Elastic high stable kql
Forwarded Google Workspace Security Alert
Identifies the occurrence of a security alert from the Google Workspace alerts center. Google Workspace's security alert center provides an overview of actionable alerts that may be affecting an organization's domain. An alert is a warning of a potential security issue that Google has detected.
Detection Logic
data_stream.dataset: google_workspace.alertFalse Positives
- ⚠ To tune this rule, add exceptions to exclude any google_workspace.alert.type or rule.name which should not trigger this rule.
- ⚠ For additional tuning, severity exceptions for google_workspace.alert.metadata.severity can be added.
Field Validations
Loading…
Comments (0)
Loading comments...