Why Aren’t Google Workspace Failed Logins Logging as Expected?

[OrCHUK]

Hey everyone,
We've successfully integrated the WORKSPACE ACTIVITIES feed into our SIEM, and it appears to be valid. 

The issue is that we can’t properly simulate login failures, and we don’t fully understand how USER_LOGIN vs. USER_RESOURCE_ACCESS logs behave.

Test scenario:

1. Went to the Google Workspace login page.
2. Entered my organization email.
3. Entered the wrong password 4-5 times.
4. Successfully logged in after entering the correct password.

Problem: When searching in SIEM for my email within that time window, I found no logs related to failed or successful logins. The first log I saw was a USER_RESOURCE_ACCESS event, but no failed login attempts were recorded. Example of the first log I found:

"{
"metadata.event_type": "USER_RESOURCE_ACCESS",
"metadata.product_event_type": "authorize",
"principal.user.email_addresses[0]": "<user_email>",
"principal.ip_geo_artifact[0].ip": "<user_ip_address>"
}"

However, I do see USER_LOGIN logs for other users and even for myself at different times, but I can’t figure out when they are triggered and when they are not.

Has anyone successfully simulated failed logins and seen them in SecOps SIEM?

Any insights would be greatly appreciated 🙂

[cmorris]

This query returns failed Workspace logins for me:

metadata.log_type = "WORKSPACE_ACTIVITY"
metadata.event_type = "USER_LOGIN"
metadata.product_event_type = "login_failure"