[MUSIC PLAYING]
DARSHAN PATEL: Welcome to the Google Cloud Security showcase,
a special web series where we'll focus on security use cases
that customers can solve with G Suite.
My name is Darshan, and I'm one of the product
managers at Google Cloud.
Today, we'll be walking through one of the top questions we
get from customers.
Can I set up rules for automating alerts and taking
repetitive actions?
Let's take a look at the demo.
So let's first take a look at where the alerts are delivered.
All the essential alerts are delivered to a single pane
called the Alert Center.
And to get to this, you navigate to it from the Admin Home Page,
click on the upper left-hand navigation,
select Security and Alert Center.
And here, you'll see a variety of different alerts
that Google automatically runs and detects
and gives you notifications on.
Most of these fall into three key categories.
One is around Gmail safety.
So we're looking for phishing, malware, and spam messages.
We do things such as give you notifications
around user-reported spam and phishing
as well as post-delivery reclassification messages.
We also have several alerts looking at account security
to help you know when accounts have been suspended
for suspicious activity as well as mobile device management
suspicious activity alerts.
Another one is the leaked password,
where we look to see if your user credentials have been
posted publicly on any site.
So now let's dig into one of these examples,
and we're going to open up the phishing message detected
post delivery.
Here, you can see several different pieces of detail.
One is saying that Google detected and reclassified
one message.
And if it was unopened, we moved it automatically
to the recipients, out of the recipient's Inbox.
If the user has interacted with it,
it will remain in their Inbox.
And this notification will help you know to go and remove that
manually.
There's other information here, such as related alerts
lower on, where you can see more details on why that alert might
have occurred and also if there was
anything that happened afterwards
such as data exfiltration.
Now let's think about how do we create our own custom rule
and set up our own repetitive action remediation steps.
So we're going to go to the Activity Rules section.
So click on the Navigation again.
Under Security, select Activity Rules.
And we're going to select something
similar to this alert with more actions taken.
So now we're going to go into the upper right-hand corner,
click Add New Rule.
We're going to give it a rule name.
So let's say this is late spam reclassification.
Rule.
OK.
And now we're going to click on Next.
And here, you can select your data source.
So for rules, you have several different data sources
you can pick from.
Device Logs, Drive, Gmail, and User.
In this case, let's go to Gmail Log Events.
And you can select an event.
And again, there are several choices
of different type of events you can monitor
to create your custom rule.
And for each data source, they will also
have different events there.
So in this case, we want to do late spam classification.
And this is where Google detects that a message was spam,
phishing, or malware after it was delivered
and reclassifies it.
So we want to create a rule for this,
and we're going to hit Add Action now.
And first, you're going to get a great little preview
about the type of results you should expect.
And this will help you determine whether you've
set up the right rule or not.
Here, we see that there will be some instances
over the past month.
And there was a spike that was under 40.
This looks like a pretty good rule that's
not going to be too noisy.
So now we'll scroll down and look at the threshold.
And here, it's going to trigger every 24 hours when
the count is greater than 0.
That looks perfect.
Now let's go ahead and see what action options we have.
So I'm going to click on Add Action and select Action.
So here, we have several Gmail-specific actions
we can take.
And in this case, let's automatically
move these to the quarantine state
when these messages are reclassified
and make it so the users are less likely to interact
with them again.
We can also turn on an alert that
will get delivered in the Alert Center, as we saw earlier.
And we can determine the severity of this.
So these look like these will be pretty important.
So let's pick High.
And we can pick the admins that we
want to receive these email notifications associated
with the alerts.
Let's go ahead and select All Super Admins.
And now, we'll hit Next to review the rule.
And we can see all the details we just selected.
Everything looks great.
And now let's create the rule.
So within a few easy steps, we have
gone through the process of creating a custom rule
and adding automatic actions to make it easier
to remediate and create the notification for us
to be aware of it, both in the Alert Center
and through the email.
Thank you for tuning in.
Please visit cloud.google.com/security
for more content from Google Cloud experts.
[MUSIC PLAYING]