In GAT+, the Google Admin can create an alert rule for files that users delete within a period.
The Admin can configure an alerts that trigger specifically when an individual user within your Google Workspace domain deletes a specified number of files within 24 hours.
This allows for more granular monitoring and quicker responses to potentially risky user behavior. The Alert will be triggered for permanently deleted files.
How to Set Up a File Deletion Alert Rule in GAT+ #
Navigate to GAT+ > Configuration > Alert rules
Click on the + button to create an alert.
Fill in the required information
- Name – Enter a name for the alert
- Enabled – Enable or disable the rule
- Type – Select Drive
- Scope – select the users for whom the rule will be applied
- Alert recipients – (optional) Enter the email of the recipient of the alert notification
- Alert on number of files deleted – enter the number of files that will trigger the alert (files in a 24 hr period)
- The alert will be triggered when the files are permanently deleted from the Trash
- Save – click to save the rule.
Edit the Alert rule #
When the Alert rule is created, it will be saved in the Alert rules, where it can be edited or deleted.
Action for which the alert is triggered #
When files are deleted from Google Drive > Bin / Trash, the alert will be triggered. This means for permanently deleted files.
Note: When files are deleted by users in Google Drive, they are sent to “Bin/Trash” and are automatically deleted after 30 days.
Result of the Alert rule #
The alert rule will be triggered, and the alert notification will be displayed in GAT+ > Alerts
The Admin can view the “User” who triggered the alert, as well as more details under Actions (2).
Data Loss Prevention #
The alert generated by GAT+ allows the domain administrator to take appropriate actions to prevent data loss by restoring deleted files in the Google Admin Console.
As an administrator, you may be able to restore a deleted user’s account and files if you deleted the account less than 20 days ago. When you delete a user, if you don’t transfer files at the time, the user’s files are deleted 20 days later. If you act quickly, you can restore the deleted user and transfer ownership of their files before they’re permanently deleted.
