In an effort to make the reports for Admin log events more understandable, detailed, and precise, there are updates to some event names and types as well as reporting frequency and event conditions. Between now and August 2026, legacy and updated event names and types will be available. After August 2026, only the new event names and types will be available.
Saved investigations will continue to work, but they will be based on legacy events and will stop working after August 2026. After August 2026, custom charts in the security investigation tool will be based on old data.
Что вам нужно сделать
- Review the changes listed on this page. If you're using or relying on any of the events listed on this page, you might need to make changes to your existing queries, alerts, reports, and rules.
- Between now and August 2026, rules that are affected will be automatically migrated and you might need to make changes to your rules. For details on updating any migrated rules, go to View and edit your activity rules .
Important : If you don't update rules that have changes to more than one event condition, you'll get increased alerts. Rules that have 2 conditions that are true will trigger an alert even if only one condition is true. For example, if a rule triggers an alert for a change to a specific Gmail setting, you will get an alert for all Gmail setting changes.
Changes to Admin log events
Account & security
| Настройки консоли администратора | Инструмент для обеспечения безопасности, аудита и проведения расследований. | API для отчетов и Google SecOps | Экспорт BigQuery |
|---|---|---|---|
| Account settings > Preferences > New features | Событие «Переключить новые функции приложения» переименовано в «Настройки переключения новых функций приложения» . Значение параметра «Новое значение» изменяется с «Истина» или «Ложь» на «Быстрый выпуск» или «Запланированный выпуск» . Description value changes from New app features for your organization changed to value to The account setting of "New Features" was changed from value1 to value2 . Вводится атрибут «Старое значение» . Его значениями являются «Быстрый релиз» и «Запланированный релиз» . The New Features value is added to the Setting Category attribute. | | |
| Безопасность > Контроль доступа и данных > Управление сессиями Google Cloud > Политика повторной аутентификации | New Value and Old Value attributes for Session Control Settings Change records values for reauthentication frequency, idle session timeout, and reauthentication method in separate log events. Previously, all 3 settings were recorded in one log event. Если какой-либо из параметров остается неизменным, запись в журнал для этого параметра не производится. | Если какой-либо из параметров остается неизменным, запись в журнал для этого параметра не производится. | Если какой-либо из параметров остается неизменным, запись в журнал для этого параметра не производится. |
контроль доступа к приложению
Reports API & SecOps events[].name& BigQuery Export event_name | Security & Audit and investigation tool event name | New events[].name & event_name | Новое название мероприятия, посвященного инструменту безопасности, аудита и расследования. |
|---|---|---|---|
| DISALLOW_SERVICE_FOR_ OAUTH2_ACCESS | API Access Blocked | CHANGE_API_ACCESS | API Access Changed |
| ALLOW_SERVICE_FOR_ OAUTH2_ACCESS | API Access Allowed | CHANGE_API_ACCESS | API Access Changed |
| ADD_TO_BLOCKED_OAUTH2 _ПРИЛОЖЕНИЯ | App Added to Blocked List | CHANGE_APP_ACCESS | App Configuration Changed |
| ADD_TO_LIMITED_OAUTH2 _ПРИЛОЖЕНИЯ | App Added to Limited List | CHANGE_APP_ACCESS | App Configuration Changed |
| ADD_TO_TRUSTED_OAUTH2 _ПРИЛОЖЕНИЯ | App Added to Trusted Allowlist | CHANGE_APP_ACCESS | App Configuration Changed |
