Administrator alerts

User alerts

You can receive User alerts when any of the following user account activities occur:

• Suspicious login activity

  This is a login event identified by our risk analysis system as outside the normal pattern of user behavior. For example, this could be a user logging in from an unusual location or in a manner associated with abuse. If we detect that an unauthorized person is attempting to access a user's account, we will present them with a Login Challenge. If they fail or abandon the challenge, this will generate a suspicious login alert.

  Note: If a suspicious event occurs when a user is using Mail Fetcher to import mail from another Gmail account, a Google IP address is reported; this is because the messages are being fetched through our servers.
• User’s password changed
• User’s Admin privilege revoked
• New user added
• User suspended
• Suspended user made active
• User deleted
• Apps outage alert

  Send email alerts to admins, users, and groups when Google posts a new outage message, an update to an existing outage, or a resolved message to an existing outage status message gets to the Google Apps Status Dashboard.

• User granted Admin privilege

Settings alerts

You can receive Settings alerts when settings for any of the following applications or devices are changed in your Google Admin console (settings made by a Google administrator):

• Mobile settings changed
• Drive settings changed
• Calendar settings changed
• GMail settings changed

Email alerts

You can receive Email alerts when any of the following email delivery events occur:

• Exchange journaling failure
• Smarthost failure
• TLS failure

Click the alert for a detailed description and debugging tips.

Types of Custom alerts

You can create Custom alerts for any of the following audit stream types:

• Admin audit
• Tokens audit
• Calendar audit
• Login audit
• Drive audit (Google Apps Unlimited edition or Google Apps for Education customers only)

Refer to the links above to use the Filters section to create a Custom alert.

1. Sign in to the Google Admin console.
2. Click Reports.
   ^{Where is it?}
3. Click Manage Alerts in the left navigation pane to review the available notifications. The Custom alerts appear at the bottom. They are ON by default.
4. Select each Predefined alert notification you want to receive by setting its Status switch to ON.
5. (Optional) Configure Predefined alerts to be sent to additional recipients by clicking an alert's Email Recipients and entering additional email addresses. You can also toggle the SuperAdministrator selection for Predefined alerts on and off. You can edit your Custom alerts to change any of the attributes or you can delete the alert.

1. Contact the users with suspicious logins, and ask them if they remember signing in when the suspicious login occurred. They can check their last account activity if they're unsure.
2. If you can't establish the legitimacy of the login, follow the Google apps Admin Security Checklist. Pay special attention to administrator login activity.
3. As a precaution, we encourage you to reset the password of any account that has suspicious activity.
4. If you determine the suspicious activity is actually a legitimate login, but you keep getting alerts for this user, consider enrolling the user in 2-step verification, which will reduce inaccurate suspicious login notifications. We recommend enrolling all of your users in 2-step verification.