[Google Workspace]: Misclassification of Successful Logins with "Challenge Passed" Status

[harrison-bornstein-abnb]

Integration Name

Google Workspace [google_workspace]

Dataset Name

Login

Integration Version

2.31.0

Agent Version

8.16.0

Agent Output Type

elasticsearch

Elasticsearch Version

8.17.1

OS Version and Architecture

N/A

Software/API Version

No response

Error Message

Login events are not recognized as successful when login.challenge_status is "Challenge Passed," even though these events represent successful logins.

Event Original

{"actor":{"email":"[email protected]","profileId":"111111111"},"etag":""Q2W123123123123"","events":{"name":"login_verification","parameters":[{"name":"login_type","value":"google_password"},{"multiValue":["security_key"],"name":"login_challenge_method"},{"name":"login_challenge_status","value":"passed"},{"boolValue":true,"name":"is_second_factor"}],"type":"login"},"id":{"applicationName":"login","customerId":"123","time":"2025-02-27T05:59:58.481Z","uniqueQualifier":"123"},"ipAddress":"111.11.111.111","kind":"admin#reports#activity"}

What did you do?

It was installed normally as any other integration.

What did you see?

event.outcome is failure

What did you expect to see?

event.outcome to be success

Anything else?

No response