# How do you use the Google Workspace alert center for email security?

URL: https://iblockspam.com/blog/google-workspace-alert-center-email
Last updated: 2026-10-22
Published: 2026-10-22
Topic: Running email day to day
Author: iBlockSpam Team

> Which Google Workspace alert center alerts cover email, their default states, how to send them to the right people, the Alert Center API, and what to do next.

## Short answer

The Google Workspace alert center, at Security > Alert center in the Admin console, lists security alerts such as user-reported phishing, phishing or malware detected after delivery, and suspicious logins. Email notifications for each alert are set on its system-defined rule under Rules. Turn on the inactive email rules, set recipients, and work each alert to Closed.

Google Workspace already watches for phishing, malware and account compromise. The alert center is where it tells you. The catch is that several useful email alerts are off by default, and the ones that are on email whoever happens to be configured. This guide lists the email-related alerts, their default states, how to route them, and what to do when one fires.

## What is the Google Workspace alert center?

The Google Workspace alert center is a page in the Admin console that lists security and service alerts for your organization, with a details page for each. Google describes it as the place to "view notifications about potential issues within your domain, and take action" ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/security/about-the-alert-center)).

At the time of writing (October 2026), the key limits Google states are:

- Alerts are retained for "approximately 10 years."
- "A maximum of approximately 300 alerts can be generated per rule in a 24-hour period."
- Enterprise editions can start an investigation from an alert, using the [security investigation tool](https://iblockspam.com/blog/google-workspace-security-investigation-tool).

## Where is the alert center, and who can use it?

Go to **Menu** > **Security** > **Alert center**. You need the **Alert center** administrator privilege ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/security/use-the-alert-center)). From any Admin console page, the bell icon opens the **Alerts** widget.

Rule-based alerts need extra privileges: Google says activity rule alerts need the Activity Rules view and manage privileges, DLP alerts need the DLP rule privileges, and other alert types need the **Reports** privilege.

The list page lets you filter by alert type, date range, status, severity, assignee or user email, and save up to 20 filters. Each alert has a status of **Not started**, **In progress** or **Closed**, an assignee, a comment history and related alerts.

## Which alerts matter for email?

The table lists the email-related system-defined rules and their default states, from Google's [system-defined rules page](https://knowledge.workspace.google.com/admin/reports/view-and-edit-system-defined-rules), as of October 2026.

| Alert | What Google says triggers it | Default state |
|---|---|---|
| [User-reported phishing](https://iblockspam.com/blog/google-workspace-user-reported-phishing-settings) | Users "received messages that they've classified as phishing" | Active |
| Suspicious message reported | Users "received messages that they've classified as spam" | Active |
| Phishing message detected post-delivery | Messages "detected as phishing post-delivery that are automatically reclassified" | Active |
| Malware message detected post-delivery | Messages detected as malware after delivery and reclassified | Active |
| Spike in user-reported spam | "An unusually high volume of messages from a sender that users have marked as spam" | Active |
| Gmail potential employee spoofing | Outside mail using a name from your directory | Active |
| Phishing in inboxes due to bad whitelist | Spam delivered to inboxes because Admin console allowlists override the filters | Active |
| Leaked password | "Compromised credentials requiring a reset of a user's password" | Active |
| Suspicious login | A sign-in "that doesn't match a user's normal behavior" | Active |
| User suspended for spamming | Google suspended an account for activity such as spamming | Active |
| User suspended for spamming through relay | Spam sent through the SMTP relay service | Active |
| Rate limited recipient | "A high rate of incoming email indicating a potential malicious attack or misconfigured setting" | Active |
| Smarthost failure | Many messages can't be delivered to a smart host you configured | Active |
| TLS failure | "Messages requiring Transport Layer Security (TLS) can't be delivered" | **Inactive** |
| Email settings changed | "An admin has changed Google Workspace Gmail settings" | **Inactive** |
| Exchange journaling failure | Journaling to Google Vault from Exchange fails | **Inactive** |

Two details from Google's [alert details page](https://knowledge.workspace.google.com/admin/security/view-alert-details) change how you read these:

- **Post-delivery alerts don't mean the mail is gone.** Unopened messages are removed automatically, but "if a recipient has opened or otherwise interacted with such a message, it will remain in their inbox until manually removed."
- **The employee-spoofing alert goes quiet by design** once you turn on employee-name protection. Google says it "is triggered only if" that protection is disabled. See our guide to [spoofing and authentication protection](https://iblockspam.com/blog/google-workspace-spoofing-authentication-protection).

