Google Workspace Login Flagged Suspicious

Last updated 11 days ago on 2026-05-14

Created 11 days ago on 2026-05-14

About

Surfaces Google Workspace sign-in events that Google's identity risk engine has flagged as suspicious via the `is_suspicious` field on the `login` activity record. This is Google's own ML-driven sign-in risk signal. The field is set by Google server-side based on signals like sign-ins from anonymizer infrastructure, known-malicious IP ranges, atypical user characteristics, or anomalous device fingerprints. Use this signal as enrichment alongside the other Workspace sign-in rules rather than as a standalone alert. This rule is a building block. It does not generate user-facing alerts by default but populates `signal.rule.building_block_type` for correlation rules or analyst pivots.

Tags

Domain: CloudDomain: IdentityData Source: Google WorkspaceData Source: Google Workspace Audit LogsData Source: Google Workspace User Log EventsUse Case: Threat DetectionUse Case: Identity and Access AuditTactic: Initial AccessTactic: Credential AccessRule Type: BBRLanguage: kuery

Severity

low

Risk Score

MITRE ATT&CK™

Initial Access (TA0001)(external, opens in a new tab or window)

↳ Valid Accounts (T1078)(external, opens in a new tab or window)

Credential Access (TA0006)(external, opens in a new tab or window)

↳ Steal Application Access Token (T1528)(external, opens in a new tab or window)

↳ Adversary-in-the-Middle (T1557)(external, opens in a new tab or window)

False Positive Examples

Google's risk engine occasionally flags legitimate sign-ins as suspicious when the user is on a new device, on a VPN egress that geo-resolves to a different region, or after extended time away. Validate by checking the user's recent sign-in history and confirming with the user.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: Query (Kibana Query Language)
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: filebeat-*logs-google_workspace.login*
Related Integrations: google_workspace(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗data_stream.dataset: "google_workspace.login" and
    event.provider: "login" and
    google_workspace.login.is_suspicious: true

Install detection rules in Elastic Security

Detect Google Workspace Login Flagged Suspicious in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).