{"id":263,"date":"2022-01-10T16:01:16","date_gmt":"2022-01-10T16:01:16","guid":{"rendered":"https:\/\/gatlabs.com\/knowledge\/?p=263"},"modified":"2025-07-14T12:25:11","modified_gmt":"2025-07-14T11:25:11","password":"","slug":"how-to-report-and-remove-files-downloaded-by-users","status":"publish","type":"docs","link":"https:\/\/gatlabs.com\/knowledge\/tech-tips\/how-to-report-and-remove-files-downloaded-by-users\/","title":{"rendered":"How to Report and Remove Files Downloaded by Google Workspace Users with GAT Shield"},"content":{"rendered":"\r\n

The GAT Shield<\/a> extension allows admins to track and view user behavior<\/strong> while logged into their Google domain account.<\/p>\r\n

Google Workspace<\/a> Admins can set up real-time alerts based on the behavior of the end-users.<\/p>\r\n\r\n\r\n\r\n

These GAT Shield Alert Rules allow admins to stop and report unsafe downloads by users across their domain.<\/p>\r\n\r\n\r\n\r\n\r\n\r\n

Report and remove downloaded files GAT Shield<\/h2>\r\n

Set up a download rule<\/h3>\r\n

\r\n\r\n<\/p>\r\n

Navigate to\u00a0 GAT<\/strong> Shield \u2192 Alerts \u2192 +New Alert Rule\u00a0<\/strong><\/p>\r\n

Fill in the details for the download alert rule<\/p>\r\n

1. Name & Type<\/h3>\r\n

For each field, various options are displayed for selection.<\/p>\r\n

    \r\n
  • Name<\/strong>: Enter a descriptive name for the alert rule.<\/li>\r\n
  • Type<\/strong>: Select “Download” from the drop-down menu. This option triggers a notification when a user downloads a file. You can customize the alert based on file formats, sizes, and specific web pages it applies to.<\/li>\r\n<\/ul>\r\n

    Action<\/strong><\/p>\r\n

    When an alert rule is triggered, a pre-selected action will be executed on the user’s device. Note that only tabs that trigger the rule will be affected if “Close” or “Redirect” actions are chosen.<\/p>\r\n

      \r\n
    • Show a warning message<\/strong>: Display a warning message to the end-user.<\/li>\r\n
    • Close<\/strong>: Close the Browse tab.<\/li>\r\n
    • Close without warning<\/strong>: Close the Browse tab directly, without any prior notification.<\/li>\r\n
    • Redirect<\/strong>: Redirect the user’s browser tab. You must also enter a warning message to be displayed to the end-user.<\/li>\r\n
    • Redirect without warning<\/strong>: Redirect the user’s Browse tab without displaying a warning message.<\/li>\r\n
    • No action<\/strong>: Select this option if no action should be performed on the end-user’s device.\r\n
        \r\n
      • Default Severity\r\n
          \r\n
        • When an alert rule is triggered, a notification is generated. The severity of this notification indicates its level of importance. “Default Severity” is the value assigned to all notifications created by this specific rule.\r\n
            \r\n
          • Select Low<\/strong>, Unspecified<\/strong> (default), or High<\/strong> to set the notification’s severity level.<\/li>\r\n<\/ul>\r\n<\/li>\r\n<\/ul>\r\n<\/li>\r\n<\/ul>\r\n<\/li>\r\n<\/ul>\r\n

            \"Creating<\/p>\r\n

            \r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n<\/p>\r\n

            2. Scope of the New Alert Rule<\/h3>\r\n

            In the Scope field, select all the users who will be affected by the alert rule<\/p>\r\n

              \r\n
            • Scope<\/strong> – add the users, group of users, or org. unit of users that will be affected by the rule<\/li>\r\n
            • Rule exclusions<\/strong> – select a list of users to be excluded from the rule<\/li>\r\n
            • Time restriction<\/strong> – select the times when the rules will be applied.\r\n
                \r\n
              • By default, when no time restriction is added, the rule will always be active. To change it, select days and time ranges when the rule will be active.<\/li>\r\n<\/ul>\r\n<\/li>\r\n
              • Continue<\/strong> – click to continue to the next configuration\u00a0<\/li>\r\n<\/ul>\r\n

