# Alert Sift

> Triage Google Workspace security alerts. Paste the Alert Center alerts - the gws or API JSON (alerts with type,
> createTime, the user in data.email, a message recipient or affected users, and metadata severity and status), a CSV
> export with a type and a time column, or plain "time | type | user | severity" lines - and what you already know (a
> phishing test, someone travelling). The page maps each alert to a kind, groups alerts into cases by kind and user,
> flags takeover chains on one user and ranks every case P1 to P4 on a triage board. A metered run plans each case -
> contain, investigate, watch or close - with the first Admin console step, and the page checks every action against
> its own rule. Nothing is changed from the page. Built on the SkillSafe skill
> @googleworkspace/recipe-triage-security-alerts.
> An independent tool, not affiliated with or endorsed by Google.

https://alert-sift.skillsafe.ai/

## What is free
- Reading alerts: Alert Center JSON (an alerts list, or a bare array), CSV or tab-separated tables with a type and a time column (user, severity, status and source columns are used when present), and lines split by |. Times are read as printed; a zone suffix is ignored.
- Kinds: government-backed attack, compromised device, leaked password, suspicious login, admin rights granted, unusual download or export, third-party app access, mail forwarding added, data loss rule triggered, spam spike, phishing or malware, suspicious device activity, user suspended, other - each with a default severity when the alert has none.
- Cases: one per kind and user. A chain is two or more account signals (suspicious login, leaked password, admin rights granted, unusual download or export, third-party app access, mail forwarding added) on one user within 48 hours.
- Priorities: P1 for an open case in a chain, a government-backed attack or an open compromised device; P2 open and high; P3 open and medium; P4 open and low, or all closed. A case is named in your note by the user's address, the name before the @, or the kind's word.
- The board (PNG, SVG) with a strip of alerts per day, and a CSV of every case.
- Three samples (gws JSON, console CSV, plain lines) replay their saved plans at no cost.

## The metered task
One task, `alerts`, on gpt-terra, metered per run. Input string fields: `task`, `goal` (what the admin knows), `totals`, `cases` (one line per case, `c1.` ... up to 20: priority, kind, count, user, time span, severity, open or closed, the reported type, the chain and whether the note names it) and `others` (cases past the list, counted by kind). The reply is one JSON object: `verdict` (`urgent` or `routine`), `plan` (each `case`, `action` - `contain`, `close`, `investigate` or `watch` - `why` and `step`, the first Admin console step) and `note`.

The page checks each action against its own rule (contain P1; close what is closed or named; investigate P2; watch the rest), the verdict against the priorities, every number and time against the alerts, and warns when the reply guesses who is behind an alert or uses a gendered pronoun.

## Links
- API tutorial: https://alert-sift.skillsafe.ai/api.html
- Source skill: https://skillsafe.ai/skill/@googleworkspace/recipe-triage-security-alerts