---
name: google-workspace-security-triage
description: Review Google Workspace Admin Reports for daily security triage. Use when analyzing Drive sharing, external downloads, risky logins, OAuth/token activity, admin lifecycle changes, or when turning recurring Google Workspace issues into reusable detection rules and benign exceptions.
---

# Google Workspace Security Triage

## Goal

Use this skill for repeatable daily review of Google Workspace audit activity with emphasis on:

- Drive exposure and external access
- Login risk and session anomalies
- OAuth/token governance
- Admin privilege and lifecycle changes

This skill is optimized for short, high-signal daily triage, not full incident response.

## Workflow

1. Confirm scope before analysis.
   Use the export window, feed coverage, and any feed-specific truncation notes.
2. Start with the highest-signal feeds.
   Read `drive`, `login`, `token`, `admin`, and `user_accounts` first.
3. Look for the current highest-value patterns.
   Use `references/rule-catalog.yaml` and `references/feed-map.md`.
4. Separate likely benign business activity from true escalation candidates.
   Check `references/known-benign-patterns.md` before escalating.
5. Write a short operator-ready report.
   Use `references/report-template.md` and include explicit follow-up actions.
6. When a new issue appears, improve the skill.
   Add a detection rule, a benign exception, or a playbook note rather than repeating the analysis ad hoc next time.

## Script Entry Points

- `scripts/daily_summary.py --input-dir <export_dir>`
- `scripts/drive_review.py --input <drive.ndjson>`
- `scripts/auth_review.py --input <login.ndjson> [--user-accounts <user_accounts.ndjson>]`
- `scripts/token_review.py --input <token.ndjson>`

Run the narrow script first when the user asks for one area only. Run `daily_summary.py` when the request is broad.

## Review Order

### Drive

- External downloads, especially bursts and many distinct files
- `change_user_access` to external identities
- `request_access` from external identities
- `change_document_visibility` and `change_document_access_scope`
- `change_owner` into shared drives while already externally visible

### Authentication

- `risky_sensitive_action_allowed`
- `risky_sensitive_action_blocked`
- Concentrated `login_failure`
- Password edits or 2SV events near risky login activity

### OAuth

- High-volume authorizations
- Unsanctioned AI, developer, or automation tools
- New client IDs or app names
- Broad scope sets, especially Drive, Gmail, Admin, and identity scopes

### Admin

- Role assignment
- User create, archive, suspend, delete
- Password reset or sign-in cookie reset
- Group and rule changes that alter access posture

## Improvement Loop

Every new issue should be captured in one of these places:

- New detection logic: `references/rule-catalog.yaml`
- Expected noisy behavior: `references/known-benign-patterns.md`
- Better analyst steps: this file or `references/remediation-playbooks.md`

For each new rule, add:

- What feed it uses
- Exact trigger logic
- Why it matters
- What benign cases to check first
- What escalation looks like

## Resources

- `references/feed-map.md`: feed-by-feed meaning and review priorities
- `references/rule-catalog.yaml`: reusable daily detections
- `references/known-benign-patterns.md`: false-positive suppressors
- `references/report-template.md`: output shape
- `references/remediation-playbooks.md`: response guidance