityRule`
`Data Loss Prevention`	`Data Loss Prevention`	`Data Loss Prevention (DLP)`	`DlpRuleViolation`
`Apps outage`	`Apps outage`	`Apps outage`	`AppsOutage`
`Sensitive Admin Action`	`Primary admin changed`	`Primary admin changed`	`SensitiveAdminAction`
	`SSO profile added`	`SSO profile added`	`SensitiveAdminAction`
	`SSO profile updated`	`SSO profile updated`	`SensitiveAdminAction`
	`SSO profile deleted`	`SSO profile deleted`	`SensitiveAdminAction`
	`Super admin password reset`	`Super admin password reset`	`SensitiveAdminAction`
`Google Mandatory Service Announcement`	`MSA Billing`	`Google Mandatory Service Announcement - Billing`	`MandatoryServiceAnnouncement`
	`MSA Legal`	`Google Mandatory Service Announcement - Legal`	`MandatoryServiceAnnouncement`
	`MSA Product`	`Google Mandatory Service Announcement - Product`	`MandatoryServiceAnnouncement`
	`MSA Security`	`Google Mandatory Service Announcement - Security`	`MandatoryServiceAnnouncement`
`Customer abuse`	`Customer abuse detected`	`Customer abuse detected`	`AbuseDetected`
`App Settings Changed`	`Calendar settings changed`	`Calendar settings changed`	`AppSettingsChanged`
	`Drive settings changed`	`Drive settings changed`	`AppSettingsChanged`
	`Email settings changed`	`Email settings changed`	`AppSettingsChanged`
	`Mobile settings changed`	`Mobile settings changed`	`AppSettingsChanged`
`User Changes`	`New user Added`	`New user added`	`UserChanges`
	`Suspended user made active`	`Suspended user made active`	`UserChanges`
	`User deleted`	`User deleted`	`UserChanges`
	`User granted Admin privilege`	`User granted Admin privilege`	`UserChanges`
	`User suspended (Administrator email alert)`	`User suspended (by admin)`	`UserChanges`
	`Users Admin privilege revoked`	`User's Admin privilege revoked`	`UserChanges`
	`Users password changed`	`User's password changed`	`UserChanges`
`Reporting Rule`	`Reporting Rule`	`Reporting Rule`	`ReportingRule`
`Google identity`	`Account suspension warning`	`Account suspension warning`	`AccountSuspensionWarning`
`Chrome`	`Chrome devices auto-update expiration warning`	`Chrome devices auto-update expiration warning`	`ChromeOsFutureExpiringDevices`