3 Government-backed attack alert routing

Caveats

• Google deliberately discloses no detection detail — absence of an alert is not evidence of absence.
• Never respond to the targeted user by email — assume their mailbox is being read by the attacker.

Setup steps

1. 1. Filter the rules list to system-defined rules and open 'Government-backed attacks'.
   open ↗

   

   https://admin.google.com/ac/ax · captured 2026-07-15

   Rules

   Type

   System-defined

2. 2. Confirm the rule is active and raised to the alert center, and set severity so it is not buried.

   Rules › Government-backed attacks

   Status

   Active

   Alert center

   On

   Severity

   High

3. 3. Route the email notification to the monitored security address (created in №2) and to a named human who can call the affected user out-of-band. Recipients must be users in an internal domain; to reach an external address, use a Google Group.

   Rules › Government-backed attacks › Actions

   Email notifications

   On

   Recipients

   security-alerts@<domain> + named responder (internal-domain addresses only)

4. 4. Record the response playbook/SOP in a document: the alert names the targeted user, so the response is a password reset and enforced 2-Step Verification, plus Advanced Protection Program enrolment (№23), coordinated through an out-of-band call rather than email (since that channel may be compromised).
   open ↗

   

   https://admin.google.com/ac/ac · captured 2026-07-15

   Security › Alert center

   Playbook link attached to the alert workflow

Ongoing maintenance

• requires a human Quarterly: confirm the named responder is still current staff and the playbook link resolves.

How to verify

1. Open the system-defined rule "Government-backed attacks" and confirm Status = Active, alert center delivery On, and the recipient set is the monitored address plus a named responder.