ActivityRule

Alerts from Google Workspace Security Center rules service configured by an admin.

JSON representation 
{
  "name": string,
  "displayName": string,
  "description": string,
  "windowSize": string,
  "threshold": string,
  "createTime": string,
  "updateTime": string,
  "triggerSource": string,
  "supersededAlerts": [
    string
  ],
  "supersedingAlert": string,
  "actionNames": [
    string
  ],
  "query": string
}
Fields
name

string

Rule name.
displayName

string

Alert display name.
description

string

Description of the rule.
windowSize

string (Duration format)

Rule window size. Possible values are 1 hour or 24 hours.
threshold

string

Alert threshold is for example “COUNT > 5”.
createTime

string (Timestamp format)

Rule create timestamp.
updateTime

string (Timestamp format)

The timestamp of the last update to the rule.
triggerSource

string

The trigger sources for this rule.

  • GMAIL_EVENTS
  • DEVICE_EVENTS
  • USER_EVENTS
supersededAlerts[]

string

List of alert IDs superseded by this alert. It is used to indicate that this alert is essentially extension of superseded alerts and we found the relationship after creating these alerts.
supersedingAlert

string

Alert ID superseding this alert. It is used to indicate that superseding alert is essentially extension of this alert and we found the relationship after creating both alerts.
actionNames[]

string

List of action names associated with the rule threshold.
query

string

Query that is used to get the data from the associated source.