| ADD_TO_TRUSTED_BY_ OAUTH_SCOPE_OAUTH2_ ПРИЛОЖЕНИЯ | App added to Trusted by OAuth Scope list | CHANGE_APP_ACCESS | App Configuration Changed |
| ADD_TO_CAA_EXEMPT _OAUTH2_APPS | Приложение включено в список разрешенных для исключения из блокировки доступа к API. | CHANGE_APP_ACCESS | App Configuration Changed |
| REMOVE_FROM_TRUSTED _OAUTH2_APPS | App Removed from Trusted Allowlist | CHANGE_APP_ACCESS | App Configuration Changed |
| REMOVE_FROM_CAA_ EXEMPT_OAUTH2_APPS | Приложение больше не включено в список разрешенных для исключения из блокировки доступа к API. | ИЗМЕНИТЬ ДОСТУП К ПРИЛОЖЕНИЮ | App Configuration Changed |
| REMOVE_FROM_BLOCKED _OAUTH2_APPS | Приложение удалено из списка заблокированных приложений. | CHANGE_APP_ACCESS | App Configuration Changed |
| REMOVE_FROM_LIMITED _OAUTH2_APPS | App removed from Limited list | CHANGE_APP_ACCESS | Изменена конфигурация приложения. |
| REMOVE_FROM_TRUSTED _BY_OAUTH_SCOPE_ OAUTH2_APPS | App removed from Trusted by OAuth Scope list | CHANGE_APP_ACCESS | App Configuration Changed |
| BLOCK_ALL_THIRD_PARTY _API_ACCESS | All third party API access blocked | ИЗМЕНЯТЬ_ UNCONFIGURED_APPS _ДОСТУП | Unconfigured Apps Access Changed |
| UNBLOCK_ALL_THIRD_ PARTY_API_ACCESS | All third party API access unblocked | ИЗМЕНЯТЬ_ НЕКОНФИГУРИРОВАННЫЕ_ПРИЛОЖЕНИЯ _ДОСТУП | Unconfigured Apps Access Changed |
| SIGN_IN_ONLY_THIRD_ PARTY_API_ACCESS | Allow Google Sign-in only third party API access | ИЗМЕНЯТЬ_ UNCONFIGURED_APPS _ДОСТУП | Изменен доступ к ненастроенным приложениям |
| UNDERAGE_BLOCK_ALL _THIRD_PARTY_API_ ДОСТУП | All third party API access blocked | CHANGE_UNDERAGE _UNCONFIGURED_APPS _ДОСТУП | Under 18 Unconfigured Apps Access Changed |
| UNDERAGE_SIGN_IN_ ONLY_THIRD_PARTY_ API_ACCESS | Allow Google Sign-in only third party API access | CHANGE_UNDERAGE _UNCONFIGURED_APPS _ДОСТУП | Under 18 Unconfigured Apps Access Changed |
Настройки Google Drive с унаследованными значениями
Previously, Google Drive settings that were overridden from an inherited value or reverted to an inherited value used the same log event identifiers, with INHERIT_FROM_PARENT in the old value and new value attributes:
- Инструмент безопасности, аудита и расследования: в событии «Изменение настроек диска» в старых и новых значениях отображалось INHERIT_FROM_PARENT.
- API отчетов и SecOps:
events[].type=DOCS_SETTINGS,events[].name=CHANGE_DOCS_SETTINGпоказали INHERIT_FROM_PARENT вadmin.old_valueиadmin.new_value - Экспорт BigQuery:
events_type=DOCS_SETTINGS,event_name=CHANGE_DOCS_SETTINGпоказал INHERIT_FROM_PARENT вadmin.old_valueиadmin.new_value
| Инструмент | Override an inherited value | Изменить существующее значение | Revert to an inherited value |
| Security & Audit and investigation tool | Event name: Create Application Setting | Название события: Изменение Application Setting | Event name: Delete Настройки приложения |
| API для отчетов и SecOps | Тип события: НАСТРОЙКИ ПРИЛОЖЕНИЯ Название события: CREATE_APPLICATION_SETTING | Event type: APPLICATION_SETTINGS Event name: CHANGE_APPLICATION_ SETTING | Event type: APPLICATION_SETTINGS Название события: DELETE_APPLICATION_SETTING |
| Экспорт BigQuery | Тип события: НАСТРОЙКИ ПРИЛОЖЕНИЯ Event name: CREATE_APPLICATION_ SETTING | Тип события: НАСТРОЙКИ ПРИЛОЖЕНИЯ Event name: CHANGE_APPLICATION_ SETTING | Event type: APPLICATION_SETTINGS Event name: DELETE_APPLICATION_ SETTING |
Настройки диска
The following table lists updated log event information for the following Admin log event attributes and values:
- Security & Audit and investigation tool : Setting name, Old value, New value
- BigQuery Export :
admin.setting_name,admin.old_value,admin.new_value - Reports API & SecOps :
