Classification:

attack

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detect when Google Workspace Alert Center raises an alert.

Strategy

Google Workspace Alert Center provides a comprehensive view of security related notifications, alerts, and actions across Google Workspace.

See View alert details for information about each type of alert.

Triage and response

1. Investigate the Google Workspace alert to determine if it is malicious or benign.
2. If the finding is deemed malicious, follow the remediation guidance provided by Google and also any internal incident response processes.
3. If the finding is a false positive, you can reduce false positives by:
   • Providing feedback on alerts
   • Using rules to turn alerts on or off