Public/Reports/Get-GSActivityReport.ps1

function Get-GSActivityReport {
    <#
    .SYNOPSIS
    Retrieves a list of activities
    
    .DESCRIPTION
    Retrieves a list of activities
    
    .PARAMETER UserKey
    Represents the profile id or the user email for which the data should be filtered. When 'all' is specified as the userKey, it returns usageReports for all users
    
    .PARAMETER ApplicationName
    Application name for which the events are to be retrieved.
    
    Available values are:
    * "Admin": The Admin console application's activity reports return account information about different types of administrator activity events.
    * "Calendar": The G Suite Calendar application's activity reports return information about various Calendar activity events.
    * "Drive": The Google Drive application's activity reports return information about various Google Drive activity events. The Drive activity report is only available for G Suite Business customers.
    * "Groups": The Google Groups application's activity reports return information about various Groups activity events.
    * "GPlus": The Google+ application's activity reports return information about various Google+ activity events.
    * "Login": The G Suite Login application's activity reports return account information about different types of Login activity events.
    * "Mobile": The G Suite Mobile Audit activity report return information about different types of Mobile Audit activity events.
    * "Rules": The G Suite Rules activity report return information about different types of Rules activity events.
    * "Token": The G Suite Token application's activity reports return account information about different types of Token activity events.

    Defaults to "Admin"
    
    .PARAMETER EventName
    The name of the event being queried
    
    .PARAMETER ActorIpAddress
    IP Address of host where the event was performed. Supports both IPv4 and IPv6 addresses
    
    .PARAMETER EndTime
    Return events which occurred at or before this time
    
    .PARAMETER Filters
    Event parameters in the form [parameter1 name][operator][parameter1 value]
    
    .PARAMETER PageSize
    Number of activity records to be shown in each page
    
    .EXAMPLE
    Get-GSActivityReport -StartTime (Get-Date).AddDays(-30)

    Gets the admin activity report for the last 30 days
    #>

    [cmdletbinding()]
    Param
    (
        [parameter(Mandatory = $false,Position = 0)]
        [ValidateNotNullOrEmpty()]
        [String]
        $UserKey = 'all',
        [parameter(Mandatory = $false,Position = 1)]
        [ValidateSet("Admin","Calendar","Drive","Groups","GPlus","Login","Mobile","Rules","Token")]
        [String]
        $ApplicationName = "Admin",
        [parameter(Mandatory = $false,Position = 2)]
        [String]
        $EventName,
        [parameter(Mandatory = $false)]
        [DateTime]
        $StartTime,
        [parameter(Mandatory = $false)]
        [DateTime]
        $EndTime,
        [parameter(Mandatory = $false)]
        [String]
        $ActorIpAddress,
        [parameter(Mandatory = $false)]
        [String[]]
        $Filters,
        [parameter(Mandatory = $false)]
        [ValidateRange(1,1000)]
        [Alias("MaxResults")]
        [Int]
        $PageSize = "1000"
    )
    Begin {
        $serviceParams = @{
            Scope       = 'https://www.googleapis.com/auth/admin.reports.audit.readonly'
            ServiceType = 'Google.Apis.Admin.Reports.reports_v1.ReportsService'
        }
        $service = New-GoogleService @serviceParams
    }
    Process {
        try {
            if ($UserKey -notlike "*@*.*" -and $UserKey -cne 'all') {
                $UserKey = "$($UserKey)@$($Script:PSGSuite.Domain)"
            }
            Write-Verbose "Getting $ApplicationName Activity report"
            $request = $service.Activities.List($UserKey,($ApplicationName.ToLower()))
            $request.MaxResults = $PageSize
            foreach ($key in $PSBoundParameters.Keys | Where-Object {$_ -notin @('UserKey','ApplicationName')}) {
                switch ($key) {
                    StartTime {
                        $request.$key = $StartTime.ToString('o')
                    }
                    EndTime {
                        $request.$key = $EndTime.ToString('o')
                    }
                    Filters {
                        $request.$key = $PSBoundParameters[$key] -join ","
                    }
                    Default {
                        if ($request.PSObject.Properties.Name -contains $key) {
                            $request.$key = $PSBoundParameters[$key]
                        }
                    }
                }
            }
            $response = @()
            [int]$i = 1
            do {
                $result = $request.Execute()
                $response += $result.Items
                $request.PageToken = $result.NextPageToken
                [int]$retrieved = ($i + $result.Items.Count) - 1
                Write-Verbose "Retrieved $retrieved events..."
                [int]$i = $i + $result.Items.Count
            }
            until (!$result.NextPageToken)
            return $response
        }
        catch {
            $PSCmdlet.ThrowTerminatingError($_)
        }
    }
}