ip_activity
Identifies every account a source IP address acted on across applications and domains, and shows posture flags and login failures to determine whether an attacker's address reached other accounts.
Instructions
Every account ONE source address acted as, across applications and domains.
The follow-through after user_activity names an attacker's address:
did the same source get into other accounts? The Reports API filters on
actorIpAddress server-side, so this is one probe per
(domain × application) over the matching events only, not a scan of the
whole tenant's log — and every domain's probes run in one pool, so a
slow domain does not delay another's answer. Per domain it returns the
acting accounts (count, first/last seen, which applications) ordered
by most recent, the posture flags the address triggered (same
definition as user_activity; Google's own verdicts are included here
when they carry the address, since userKey=all sees them), and
per-application accounting. Failed logins from the address appear under
applications.login.events as login_failure — a spray from this
address shows there before it ever succeeds.
Coverage reads as in user_activity: window.start, per-application
capped / error (and the union capped, a failed application
included), and a per-domain error when that domain's credential is
rejected (the other domains still answer). A quiet answer for a
current-day window can be data lag rather than absence.
Read-only (Reports API activities().list only, the
admin.reports.audit.readonly DWD scope).
Args:
ip: The source address, IPv4 or IPv6 literal (no zone id). Validated
before use.
hours: Window length ending now.
applications: Comma-separated application names; default as in
user_activity.
max_pages: Page budget per (domain × application).
top: Accounts returned per domain, most recently seen first;
accounts_total says how many there were.
domain: Restrict to one configured [domain.*] section. Default:
every configured domain, since an address is not tied to one.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ip | Yes | ||
| top | No | ||
| hours | No | ||
| domain | No | ||
| max_pages | No | ||
| applications | No |