Security object deletion in Google Workspace Admin Console

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2026-05-18

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: Google Workspace Audit Logs
Detection Modules	Identity Threat Module
Detector Tags	Google Workspace
ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Impair Defenses: Disable or Modify Tools (T1562.001)
Severity	Informational

A security object was deleted in Google Workspace Admin Console.

Adversaries may modify or disable security rules to avoid detection of their activities.

Investigate the security object name deleted and whether it was intended.
Check if the user was recently granted new elevated permissions that allowed them to delete security rules.
Follow other administrative or suspicious actions performed by this user around the same time.

ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Impair Defenses: Disable or Modify Tools (T1562.001)
Severity	Low

A security object was deleted in Google Workspace Admin Console.

Adversaries may modify or disable security rules to avoid detection of their activities.

Investigate the security object name deleted and whether it was intended.
Check if the user was recently granted new elevated permissions that allowed them to delete security rules.
Follow other administrative or suspicious actions performed by this user around the same time.