Skip to main content

Google Workspace accessed by Google

ID:google_workspace_accessed_by_google
Data type:Google Workspace
Severity:
Low
MITRE ATT&CK:TA0001:T1199

Description​

AlphaSOC detected an audit event in which the applicationName is access_transparency. This indicates that Google accessed the organization's Google Workspace.

Impact​

Access by Google personnel may expose sensitive user data to external human reviewers or systems. While often legitimate, unexpected or unexplained access can indicate law‑enforcement requests or misconfigured support workflows that increase data exposure risk.

Severity​

SeverityCondition
Low
Google Workspace accessed by Google

Investigation and Remediation​

Query Google Workspace audit logs for the relevant Access Transparency entries and correlate with support tickets, admin change requests, or legal notices. If the access is unexpected, confirm the access reason with Google support and review the affected accounts and resources.