                \"Scope<\/p>\r\n

                3. Configuration of the New Alert Rule<\/h3>\r\n

                In the configuration, fill in the required information<\/p>\r\n

                  \r\n
                • Mode<\/strong> – select what mode to be enabled.\u00a0\r\n
                    \r\n
                  • File extensions and Size<\/li>\r\n
                  • File extensions only\u00a0<\/li>\r\n
                  • Size only\u00a0<\/li>\r\n<\/ul>\r\n<\/li>\r\n
                  • File extensions<\/strong> – enter the file extensions for which the rule will be applied. The alert rule will be triggered if the downloaded file has any of these extensions. If the minimum file size is set you can leave this list empty to trigger on any download.<\/li>\r\n
                  • Minimum File<\/strong> size<\/strong> – Enter a minimum file size to trigger the alert.<\/li>\r\n
                  • Cancel download<\/strong> – Enabling this option cancels the download and removes local files\r\n
                    \r\n
                    \u00a0<\/div>\r\n<\/div>\r\n<\/li>\r\n
                  • Continue<\/strong> – click the button to continue\u00a0<\/li>\r\n<\/ul>\r\n

                    \"Mode<\/p>\r\n

                    4. Notifications of the New Alert Rule<\/h3>\r\n

                    In the notifications,<\/p>\r\n

                      \r\n
                    • Recipients – Select the alert recipients<\/li>\r\n
                    • Notification interval – select the time (in minutes) for which the alert notification will not be sent<\/li>\r\n
                    • Full alert context by saving website and file information, and including them in the notifications<\/li>\r\n
                    • Screen capture – select an option from the list\u00a0\u00a0\r\n
                        \r\n
                      • Do not send<\/li>\r\n
                      • Send in the notification email<\/li>\r\n
                      • Send in the notification email and save to the rule creator’s Drive<\/li>\r\n
                      • Send in the notification email, save to the rule creator’s Drive, and share it with other alert recipients<\/li>\r\n<\/ul>\r\n<\/li>\r\n
                      • Webcam capture – select an option from the list\u00a0\r\n
                          \r\n
                        • Do not send<\/li>\r\n
                        • Send in the notification email<\/li>\r\n
                        • Send in the notification email and save to the rule creator’s Drive<\/li>\r\n
                        • Send in the notification email, save to the rule creator’s Drive, and share it with other alert recipients<\/li>\r\n<\/ul>\r\n<\/li>\r\n
                        • Continue<\/strong> – click the button to continue\u00a0<\/li>\r\n<\/ul>\r\n

                          \"Alert<\/p>\r\n

                          5. Summary of the New Alert Rule<\/h3>\r\n

                          In the Summary, the Admin can view all the details for the rule that has been created<\/p>\r\n

                          Click on the Create<\/strong> button to create the rule<\/p>\r\n

                          \"Summary<\/p>\r\n

                          Result for the end-user<\/h3>\r\n

                          \r\n\r\n<\/p>\r\n

                          The end-user where the rule is applied will receive a notification<\/strong> on their screen, depending on what “End-user” action is selected.<\/p>\r\n

                          \r\n\r\n\r\n\r\n\r\n\r\n<\/p>\r\n

                          The download will be removed, and <\/strong>the user will see this message in the recent download history on their Chrome browser<\/p>\r\n

                          \r\n\r\n<\/p>\r\n

                          <\/figure>\r\n

                          \"\"<\/p>\r\n

                          \r\n\r\n\r\n\r\n<\/p>\r\n

                          Result for the Google Workspace Admin<\/h3>\r\n

                          \r\n\r\n<\/p>\r\n

                          All the results will be displayed in GAT\u00a0 Shield > Alerts > Notifications\u00a0<\/strong><\/p>\r\n

                          Note: The Default time frame is selected for the last 24 hours; this, of course, can be changed and filtered for different times.<\/p>\r\n

                          \"in<\/p>\r\n

                          How-to video:<\/strong><\/p>\r\n