GAT+ Alarms functionality has a wide variety of scenarios to alert G Suite Super Admins when there are unusual email activities. So you can better assess compromised Gmail accounts across your domain.
Here is a list of characteristics to alert on.
- Alert on External email forwarding
- Alert on email delegation
- Alert on new Gmail filters
- Alert on new email Send As
- Alert when a user receives more than (24 hours)
- Alert when a user sends emails externally more than (number of emails) in (24 hours)
Once you select all the section to be added to Alarm, select Save and you will be alarmed according to the rules you set