Google Workspace Alerts

Google Workspace Alert Center surfaces security alerts across your Google Workspace domain — phishing detections, data loss prevention (DLP) violations, device compromises, state-sponsored attack warnings, suspicious logins, and more. RunReveal polls the Alert Center API every 60 seconds and ingests each alert as an event.

Connecting Google Workspace Alerts requires a Google Workspace administrator who can:

Create a GCP service account and enable the Alert Center API
Perform domain-wide delegation in the Google Admin Console

Set Up a Google Cloud Project and Enable the Alert Center API

Go to the Google Cloud Console.
Create a new project or select an existing one.
Navigate to APIs & Services > Dashboard.
Click + ENABLE APIS AND SERVICES, search for Google Workspace Alert Center API, and enable it.
Go to Credentials > + CREATE CREDENTIALS > Service account.
Give the service account a descriptive name (e.g. runreveal-alerts) and click Create and Continue.
Click on the service account, go to Keys > Add Key > Create new key > JSON. Download the JSON file — this is your credential file.

Grant Domain-Wide Delegation in Google Admin Console

Go to the Google Admin Console.
Navigate to Security > Access and data control > API controls.
Under Domain wide delegation, click Manage Domain Wide Delegation.
Click Add new and enter the Client ID of your service account (found in the service account’s details page in the GCP Console).

In the OAuth Scopes field, enter:

https://www.googleapis.com/auth/apps.alerts

Click Authorize.

Add the Google Workspace Alerts Source to RunReveal

In the RunReveal dashboard, select Google Workspace Alerts on the sources page.

Give your source a descriptive name.
Set the Subject field to the email address of a Google Workspace administrator in your domain. This is the account the service account will impersonate when calling the API.
Either use the file picker to select your credential.json file, or paste its contents into the Credential text area.

Click Verify Settings and Connect to save your new source.

Verify It’s Working

Once added, alerts should begin flowing within a minute. You can validate that RunReveal is receiving your alerts by running the following SQL query in Log Explorer:

SELECT * FROM runreveal.logs WHERE sourceType = 'google-workspace-alerts' LIMIT 10

Alert Types

The Alert Center reports alerts from a variety of sources, including:

Source	Example Alert Types
Gmail phishing	Suspicious email reported by user, Government-backed attack warning
Data Loss Prevention	DLP rule violation
Mobile device management	Device compromised, Suspicious device activity
Google identity	Suspicious login, Account suspended
Google Operations	Service notification
State-sponsored attack	Government-backed attack warning

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.

Table: google_workspace_alerts_logs (47 columns)

Column	Type
`workspaceID`	String
`sourceID`	String
`sourceType`	String
`sourceTTL`	UInt32
`receivedAt`	DateTime
`id`	String
`eventTime`	DateTime
`eventName`	String
`eventID`	String
`srcIP`	String
`srcASCountryCode`	String
`srcASNumber`	UInt32
`srcASOrganization`	String
`srcCity`	String
`srcConnectionType`	String
`srcISP`	String
`srcLatitude`	Float64
`srcLongitude`	Float64
`srcUserType`	String
`dstIP`	String
`dstASCountryCode`	String
`dstASNumber`	UInt32
`dstASOrganization`	String
`dstCity`	String

Column	Type
`dstConnectionType`	String
`dstISP`	String
`dstLatitude`	Float64
`dstLongitude`	Float64
`dstUserType`	String
`actor`	Map(String, String)
`tags`	Map(String, String)
`resources`	Array(String)
`serviceName`	String
`enrichments`	Array(Tuple(data Map(String, String), name String, provider String, type String, value String))
`readOnly`	Bool
`rawLog`	String
`alertId`	String
`customerId`	String
`alertType`	String
`alertSource`	String
`severity`	String
`createTime`	String
`startTime`	String
`endTime`	String
`updateTime`	String
`deleted`	String
`data`	String

Zendesk Forwarders