{
    "TLS failure": "Messages requiring Transport Layer Security (TLS) can't be delivered.",
    "Rate limited recipient": "A high rate of incoming email indicating a potential malicious attack or misconfigured setting.",
    "Smarthost failure": "Alerts if a large number of messages can't be delivered to one of your smart host servers.",
    "Exchange journaling failure": "Failures with Exchange journaling that ensures email traffic generated by Microsoft Exchange server users is properly archived in Google Vault.",
    "Government-backed attacks": "Warnings about potential government-backed attacks.",
    "User-reported phishing": "A sender has sent messages to your domain that users have classified as phishings.",
    "User's Admin privilege revoked": "A user is revoked of their admin privilege.",
    "User suspended for spamming through relay": "Google detected suspicious activity such as spamming through a SMTP relay service and suspended the account.",
    "User suspended for spamming": "Google detected suspicious activity such as spamming and suspended the account.",
    "User suspended due to suspicious activity": "Google suspended a user's account due to a potential compromise detected.",
    "User suspended (Google identity alert)": "Google detected suspicious activity and suspended the account.",
    "User suspended (by admin)": "An admin has suspended the account.",
    "User granted Admin privilege": "A user is granted an admin privilege.",
    "User deleted": "A user has been deleted from the domain.",
    "Suspicious programmatic login": "Google detected suspicious login attempts from potential applications or computer programs.",
    "Suspicious message reported": "A sender has sent messages to your domain that users have classified as spam.",
    "Suspicious login": "Google detected a sign-in attempt that doesn't match a user's normal behavior, such as a sign-in from an unusual location.",
    "Suspicious device activity": "Provides details if device properties such as device ID, serial number, type of device, or device manufacturer are updated.",
    "Suspended user made active": "A suspended user is made active.",
    "Spike in user-reported spam": "An unusually high volume of messages from a sender that users have marked as spam.",
    "Phishing message detected post-delivery": "Messages detected as phishing post-delivery that are automatically reclassified.",
    "Phishing in inboxes due to bad whitelist": "Messages classified as spam by Gmail filters delivered to user inboxes due to whitelisting settings in the Google Admin console that override the spam filters.",
    "New user added": "A new user has been added to the domain.",
    "Mobile settings changed": "An admin has changed mobile management settings.",
    "Malware message detected post-delivery": "Messages detected as malware post-delivery that are automatically reclassified.",
    "Leaked password": "Google detected compromised credentials requiring a reset of the user's password.",
    "Google Voice configuration problem": "Auto attendants and ring groups with invalid references may hang up at unexpected times.",
    "Google Operations": "Provides details about security and privacy issues that affect your Google Workspace services.",
    "Gmail potential employee spoofing": "Incoming messages where a sender's name is in your Google Workspace directory, but the mail is not from your company's domains or domain aliases.",
    "Email settings changed": "An admin has changed Google Workspace Gmail settings.",
    "Drive settings changed": "An admin has changed Google Workspace Drive settings.",
    "Domain data export initiated": "A Super Administrator for your Google account has started exporting data from your domain.",
    "Directory sync cancelled due to safeguard threshold exceeded": "Directory sync has been automatically cancelled and disabled as the directory sync service detected a possibility to exceed deprovisioning safeguard threshold.",
    "Device compromised": "Provides details about devices in your domain that have entered a compromised state.",
    "Calendar settings changed": "An admin has changed Google Workspace Calendar settings.",
    "Apps outage alert": "Alerts about new, updated, or resolved outage on the Google Workspace Status Dashboard.",
    "App Maker Cloud SQL setup": "A user has requested a Google Cloud SQL instance to be set up for use with App Maker.",
    "Account suspension warning": "Google Workspace accounts engaging in suspicious activity may have their account suspended. Google Workspace accounts must comply with the Google Workspace Terms of Service, Google Workspace for Education Terms of Service, Google Cloud Platform Terms of Service or Cloud Identity Terms of Service.",
    "[Beta] Client-side encryption service unavailable": "A problem has been detected with your client-side encryption service indicating an outage or misconfigured setting."
}