---
title: Alert on Negative Login by Any Google Workspace User
description: "Get alerted a negative login is registered by GAT+ from any user of your Google domain ## How to Set Up Alert Rules [![](https://gatlabs.com/wp-content/uploads/2020/02/screenshot-www.youtube.com-2020.04.10-14_50_53.png)](https://youtu.be/TsIP-Pzl_10) Open GAT+ navigate to** Alert rules** under the **Configuration **tab   ![](https://gatlabs.com/wp-content/uploads/2020/02/screenshot-gs.generalaudittool.com-2020.04.20-13_10_12.png) Click on the **+ **sign and a new window will…"
url: "https://gatlabs.com/knowledge/tech-tips/alert-on-negative-login-by-any-g-suite-user/"
updated: "2023-05-30"
category: DLP (Data Loss Prevention)
tags:
  - GAT+
---

# Alert on Negative Login by Any Google Workspace User

Get alerted a negative login is registered by GAT+ from any user of your Google domain

## How to Set Up Alert Rules

[![](https://gatlabs.com/wp-content/uploads/2020/02/screenshot-www.youtube.com-2020.04.10-14_50_53.png)](https://youtu.be/TsIP-Pzl_10)

Open GAT+ navigate to** Alert rules** under the **Configuration **tab

 

![](https://gatlabs.com/wp-content/uploads/2020/02/screenshot-gs.generalaudittool.com-2020.04.20-13_10_12.png)

Click on the **+ **sign and a new window will be displayed, fill in the details.

![](https://gatlabs.com/knowledge/wp-content/uploads/2021/12/User-negative-login-1024x970.png)

Set up a **Name **for the rule

Set the checkmark to **Enabled**

Set the **Type **to **Users Logins**

Choose the scope who will be affected by this alert rule

- It can be a user, group, or org. unit

Pick and select the **Alert** **Recipient**, this can be a user or group email.

Select **Notify on negative logins,**every time user from the selected **scope**has tried to log in to your domain un-successfully, the alert will be triggered.

When the rule** **is created it can be found in the **Alert rules** under **Configuration**

![](https://gatlabs.com/wp-content/uploads/2020/02/screenshot-gs.generalaudittool.com-2020.02.14-17_37_20.png)

 

It can be viewed (eye icon), edited (pen icon), or deleted from the (x button).