View and edit system-defined rules

• Apps outage alert—New, updated, or resolved outage on the Status Dashboard (Google Workspace only)
• Gmail potential employee spoofing—Incoming messages were received where a sender’s name is in your Google Workspace directory, but the mail is not from your company’s domains or domain aliases.
• Leaked password—Google detected compromised credentials requiring a reset of a user's password.
• Suspicious message reported—Users at your domain received messages that they've classified as spam.
• Suspicious programmatic login—Google detected suspicious login attempts from applications or computer programs.
• Suspicious login—Google detected a sign-in attempt that doesn't match a user's normal behavior, such as a sign-in from an unusual location.
• User’s password changed—An admin changed a user's password.
• New user added—A new user was added to the domain.
• User deleted—A user was deleted from the domain.
• User suspended (by admin)—An admin suspended a user.
• User suspended (Google identity alert)—Google detected suspicious activity and suspended the account.
• User suspended due to suspicious activity—Google suspended a user's account due to a potential compromise detected.
• User suspended for spamming—Google detected suspicious activity such as spamming and suspended the account.
• User suspended for spamming through relay—Google detected suspicious activity such as spamming through an SMTP relay service and suspended the account.
• User granted Admin privilege—A user was granted an admin privilege.
• User's Admin privilege revoked—A user's admin privilege was revoked.
• Suspended user made active—An admin restored a suspended user.
• User-reported phishing—Users at your domain received messages that they've classified as phishing.
• Approaching Gemini usage limit–User is approaching a Gemini for Workspace usage limit.

• Device compromised—Provides details about devices in your domain that have entered a compromised state.
• Suspicious device activity—Provides details if device properties such as device ID, serial number, type of device, or device manufacturer are updated.

• Exchange journaling failure—Failures with Exchange journaling, which ensures email traffic generated by Microsoft Exchange server users is properly archived in Google Vault.
• Malware message detected post-delivery—Messages detected as malware post-delivery that were automatically reclassified.
• Phishing in inboxes due to bad whitelist—Messages classified as spam by Gmail filters delivered to user inboxes due to whitelisting settings in the Google Admin console that override the spam filters.
• Phishing message detected post-delivery—Messages detected as phishing post-delivery that are automatically reclassified.
• Rate limited recipient—A high rate of incoming email indicating a potential malicious attack or misconfigured setting.
• Smarthost failure—If you set up a smart host for incoming or outgoing mail, this alert informs you if a large number of messages can’t be delivered to one of your smart host servers.
• Spike in user-reported spam—An unusually high volume of messages from a sender that users have marked as spam.
• TLS failure—Messages requiring Transport Layer Security (TLS) can't be delivered.

• Calendar settings changed (Google Workspace only)—An admin has changed Google Workspace Calendar settings.
• Domain data export initiated—A super administrator for your Google account has started exporting data from your domain.
• Drive settings changed (Google Workspace only)—An admin has changed Google Workspace Drive settings.
• Email settings changed (Google Workspace only)—An admin has changed Google Workspace Gmail settings.
• Mobile settings changed—An admin has changed mobile management settings.

• Access Approvals—A Google staff member has requested access to your organization's Google Workspace data.
• Google mandatory service announcement—Email communication to primary admins that's necessary for the continued use of a product or service, or that's considered a necessary legal update.
• Google Operations—Provides details about security and privacy issues that affect your Google Workspace services.
• Government-backed attacks—Warnings about potential government-backed attacks.

Note: When editing the Google Operations rule, you cannot remove the primary super administrator from the recipient list for email notifications.

_{Google, Google Workspace, and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.}