Reports are an amazing tool for identifying trends, and searching logs allows you to trace specific events, but they both depend on you spending time finding relevant information.

G Suite Alerts provide email notifications when certain events take place. As an administrator, you can choose for which events you wish to be notified immediately. 

The alert screen has three columns:

• Alert name: This is a short description of the event.
• Email recipients: Which group will be notified of this event.
• Status: Indicates whether the event is enabled or disabled. To change the status of an event, just click on the toggle slider:

At the moment of writing this, there are 21 different alerts to choose from. Let's explore them so you can choose which ones you need on your domains:

• Drive settings changed: Sends a message when an administrator changes the default Drive settings for this domain.
• TLS failure: This will inform you when messages marked as required to use TLS could not be delivered or received.
• User deleted: Sends a message when an account was deleted from the system.
• User granted Admin privilege: Triggers when some user has been granted administrative privileges.
• Exchange journaling failure: This notifications trigger when Google Vault is having problems connecting to Microsoft Exchange servers.
• Suspended user made active: Sends a notification when a suspended account becomes activated. 
• User's Admin privilege revoked: Sends a notification when an account is changed from administrator to regular.
• Smarthost failure: This will notify you if an usual amount of messages fail to be delivered to one of your smart hosts. You can use the IP in the notification to find more details in the email log.
• Email settings changed: This notifies you when an administrator changes the Gmail defaults for this domain.
• User's password changed: With this alert enabled, administrators will be notified when any account gets a new password within the domain. This can help you keep track of whether users are updating their password.
• User suspended: This notification is sent when an administrator suspends an account.
• Suspicious login activity: With this notification, administrators will be notified when there is suspicious login activity on one of the accounts.
• Calendar settings changed: This will send a notification when an administrator changes the default configuration for Google Calendar on this domain.
• Apps outage alert: If there is a problem with Google servers, this alert will notify the administrators. I recommend enabling this just in case.
• New user added: This alert will send a notification every time an account is created.
• Mobile settings changed: A notification will be sent when an administrator changes the default settings for mobile devices in this domain.
• Device compromise update: This will send you a notification when a device that has access to this domain is compromised or mark it as no longer compromised. You can see more details in the Devices log.
• Suspicious mobile activity: When this alert enabled, administrators will be notified of suspicious activity in any of the devices that have access to the domain.
• Rate limited recipient: This alert gets triggered when there is a suspiciously large amount of inbound emails in the domain, which could be caused by a malicious attack.
• Government-backed attack warning: This is a special kind of notification that the Google team sends you when they suspect that your domain has received government-backed attacks attempting to compromise some account. This warning will include personalized guidance with steps to take to protect the domain.
• Google operations: This is another special alert that you will receive when Google suspects there is a potential security or privacy issue that is affecting G Suite services for your domain.