63 Audit-the-auditors alerting

Caveats

• A rule that notifies the auditors about the auditors is theatre — the recipient must sit outside the group being watched.
• A Vault admin with rule-edit privilege can disable the rule that watches them — pair this with the config-drift sentinel (№61).
• Basic activity rules are available in all editions, but Vault log events need a Vault add-on license and the investigation tool needs Enterprise Standard+, Frontline Standard+, Education Standard+ or Cloud Identity Premium — without those this control is partially blind.

Setup steps

1. 1. Open Audit and investigation and pick the data source that records auditor behaviour: Vault log events (exports, holds, searches), Admin log events (privilege grants), Gmail log events (delegate activity, via the Delegate attribute).
   open ↗

   

   https://admin.google.com/ac/sc/investigation · captured 2026-07-15

   Reporting › Audit and investigation

   Data source

   Vault log events

2. 2. Create an activity rule on Vault log events for search/export/hold-change actions — the people who can read everything must be the most-watched.
   open ↗

   

   https://admin.google.com/ac/ax · captured 2026-07-15

   Rules › Create rule › Activity

   Condition: Vault event in {search, export, hold created/deleted}; Severity = High

3. 3. Add rules for the other two auditor behaviours: investigation-tool use in Admin log events, and delegate activity in Gmail log events — filter on the Delegate / Has delegate attributes to catch actions performed through a delegated mailbox.

   Rules › Create rule › Activity

   Rule: Admin log events, investigation-tool query; Rule: Gmail log events, Has delegate = true; Severity = High

4. 4. Route both rules to a recipient who is NOT an auditor/Vault admin — self-notification is not oversight.

   Recipients

   oversight alias outside the Vault admin group

5. 5. Trigger one benign Vault search and confirm the alert lands in the alert center and in the oversight mailbox.
   open ↗

   

   https://admin.google.com/ac/ac · captured 2026-07-15

   Security › Alert center

Ongoing maintenance

• requires a human Weekly: review auditor-activity alerts — the point is that someone other than the auditor reads them.

How to verify

1. Perform a benign privileged audit action (e.g. an investigation-tool search) and confirm the corresponding alert fires to the second-person channel.