View alert details

From your list of alerts in the alert center, you can drill down to view more details about individual alerts. Each alert type has different details and provides you with different options when responding to an alert.

To view alert details:

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Menu "" and then Security and then Alert center.
  3. To view more details, click any item on the page to open the alert details page.

    From the alert details page, you can view details about an alert, delete an alert, access details about the rule that generated the alert, and take other actions.

Note: The alert center doesn’t display timezone details. Times in the alert center are formatted to your Google Admin console timezone preference.

Gmail alerts

Open all   |   Close all

Gmail potential employee spoofing

This alert informs you when an external sender may be spoofing users with a similar name in your domain by using a display name that matches a user in your global address book. The external sender may have a history of sending spam or has limited/no history of sending emails to your domain.

Note: This alert is triggered only if the spoofing and authentication protection option for employee name spoofing is disabled. For instructions on enabling or disabling this feature, see Turn on spoofing and authentication protection in Advanced phishing and malware protection

To view which messages users have interacted with, and to remove those messages from user inboxes, go to the investigation tool. For instructions, see Take action based on search results. To block the sender, see Block specific senders based on email address or domain.

From the Alert details page, you can view important details about this alert:

  • Summary—Includes a summary of the alert—for example, the number of potential spoofing messages, the display name used, and the number of recipients.
  • Date—Date and time of the event
  • Sender—Username of the sender
  • Total user reports
  • Received by—Lists the number of recipients and the usernames of the recipients

The details page also includes a table with message details including the date, message ID, subject hash, message body hash, username of the recipient, attachment hashes, and your primary domain name to help with your investigation. The investigation tool can provide additional details to continue your investigation.

Note: To control the volume of alerts, an alert isn't created if there's an existing, open alert from the same external sender.

Malware message detected post-delivery

Unopened messages that are detected as malware post-delivery are automatically reclassified and removed from the user's inbox. However, if a recipient has opened or otherwise interacted with such a message, it will remain in their inbox until manually removed. It is strongly recommended that all opened malware messages be removed from user inboxes as soon as possible.

The Alert details page includes the following information:

  • Summary—This section includes a summary of the alert—for example, the number of malware messages and the number of recipients.
  • Date—Date and time of the event
  • Sender—Username of the sender
  • Total message delivery events
  • Received by—Lists the number of recipients and the usernames of the recipients

The details page also includes a list of samples of message delivery events. This list is included in a table at the bottom of the page. Each item in the list includes the date, message ID, subject hash, message body hash, recipient, attachment hashes, and your primary domain name. 

To view which messages users have interacted with and remove them from user inboxes, go to the investigation tool(see Take action based on search results). To block the sender, see Block specific senders based on email or domain.

Phishing in inboxes due to bad whitelist

Messages classified as spam by Gmail filters might be delivered to user inboxes due to whitelisting settings in the Google Admin console that override the spam filters. As a result, users in your organization might receive phishing messages. The Phishing in inboxes due to bad whitelist alert provides details about such a security event. 

From the Alert details page, you can view important details about this alert:

  • Summary—This section includes a summary of the alert—for example, the number of phishing messages and the number of recipients.
  • Date—Date and time of the event
  • Sender—Username of the sender
  • Source IP—IP address of the sender's domain
  • Whitelist type—Setting in the Google Admin console that overrode the spam filters
  • Message delivery events—Number of events
  • Received by—Lists the number of recipients and the usernames of the recipients.

The details page also includes a list of samples of message delivery events. This list is included in a table at the bottom of the page. Each item in the list includes the date, message ID, subject hash, message body hash, username of the recipient, attachment hashes, and your primary domain name.

Using the details from this alert, you can take action to block the sender.

Phishing message detected post-delivery

Unopened messages that are detected as phishing post-delivery are automatically reclassified and removed from the user's inbox. However, if a recipient has opened or otherwise interacted with such a message, it will remain in their inbox until manually removed. It is strongly recommended that all opened phishing messages be removed from user inboxes as soon as possible.

To view which messages users have interacted with and remove them from user inboxes, go to the investigation tool (see Take action based on search results). To block the sender, see Block specific senders based on email or domain.

From the Alert details page, you can view important details about this alert:

  • Summary—This section includes a summary of the alert—for example, the number of phishing messages and the number of recipients.
  • Date—Date and time of the event
  • Sender—Username of the sender
  • Total message delivery events
  • Received by—Lists the number of recipients and the usernames of the recipients

The details page also includes a list of samples of message delivery events. This list is included in a table at the bottom of the page. Each item in the list includes the date, message ID, subject hash, message body hash, recipient, attachment hashes, and your primary domain name.