events[].parameters[].name=setting_name,events[].parameters[].name=OLD_VALUEorNEW_VALUE
Old event | Обновленное событие | ||
Название параметра | Старая или новая стоимость | Название параметра | Старая или новая стоимость |
СОВМЕСТНОЕ ИСПОЛЬЗОВАНИЕ ВНЕ ДОМЕНА | SHARING_NOT_ ALLOWED_BUT_MAY _RECEIVE_FILES | ExternalSharing external_sharing_mode | ЗАПРЕЩЕНО |
ExternalSharing allow_receiving_external _files | истинный | ||
SHARING_NOT_ ALLOWED | ExternalSharing external_sharing_mode | ЗАПРЕЩЕНО | |
ExternalSharing allow_receiving_external_files | ЛОЖЬ | ||
Доверенные домены разрешены с предупреждением о том, что они могут получать файлы от кого угодно. | ExternalSharing external_sharing_mode | ДОПУСТИМЫЕ ДОМЕНЫ | |
ExternalSharing warn_for_sharing_outside_allowlisted_domains | истинный | ||
ExternalSharing allow_receiving_files_ outside_allowlisted_ domains changed | истинный | ||
TRUSTED_DOMAINS_ ALLOWED_WITH_ WARNING | ExternalSharing external_sharing_mode | ДОПУСТИМЫЕ ДОМЕНЫ | |
ExternalSharing warn_for _sharing_outside_ allowlisted_domains | истинный | ||
ExternalSharing allow_ receiving_files_outside_ allowlisted_domains changed | ЛОЖЬ | ||
Доверенные домены разрешены и могут получать файлы от кого угодно. | ExternalSharing external_sharing_mode | ДОПУСТИМЫЕ ДОМЕНЫ | |
ExternalSharing warn_ for_sharing_outside_ allowlisted_domains | ЛОЖЬ | ||
ExternalSharing allow_ receiving_files_outside_ allowlisted_domains changed | истинный | ||
TRUSTED_DOMAINS_ ALLOW | ExternalSharing external_sharing_mode | ALLOWLISTED_ DOMAINS | |
ExternalSharing warn_for_sharing _outside_allowlisted_ domains | ЛОЖЬ | ||
ExternalSharing allow_receiving_files _outside_allowlisted_ domains changed | ЛОЖЬ | ||
Разрешено делиться информацией с предупреждением. | ExternalSharing external_sharing_mode | ДОПУСТИМЫЙ | |
ExternalShare - предупреждение о внешнем обмене | истинный | ||
РАЗРЕШЕНО ДЕЛИТЬСЯ | ExternalSharing external_sharing_mode | ДОПУСТИМЫЙ | |
ExternalShare - предупреждение о внешнем обмене | ЛОЖЬ | ||
SHARING_INVITES_TO_ NON_GOOGLE_ ACCOUNTS | НЕ_РАЗРЕШЕНО | ExternalShares allow_non_google_invites | ЛОЖЬ |
АНОНИМНЫЙ ПРЕДПРОСМОТР | ExternalShares allow_non_google_invites | истинный | |
ИЗДАНИЕ_В_ИНТЕРНЕТЕ | НЕ_РАЗРЕШЕНО | ExternalShare позволяет публиковать файлы. | ЛОЖЬ |
ДОПУСТИМЫЙ | истинный | ||
Параметры проверки совместного доступа | NAMED_PARTIES_ ONLY | ExternalSharing access_checker_ suggestions | ТОЛЬКО ДЛЯ ПОЛУЧАТЕЛЕЙ |
DOMAIN_OR_NAMED_PARTIES | ПОЛУЧАТЕЛИ_ИЛИ_ АУДИТОРИЯ | ||
ВСЕ | ПОЛУЧАТЕЛИ_ИЛИ_ АУДИТОРИЯ_ИЛИ_ ПУБЛИКА | ||
ПАРАМЕТРЫ МЕЖДОМЕННОГО ОБМЕНА | CROSS_DOMAIN_ FROM_INTERNAL_OR _EXTERNAL | ExternalSharing allowed_parties _for_distributing_ content | ВСЕ_ПОЛЬЗОВАТЕЛИ_ВОЗМОЖНОСТИ |
CROSS_DOMAIN_FROM_INTERNAL_ONLY | ELIGIBLE_INTERNAL_USERS | ||
CROSS_DOMAIN_MOVES_BLOCKED | НИКТО | ||
DEFAULT_LINK_ SHARING_FOR_NEW _DOCS | ЧАСТНЫЙ | GeneralAccessDefault default_file_access | ЧАСТНАЯ СОБСТВЕННОСТЬ |
PEOPLE_WITH_LINK | ОСНОВНАЯ_АУДИТОРИЯ_С_ССЫЛКОЙ | ||
ОБЩЕСТВЕННЫЙ | ОСНОВНАЯ_АУДИТОРИЯ_С_ССЫЛКОЙ_ИЛИ_ПОИСКОМ | ||
DOCS_OFFLINE_ENABLED | ЛОЖЬ | DocsOffline enable_docs_offline | ЛОЖЬ |
истинный | истинный | ||
ENABLE_DRIVE_APPS | ЛОЖЬ | DriveSdk enable_drive_sdk_api_access | ЛОЖЬ |
истинный | истинный | ||
Настройки Gmail
Для всех затронутых настроек в Reports API и SecOps:
-
events[].typeEMAIL_SETTINGS is renamed to APPLICATION_SETTINGS -
events[].parameters[].name=USER_DEFINED_SETTING_NAME перемещено вevents[].parameters[].name=SETTING_METADATA.USER_DEFINED_NAME
Для всех затронутых настроек в экспорте BigQuery:
-
event_typeEMAIL_SETTINGS переименован в APPLICATION_SETTINGS. - Параметр admin.user_defined_setting_name перемещен в admin.setting_metadata.user_defined_name
