> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/public-sharing/google-drive-playbooks-for-public-sharing.md).
# Google Drive playbooks for public sharing
To mitigate the risk associated with public sharing in Google Drive, you can define automated workflows for these use cases:
* [Auto-expire public sharing](#auto-expire-public-sharing)
* [Notify and remediate publishing a file to the web](#notify-and-remediate-publishing-a-file-to-the-web)
* [Remediate public over-exposure with a loop function](#remediate-public-over-exposure-with-a-loop-function)
* [Remove public sharing of files with sensitive Google labels](#remove-public-sharing-of-files-with-sensitive-google-labels)
* [Remediate public sharing of PII](#remediate-public-sharing-of-pii)
* [Remove public sharing](#remove-public-sharing)
* [Remove public sharing link on-demand](#remove-public-sharing-link-on-demand)
* [Remove public sharing of sensitive files](#remove-public-sharing-of-sensitive-files)
## Auto-expire public sharing
When someone publicly shares a file in Google Drive, the actor is notified by email. After a 30-day grace period, any publicly shared links are removed.
{% hint style="info" %}
See the DoControl [demo video](https://youtu.be/x9ayyk05BjA) to configure the auto-expiry of publicly shared files in Google Drive. DoControl's best practices will help you to minimize data overexposure, and mitigate the risk of data loss.
{% endhint %}
1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to the Google Drive app, and select the **Auto-expire public sharing** playbook.
3. Give an action name.
4. Under the **Change document visibility** event, define the relevant conditions:
* The `Get actor email` condition is in a specific group.
* The `is publicly shared` condition is **true**.
5. Add any relevant conditions.
6. Customize the email message to send to the actor about publicly sharing the asset, and that the shared links will be automatically removed after 30 days.
7. Customize the **Wait** step of 30 days, after which the public sharing link is removed from the asset.
## Notify and remediate publishing a file to the web
You can remove the URL of a Google Drive file that was made public and searchable on the web.
Published Google files can pose a significant threat to your organization in terms of data exposure, since they can be searched and found.
1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to the Google Drive app, and select the **Notify and remediate publishing a file to the web** playbook.
3. Make sure the condition is defined as:\
`Get web publishing status` equals `public_on_the_web`
4. Customize the **Notify in Slack** action to send a message to the SecOps team that a Google file was made public on the web.
5. Customize the **Wait** action.
6. Customize the **Approval** action asking to approve the public sharing on the web:
* **Not approved or timeout** - The URL is automatically removed from the Google asset
* **Approved** - Workflow ends
## Remediate public over-exposure with a loop function
When someone shares a file publicly in Google Drive and approval is not given, the public sharing link is automatically removed from the asset. If approval is given, a 30-day grace period will elapse until sending the approval request again.
1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to the Google Drive app, and select the **Remediate public over-exposure with a loop function** playbook.
3. Give an action name.
4. Under the **Change document visibility** event, define the relevant conditions:
* The `Get actor email` condition is in your organizational domain
* The `is publicly shared` condition is **true**.
5. Add any relevant conditions.
6. Customize the approval request sent to the actor for publicly sharing an asset.
7. If the share **isn't** approved or the approval request times out, the public sharing link is automatically removed from the asset.
8. If the share **is** approved:
* Wait 30 days before sending another approval request to the actor.
* If the second request is approved, customize the Slack message to send to the actor notifying that the publicly shared link will be extended by another 30 days.
* After 30 days, the approval request is sent to the actor again, and so on.
## Remove public sharing of files with sensitive Google labels
When someone shares files publicly in Google Drive with a sensitive Google label, such as "Restricted," the public sharing links are automatically removed from the assets, and the actor is notified in Slack. If the SecOps team approves the file sharing, the public sharing links are not removed.
{% hint style="info" %}
* This playbook is **event-aggregated**, so public sharing links can be removed from multiple Google assets.
* DoControl supports organization-wide labels that are open to all users, not a restricted group of users.
{% endhint %}
1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to the **Google Drive** app and **Public sharing** category, and select the **Remove public sharing of files with sensitive Google labels** playbook.
