Back to Checks
googleworkspace

Gmail potential employee spoofing alert rule is configured

rules_gmail_employee_spoofing_alert_configured
Service: rulesSeverity: medium
OfficialBuilt-inVerified
Categories:loggingemail-security
Resource Type:NotDefined

The Gmail potential employee spoofing system-defined alert rule should be enabled with alerts sent to the alert center, email notifications turned on, recipients set to all super administrators, and severity set to Medium or higher. This ensures administrators are notified when incoming messages have a sender name matching the directory but from an external domain.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

Without this alert enabled, administrators will not be notified of potential employee spoofing via email. Attackers may impersonate internal employees using external email addresses to conduct phishing attacks against the organization.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks rules_gmail_employee_spoofing_alert_configured

Recommendation

Configure the Gmail potential employee spoofing alert rule with alert center ON, email notifications ON, and recipients set to all super administrators.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Select **Rules**
3Under **Google protects you by default** select **View list**
4Scroll to **Gmail potential employee spoofing** and select it
5Within the Actions pane, click the edit pencil
6Select **Send to alert center** to set the alert to ON
7Set the alert severity to **Medium**
8Select **Send email notifications**
9Ensure **All super administrators** is selected as recipients
10Click **Review** to confirm the values
11Click **Update Rule**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.rules.lib.alerts import (
    evaluate_system_defined_alert,
)
from prowler.providers.googleworkspace.services.rules.rules_client import (
    rules_client,
)

RULE_NAME = "Gmail potential employee spoofing"
MINIMUM_SEVERITY = "MEDIUM"


class rules_gmail_employee_spoofing_alert_configured(Check):
    """Check that the Gmail potential employee spoofing system-defined alert rule is fully configured.

    CIS 6.8 requires the rule to be on, to notify by email, to include all
    super administrators as recipients and to be set to MEDIUM severity or higher.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        return evaluate_system_defined_alert(
            rules_client, self.metadata(), RULE_NAME, MINIMUM_SEVERITY
        )

References