GAT+ Alarms functionality has a wide variety of scenarios to alert G Suite Super Admins when there are unusual email activities. So you can better assess compromised Gmail accounts across your domain.
Here is a list of characteristics to alert on.
Alert on External email forwarding
Alert on email delegation
Alert on new Gmail filters
Alert on new email Send As
Alert when a user receives more than (24 hours)
Alert when a user sends externally more than (24 hours)