The GCPUser entity represents a Google Cloud / Google Workspace user account.
| Field | Type | Possible Operators | Description |
|---|---|---|---|
| Guid | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Unique identifier for the entity in Forestall |
| FSName | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Display name used in Forestall |
| GCPTier | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL | GCP tier classification assigned by Forestall |
| Domain | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Domain the user belongs to |
| Aliases | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Email aliases associated with the user |
| ChangePasswordAtNextLogin | BOOLEAN | N/A (toggle) | Whether the user must change their password on next login |
| CreationTime | DATE | SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY | Timestamp when the user account was created |
| CreationTimeDateTimeOffset | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Creation time with timezone offset |
| CustomerId | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Google Workspace customer ID |
| DeletionTime | DATE | SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY | Timestamp when the user account was deleted |
| Emails | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | All email addresses associated with the user |
| GuestAccountEmail | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Email address of the guest account |
| Id | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Google-assigned unique user ID |
| IsAdmin | BOOLEAN | N/A (toggle) | Whether the user has super admin privileges |
| IpWhitelisted | BOOLEAN | N/A (toggle) | Whether the user’s IP address is whitelisted |
| IsDelegatedAdmin | BOOLEAN | N/A (toggle) | Whether the user is a delegated administrator |
| IsEnforcedIn2Sv | BOOLEAN | N/A (toggle) | Whether 2-step verification is enforced for the user |
| IsEnrolledIn2Sv | BOOLEAN | N/A (toggle) | Whether the user is enrolled in 2-step verification |
| IsGuestUser | BOOLEAN | N/A (toggle) | Whether the account is a guest user |
| Kind | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Resource kind identifier from Google |
| LastLoginTime | DATE | SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY | Timestamp of the user’s last login |
| LastLoginTimeDateTimeOffset | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Last login time with timezone offset |
| DisplayName | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Full display name of the user |
| GivenName | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | First name of the user |
| LastName | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Last name of the user |
| NonEditableAliases | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Aliases that cannot be edited |
| OrgUnitPath | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Organizational unit path the user belongs to |
| PrimaryEmail | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Primary email address of the user |
| RecoveryEmail | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Recovery email address for the user |
| Relations | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | User relations (e.g. manager, assistant) |
| Suspended | BOOLEAN | N/A (toggle) | Whether the user account is suspended |
| SuspensionReason | TEXT | LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY | Reason for account suspension |
| risk | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL | Risk score assigned to the entity |
| ExposurePoint | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL | Exposure point score assigned to the entity |
| IsShadow | BOOLEAN | N/A (toggle) | Whether the entity is marked as a Shadow Admin |