> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/asset-monitoring-and-isolation/google-drive-playbooks-for-asset-monitoring-and-isolation.md).
# Google Drive playbooks for asset monitoring and isolation
To mitigate the risk associated with sharing specific assets in Google Drive, you can define automated workflows to monitor and isolate Google Drive assets:
* [Change asset owner on-demand](#change-asset-owner-on-demand)
* [Notify on downloading file](#notify-on-downloading-file)
* [Notify on uploading file](#notify-on-uploading-file)
* [Notify on viewing file](#notify-on-viewing-file)
* [Remediate external sharing in a specific folder](#remediate-external-sharing-in-a-specific-folder)
* [Remove public sharing in a specific folder](#remove-public-sharing-in-a-specific-folder)
* [Remove sharing links on-demand](#remove-sharing-links-on-demand)
## Change asset owner on-demand
To monitor and isolate assets in Google Drive, you can change the asset's owner on-demand with an inventory action. This inventory action is applicable only for **My Drive** assets.
{% hint style="success" %}
You can customize inventory actions to meet your organization's requirements. When you trigger the inventory action, select the relevant workflow you created.
{% endhint %}
1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to the Asset monitoring and isolation category, and select the **Change asset owner on-demand** playbook.
3. Give an action name.
4. Customize the new owner email, or use the Google Drive: `Get new owner email` macro.
Add any relevant actions.
5. Save the workflow with a new name.
6. When you trigger the inventory action, select the relevant workflow you created.
## Notify on downloading file
When someone downloads a specific file from Google Drive, you can send an automatic notification by Slack to the Security team.
1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to the Asset monitoring and isolation category, and select the **Notify on downloading file** playbook.
3. Give an action name.
4. In the condition, specify what the file contains.
5. Customize the **Notify in Slack** message to send to your Security team.
## Notify on uploading file
When someone uploads a specific file to Google Drive, you can send an automatic notification by Slack to the Security team.
1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to the Asset monitoring and isolation category, and select the **Notify on uploading file** playbook.
3. Give an action name.
4. In the condition, specify what the file contains.
5. Customize the **Notify in Slack** message to send to your Security team.
## Notify on viewing file
When someone views a specific file in Google Drive, you can send an automatic notification by Slack to the Security team.
1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to the Asset monitoring and isolation category, and select the **Notify on viewing file** playbook.
3. Give an action name.
4. In the condition, specify what the file contains.
5. Customize the **Notify in Slack** message to send to your Security team.
## Remediate external sharing in a specific folder
When someone shares an asset from a specific folder in Google Drive with someone who's not from a trusted domain, you can remove external collaborators, and send an automatic notification by email to both the actor and Security team.
1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to the Asset monitoring and isolation category, and select the **Remediate external sharing in a specific folder** playbook.
3. Give an action name.
4. Specify the conditions:
* Get parent folders = At least one.. is `false`
* Added collaborators = `At least one not in trusted domains`
* Has added collaborators is `true`
* Add any relevant conditions.
5. Customize the **Notify by email** message to send to the actor. Let them know that the file will be removed immediately, as the collaborator is outside of the organization's trusted domains.
6. Customize the **Array filter** action to filter for array elements that are not in trusted domains.
7. Customize the **Remove collaborator** action to remove the filtered collaborators who aren't from trusted domains.
8. Customize the **Notify by email** message to send to the Security team, notifying them that the external collaborators were removed from the file.
## Remove public sharing in a specific folder
When someone publicly shares an asset from a specific folder in Google Drive, you can remove publicly shared links, and send an automatic notification to both the actor and the Security team.
1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to the Asset monitoring and isolation category, and select the **Remove public sharing in a specific folder** playbook.
3. Give an action name.
4. Specify the conditions:
* Is publicly shared = `true`
* Get parent folders = Specify which parent folder
* Add any relevant conditions.
5. Customize the **Notify by email** message to send to the actor. Let them know that the file will be removed immediately, as public sharing violates organizational policy.
6. Customize the **Remove sharing links** action to remove any public links.
7. Specify how to continue the workflow in the case of errors.
8. Customize the **Remove collaborator** action to remove the filtered collaborators who aren't from trusted domains.
9. Customize the **Notify in Slack** message to send to the Security team, notifying them that public sharing was removed from the file.
## Remove sharing links on-demand
With this inventory action you can remove all sharing links from selected Google Drive assets for these link types:
* **Public** - Removes publicly shared links
* **Organization** - Removes organization-wide links
{% hint style="success" %}
You can customize inventory actions to meet your organization's requirements. When you trigger the inventory action, select the relevant workflow you created.
{% endhint %}
1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to the Asset monitoring and isolation category, and select the **Remove sharing links on-demand** playbook.
3. Save the workflow with a new name.
4. Customize the **Remove sharing links** action, especially the error handling.
5. When you trigger the inventory action, select the relevant workflow you created.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/asset-monitoring-and-isolation/google-drive-playbooks-for-asset-monitoring-and-isolation.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