Gmail setting | Безопасность и аудит инструмент расследования | Reports API & SecOps | BigQuery Export |
|---|---|---|---|
Почтовая делегация | Функция «Изменить настройки электронной почты» переименована в «Изменить настройки приложения». Параметр ENABLE_SENDER_ATTRUBITION переименован в MailDelegation, а параметр sender_attribution_requestion — в желаемый. | | |
Список разрешенных прокси-серверов для URL-адресов изображений | Функция «Изменить настройки электронной почты» переименована в «Изменить настройки приложения». NUMBER_OF_EMAIL _IMAGE_URL_ WHITELIST _PATTERNS is renamed to MailImage Proxy external _image_bypass_ pattern | | |
Compliance > Restrict delivery | Функция «Изменить/Удалить/Создать настройки Gmail» переименована в «Изменить/Удалить/Создать настройки приложения». RESTRICT_DELIVERY переименован в RestrictDelivery rules walled_garden_info или RuleState rule_state enabled | | |
Compliance > Comprehensive mail storage | Change/Delete/Create Gmail Setting is renamed to Change/Delete/Create Application Setting COMPREHENSIVE_MAIL_STORAGE переименован в RuleState rule_state enabled | | |
Спам, фишинг и вредоносное ПО > Входящий шлюз | Функция «Изменить/Удалить/Создать настройки Gmail» переименована в «Изменить/Удалить/Создать настройки приложения». INBOUND_GATEWAY переименовывается в RuleState rule_state enabled или InboundGateway {field} | | |
Routing > Email forwarding using recipient address map | Функция «Изменить/Удалить/Создать настройки Gmail» переименована в «Изменить/Удалить/Создать настройки приложения». ALIAS_TABLE переименован в AliasTable rules alias_table_info или RuleState rule_state enabled | | |
Соответствие требованиям > Соответствие контента требованиям | Функция «Изменить/Удалить/Создать настройки Gmail» переименована в «Изменить/Удалить/Создать настройки приложения». CONTENT_COMPLIANCE переименован в ContentCompliance rules content_compliance_info или RuleState rule_state enabled | | admin.setting_nameCONTENT_COMPLIANCE переименован в ContentCompliance rules content_compliance_info или RuleState rule_state enabled |
Default Routing > Default Routing | Change/Delete/Create Gmail Setting is renamed to Change/Delete/Create Application Setting DOMAIN_DEFAULT переименован в DomainDefault rules domain_default_info или RuleState rule_state enabled. | | |
Маршрутизация > Маршрутизация | Change/Delete/Create Gmail Setting is renamed to Change/Delete/Create Application Setting UNIFIED_MAIL_ ROUTING is renamed to Routing rules routing_info or RuleState rule_state enabled | | |
Routing > Inbound email journal acceptance in Vault | Функция «Изменить/Удалить/Создать настройки Gmail» переименована в «Изменить/Удалить/Создать настройки приложения». INBOUND_EMAIL_ JOURNAL_ ACCEPTANCE is renamed to RuleState rule_state enabled or ExchangeJournal Ingestion {field} | | |
Заблокированные отправители | Функция «Изменить/Удалить/Создать настройки Gmail» переименована в «Изменить/Удалить/Создать настройки приложения». BLOCKED_SENDERS is renamed to BlockedSenders rules blocked_senders_info or RuleState rule_state enabled | | |
Маршрутизация > Архивирование электронной почты сторонними сервисами | Функция «Изменить/Удалить/Создать настройки Gmail» переименована в «Изменить/Удалить/Создать настройки приложения». OUTBOUND_EMAIL_ JOURNAL_ GENERATION is renamed to ExchangeJournal Generation rules exchange_journal_ generation _info or RuleState rule_state enabled | | |
Маршрутизация > Почтовый ящик, не относящийся к Gmail | Change/Delete/Create Gmail Setting is renamed to Change/Delete/Create Application Setting QUARANTINE_ SUMMARY is renamed to NonGmail Mailbox rules quarantine _summary _info or RuleState rule_state enabled | | |
