G Suite Security Alert Center

G Suite Security Alert Center allows users to fetch different alert types such as Suspicious login, Device compromised, Leaked password, and more. Users can delete or recover a single alert or a batch of alerts and retrieve the alert's metadata. This integration allows users to provide feedback for alerts and fetch existing feedback for a particular alert.

Data Enrichment & Threat Intelligence · G Suite Security Alert Center

Configuration parameters

  • isFetch — Fetch incidents
  • incidentType — Incident type
  • user_service_account_json — Service Account JSON
  • admin_email_creds — Admin Email
  • admin_email — Admin Email
  • max_fetch — Maximum number of incidents per fetch (required)
  • first_fetch — First fetch time interval
  • alert_type — Alert Type
  • filter — Filter
  • fetch_feedback — Fetch feedback
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (6)

  • gsac-alert-delete

    Performs delete operation on alerts. Note: The alerts that are marked for deletion will be removed from the Alert Center after 30 days.

  • gsac-alert-feedback-create

    Creates new feedback for an alert.

  • gsac-alert-feedback-list

    Lists all the feedback for an alert.

  • gsac-alert-get

    Gets the specified alert. Note: To get the alert_id, execute the gsac-alert-list command.

  • gsac-alert-list

    Lists the alerts. Use the filter to filter the list by various alert types. Note: The alerts that have been marked for deletion in the past 30 days will still be visible.

  • gsac-alert-recover

    Performs a recover operation on alerts. Note: Recovers the alerts that were marked for deletion within the past 30 days.