## How do you send alert emails to the right people?

Alert emails come from **rules**, not from the alert center page. Every system-defined rule has its own actions and recipients ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/reports/view-and-edit-system-defined-rules)).

1. In the Admin console, go to **Menu** > **Rules**. You need the **View Trust Rules** privilege.
2. Click **Add a filter** > **Type**, tick **System defined**, and click **Apply**.
3. Click a rule, such as **User-reported phishing**. The **Rule details** page shows whether email notifications are on and who receives them.
4. Click **Edit Rule** > **Next: View Conditions** > **Next: Add Actions**.
5. Set the severity (**Low**, **Medium** or **High**), keep **send to alert center** on, turn on email notifications and add recipients.
6. Click **Next: Review**, then **Update Rule**.

Repeat for each inactive rule you want, starting with **Email settings changed** and **TLS failure**. Google notes some rule changes "can take up to 24 hours to take effect."

Three limits to plan around:

- When an alert is on, Google sends "an email each time the conditions for that rule are met, up to 25 emails in 2 hours."
- System-defined rules "can only be configured to send email to internal domain users." To reach an outside MSP or ticketing address, send to a Google Group that includes it.
- For the **Google Operations** rule, you can't remove the primary super administrator from the recipients.

A practical routing plan: send phishing and malware alerts to a security group monitored daily, account alerts to whoever handles password resets, and settings-change alerts to all super administrators.

## Can you create your own email alerts?

Yes, with **activity rules**, which watch log events and raise an alert when a condition is met. Go to **Rules** > **Create activity rule**, choose a data source such as **Gmail log events**, add conditions, then choose alert and email actions ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/security/create-and-manage-activity-rules)).

Google's guidelines to know first:

- Rules work only on log event data sources, not live data such as Gmail messages.
- Every rule needs at least one event attribute and at least one action or alert.
- Thresholds, actions in triggers and more than 7 conditions are advanced features. At the time of writing (October 2026), Google lists them for Frontline Plus, Enterprise Standard and Plus, Education Plus, Enterprise Essentials Plus, Cloud Identity Premium and Chrome Enterprise Premium.
- Because they run on logs, activity rules "trigger after the event happens," so they alert rather than block.

## Should you give feedback on alerts?

Yes, when an alert is clearly right or clearly wrong. Google says alerts "are generated based on a machine-learning system," and that feedback on whether an alert was correct or useful "improves the accuracy of the alerts over time." The feedback "is only used to improve signals for your domain, and is not shared outside of your organization," and any admin with full alert center access can give it ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/security/use-the-alert-center)).

Two list-page details help with triage. The **Last updated** column changes when new data arrives, for example when a Gmail alert grows from 10 messages to 20, but not when an admin edits the status, assignee or severity. And **Alert history** records every such edit with the admin's address and time, which gives you an audit trail for free.

## Is there an API or automation option?

Yes. The **Alert Center API** "lets apps you build retrieve alert data and alert feedback," and Google says the current version, v1beta1, "is available to all Google Workspace customers" ([Google for Developers](https://developers.google.com/workspace/admin/alertcenter/guides)). It needs a Google Cloud project, a service account and the `https://www.googleapis.com/auth/apps.alerts` scope.

To list user-reported phishing alerts since a date, the request looks like this (example):

```
GET https://alertcenter.googleapis.com/v1beta1/alerts?filter=type="User reported phishing" AND createTime >= "2026-10-01T00:00:00Z"&orderBy=createTime desc
```

URL-encode the filter in real requests. Google's [alert types reference](https://developers.google.com/workspace/admin/alertcenter/reference/alert-types) maps console names to API names; for example, "Phishing message detected post-delivery" is `Phishing reclassification` in the API, from the source `Gmail phishing`. The API can also publish a Pub/Sub message for each new or changed alert, which suits a SIEM.

