The GCPDevice entity represents a device managed through Google Workspace Mobile Device Management (MDM) or endpoint verification.
| Field | Type | Possible Operators | Description |
|---|---|---|---|
| Guid | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Unique identifier for the entity in Forestall |
| FSName | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Display name used in Forestall |
| Name | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Full resource name of the device |
| DeviceId | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Unique ID assigned to the device |
| DeviceType | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Type of device (e.g. ANDROID, IOS, WINDOWS) |
| Brand | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Brand of the device |
| BuildNumber | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | OS build number of the device |
| CompromisedState | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Whether the device is considered compromised |
| EncryptionState | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Encryption state of the device storage |
| Hostname | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Hostname of the device |
| Imei | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | IMEI number of the device |
| KernelVersion | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Kernel version of the device OS |
| LastSyncTime | DATE | SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY | Timestamp of the last sync with management |
| ManagementState | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Current management state of the device |
| Manufacturer | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Manufacturer of the device |
| Meid | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | MEID number of the device |
| Model | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Model name or number of the device |
| NetworkOperator | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Mobile network operator of the device |
| OsVersion | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Operating system version of the device |
| OtherAccounts | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Other accounts present on the device |
| OwnerType | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Ownership type of the device (e.g. COMPANY, PERSONAL) |
| SecurityPatchTime | DATE | SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY | Date of the last applied security patch |
| SerialNumber | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Serial number of the device |
| UnifiedDeviceId | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Unified cross-platform device identifier |
| WifiMacAddresses | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Wi-Fi MAC addresses of the device |
| GCPTier | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL | GCP tier classification assigned by Forestall |
| risk | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL | Risk score assigned to the entity |
| ExposurePoint | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL | Exposure point score assigned to the entity |