Routing > SMTP relay service | Change/Delete/Create Gmail Setting is renamed to Change/Delete/Create Application Setting OUTBOUND_RELAY is renamed to RuleState rule_state enabled | | |
Spam, phishing, and malware > Security sandbox rules | Change/Delete/Create Gmail Setting is renamed to Change/Delete/Create Application Setting SECURITY_SANDBOX_ RULE is renamed to DeepScanning rules deep_scanning_info or RuleState rule_state enabled | | |
Compliance > Secure transport (TLS) compliance | Change/Delete/Create Gmail Setting is renamed to Change/Delete/Create Application Setting TLS_COMPLIANCE переименовывается в TlsCompliance rules tls_compliance_info или RuleState rule_state enabled. | | |
Spam, phishing, and malware > Spam | Change/Delete/Create Gmail Setting is renamed to Change/Delete/Create Application Setting SPAM_CONTROL is renamed to SpamOverride rules spam_override_info or RuleState rule_state enabled | | |
Compliance > Objectable content | Change/Delete/Create Gmail Setting is renamed to Change/Delete/Create Application Setting OBJECTIONABLE_ CONTENT is renamed to Objectionable Content rules objectionable_content _info or RuleState rule_state enabled | | |
Маршрутизация > Альтернативный безопасный маршрут | Change/Delete/Create Gmail Setting is renamed to Change/Delete/Create Application Setting Параметр ALTERNATE_SECURE_ROUTE переименован в AlternateSecureRoute alternate_route_id или RuleState rule_state enabled. | | |
Соответствие требованиям > Соответствие требованиям к приложениям | Change/Delete/Create Gmail Setting is renamed to Change/Delete/Create Application Setting ATTACHMENT_ COMPLIANCE is renamed to Attachment Compliance rules attachment_ compliance_ info or RuleState rule_state enabled | | |
Compliance > Restrict delivery for S/MIME | Функция «Изменить/Удалить/Создать настройки Gmail» переименована в «Изменить/Удалить/Создать настройки приложения». SMIME_RESTRICT_DELIVERY переименован в правила доставки SmimeRestrict, smime_restrict_delivery_info или RuleState, rule_state enabled. | | |
Hosts > Hosts | Функция «Изменить/Удалить/Создать настройки Gmail» переименована в «Изменить/Удалить/Создать настройки приложения». EMAIL_ROUTE is renamed to Mail DeliveryRoutes available_route receiving_route_info | | |
Compliance > Append footer | Функция «Изменить/Удалить/Создать настройки Gmail» переименована в «Изменить/Удалить/Создать настройки приложения». COMPLIANCE_FOOTER переименован в AppendFooter rules append_footer_info или RuleState rule_state enabled | | |
Маршрутизация > Исходящий шлюз | Change/Delete/Create Gmail Setting is renamed to Change/Delete/Create Application Setting EMAIL_ROUTE is renamed to MailDeliveryRoutes available_route receiving_route_info | | |
Настройки пользователя > Уведомления о прочтении электронных писем | Функция «Изменить настройки электронной почты» переименована в «Изменить настройки приложения». Поле EMAIL_READ_RECEIPTS_ALLOWED_DESTINATIONS переименовано в ReadReceipts {имя поля}. | | |
Настройки пользователя > Формат имени | Change Email Setting is renamed to Change Application Setting DEFAULT_NAME_FORMAT переименован в NameFormat default_display_name_format | | |
Доступ конечного пользователя > Разрешить исходящие шлюзы для каждого пользователя | Функция «Изменить настройки электронной почты» переименована в «Изменить настройки приложения». Параметр ALLOW_NAME_FORMAT_CUSTOMIZATION переименован в PerUserOutbound Gateway enable_smtp_relay | | |
Доступ конечного пользователя > Доступ по протоколам POP и IMAP | Функция «Изменить настройки электронной почты» переименована в «Изменить настройки приложения». Поле IMAP_ACCESS переименовано в ImapSettings {имя поля}. Параметр ENABLE_POP_ACCESS переименован в PopSettings pop_disabled | | |
