View and change alert status

From the alert details page, you can view and change the status of an alert: Not started, In progress, or Closed. This enables an assignee to keep other administrators informed as they take action on an alert—for example, to view messages related to user-reported phishing, or to investigate users who might be responsible for a phishing attack.  

View alerts according to status

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  SecurityAlert center.
   You’ll see any alerts for your domain. In the Status column, you’ll see the status of each alert.
3. To filter alerts by their status, at the top, click Add a filter and select Status.
4. Check the Not started, In progress, or Closed box then click APPLY. The status label appears at the top.
5. Click the alert you wish to see details for.
6. To see alerts with a different status, at the top, click Status and from the drop-down list, select Not started, In progress, or Closed.
7. To see all alerts, at the top, click Alert Center. You’ll see the full list of alerts regardless of status.

Understand the alert details page

• When you click on an alert, in the sidebar on the left, you can view details about the alert, assign an administrator in your domain to the alert, change the status of the alert, and more. Some administrators can click New Investigation to start an investigation. Learn more
• In the Key Details section, depending on the alert, you see the summary of the alert, the date it occurred, the actor (or user affected), and more details such as the messages, dates, and recipients for an email alert, for example.
• You also see related alerts and the alert history details.

Assign a status to an alert

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  SecurityAlert center.
   You see a dashboard with a list of alerts.
3. To assign status, click the alert.
4. From the Status drop-down list, select the status (Not started, In progress, or Closed).