View and change alert assignees

From the alert details page, you have the option to assign an alert to an administrator. Each alert can have just one assignee, and the assignee must have alert center access.

Assignees can follow up to take action on an alert—for example, to view messages related to user-reported phishing, or to investigate users who might be responsible for a phishing attack. Assignees can also change the alert status (Not started, In progress, or Closed) or change the alert severity (High, Medium, or Low) to keep other administrators informed about the alert.

View alerts according to assignee

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  SecurityAlert center.
   You’ll see any alerts for your domain. In the Assignee column, you’ll see assignees for alerts in which an assignee has been selected.
3. To filter alerts by assignee, at the top, click Add a filter and select Assignee.
4. Type the username for an administrator, and click APPLY.
5. To see all alerts, at the top, click Alert Center. You’ll see the full list of alerts regardless of assignee.

Understand the alert details page

1. When you click on an alert, in the sidebar on the left, you can view details about the alert, assign an administrator in your domain to the alert, change the status of the alert, and more. Some administrators can click New Investigation to start an investigation. Learn more
2. In the Key Details section, depending on the alert, you see the summary of the alert, the date it occurred, the actor (or user affected), and more details such as the messages, dates, and recipients for an email alert, for example.
3. You also see related alerts and the alert history details.

Choose an assignee for an alert

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  SecurityAlert center.
   You see a dashboard with a list of alerts.
3. To choose an assignee for an alert, click the alert.
4. In the left column, type the username of an administrator, and click APPLY.