google-workspace-oauth-logs
Get OAuth token activity logs from Google Workspace.
Syntax
google-workspace-oauth-logs [profile=PROFILE] [duration=NUM{mon|w|d|h|m|s}] [from=yyyyMMddHHmmss] [to=yyyyMMddHHmmss] [raw=RAW]
Options
- profile=PROFILE
- Optional. Profile name of Google Workspace
- duration=NUM{mon|w|d|h|m|s}
- Optional. Scan only recent data. You should use s(second), m(minute), h(hour), d(day), mon(month) time unit. For example,
10smeans data from 10 seconds earlier. - from=yyyyMMddHHmmss
- Optional. Start time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
- to=yyyyMMddHHmmss
- Optional. End time of range. yyyyMMddHHmmss format. If you omit time part, it will be padded by zero.
- raw=RAW
- Optional. t or f. Specify 't' to output line field.
Output Fields
| Field | Type | Name | Description |
|---|---|---|---|
| profile | String | Connect profile | Profile name of Google Workspace |
| line | String | Event raw | |
| _time | Date | Time | |
| src_ip | IP address | Source IP address | |
| user | String | User | |
| action | String | Action | e.g. authorize |
| app_name | String | App name | e.g. Google Chrome |
| client_type | String | Client type | e.g. WEB, NATIVE_DESKTOP, NATIVE_IOS, NATIVE_ANDROID |
| client_id | String | Client ID | |
| scopes | String | Scopes | e.g. https://www.google.com/accounts/OAuthLogin |