User

The GCPUser entity represents a Google Cloud / Google Workspace user account.

Field	Type	Possible Operators	Description
Guid	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Unique identifier for the entity in Forestall
FSName	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Display name used in Forestall
GCPTier	NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL	GCP tier classification assigned by Forestall
Domain	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Domain the user belongs to
Aliases	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Email aliases associated with the user
ChangePasswordAtNextLogin	BOOLEAN	N/A (toggle)	Whether the user must change their password on next login
CreationTime	DATE	SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY	Timestamp when the user account was created
CreationTimeDateTimeOffset	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Creation time with timezone offset
CustomerId	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Google Workspace customer ID
DeletionTime	DATE	SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY	Timestamp when the user account was deleted
Emails	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	All email addresses associated with the user
GuestAccountEmail	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Email address of the guest account
Id	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Google-assigned unique user ID
IsAdmin	BOOLEAN	N/A (toggle)	Whether the user has super admin privileges
IpWhitelisted	BOOLEAN	N/A (toggle)	Whether the user's IP address is whitelisted
IsDelegatedAdmin	BOOLEAN	N/A (toggle)	Whether the user is a delegated administrator
IsEnforcedIn2Sv	BOOLEAN	N/A (toggle)	Whether 2-step verification is enforced for the user
IsEnrolledIn2Sv	BOOLEAN	N/A (toggle)	Whether the user is enrolled in 2-step verification
IsGuestUser	BOOLEAN	N/A (toggle)	Whether the account is a guest user
Kind	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Resource kind identifier from Google
LastLoginTime	DATE	SMALLER, LARGER, BETWEEN, EQUAL, IS_EMPTY	Timestamp of the user's last login
LastLoginTimeDateTimeOffset	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Last login time with timezone offset
DisplayName	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Full display name of the user
GivenName	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	First name of the user
LastName	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Last name of the user
NonEditableAliases	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Aliases that cannot be edited
OrgUnitPath	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Organizational unit path the user belongs to
PrimaryEmail	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Primary email address of the user
RecoveryEmail	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Recovery email address for the user
Relations	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	User relations (e.g. manager, assistant)
Suspended	BOOLEAN	N/A (toggle)	Whether the user account is suspended
SuspensionReason	TEXT	LIKE, NOT_LIKE, EQUAL, NOT_EQUAL, IS_EMPTY	Reason for account suspension
risk	NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL	Risk score assigned to the entity
ExposurePoint	NUMBER	EQUAL, BETWEEN, SMALLER, LARGER, SMALLER_EQUAL, LARGER_EQUAL	Exposure point score assigned to the entity
IsShadow	BOOLEAN	N/A (toggle)	Whether the entity is marked as a Shadow Admin