End User Access > Automatic Forwarding | Функция «Изменить настройки электронной почты» переименована в «Изменить настройки приложения». ENABLE_EMAIL_ AUTOFORWARDING is renamed to AutoForwarding auto_forwarding_ disabled | | |
End User Access > Google Workspace Sync | Change Email Setting is renamed to Change Application Setting ENABLE_OUTLOOK_ SYNC is renamed to MailSyncSettings enable_outlook_sync | | |
Setup > User email uploads | Функция «Изменить настройки электронной почты» переименована в «Изменить настройки приложения». Параметр ENABLE_EMAIL_USER_IMPORT переименован в MailAndContacts Import Settingscan_import_mail_and_contacts | | |
User settings > Themes | Функция «Изменить настройки электронной почты» переименована в «Изменить настройки приложения». ENABLE_GMAIL_ SKINS is renamed to MailFrontendSettings skin_desired | | |
Compliance > Optical Character Recognition (OCR) | Функция «Изменить настройки электронной почты» переименована в «Изменить настройки приложения». Параметр ENABLE_OPTICAL_CHARACTER_RECOGNITION переименован в OcrSettings ocr_enabled | | |
Manage Quarantines | Change Email Setting is renamed to Change Application Setting EMAIL_QUARANTINE is renamed to AdminQuarantine admin_quarantine_ info {field} | | |
Управление доступом к списку разрешенных пользователей Google Workspace Marketplace | Change/Delete/Create Gmail Setting is renamed to Change/Delete/Create Application Setting Параметр ENABLE_G_SUITE_MARKETPLACE переименован в параметр доступа к приложениям web_display_option. | | |
Приложения Google Workspace Marketplace | Функция «Изменить/Удалить/Создать настройки Gmail» переименована в «Изменить/Удалить/Создать настройки приложения». Параметр ENABLE_G_SUITE_MARKETPLACE переименован в Allowlist app_access. | | |
User Settings > S/MIME | Change Email Setting is renamed to Change Application Setting EMAIL_SMIME is renamed to SMime status | | |
New Gmail parameters
Имя параметра | Nested parameter | Reports API & SecOps | BigQuery Export |
|---|---|---|---|
| SETTING_METADATA | USER_DEFINED_NAME | | admin.setting_metadata .user_defined_name |
ОПИСАНИЕ | | admin.setting_metadata .description | |
rule_key | | admin.setting_metadata .rule_key | |
rule_type | | admin.setting_metadata .rule_type |
New Gmail events
Changes to the following Gmail settings ( Apps > Google Workspace > Settings for Gmail ) in the Admin console will log an event in Admin log events:
- User Settings > S/MIME > Allow SHA-1 globally (not recommended)
- Spam, phishing, and malware > Inbound gateway > Gateway IPs > Add/Delete IP addresses / ranges
- Authenticate email > DKIM authentication > Start/Stop Authentication
- Compliance > Email and chat auto-deletion > Automatically delete email and chat messages older than the specified number of days > Modify the labels to exclude
Changes to the settings will be logged as follows:
- Security & Audit and investigation tool event: Change Application Setting
- Reports API & SecOps:
events[].name=CHANGE_APPLICATION_SETTING,events[].type=APPLICATION_SETTINGS - BigQuery Export:
event_name=CHANGE_APPLICATION_SETTING,event_type=APPLICATION_SETTINGS
Updating automatically migrated rules
Instructions will be added here soon describing how you can find your rules that have been automatically migrated. For details on managing automatically migrated rules, go to Create and manage activity rules .
Changes to event names in the security investigation tool
For the affected event names in the following table:
- Breaking columns are being removed from rule conditions. (A breaking column is a security investigation tool column that has a changed value.)
- Rule creation for these events is being restricted.
