+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ Domain data export initiated |
+ No events found |
+ Shall |
+ A Super Administrator for your Google account has started exporting data from your domain. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ [Beta] Client-side encryption service unavailable |
+ No events found |
+ Shall |
+ A problem has been detected with your client-side encryption service indicating an outage or misconfigured setting. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ User-reported phishing |
+ No events found |
+ Shall |
+ A sender has sent messages to your domain that users have classified as phishings. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ Suspicious message reported |
+ No events found |
+ Shall |
+ A sender has sent messages to your domain that users have classified as spam. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ Suspended user made active |
+ No events found |
+ Shall |
+ A suspended user is made active. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ User suspended (by admin) |
+ No events found |
+ Shall |
+ An admin has suspended the account. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ Spike in user-reported spam |
+ No events found |
+ Shall |
+ An unusually high volume of messages from a sender that users have marked as spam. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ Google Voice configuration problem |
+ No events found |
+ Shall |
+ Auto attendants and ring groups with invalid references may hang up at unexpected times. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ Directory sync cancelled due to safeguard threshold exceeded |
+ No events found |
+ Shall |
+ Directory sync has been automatically cancelled and disabled as the directory sync service detected a possibility to exceed deprovisioning safeguard threshold. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ Account suspension warning |
+ No events found |
+ Shall |
+ Google Workspace accounts engaging in suspicious activity may have their account suspended. Google Workspace accounts must comply with the Google Workspace Terms of Service, Google Workspace for Education Terms of Service, Google Cloud Platform Terms of Service or Cloud Identity Terms of Service. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ Leaked password |
+ No events found |
+ Shall |
+ Google detected compromised credentials requiring a reset of the user's password. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ User suspended (Google identity alert) |
+ No events found |
+ Shall |
+ Google detected suspicious activity and suspended the account. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ User suspended for spamming |
+ No events found |
+ Shall |
+ Google detected suspicious activity such as spamming and suspended the account. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ User suspended for spamming through relay |
+ No events found |
+ Shall |
+ Google detected suspicious activity such as spamming through a SMTP relay service and suspended the account. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ Suspicious programmatic login |
+ No events found |
+ Shall |
+ Google detected suspicious login attempts from potential applications or computer programs. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ User suspended due to suspicious activity |
+ No events found |
+ Shall |
+ Google suspended a user's account due to a potential compromise detected. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ Gmail potential employee spoofing |
+ No events found |
+ Shall |
+ Incoming messages where a sender's name is in your Google Workspace directory, but the mail is not from your company's domains or domain aliases. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ Phishing in inboxes due to bad whitelist |
+ No events found |
+ Shall |
+ Messages classified as spam by Gmail filters delivered to user inboxes due to whitelisting settings in the Google Admin console that override the spam filters. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ Malware message detected post-delivery |
+ No events found |
+ Shall |
+ Messages detected as malware post-delivery that are automatically reclassified. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ Phishing message detected post-delivery |
+ No events found |
+ Shall |
+ Messages detected as phishing post-delivery that are automatically reclassified. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ TLS failure |
+ No events found |
+ Shall |
+ Messages requiring Transport Layer Security (TLS) can't be delivered. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ Device compromised |
+ No events found |
+ Shall |
+ Provides details about devices in your domain that have entered a compromised state. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ Google Operations |
+ No events found |
+ Shall |
+ Provides details about security and privacy issues that affect your Google Workspace services. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ Suspicious device activity |
+ No events found |
+ Shall |
+ Provides details if device properties such as device ID, serial number, type of device, or device manufacturer are updated. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ Government-backed attacks |
+ No events found |
+ Shall |
+ Warnings about potential government-backed attacks. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ Rate limited recipient |
+ No events found |
+ Should |
+ A high rate of incoming email indicating a potential malicious attack or misconfigured setting. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ User deleted |
+ No events found |
+ Should |
+ A user has been deleted from the domain. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ App Maker Cloud SQL setup |
+ No events found |
+ Should |
+ A user has requested a Google Cloud SQL instance to be set up for use with App Maker. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ Apps outage alert |
+ No events found |
+ Should |
+ Alerts about new, updated, or resolved outage on the Google Workspace Status Dashboard. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ Smarthost failure |
+ No events found |
+ Should |
+ Alerts if a large number of messages can't be delivered to one of your smart host servers. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ Calendar settings changed |
+ No events found |
+ Should |
+ An admin has changed Google Workspace Calendar settings. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ Drive settings changed |
+ No events found |
+ Should |
+ An admin has changed Google Workspace Drive settings. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ Email settings changed |
+ No events found |
+ Should |
+ An admin has changed Google Workspace Gmail settings. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ Mobile settings changed |
+ No events found |
+ Should |
+ An admin has changed mobile management settings. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ Exchange journaling failure |
+ No events found |
+ Should |
+ Failures with Exchange journaling that ensures email traffic generated by Microsoft® Exchange server users is properly archived in Google Vault. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ New user added |
+ Pass |
+ Should |
+ A new user has been added to the domain. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ User granted Admin privilege |
+ Pass |
+ Shall |
+ A user is granted an admin privilege. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ User's Admin privilege revoked |
+ Pass |
+ Shall |
+ A user is revoked of their admin privilege. |
+
+
+ GWS.COMMONCONTROLS.13.1v0.3 |
+ Suspicious login |
+ Fail |
+ Shall |
+ Google detected a sign-in attempt that doesn't match a user's normal behavior, such as a sign-in from an unusual location. |
+
+
+