3 Government-backed attack alert routing

Caveats

• Google deliberately discloses no detection detail¹
• Never respond to the targeted user by email²

Setup steps

1. open ↗

   

   https://admin.google.com/ac/ax · captured 2026-07-15

   Rules ↗

   Filter the rules list to system-defined rules and open 'Government-backed attacks'.

   Type

   System-defined

   View and edit system-defined rules ↗

2. Rules › Government-backed attacks ↗

   Confirm the rule is active and raised to the alert center, and set severity so it is not buried.

   Status

   Active

   Alert center

   On

   Severity

   High

3. Rules › Government-backed attacks › Actions

   Route the email notification to the monitored security address and to a named human who can call the affected user out-of-band. Recipients must be users in an internal domain; to reach an external address, use a Google Group.

   Email notifications

   On

   Recipients

   security-alerts@<domain> + named responder (internal-domain addresses only)

   View and edit system-defined rules ↗

4. open ↗

   

   https://admin.google.com/ac/ac · captured 2026-07-15

   Security › Alert center ↗

   Record the response playbook/SOP in a document: the alert names the targeted user, so the response is a password reset and enforced 2-Step Verification, plus Advanced Protection Program enrolment (№21), coordinated through an out-of-band call rather than email (since that channel may be compromised).

   Playbook link attached to the alert workflow

   View alert details ↗ Enable user enrollment in the Advanced Protection Program ↗

Ongoing maintenance

• requires a human Quarterly: confirm the named responder is still current staff and the playbook link resolves.

How to verify

1. Open the system-defined rule "Government-backed attacks" and confirm Status = Active, alert center delivery On, and the recipient set is the monitored address plus a named responder.