- Certain event names will have new conditions, as shown in Updates to event names later on this page.
| Security investigation tool event name | Breaking column name |
|---|---|
| Change email setting | Название параметра |
| Resource name | |
| Change Gmail setting | Название параметра |
| Resource name | |
| Create Gmail setting | Название параметра |
| Resource name | |
| Delete Gmail setting | Название параметра |
| Resource name | |
| Change Drive setting | Название параметра |
| Новое значение | |
| Old value | |
| Session control settings change | Новое значение |
| Old value | |
| No breaking columns |
| Toggle new app features | Новое значение |
Event name change example in the security investigation tool
For all rule conditions joined by AND, we're removing the part of the condition that contains the changing event. The final condition will be a single condition.
If Event name IS Change email setting AND Setting name IS abc , the automatically migrated rule will become Event name IS Change email setting .
Updates to event conditions
We are also updating the following event conditions.
| Event display name | Current condition | New condition |
|---|---|---|
| Create email setting | Event IS Change email setting | Event IS Change application setting AND Setting Application IS Gmail |
| Create Gmail setting | Event IS Change Gmail setting | Event IS Change application setting AND Setting Application IS Gmail |
| Create Gmail setting | Event IS Create Gmail setting | Event IS Create application setting AND Setting Application IS Gmail |
| Create Gmail setting | Event IS Delete Gmail setting | Event IS Delete application setting AND Setting Application IS Gmail |
| Create Drive setting | Event IS Change Drive setting | ( Event IS Change application setting OR Event IS Create application setting OR Event IS Delete application setting) AND Setting Application IS Drive and Docs. |
| Toggle New App Features | Event IS Toggle New App Features | Event IS Toggle New App Features Preference |
| API Access Blocked | Event IS API Access Blocked | Event IS API Access Changed AND Old Value IS Unrestricted |
| API Access Allowed | Event IS API Access Allowed | Event IS API Access Changed AND New Value IS Unrestricted |
| App Added to Blocked List | Event IS App Added to Blocked List | Event IS App Configuration Changed AND New Value IS Blocked |
| App Added to Limited List | Event IS App Added to Limited List | Event IS App Configuration Changed AND New Value IS Limited |
| App Added to Trusted Allowlist | Event IS App Added to Trusted Allowlist | Event IS App Configuration Changed AND New Value IS Trusted |
| App added to Trusted by OAuth Scope list | Event IS App added to Trusted by OAuth Scope list | Event IS App Configuration Changed AND New Value IS Specific Google data |
| App Removed from Blocked List | Event IS App Removed from Blocked List | Event IS App Configuration Changed AND Old Value IS Blocked AND New Value IS Unconfigured |
| App removed from Limited list | Event IS App removed from Limited list | Event IS App Configuration Changed AND Old Value IS Limited AND New Value IS Unconfigured |
| App Removed from Trusted Allowlist | Event IS App Removed from Trusted Allowlist | Event IS App Configuration Changed AND Old Value IS Trusted AND New Value IS Unconfigured |
| App removed from Trusted by OAuth Scope list | Event IS App removed from Trusted by OAuth Scope list | Event IS App Configuration Changed AND Old Value IS Specific Google data AND New Value IS Unconfigured |
| App allowlisted for exemption from API access blocks | Event IS App allowlisted for exemption from API access blocks | Event IS App Configuration Changed AND New Value IS Trusted and Allowlisted for Context-Aware Access Exemption |
| App no longer allowlisted for exemption from API access blocks | Event IS App no longer allowlisted for exemption from API access blocks | Event IS App Configuration Changed AND Old Value IS Trusted and Allowlisted for Context-Aware Access Exemption AND New Value IS Unconfigured |
| All third party API access blocked | Event IS All third party API access blocked | Event IS Unconfigured Apps Access Changed AND New Value IS Don't Allow |
| All third party API access unblocked | Event IS All third party API access unblocked | Event IS Unconfigured Apps Access Changed AND New Value IS Allow |
| Allow Google Sign-in only third party API access | Event IS Allow Google Sign-in only third party API access | Event IS Unconfigured Apps Access Changed AND New Value IS Allow Google sign-in only |
| All third party API access blocked | Event IS All third party API access blocked | Event IS Under 18 Unconfigured Apps Access Changed AND New Value IS Don't Allow |
| Allow Google Sign-in only third party API access | Event IS Allow Google Sign-in only third party API access | Event IS Under 18 Unconfigured Apps Access Changed AND New Value IS Allow Google sign-in only |