login_audit
Audit the login log: Google-auto-disabled accounts, suspicious logins, failure top-N.
Instructions
Audit the login log: Google-auto-disabled accounts, suspicious logins, failure top-N.
Answers "did Google itself decide something was wrong with an account here,
and with which account?" — the question a "my mail suddenly stopped working"
ticket usually turns out to be. account_disabled_* is Google reporting
that it locked an account (leaked password, hijacking, spamming);
suspicious_login and gov_attack_warning are warnings without a lock.
In both sections user is the account the event is ABOUT, not an actor
who did something: Google raised these itself, so the actor is Google and
the account is read from the event's affected_email_address. Treat a
hit as evidence about that account, and reach for get_user next for its
current state.
An account_disabled_spamming entry means Google observed outbound spam,
which is a compromise finding, not a delivery problem — the account was
almost certainly being used by someone else. The IdP upstream is a separate
system and is NOT disabled by this: an account locked here can still
authenticate there until it is disabled there too.
Combine with a Directory suspended-users snapshot (Phase 2) for current
state. Each section carries capped (window not fully scanned) — treat
counts as lower bounds then.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| top | No | ||
| hours | No | ||
| domain | No | ||
| include_failures | No |