How to Configure Google Workspace Security Investigation Tool (SIT) Custom Alerts

The Security Data Overload

In a large enterprise Google Workspace environment, thousands of security events occur every hour. A user might share a sensitive Google Doc with a personal Gmail account, an administrator might change a critical Organizational Unit (OU) setting, or an employee might download a file containing a virus. While the Security Investigation Tool (SIT) allows you to manually query these events, administrators cannot sit and refresh a dashboard all day.

To proactively defend the environment, you must configure Custom Alerts. A Custom Alert is an automated, continuous query running in the background. If a specific condition is met (e.g., “If John Doe downloads more than 50 files in 10 minutes”), the Security Investigation Tool will instantly trigger, aggregate the forensic data, and fire an email alert to the IT Security team, allowing them to intercept the potential data exfiltration before it completes.

Step 1: Accessing the Investigation Tool

You must possess Super Administrator privileges, or an Enterprise admin role with explicit access to the Security Center.

1. Log into the Google Workspace Admin Console.
2. Navigate to Security > Security center > Investigation tool.

Step 2: Building the Forensic Query

Before you can create an alert, you must build the mathematical query that the alert will monitor.

Let’s build a query designed to catch Mass Data Exfiltration (an employee downloading an unusually high number of files to their local hard drive).

1. In the Data Source dropdown, select Drive log events.
2. Click Add Condition.
3. Set the condition to: Event > is > Download.
4. Click Search.

The tool will display a list of all recent file downloads across the entire company. This is too noisy for an alert. We need to aggregate the data to find anomalies.

Step 3: Grouping and Aggregating the Data

To trigger an alert only when a threshold is breached, we must group the events by the user who performed the action.

1. Above the search results, click the Group by button.
2. Select Actor.
3. Click Search again.

Now, instead of a raw list of files, the console shows a list of usernames, alongside a “Count” column showing exactly how many files that specific user has downloaded.

Step 4: Creating the Custom Alert Rule

Now that the query is perfectly structured to count downloads per user, we can transform it into an automated alert.

1. Click the Save button (disk icon) at the top right of the query builder, and then click Create activity rule.
2. Rule Name: Alert: Mass Drive Data Exfiltration.
3. Description: Triggers if a user downloads more than 50 files within a short timeframe.
4. In the Conditions section, you will see your pre-built logic. Underneath it, you will see the Threshold setting.
5. Set the Threshold to trigger if the Count is Greater than 50 within a 1-hour window.

Step 5: Configuring the Actions and Notifications

The rule knows what to look for, but it needs to know what to do when the threshold is breached.

1. Scroll down to the Actions section.
2. (Optional but highly recommended): You can configure the rule to automatically take action. Check the box to Suspend User. (If a user downloads 50 files, Google will instantly lock their account, stopping the exfiltration).
3. Scroll down to the Alerts section.
4. Check the box for Send email notifications.
5. Select All super administrators, or type in the specific email address of your SOC (Security Operations Center), e.g., [email protected].
6. Click Create Rule.

The Proactive Defense

The Custom Alert is now active. The Security Investigation Tool will continuously monitor the global Google Drive logs in real-time. If an employee submits their resignation and then attempts to download the entire “Client Contacts” shared drive, the moment they hit the 51st file download, Google Workspace will automatically suspend their account and fire a high-priority email to the SOC team containing the exact IP address, timestamp, and a list of the files compromised.