Ensure secure Google Workspace access with this workflow template that monitors login activity using Reports API and assesses it against predefined allowed regions. It leverages VirusTotal for additional IP address analysis, and in case of regional violations, it automates Slack notifications providing detailed login and verdict information. Ideal for strengthening Identity and Access Management and spotting Suspicious User Activity.
Use Cases
Identity and Access Management , Suspicious User Activity
Workflow Breakdown
Retrieve the Google Login Activity from the Reports API
Loop over each login and compare against the specific allowed regions
Lookup region in VirusTotal and save the result for comparison
If a violation is found, notify the Slack channel and provide the login details and verdict from VirusTotal
Vendors
Slack, Utils, VirusTotal, HTTP, Google Workspace
Workflow Output
On violation, update the Slack Channel