> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/it-and-security-operations/google-playbooks-for-it-and-security-operations.md).
# Google playbooks for IT and security operations
To mitigate the risk associated with IT and security operations in Google Workspace, you can define automated workflows for these use cases:
* [Add external domain to trusted domain list after file share](#add-external-domain-to-trusted-domain-list-after-file-share)
* [Notify about suspicious login from non-trusted IP](#notify-about-suspicious-login-from-non-trusted-ip)
* [Remediate suspended employee's personal email access to Google Drive](#remediate-suspended-employees-personal-email-access-to-google-drive)
## Add external domain to trusted domain list after file share
When a Google Drive asset is shared with a non-trusted domain, the user is given the choice to approve the share, remove the collaborator, or ask the SecOps team to add the domain to the organization's list of trusted domains.
1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to IT and security operations, and select the **Add external domain to trusted domain list after file share** playbook.
3. Give an action name.
4. Under the **Change user access** event, define the relevant condition:
* `Added collaborators` - At least one `not in trusted domains`
* `Added collaborators` - At least one contains ``
5. Add any relevant conditions.
6. Customize the **Decision** step to ask the user to decide one of the following:
* **Remove sharing** - Customize the **Remove collaborator** step, and define error handling.
* **Approve once** - Add an **End workflow** step.
* **Add to trusted domain** - Customize the **Approval** step asking SecOps to approve adding the domain to the list of trusted domains.
* **If SecOps approves** - Customize the **DoControl API** step. Ensure that mutation is selected, and the boilerplate request meets your requirements.
* **If SecOps doesn't approve or there is a timeout** - Customize the **Remove collaborator** step, and define error handling.
## Notify about suspicious login from non-trusted IP
When someone logs into Google Workspace from a non-trusted IP, the Security Ops team is automatically notified by email.
1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to IT and security operations, and select the **Notify about suspicious login from non-trusted IP** playbook.
3. Give an action name.
4. Under the **Login success** event, define the condition:\
`Get IP address` is `not in trusted IPs`
5. Add any relevant conditions.
6. Customize the **Notify in Slack** step to send a Slack message to the Security Ops team, notifying them that:\
`We detected a suspicious login from this IP address: .`\
`This IP is not from your organization's trusted IP list.`
## Remediate suspended employee's personal email access to Google Drive
When a suspended Google user shares files with their personal email, DoControl automatically remediates the shared files. If the remediation cannot start, the Security Ops team is notified by email.
1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to IT and security operations, and select the **Remediate suspended employee's personal email access to Google Drive** playbook.
3. Give an action name.
4. Under the **Suspend user** event, define the relevant conditions.
5. Customize the **Get user metadata** step to retrieve the personal email of the suspended employee from your organization's HRIS (HiBob or Workday).
6. Customize the **DoControl API** step to run remediation on any files shared with the employee's personal email.
7. Customize a **Conditional** step that verifies that remediation started:
* If **true** - End workflow
* If **false** - Customize the **Notify by email** step to let the security team know that remediation did not start yet, and customize the **Wait** step to try again in 60 minutes.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/it-and-security-operations/google-playbooks-for-it-and-security-operations.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
