61 Audit-the-auditors alerting

Caveats

• A rule that notifies the auditors about the auditors is theatre¹
• A Vault admin with rule-edit privilege can disable the rule that watches them²
• Basic activity rules are available in all editions, but Vault log events need a Vault add-on…³

Setup steps

1. open ↗

   

   https://admin.google.com/ac/sc/investigation · captured 2026-07-15

   Reporting › Audit and investigation ↗

   Open Audit and investigation and pick the data source that records auditor behaviour: Vault log events (exports, holds, searches), Admin log events (privilege grants), Gmail log events (delegate activity, via the Delegate attribute).

   Data source

   Vault log events

   Vault log events ↗

2. open ↗

   

   https://admin.google.com/ac/ax · captured 2026-07-15

   Rules › Create rule › Activity ↗

   Create an activity rule on Vault log events for search/export/hold-change actions — the people who can read everything must be the most-watched.

   Condition: Vault event in {search, export, hold created/deleted}; Severity = High

   Create and manage activity rules ↗

3. Rules › Create rule › Activity ↗

   Add rules for the other two auditor behaviours: investigation-tool use in Admin log events, and delegate activity in Gmail log events — filter on the Delegate / Has delegate attributes to catch actions performed through a delegated mailbox.

   Rule: Admin log events, investigation-tool query; Rule: Gmail log events, Has delegate = true; Severity = High

   Admin log events ↗ Gmail log events ↗

4. Route both rules to a recipient who is NOT an auditor/Vault admin — self-notification is not oversight.

   Recipients

   oversight alias outside the Vault admin group

5. open ↗

   

   https://admin.google.com/ac/ac · captured 2026-07-15

   Security › Alert center ↗

   Trigger one benign Vault search and confirm the alert lands in the alert center and in the oversight mailbox.

   About the alert center ↗

Ongoing maintenance

• requires a human Weekly: review auditor-activity alerts — the point is that someone other than the auditor reads them.

How to verify

1. Perform a benign privileged audit action (e.g. an investigation-tool search) and confirm the corresponding alert fires to the second-person channel.