Google Workspace Alerts

Google Workspace Alert Center surfaces security alerts across your Google Workspace domain — phishing detections, data loss prevention (DLP) violations, device compromises, state-sponsored attack warnings, suspicious logins, and more. RunReveal polls the Alert Center API every 60 seconds and ingests each alert as an event.

Follow up on alerts: Alert Center is easy to miss if you are not already watching it in Admin. Use Investigations and/or detections so these events get reviewed or notified—not only stored in Explore.

Connecting Google Workspace Alerts requires a Google Workspace administrator who can:

Create a GCP service account and enable the Alert Center API
Perform domain-wide delegation in the Google Admin Console

Setup

Set up a Google Cloud project and service account

Go to the Google Cloud Console.
Create a new project or select an existing one.
Navigate to APIs & Services > Dashboard.
Click + ENABLE APIS AND SERVICES, search for Google Workspace Alert Center API, and enable it.
Go to Credentials > + CREATE CREDENTIALS > Service account.
Give the service account a descriptive name (e.g. runreveal-alerts) and click Create and Continue.
Open the service account details and copy its Client ID (numeric). You need this for domain-wide delegation.

Grant domain-wide delegation in Google Admin Console

Domain-wide delegation is required for both authentication methods below. Workload Identity Federation does not replace this step.

Go to the Google Admin Console.
Navigate to Security > Access and data control > API controls.
Under Domain wide delegation, click Manage Domain Wide Delegation.
Click Add new and enter the Client ID of your service account.
In the OAuth Scopes field, enter:
https://www.googleapis.com/auth/apps.alerts
Click Authorize.

Authenticate RunReveal to the service account

RunReveal can authenticate as your service account with either a JSON service account key or Workload Identity Federation with AWS (no long-lived private key stored in RunReveal).

The WIF pool setup matches Google Workspace Audit Logs and GCS. You can reuse an existing pool—grant access to this Alert Center service account and download a config for it.

Service account keys

Open the service account in GCP → Keys → Add Key → Create new key → JSON.
Download the key file. You will paste or upload it in RunReveal (type will be service_account).

Add the Google Workspace Alerts source to RunReveal

In the RunReveal dashboard, select Google Workspace Alerts on the sources page.

Give your source a descriptive name.
Set Subject to a Google Workspace administrator email in your domain (the account the service account impersonates). This is required for both auth methods.
Choose a GCP Auth Method:

Service account key

Select Service account key, then paste the service account JSON into Credential or upload the file.

Workload Identity Federation with AWS

Select Workload Identity Federation with AWS, then:

Role based auth — paste your IAM role ARN, or leave blank to use the RunReveal-provided role.
External ID — must match the sts:ExternalId condition on your role trust policy (if you set one).
Identity Provider Config — paste or upload the WIF client config downloaded from GCP (type: external_account), not a service account private key.

Click Verify Settings and Connect to save your new source.

Troubleshooting

Symptom	What to check
Auth / token errors on verify or poll	Credential JSON type matches the auth method (`service_account` vs `external_account`); Subject is a Workspace admin
`unauthorized_client` / insufficient scopes	Domain-wide delegation Client ID matches the service account; scope is exactly `https://www.googleapis.com/auth/apps.alerts`
WIF assume-role failures	External ID matches AWS trust; attribute value uses assumed-role ARN form, not the bare `arn:aws:iam::…:role/…` ARN
Alert Center API not enabled	Enable Google Workspace Alert Center API on the GCP project that owns the service account

Verify It's Working

Once added, alerts should begin flowing within a minute. You can validate that RunReveal is receiving your alerts by running the following SQL query in Log Explorer:

SELECT * FROM runreveal.logs WHERE sourceType = 'google-workspace-alerts' LIMIT 10

Alert Types

The Alert Center reports alerts from a variety of sources, including:

Source	Example Alert Types
Gmail phishing	Suspicious email reported by user, Government-backed attack warning
Data Loss Prevention	DLP rule violation
Mobile device management	Device compromised, Suspicious device activity
Google identity	Suspicious login, Account suspended
Google Operations	Service notification
State-sponsored attack	Government-backed attack warning

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.

Table: google_workspace_alerts_logs (47 columns)

Column	Type
`workspaceID`	String
`sourceID`	String
`sourceType`	String
`sourceTTL`	UInt32
`receivedAt`	DateTime
`id`	String
`eventTime`	DateTime
`eventName`	String
`eventID`	String
`srcIP`	String
`srcASCountryCode`	String
`srcASNumber`	UInt32
`srcASOrganization`	String
`srcCity`	String
`srcConnectionType`	String
`srcISP`	String
`srcLatitude`	Float64
`srcLongitude`	Float64
`srcUserType`	String
`dstIP`	String
`dstASCountryCode`	String
`dstASNumber`	UInt32
`dstASOrganization`	String
`dstCity`	String

Column	Type
`dstConnectionType`	String
`dstISP`	String
`dstLatitude`	Float64
`dstLongitude`	Float64
`dstUserType`	String
`actor`	Map(String, String)
`tags`	Map(String, String)
`resources`	Array(String)
`serviceName`	String
`enrichments`	Array(Tuple(data Map(String, String), name String, provider String, type String, value String))
`readOnly`	Bool
`rawLog`	String
`alertId`	String
`customerId`	String
`alertType`	String
`alertSource`	String
`severity`	String
`createTime`	String
`startTime`	String
`endTime`	String
`updateTime`	String
`deleted`	String
`data`	String

On this page