Spike in user reported spam

With this alert, an unusually high volume of messages have been marked as spam by users in your domain. 

For instructions on blocking this sender, see Block specific senders based on email or domain. To find similar messages that users may not have reported, to reclassify messages, and to remove these messages from user inboxes, go to the investigation tool (for instructions, see Take action based on search results).

From the Alert details page, you can view important details about this alert:

  • Summary—This section includes a summary of the alert—for example, the number of spam messages and the number of recipients.
  • Date—Date and time of the event (this is usually the date of the first message that's reported within the spike grouping)
  • Total user reports
  • Received by—Lists the number of recipients and the usernames of the recipients

The details page also includes a list of samples of user reports. This list is included in a table at the bottom of the page. Each item in the list includes the date, message ID, subject hash, message body hash, username of the recipient, attachment hashes, and your primary domain name.

Suspicious message reported

With this alert, an external sender has sent messages to your domain that users have classified as spam.

Messages may be classified as suspicious if they meet certain characteristics typical of spam messages, but when Google does not have a strong enough signal to mark them as spam. This alert is generated when a user marks such messages as spam, thus confirming Google's suspicions.

For instructions on blocking this sender, see Block specific senders based on email or domain. To find similar messages that users may not have reported, to reclassify messages, and to remove these messages from user inboxes, go to the investigation tool (for instructions, see Take action based on search results).

From the Alert details page, you can view important details about this alert:

  • Summary—This section includes a summary of the alert—for example, the number of suspicious messages and the number of recipients.
  • Date—Date and time of the event
  • Sender—Username of the sender
  • Total user reports
  • Received by—Lists the number of recipients and the usernames of the recipients

The details page also includes a list of samples of user reports. This list is included in a table at the bottom of the page. Each item in the list includes the date, message ID, subject hash, message body hash, username of the recipient, attachment hashes, and your primary domain name.

User-reported phishing

A spike in user-reported phishing emails could mean that your domain is experiencing a phishing attack. The User-reported phishing alert provides details about such a security event. 

From the Alert details page, you can view important details about this alert:

  • Summary—This section includes a summary of the alert—for example, the number of phishing messages and the number of recipients.
  • Date—Date and time of the event
  • Sender—Username of the sender
  • Total user reports—Number of user reports
  • Received by—Lists the number of recipients and the usernames of the recipients.

The details page also includes a list of samples of user reports. This list is included in a table at the bottom of the page. Each item in the list includes the date, message ID, subject hash, message body hash, username of the recipient, attachment hashes, and your primary domain name. 

Using the details from this alert, you can take action to block the sender.

User alerts

Open all   |   Close all

Leaked password

When Google detects compromised credentials, we require a reset of the user's password before the user can sign in again.

Common causes of password theft are viruses, user responses to phishing emails, or the use of the same password on many different websites, of which one or more have been compromised by attackers. 

We recommend resetting the user's password, and checking to see if their account has been compromised. We also recommend having the user go through the Gmail security checklist

From the Alert details page, you can view important details about this alert:

  • Summary—This section includes a summary of the alert with an overview of the details.
  • Date of login
  • User impacted—Username with compromised credentials

For more information on how Google detects compromised credentials, see Change unsafe passwords in your Google Account > Learn about compromised passwords.

New user added

The New user added alert informs you that a new user has been added to your domain.

From the Alert details page, you can view important details about the New user added alert:

  • Summary—Includes a summary of the alert with an overview of the details
  • Date—Date and time of the event
  • User—User that was added to your domain
  • Changed by—User that added the new user to your domain
Suspicious login blocked

Important: Suspicious login blocked alerts are hidden from the default alert center list view. They can be viewed by selecting the alert type filter for Suspicious login. Even though the alerts are hidden from the list view, new alerts will still trigger email notifications if enabled.

Google considers login activity suspicious if there's a sign-in attempt that doesn't match a user's normal behavior, such as a sign-in from an unusual location, or if an unauthorized person may have attempted to access a user's account. 

In most cases, before we send you an alert, we'll show the user a login challenge. If the user fails or abandons the challenge, we'll send you a suspicious login alert.

We recommend suspending this user until you've gone through these security steps. You can suspend the user from their settings page, or by using the investigation tool.

You can restore the user and reset their password once you've determined it's safe to do so. We recommend having the user go through the Gmail security checklistEnabling 2-step verification for the domain and enforcing security keys for your users is strongly recommended.

