Search and filter across all detection sources
53 rules
GSuite Passthrough Rule Triggered
A GSuite rule was triggered.
Suspicious GSuite Login
GSuite reported a suspicious login for this user.
GSuite User Device Compromised
GSuite reported a user's device has been compromised.
GSuite Device Suspicious Activity
GSuite reported a suspicious activity on a user's device.
GSuite User Banned from Group
A GSuite user was banned from an enterprise group by moderator action.
GSuite User Suspended
A GSuite user was suspended, the account may have been compromised by a spam network.
Google Accessed a GSuite Resource
Google accessed one of your GSuite resources directly, most likely in response to a support incident.
GSuite Document External Ownership Transfer
A GSuite document's ownership was transferred to an external party.
GSuite User Password Leaked
GSuite reported a user's password has been compromised, so they disabled the account.
Suspicious is_suspicious tag
GSuite reported a suspicious activity for this user.
GSuite Workspace Gmail Security Sandbox Disabled
A Workspace Admin Has Disabled The Security Sandbox
GSuite Workspace Password Reuse Has Been Enabled
A Workspace Admin Has Enabled Password Reuse
GSuite Workspace Data Export Has Been Created
A Workspace Admin Has Created a Data Export
GSuite Workspace Trusted Domain Allowlist Modified
A Workspace Admin Has Modified The Trusted Domains List
GSuite User Advanced Protection Change
A user disabled advanced protection for themselves.
GSuite Calendar Has Been Made Public
A User or Admin Has Modified A Calendar To Be Public
GSuite Workspace Calendar External Sharing Setting Change
A Workspace Admin Changed The Sharing Settings for Primary Calendars
GSuite External Drive Document
A Google drive resource became externally accessible.
GSuite Workspace Gmail Default Routing Rule Modified
A Workspace Admin Has Modified A Default Routing Rule In Gmail
GSuite Workspace Gmail Pre-Delivery Message Scanning Disabled
A Workspace Admin Has Disabled Pre-Delivery Scanning For Gmail.
GSuite Workspace Strong Password Enforcement Has Been Disabled
A Workspace Admin Has Disabled The Enforcement Of Strong Passwords
Gsuite Mail forwarded to external domain
A user has configured mail forwarding to an external domain
GSuite User Two Step Verification Change
A user disabled two step verification for themselves.
Gsuite Email Bypassed Spam Filter
Detects if an email received by a user has bypassed the organization's spam filter.
GSuite Login Type
A login of a non-approved type was detected for this user.