G Suite Security Alert Center
G Suite Security Alert Center allows users to fetch different alert types such as Suspicious login, Device compromised, Leaked password, and more. Users can delete or recover a single alert or a batch of alerts and retrieve the alert's metadata. This integration allows users to provide feedback for alerts and fetch existing feedback for a particular alert.
- Category
- Data Enrichment & Threat Intelligence
- Pack
- GSuiteSecurityAlertCenter
Configuration parameters
- isFetch — Fetch incidents
- incidentType — Incident type
- incidentFetchInterval — Incidents Fetch Interval
- user_service_account_json — Service Account JSON
- admin_email_creds — Admin Email
- admin_email — Admin Email
- max_fetch — Maximum number of incidents per fetch (required)
- first_fetch — First fetch time interval
- alert_type — Alert Type
- filter — Filter
- fetch_feedback — Fetch feedback
- insecure — Trust any certificate (not secure)
- proxy — Use system proxy settings
Commands (6)
- gsac-alert-delete — Performs delete operation on alerts. Note: The alerts that are marked for deletion will be removed from the Alert Center after 30 days.
- gsac-alert-feedback-create — Creates new feedback for an alert.
- gsac-alert-feedback-list — Lists all the feedback for an alert.
- gsac-alert-get — Gets the specified alert. Note: To get the alert_id, execute the gsac-alert-list command.
- gsac-alert-list — Lists the alerts. Use the filter to filter the list by various alert types. Note: The alerts that have been marked for deletion in the past 30 days will still be visible.
- gsac-alert-recover — Performs a recover operation on alerts. Note: Recovers the alerts that were marked for deletion within the past 30 days.