From the Alert details page, you can view important details about this alert:

  • Summary—This section includes a summary of the alert with an overview of the details
  • Date login was marked as suspicious
  • Date of login attempt
  • User impacted—Username affected by the suspicious login
  • IP from which the login was detected
Suspicious login from a less secure app

Google considers login activity suspicious if there's a sign-in attempt that doesn't match a user's normal behavior, such as a sign-in from an unusual location, or if an unauthorized person may have attempted to access a user's account. 

Apps that are less secure don't use modern security standards, such as OAuth. Using apps and devices that don’t use modern security standards increases the risk of accounts being compromised.

Examples of apps that don’t support modern security standards include:

  • ​Native mail, contacts, and calendar sync applications on older versions of iOS and OSX​
  • ​Some computer mail clients, such as older versions of Microsoft Outlook

From the Alert details page, you can view important details about the Suspicious login from a less secure app alert, including a summary of the alert, and the date and time of the event.

For more information, see Control access to less secure apps.

Suspicious programmatic login

Google considers login activity suspicious if there's a sign-in attempt that doesn't match a user's normal behavior, such as a sign-in from an unusual location, or if an unauthorized person may have attempted to access a user's account. 

Like conventional web logins, programmatic logins (through apps) are subject to risk analysis. To help keep Google accounts (through work, school, or other groups) more secure, Google blocks suspicious programmatic logins from accessing Google accounts.

We strongly recommend using OAuth for any connection to your users’ data. If a user tries to sign in with a programmatic login, we recommend contacting the user to identify the app they’re using and make sure they were the user attempting to access their account. Subsequently, upgrade the user to an app that uses OAuth and to turn off access to less secure apps for this user and as many others as possible.

From the Alert details page, you can view important details about this alert:

  • Summary—This section includes a summary of the alert with an overview of the details
  • Date login was marked as suspicious
  • Date of login attempt
  • User impacted—Username affected by the suspicious login
  • IP from which the login was detected
Suspended user made active

The Suspended user made active alert informs you that a suspended user in your domain has been made active. 

From the Alert details page, you can view important details about the Suspended user made active alert:

  • Summary—Includes a summary of the alert with an overview of the details
  • Date—Date and time of the event
  • User—Suspended user that was made active
  • Changed by—User that changed a suspended user to active
User deleted

The User deleted alert informs you that a user has been deleted from your domain.

From the Alert details page, you can view important details about the User deleted alert:

  • Summary—Includes a summary of the alert with an overview of the details
  • Date—Date and time of the event
  • User—User that was deleted from your domain
  • Changed by—User that deleted the user from your domain
User granted admin privilege

The User granted admin privilege alert informs you that a user in your domain has been granted an admin privilege. 

From the Alert details page, you can view important details about the User granted admin privilege alert:

  • Summary—Includes a summary of the alert with an overview of the details
  • Date—Date and time of the event
  • User—User that was granted an admin privilege
  • Changed by—User that granted an admin privilege to a user
User suspended

When Google detects suspicious activity that suggests an account has been compromised, we proactively suspend the affected user's account. 

As an administrator, you can also suspend users from their settings page, or by using the investigation tool. 

You can restore the user and reset their password once you've determined it's safe to do so. Before restoring a user, we recommend that you follow these security steps

We also recommend having the user go through the Gmail security checklist. Enabling 2-step verification for the domain and enforcing security keys for your users is strongly recommended.

From the Alert details page, you can view important details about this alert:

  • Summary—This section includes a summary of the alert with an overview of the details
  • Date of login
  • User impacted—Username affected by the suspicious activity
User suspended (by admin)

The User suspended (by admin) alert informs you that a user in your domain has been suspended by an administrator. 

From the Alert details page, you can view important details about the User suspended (by admin) alert:

  • Summary—Includes a summary of the alert with an overview of the details
  • Date—Date and time of the event
  • User—User that was suspended
  • Changed by—Admin that suspended the user
User suspended due to suspicious activity

This alert is a generic alert that lets you know that a user has been suspended due to suspicious activity. As a response to this alert, you can follow up with the user, or—if needed—you can contact Google support to see if they can provide more information.

From the Alert details page, you can view important details about this alert:

  • Summary—This section includes a summary of the alert with an overview of the details.
  • Date login was marked as suspicious
  • Date of login attempt
  • User impacted—Username affected by suspicious activity
  • IP address from which the login was detected
User suspended for spamming

When Google detects suspicious activity that suggests an account compromise, such as evidence that a user is sending spam, we proactively suspend the affected user's account.

You can restore the user and reset their password once you've determined it's safe to do so. We recommend having the user go through the Gmail security checklist. Enabling 2-step verification for the domain and enforcing security keys for your users is strongly recommended.

