Google Drive files that Contain Email Addresses

Introduction #

Using GAT+ Alert rules, an Admin can get notified if Google Drive documents when shared outside of your domain, contain text with email addresses.

This is one example of using the regex feature inside of Alert Rules.

Create the alert #

Navigate to GAT+ → Configuration →Alert rules → + button

A new pop-up window will be displayed.

• Name – enter the name for the rule.
• Enabled – use the checkmark to enable or disable the alert.
• Type – select the type of alert to Drive.
• Scope – select the scope of users where the rule will be active for.
• Recipient – enter the email of the recipient, this can be a user or group email or leave as blank, all alerts generated will be shown under Alerts tab by default.

Set regex #

• Alert if the regex matches a newly shared out file (doc, presentation, pdf, txt files)
  • Click on the “Custom” option
    • Enter a name for the custom alert
  • An empty field will be displayed
    • Enter the REGEX needed

The Regex example below: You can set regex example for any words 

(\W|)(@gmail.com)|(@yahoo.com)|(@outlook.com).*?(\W$)

Additional options #

There are two options that can be selected.

• Notify user – Send notification to the end-users who did the sharing
• Remove shares – Use to remove the shares automatically, once the alert is triggered

Click on the “Save” button to save the rule

The rule will be saved and later can be viewed, edited, or removed from the options under Actions. 

When a google document is shared out and if it contains an email address (based on the regex) in its content an alert will be triggered.

Note: there extra contributors (external users) and Sharing Flag is Shared Out 

Result #

The alert will be shown under GAT+ → Audit & Management → Alerts 

On the alert itself click on the “eye” icon under Actions. Pop-up will be displayed with additional details.

If the additional options are selected.

• The users will be notified
• The Shared will be removed – automatically once the Alert is triggered

Note: the “shares” (contributors) and the Sharing Flag – Shred out – have been removed