Google Workspace Risky Sensitive Action Allowed
This rule detects instances where Google Workspace flags a sensitive action as risky (such as sign-ins from suspicious locations, unusual devices, or known-bad IPs), yet the action is allowed to proceed. This indicates a potential bypass of security controls or an account compromise where an adversary is utilizing a valid account despite triggered risk indicators.
Cortex XDR