From the Alert details page, you can view important details about this alert:

  • Summary—This section includes a summary of the alert with an overview of the details.
  • Date
  • User impacted—Username affected by suspicious activity
User suspended for spamming through relay

When Google detects suspicious activity that suggests an account compromise, such as evidence that a user is sending spam through the SMTP relay service, we proactively suspend the affected user's account.

You can restore the account once you have resolved the issue with relay spam. During the suspension period, the user won't be able to sign in to Google services, or send email via this account, but we will continue to deliver incoming email as normal.

From the Alert details page, you can view important details about this alert:

  • Summary—This section includes a summary of the alert with an overview of the details.
  • Date
  • User impacted—Username affected by suspicious activity
User's admin privilege revoked

The User's admin privilege revoked alert informs you that an admin has revoked the admin privileges of a user in your domain. 

From the Alert details page, you can view important details about the User's admin privilege revoked alert:

  • Summary—Includes a summary of the alert with an overview of the details
  • Date—Date and time of the event
  • User—User that had the admin privilege revoked
  • Changed by—Admin that revoked the admin privilege
User's password changed

The User's password changed alert informs you that a user's password was changed in your domain. 

From the Alert details page, you can view important details about the User's password changed alert:

  • Summary—Includes a summary of the alert with an overview of the details
  • Date—Date and time of the event
  • User—User that had their password changed

Device alerts

Open all   |   Close all

Device compromised

The Device compromised alert provides details about devices in your domain that have entered a compromised state. A device is considered compromised if it's rooted (for Android devices), if it's jailbroken (for iOS devices), or if it experiences an unusual state change.

From the Alert details page, you can view important details about this alert: 

  • Summary—This section includes a summary of the alert—for example, the type of device and the device ID.
  • Date—Date and time of the event
  • Device owner—Username of the device owner
  • Device impacted—This section includes device details, such as the device ID, serial number, device type, device model name, and resource ID name.
Suspicious device activity

If a device property is updated—for example, the device ID, serial number, type of device, or device manufacturer—it's considered suspicious device activity. The Suspicious device activity alert provides details about such a security event. 

From the Alert details page, you can view important details about this alert: 

  • Summary—This section includes a summary of the alert—for example, the number of device properties that were updated, and the device ID.
  • Date—Date and time of the event
  • Device owner—Username of the device owner
  • Device impacted—This section includes details such as the device ID, serial number, device type, model name, and the resource ID name. 
  • Received by—Lists the number of recipients and the usernames of the recipients.

The details page also includes a list of device-property updates. This list is included in a table at the bottom of the page. The old value and the new value are displayed for each device property that was updated.

Administrative alerts

Open all   |   Close all

Calendar settings changed

The Calendar settings changed alert informs you when an admin has changed Google Workspace Calendar settings.

From the Alert details page, you can view important details about the Calendar settings changed alert:

  • Summary—Includes a summary of the alert with an overview of the details
  • Date—Date and time of the event
  • Settings—Setting that was changed by the admin
  • New value—New value for the setting
  • Old value—Old value for the setting
  • By—Admin that changed the setting

Click Search in audit logs to view more details about the event that triggered the alert.

Domain data export initiated

The Domain data export initiated alert provides details about a super administrator for your Google account who has started exporting data from your domain. Once initiated, there is a 48 hour window in which a domain data export may be cancelled before the export process actually begins. If you think this export wasn't intentional, contact Google Workspace Support.

Data export typically takes 72 hours or more, depending on the size of your domain. You can see the status of the export in the Data Export tool. For more information about the Data Export tool, see Export your organization’s data.

From the Alert details page, you can view important details about this alert:

  • Summary—Includes a summary of the alert with an overview of the details.
  • Date
  • Actor—User who initiated the data export
Drive settings changed

The Drive settings changed alert informs you when an admin has changed Google Workspace Drive settings.

From the Alert details page, you can view important details about the Drive settings changed alert:

  • Summary—Includes a summary of the alert with an overview of the details
  • Date—Date and time of the event
  • Settings—Setting that was changed by the admin
  • New value—New value for the setting
  • Old value—Old value for the setting
  • By—Admin that changed the setting

Click Search in audit logs to view more details about the event that triggered the alert.

Email settings changed

The Email settings changed alert informs you when an admin has changed Google Workspace Gmail settings.

From the Alert details page, you can view important details about the Email settings changed alert:

  • Summary—Includes a summary of the alert with an overview of the details
  • Date—Date and time of the event
  • Settings—Setting that was changed by the admin
  • New value—New value for the setting
  • Old value—Old value for the setting
  • By—Admin that changed the setting

Click Search in audit logs to view more details about the event that triggered the alert.

