Chrome ‘Device Usage’ Alerts in GAT Shield

Do you want to track down a missing device? Do you know the serial number? Or know the last person using it? If yes, you can use GAT Shield Device Usage alert to get notified.

How to Configure this Alert.

1.Launch the GAT Shield tool.

2.Enter the Alert Rules section.

3.Select Device Usage from the ‘Add a rule’ drop-down menu.

4.Give the rule a meaningful name. Check the box to activate the rule. Now, enter the user’s email address and/or serial number. If both are entered one of them will take precedence if detected first when the rule is triggered on the device.

5.Check the box Report Screen Capture to take a screenshot of the page they were browsing at the time the rule is fired.

6.Optionally you can take a webcam picture of the person behind the device.

7.There is an option to display a message to the user if you turn ON End user action.

Once the alert is triggered an email is sent to the G Suite Super Admin.

When GAT  Shield receives a signal that the device is active, the admin will receive an email with a screenshot of the page opened, and location on a map where the device is located.
The Device Usage rule will be switched to disabled once the rule is fired to prevent getting multiple alerts for the same user or device.

Alert of Disabled 2 Factor Authentication

Go to the Alarm area in GAT+.

select 'alarms'

You can enable the option ‘Alert on 2FA disabled’. This alarm is fired whenever a user or an Admin disables an account’s 2FA mechanism when it had been working. For organizations that depend on high levels of security, this is a vital alarm to alert Admins to dangers.

see alarm details and edit them as needed.

You can also get alerted when 2FA codes are used by users.

Alerting to Changes in a Selected Google Drive Folder (Old UI)

The Google Drive may contain a shared folder or folder tree which occasionally has new files added or existing files changed. Using GAT it is possible for an Admin to set up a daily job which will report on the new or changed files to a list of recipients.

In the Drive Audit are of GAT, first find all files changed since yesterday.

Clear the search and next find the folder you want to monitor

And expand the folder tree by clicking on +> after the folder name. (-> expands one level, +> expands all levels.

Now select the Drive Audit tab labeled ‘Recent Filters’ and combine the last two searches with the ‘AND’ operator and click ‘Show’.

This shows all the files in the folder tree that changed since yesterday. It may or may not have results. The important thing is the combined search string.

Next click on ‘Schedule/Save’, this will take you through to the scheduler.

Here you can set the job up to run every day after midnight, have the report listing the changed files in PDF format (or CSV, the CSV will have a list of the changed document URLs).  

You can add a list of internal and external recipients who will get the report. GAT will automatically move the date forward by a day each time it runs the scan, in this way only what is changed in the last 24 hours will be reported. 

Related Resources:

Some powerful things you can do from the Drive Audit list

How to Report and Remove Files Downloaded by Users Using GAT Shield

Devices Missing? Or You Just Need to be Told When Someone is On-Line?

GAT Shield has now added a ‘Device Usage’ alert.
An Admin configures the rule with either the device serial number, or the last known user, or both. If GAT+ detects either of these flags, the Admin will immediately receive an email with the device location and a link to a map showing the location and optionally a screen grab and/or a camera shot of who is behind the screen. Optional messages can also be sent to the device.
Once configured this Alert rule is active, once triggered and the alert sent to the Admin the rule is marked ‘Not active’.