For the Alert Center nobody has opened this week
Alert SiftTriage Google Workspace security alerts.
Paste the alerts and what you already know. The page groups them into cases, flags a takeover chain on one user, and lays every case on a P1 to P4 board. One run plans each case - contain, investigate, watch or close - with the first Admin console step. Nothing is changed from this page.
1 The alerts free
JSON: gws alertcenter alerts list or the Alert Center API. CSV: the Alert Center's export. Times are read as printed. Or drop the file here.
2 The board free
Cases, most urgent first
3 The plan metered
One run decides each case: contain every P1 now, close what is closed or explained by your note, investigate open high-severity cases and watch the rest, with the first step in the Admin console.
Pricing as soon as the session is ready...
Sign inThe reply could not be read. Here it is as it came back:
What to do
Closed
The page's check
Make the changes in the Admin console yourself. Nothing is changed from this page.
4 Saved triages
How it works
The page reads Alert Center JSON (alerts with type, createTime, the user in data.email, a message recipient or affected users, and metadata severity and status), a CSV whose header has a type and a time column, or lines split by |. Times are read as printed; a zone suffix is ignored. Each alert type maps to a kind - suspicious login, leaked password, admin rights granted, phishing and so on - with a default severity when none is given.
Alerts of one kind on one user make a case. A chain is two or more account signals - suspicious login, leaked password, admin rights granted, unusual download or export, third-party app access, mail forwarding - on one user within 48 hours. P1: an open case in a chain, a government-backed attack or an open compromised device. P2: open and high. P3: open and medium. P4: open and low, or all closed.
A case is named in your note when it has the user's address, the user's name before the @, or the kind's word (phishing, login, spam). The rule: contain P1; close what is closed or named; investigate P2; watch the rest. The plan covers the first 20 cases and the page checks every action against the rule.