Mobile settings changed

The Mobile settings changed alert informs you when an admin has changed mobile management settings.

From the Alert details page, you can view important details about the Mobile settings changed alert:

  • Summary—Includes a summary of the alert with an overview of the details
  • Date—Date and time of the event
  • Settings—Setting that was changed by the admin
  • New value—New value for the setting
  • Old value—Old value for the setting
  • By—Admin that changed the setting

Click Search in audit logs to view more details about the event that triggered the alert.

Custom rule alerts

Open all   |   Close all

Activity rule

An activity rule is a set of conditions and actions defined by an administrator. If a policy’s conditions are met, the rule is triggered, and corresponding actions are executed automatically. Activity rules automate processes that would otherwise need to be done manually, and can be customized to serve your domain’s specific business needs. 

As an administrator, you can create a rule that alerts you or takes action based on any search that you configure in the investigation tool. If you configure this rule to trigger an alert, the alert is displayed as an Activity rule in the alert center (for more details, see Create rules with the investigation tool).

From the Alert details page, you can view important details about this alert:

  • Summary—This section includes a summary of the alert with an overview of the details.
  • Date
  • Threshold
  • Alert status
  • Alert severity—Low, Medium, or High
  • Rule that triggered the alert
Data Loss Prevention (DLP)

You receive a Data Loss Prevention (DLP) alert in the alert center when a Drive DLP rule is triggered.

As an administrator, you can prevent users from sharing sensitive content in Google Drive or shared drives with people outside of your organization. DLP rules enable you to scan files for sensitive content. For example, if a user shares a file with bank account or tax ID numbers, you can send an email to super admins to let them know. You can also warn users when they try to share a file or completely block anyone outside of your organization from accessing the file.

From the Alert details page, you can view important details about the Data Loss Prevention (DLP) alert:

  • Summary—Includes a summary of the alert with an overview of the details
  • Date—Date and time of the event
  • Triggering user—User that modified a file by adding sensitive content to it
  • Shared users—Users the Drive file was shared with
  • Document ID—Unique identifier for the Drive document
  • Document title—Title of the Drive document
  • Detector names—Names of user-defined content detectors, or predefined content detectors—for example, Social Security number or driver's license number.
  • Triggered actions—Actions that were triggered from the DLP rule; for example, Block external sharing or Alert.
  • Suppressed actions—Actions that were suppressed due to conflicts with actions configured in other rules

Note: When a rule isn't configured correctly, admins are potentially overwhelmed with a very large number of DLP alerts. To prevent this, DLP alerts are limited to 50 alerts per rule per day.

Reporting rule

The Reporting rule alert informs you when a custom reporting rule related to audit-log events is triggered by a specific activity. 

In addition to triggering an alert in the alert center, custom reporting rules also trigger an email notification (for more details about reporting rules, see Create and view reporting rules & set up alerts).

From the Alert details page, you can view important details about the Reporting rule alert, including a summary of the alert, date and time of the event, event description, and the name of the related audit log.

Click Search in audit logs to view more details about the event that triggered the alert.

General alerts

Open all   |   Close all

Google Operations

The Google Operations alert provides details about security and privacy issues affecting your organization's Google Workspace services. 

From the Alert details page, you can view important details about this alert:

  • Summary—In this section, Google provides a message that includes specific details about the issue or incident. This section varies in size from a few sentences to several paragraphs.
  • Attachments—If available, you can download attachments with any additional details about the incident or issue.
Government-backed attacks

With this alert, administrators receive warnings about potential government-backed attacks. For example, in rare instances, government-backed attackers may try to steal a user's password within your organization.

To further improve the security in your organization, we highly recommend that you reset the passwords of affected users, enforce 2-step verification for the domain, and enforce security keys for your users.

For more details about government-backed attacks, see Government-backed attack alerts.

From the Alert details page, you can view important details about this alert:

  • Summary—Description of the alert
  • Date—Date and time of the event
  • Actor

Configure alert center email notifications

In addition to viewing alert center alerts in the Google Admin console, you can set up alert center email notifications. For details and instructions, see Configure alert center email notifications

Important: When adding recipients to email notifications, you have the option to add groups. To make sure users outside of your organization are able to send email notifications to the group, you'll need to correctly configure access settings for that group. For instructions, see View or edit group access settings for email notifications.

Was this helpful?
How can we improve it?

Need more help?

Sign in for additional support options to quickly solve your issue