Your organization has just appointed a new CISO. They have signed up to receive admin alerts and just received an alert for a suspicious login…

Access the Admin Console:

In the Google Workspace Admin console, navigate to "Reports" > "Audit" > "Login".

Generate a Login Audit Report:

Customize the report to include details about suspicious login attempts.

Set the time frame to the past year and filter the results to show only suspicious logins.

Export the Report:

Export the login audit report in a suitable format (e.g., CSV) for further analysis.

Ensure the report includes user account details and the number of suspicious login attempts for each

account.

Analyze the Data:

Review the exported data to identify patterns and determine how frequently suspicious login

attempts occur within the organization.

Provide the analysis to the CISO with the required details for each user account.

Reference

Google Workspace Admin Help: View and analyze login audit logs