> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/saas-data-monitoring/events/google-workspace-events.md).

# Google Workspace events

DoControl's integration with Google Workspace is based on incoming real-time events from Google's native audit log event stream. 

Each time a user-related or Google Drive action happens on the customer's Google tenant, a matching event arrives at DoControl with the action metadata. Examples of Google events sent to DoControl include:

* Sharing a file with a collaborator
* Adding a user to a group
* Suspending a user

## Google event streams

DoControl integration supports the following event streams:

<table><thead><tr><th width="258">Google event stream</th><th>Events and parameters</th></tr></thead><tbody><tr><td>Audit log > Admin > Drive</td><td><a href="https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-docs-settings">Drive Settings in Admin Audit activity events</a></td></tr><tr><td>Audit log > Google Drive</td><td><a href="https://developers.google.com/admin-sdk/reports/v1/appendix/activity/drive">Drive Audit activity events</a></td></tr><tr><td>Audit log > Admin > User</td><td><a href="https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-user-settings">User Settings in Admin Audit activity events</a></td></tr><tr><td>Audit log > Login</td><td><a href="https://developers.google.com/admin-sdk/reports/v1/appendix/activity/login">Login Audit activity events</a></td></tr></tbody></table>

{% hint style="info" %}
Any event streams that are not mentioned are currently not supported or displayed in DoControl.
{% endhint %}

## Google login events

DoControl workflows support login events to Google Workspace. This helps your organization  to detect suspicious activity in near real-time. DoControl supports these use cases:

* **Suspicious login indications** - Displayed in the Events page or sent as notifications via workflows.
* **Security signals via workflows** - Streamline login events to workflows to receive pro-active notifications about former employee access, failed login attempts, and risk remediation.
* **SSPM threat models** - Include disabled MFA, insecure authentication methods, and password leakage.

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FcwkMNaT0hW2ZkXLpMyfW%2FGoogle%20login%20events.png?alt=media&amp;token=cf6df57c-a51f-4ec0-b494-073b9f9fb650" alt=""><figcaption></figcaption></figure>

#### To view Google Workspace login events:

1. From the DoControl menu, click **Events**.
2. Filter the apps for Google Workspace.<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2Fc2KxYbVQZUWLFzbk82ij%2FGoogle%20login%20filter.png?alt=media&amp;token=897d1057-b95c-4f20-a51d-af7aea9d38fa" alt=""><figcaption></figcaption></figure>

   Relevant login activities for Google Workspace are displayed in the Event type column. Examples of login activities include the following:

| Google Workspace event   | Description                                                                                                                                            |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Login success            | A login attempt was successful.                                                                                                                        |
| Login verification       | The actor was asked to verify login credentials.                                                                                                       |
| Failed login             | A login attempt was unsuccessful.                                                                                                                      |
| Login challenge          | A login was challenged to verify the actor's identity. Any login challenges encountered during a login session are grouped into a single events entry. |
| Logout                   | The actor logged out from the system.                                                                                                                  |
| Sensitive action allowed | The login attempt had some unusual characteristics, for example the user logged in from an unfamiliar IP address.                                      |
| Sensitive action blocked | The actor was blocked from the action. The session was risky and identity couldn’t be verified.                                                        |

{% hint style="info" %}
For the complete list of Google Workspace login events, see [Login Audit Activity Events](https://developers.google.com/admin-sdk/reports/v1/appendix/activity/login)
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/saas-data-monitoring/events/google-workspace-events.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.