## What should you do when an email alert fires?

1. **Assign it and set it to In progress**, so other admins know it's handled.
2. **Read Key Details**: sender, recipients, dates and sample messages.
3. **Find every copy.** On Enterprise editions, click **Investigate alert**. Otherwise, search in [Email Log Search](https://iblockspam.com/blog/google-workspace-email-log-search).
4. **Remove opened copies.** Post-delivery reclassification skips messages users already interacted with.
5. **Check who clicked or replied**, and reset passwords for anyone who entered credentials. Our guide on [what to do after clicking a phishing link](https://iblockspam.com/blog/what-to-do-after-clicking-phishing-link) covers the user side.
6. **Block or tighten.** Block the sender, or fix the allowlist entry behind a "bad whitelist" alert.
7. **Comment and close.** Note what you did in **Alert history**, then set the status to **Closed**.

For a planned response, see our [email security incident response plan](https://iblockspam.com/blog/email-security-incident-response-plan). If an alert points to a takeover, follow [Google Workspace compromised account recovery](https://iblockspam.com/blog/google-workspace-compromised-account-recovery). Microsoft 365 admins can compare our guide to [Microsoft 365 alert policies for email](https://iblockspam.com/blog/microsoft-365-alert-policies-email).

## Next steps

- Open **Rules**, filter on **System defined**, and check the recipients of every email-related rule above.
- Turn on **Email settings changed** and **TLS failure**.
- Route phishing alerts to a group someone reads every working day.
- Reduce how many alerts fire in the first place by checking your domain's setup with the free [Email Health Check](https://iblockspam.com/tools/email-health-check); if you're weighing filtering before Gmail, see our [Google Workspace platform page](https://iblockspam.com/platforms/google-workspace).

See all [email operations guides](https://iblockspam.com/blog/topic/operations).

## Frequently asked questions

### Where is the alert center in the Google Admin console?

Go to Menu > Security > Alert center. You need the Alert center administrator privilege. You can also click the bell icon at the top of any Admin console page to open the Alerts widget, which shows recent alerts with their High, Medium or Low severity and a View all link.

### How long does Google Workspace keep alert center alerts?

Google says alerts are retained in the alert center for approximately 10 years. It also says a maximum of approximately 300 alerts can be generated per rule in a 24-hour period, so a large incident may not produce one alert per event.

### How do I get Google Workspace alert center alerts by email?

Alert emails come from rules, not from the alert center itself. Go to Menu > Rules, filter on Type > System defined, open a rule, click Edit Rule and set email notifications and recipients on the Actions page. Google says system-defined rules can only email internal users; use a Google Group to reach outside addresses.

### Can I get Google Workspace alerts into a SIEM or ticketing system?

Yes. The Alert Center API lets an app list alerts and add feedback, using a service account with the apps.alerts scope. It can also publish a Pub/Sub notification for each new or updated alert. Alternatively, send rule emails to a Google Group that forwards into your ticketing system.

### What is the Phishing in inboxes due to bad whitelist alert?

Google describes it as messages Gmail classified as spam that were delivered to inboxes anyway because of allowlist settings in the Admin console overriding the spam filters. It points to an approved-senders entry or IP allowlist that's too broad. Review the listed setting and keep sender authentication on for address list entries.

## Sources

- [Google Workspace Admin Help: About the alert center](https://knowledge.workspace.google.com/admin/security/about-the-alert-center)
- [Google Workspace Admin Help: Use the alert center](https://knowledge.workspace.google.com/admin/security/use-the-alert-center)
- [Google Workspace Admin Help: View and edit system-defined rules](https://knowledge.workspace.google.com/admin/reports/view-and-edit-system-defined-rules)
- [Google Workspace Admin Help: View alert details](https://knowledge.workspace.google.com/admin/security/view-alert-details)
- [Google Workspace Admin Help: Create and manage activity rules](https://knowledge.workspace.google.com/admin/security/create-and-manage-activity-rules)
- [Google for Developers: Alert Center API alert sources and types](https://developers.google.com/workspace/admin/alertcenter/reference/alert-types)
- [Google for Developers: Alert Center API method alerts.list](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/alerts/list)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/google-workspace-alert-center-email (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt