Embedded Files
As an Administrator, you can proactively address security issues by creating activity rules. These rules let you set up alerts and automate actions to help prevent, detect, and remediate problems.
Configuring a rule involves defining conditions (if x happens) and specifying the actions to take (then do y). Essentially, you tell Google what to watch for, and what to do when it happens.
While all Google Workspace editions include the Alert Center for notifications, the advanced automation to proactively remediate problems (the "actions" part of the rules) is a feature of premium editions (Business Plus, Enterprise Standard, and Enterprise Plus).
Let's see the scene
Let's see the scene
In this exercise, you’ll practice creating an activity rule and alert.
Something suspicious is going on with one of your user’s accounts. Let’s see how you can help.
Exercise directions
Exercise directions
Step 1
If you’re not already signed in, sign in to your domain as the Administrator at admin.google.com.
Step 2
From the main menu, navigate to Rules, then click Create rule, and select Activity rule.
Step 3
In the Rule name text box, enter Suspicious login rule. Click CONTINUE.
Step 4
From the Data source dropdown menu, select User log events.
Step 5
In the condition builder, select the following values:
Attribute: Event
Operator: Is
Value: Suspicious login
Click CONTINUE.
Step 6
Select If the event frequency meets a specific threshold. Set the threshold:
Limit: Greater than or equal to (>=) 1
Time frame: 1 hour
This means for any given period of one hour, if your search returns one or more results, the rule will be triggered.
Click CONTINUE.
Step 7
Click ADD ACTION. From the dropdown, select Force password change.
Step 8
Under the Notification section:
Set Severity to High.
Ensure Send to Alert Center is checked.
Click Add email recipients and select Alex.
Step 9
Click CONTINUE (or Review). Verify the summary of your conditions and actions.
Step 10
Click CREATE RULE.
Notes
Notes
When setting up an activity rule, you can use the Condition builder tab, where filters are represented as conditions with AND/OR operators. You can also use the Filter tab to include simple parameter and value pairs to filter the search results.
The availability of data sources varies depending on your Google Workspace edition and your Admin privileges. For details, please refer to Admin access to reporting rules & activity rules and Data sources & conditions in the investigation tool.
When creating an activity rule, you can't add actions for Drive log events.
When creating an activity rule, the rule status is Active by default, which means the system will begin collecting logs, and the rule will be enforced. You also have the option to set the rule status to Monitor, which enables you to review logs before enforcing the rule. Later, you can also set the rule to Inactive, which means the system is no longer collecting logs, and the rule isn't enforced.
Help Center resources
Help Center resources
Explore more about creating activity rules and alerts in the Google Workspace Admin Help Center.
Page updated
Report abuse