> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/google-workspace-audit-logs.md). # Google Workspace Audit Logs Alerts related to data source "Google Workspace Audit Logs". | Alert | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [A domain was added to the trusted domains list](/analytics-alerts/alerts-by-name/a-domain-was-added-to-the-trusted-domains-list.md) | | [A GCP service account was delegated domain-wide authority in Google Workspace](/analytics-alerts/alerts-by-name/a-gcp-service-account-was-delegated-domain-wide-authority-in-google-workspace.md) | | [A Google Workspace identity created, assigned or modified a role](/analytics-alerts/alerts-by-name/a-google-workspace-identity-created-assigned-or-modified-a-role.md) | | [A Google Workspace identity performed an unusual admin console activity](/analytics-alerts/alerts-by-name/a-google-workspace-identity-performed-an-unusual-admin-console-activity.md) | | [A Google Workspace identity used the security investigation tool](/analytics-alerts/alerts-by-name/a-google-workspace-identity-used-the-security-investigation-tool.md) | | [A Google Workspace Role privilege was deleted](/analytics-alerts/alerts-by-name/a-google-workspace-role-privilege-was-deleted.md) | | [A Google Workspace service was configured as unrestricted](/analytics-alerts/alerts-by-name/a-google-workspace-service-was-configured-as-unrestricted.md) | | [A Google Workspace user was added to a group](/analytics-alerts/alerts-by-name/a-google-workspace-user-was-added-to-a-group.md) | | [A Google Workspace user was removed from a group](/analytics-alerts/alerts-by-name/a-google-workspace-user-was-removed-from-a-group.md) | | [A mail forwarding rule was configured in Google Workspace](/analytics-alerts/alerts-by-name/a-mail-forwarding-rule-was-configured-in-google-workspace.md) | | [A third-party application was authorized to access the Google Workspace APIs](/analytics-alerts/alerts-by-name/a-third-party-application-was-authorized-to-access-the-google-workspace-apis.md) | | [A third-party application's access to the Google Workspace domain's resources was revoked](/analytics-alerts/alerts-by-name/a-third-party-application-s-access-to-the-google-workspace-domain-s-resources-was-revoked.md) | | [Admin privileges were granted to a Google Workspace user](/analytics-alerts/alerts-by-name/admin-privileges-were-granted-to-a-google-workspace-user.md) | | [An app was added to Google Marketplace](/analytics-alerts/alerts-by-name/an-app-was-added-to-google-marketplace.md) | | [An app was added to the Google Workspace trusted OAuth apps list](/analytics-alerts/alerts-by-name/an-app-was-added-to-the-google-workspace-trusted-oauth-apps-list.md) | | [An app was removed from a blocked list in Google Workspace](/analytics-alerts/alerts-by-name/an-app-was-removed-from-a-blocked-list-in-google-workspace.md) | | [Chrome Extension Installed By User](/analytics-alerts/alerts-by-name/chrome-extension-installed-by-user.md) | | [Chrome OS Remote Access policy was modified in Google Workspace](/analytics-alerts/alerts-by-name/chrome-os-remote-access-policy-was-modified-in-google-workspace.md) | | [Data Sharing between GCP and Google Workspace was disabled](/analytics-alerts/alerts-by-name/data-sharing-between-gcp-and-google-workspace-was-disabled.md) | | [External SaaS file-sharing activity](/analytics-alerts/alerts-by-name/external-saas-file-sharing-activity.md) | | [External Sharing was turned on for Google Drive](/analytics-alerts/alerts-by-name/external-sharing-was-turned-on-for-google-drive.md) | | [Gmail delegation was turned on for the organization](/analytics-alerts/alerts-by-name/gmail-delegation-was-turned-on-for-the-organization.md) | | [Gmail routing settings changed](/analytics-alerts/alerts-by-name/gmail-routing-settings-changed.md) | | [Google Marketplace restrictions were modified](/analytics-alerts/alerts-by-name/google-marketplace-restrictions-were-modified.md) | | [Google Workspace automation was created](/analytics-alerts/alerts-by-name/google-workspace-automation-was-created.md) | | [Google Workspace organizational unit was modified](/analytics-alerts/alerts-by-name/google-workspace-organizational-unit-was-modified.md) | | [Google Workspace third-party application's security settings were changed](/analytics-alerts/alerts-by-name/google-workspace-third-party-application-s-security-settings-were-changed.md) | | [Google Workspace user authentication information changed](/analytics-alerts/alerts-by-name/google-workspace-user-authentication-information-changed.md) | | [Large volume of files potentially containing credentials accessed in Google Drive](/analytics-alerts/alerts-by-name/large-volume-of-files-potentially-containing-credentials-accessed-in-google-drive.md) | | [Massive file downloads from SaaS service](/analytics-alerts/alerts-by-name/massive-file-downloads-from-saas-service.md) | | [Massive files deletion in Google Drive](/analytics-alerts/alerts-by-name/massive-files-deletion-in-google-drive.md) | | [Massive upload to SaaS service](/analytics-alerts/alerts-by-name/massive-upload-to-saas-service.md) | | [MFA Disabled for Google Workspace](/analytics-alerts/alerts-by-name/mfa-disabled-for-google-workspace.md) | | [MFA was disabled for a Google Workspace user](/analytics-alerts/alerts-by-name/mfa-was-disabled-for-a-google-workspace-user.md) | | [Potential Phishing has been detected](/analytics-alerts/alerts-by-name/potential-phishing-has-been-detected.md) | | [SaaS suspicious external domain user activity](/analytics-alerts/alerts-by-name/saas-suspicious-external-domain-user-activity.md) | | [Security object deletion in Google Workspace Admin Console](/analytics-alerts/alerts-by-name/security-object-deletion-in-google-workspace-admin-console.md) | | [Suspicious SaaS API call from a Tor exit node](/analytics-alerts/alerts-by-name/suspicious-saas-api-call-from-a-tor-exit-node.md) | | [Suspicious theme and sentiment in email](/analytics-alerts/alerts-by-name/suspicious-theme-and-sentiment-in-email.md) | | [User accessed SaaS resource via anonymous link](/analytics-alerts/alerts-by-name/user-accessed-saas-resource-via-anonymous-link.md) | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/google-workspace-audit-logs.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.