2 Alert recipient hygiene + suspicious-login alerts

Caveats

• Alerts default to every super admin — a recipient list that broad means nobody owns it, and nobody reads it.
• Turning a rule off only hides it from the alert center — the underlying event is still written to the audit logs, so you lose the alert, not the evidence.

Setup steps

1. 1. Open the alert center and confirm alerts are actually arriving (an empty alert board on a live tenant usually means the alert routing is misconfigured — not that nothing is happening).
   open ↗

   

   https://admin.google.com/ac/ac · captured 2026-07-15

   Security › Alert center

   Filter

   last 30 days, all severities

2. 2. On the Rules page, open the system-defined rules for suspicious login, leaked password, device compromised and user granted Admin privilege. Don't hunt through the full table — use the '+ Add a filter' button (highlighted in the screenshot) and pick Type = System defined to cut the list to these rules.
   open ↗

   

   https://admin.google.com/ac/ax · captured 2026-07-15

   Rules

   Status

   Active

   Alert center

   On

3. 3. Create the monitored security address the alerts will route to — a Google Group (e.g. security-alerts@), owned by the security owner, with the humans who actually respond as members. This one address is what every alert rule here, the government-backed-attack routing (№3) and the rest of the catalog's alerting point at.
   open ↗

   

   https://admin.google.com/ac/groups · captured 2026-07-15

   Directory › Groups

   Create group security-alerts@<domain>; Members = the responders (owner + at least one deputy); Who can post = Anyone on the web (Google's alert mail originates outside your domain); Who can view conversations = Group members

4. 4. Replace the default 'all super admins' recipients with a monitored distribution address that a human reads, and remove ex-admins.

   Rules › <rule> › Actions

   Email notifications

   On

   Recipients

   security-alerts@<domain> (monitored group whose access settings allow senders from outside the organisation)

5. 5. Check the organisation's admin contact addresses so Google's own notifications do not fall into a departed admin's mailbox.
   open ↗

   

   https://admin.google.com/ac/accountsettings/profile · captured 2026-07-15

   Account › Account settings › Profile

   Secondary email

   a monitored address outside your Workspace domain (the console rejects in-domain addresses here)

Ongoing maintenance

• requires a human Quarterly: re-check rule recipients after admin departures — alerts routed to a leaver’s mailbox fail silently.
• automatable: AI agent Weekly: review the alert center for unhandled alerts.

How to verify

1. Trigger a harmless rule (e.g. sign in from a fresh browser profile to raise a suspicious-login event) and confirm the alert reaches the monitored mailbox.

2. Read the recipient list on each system-defined rule in Rules — every alert should route to the monitored security address.