3. Give an action name for the trigger.
This playbook detects and remediates all publicly shared Google assets with the "Restricted" label
4. Under the **Change document visibility** event, these conditions are pre-populated:
* The file is publicly shared
* Google label is restricted
5. Add any relevant conditions.
6. In the **Approval** step, customize the email or Slack message to send to your SecOps team asking them to approve the public sharing of the sensitive Google files:
* **Yes** - If the SecOps team approves, end the workflow.
* **No** or **Timeout** - If the SecOps team doesn't approve, customize the **Remove sharing links** step.
7. In the **Remove sharing links** step, customize the error handling.
8. Customize the **Notify in Slack** step to inform the actor that the sharing links will be removed immediately since it's organizational policy not to publicly share sensitive files.
## Remediate public sharing of PII
When someone publicly shares a sensitive file in Google Drive, the file is scanned for PII labels:
* If the probability of containing PII is **high**, any publicly shared links are removed, and the actor is notified by email.
* If the probability of containing PII is **medium**, an approval request is sent to the actor to approve the public file sharing. If he doesn't approve, publicly shared links are removed.
* If the probability of containing PII is **not medium**, 30 days must pass before asking the actor to approve the public file sharing. If he doesn't approve, publicly shared links are removed.
1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to the Google Drive app, and select the **Remediate public sharing of PII** playbook.
3. Give an action name.
4. Under the **Change document visibility** event, define the relevant conditions:
* The `Get actor email` condition is in a specific group
* The `is publicly shared` condition is **true**.
5. Add any relevant conditions.
6. Customize the PII scan to search for specific keywords, such as `bank account number`.
7. In the **Conditional** step, define a **high** probability ratio of containing PII keywords.
* If **true**, the publicly shared link is removed.
* Customize an email message sent to the actor notifying that public sharing of PII violates organizational policy, and that the shared link has been removed.
* If false, go to the next **Conditional** step with medium probability.
8. In the next **Conditional** step, define a **medium** probability ratio of containing PII keywords.
9. If the Conditional step is **true:**
* Customize the approval request sent to the actor.
* If the share **isn't** approved or the approval request times out, the publicly shared link is removed.
* If the share **is** approved, wait 30 days before resending the approval request to the actor.
10. If the Conditional step is **false**:
* Wait 30 days before sending an approval request to the actor.
* If the share **isn't** approved or the approval request times out, the publicly shared link is removed.
* If the share **is** approved, wait 30 days before resending the approval request to the actor.
## Remove public sharing
When someone publicly shares a file in Google Drive, the actor is notified by email, and any publicly shared links are automatically removed.
1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to the Google Drive app, and select the **Remove public sharing** playbook.
3. Give an action name.
4. Under the **Change document visibility** event, define the relevant conditions:
* The `Get actor email` condition is in a specific group.
* The `is publicly shared` condition is **true**.
5. Add any relevant conditions.
6. Customize the email message to send to the actor about publicly sharing the asset.\
The public sharing link is automatically removed from the asset.
## Remove public sharing link on-demand
You can trigger an inventory action to remove publicly shared links from Google Drive assets on-demand.
{% hint style="success" %}
You can customize [inventory actions](/docontrol-user-guide/workflows/inventory-actions-quick-actions.md) to meet your organization's requirements.
{% endhint %}
1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to Public sharing, and select the **Remove public sharing link on-demand** playbook for Google Drive.
3. Select the link type to remove:
* Public
* Organization
* Any link
4. Add any actions, such as **Notify by email** or **Notify in Slack**.
5. Save the workflow.
## Remove public sharing of sensitive files
When an alert is triggered for publicly sharing sensitive files in Google Drive, any publicly shared links are removed.
1. In Workflows, select **Playbooks**.
2. Filter the playbooks according to Public sharing, and select the **Remove public sharing of sensitive files** playbook.
3. Give an action name.
4. In the **Conditional** step, customize the relevant conditions:
* The `Get severity` condition doesn't contain **LOW.**
* The `Get actor role in SaaS` condition contains **Admin**.
* Add any relevant conditions.
5. If the conditional step is **true:**
* Customize an email message to send to the Security team or actor, notifying that an alert was triggered because multiple sensitive keywords were found. As a result, the shared link will be removed.
* The public sharing links are removed from the Google Drive asset.
6. If the conditional step is **false**, end the workflow with a success message.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/public-sharing/google-drive-playbooks-for-public-sharing.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
