GWS Alerts - Stale / Unassigned Alerts (Triage Hygiene)
GWS Alerts Stale Alerts
Query
GWSAlerts_CL
| where TimeGenerated > ago(60d)
| where MetadataStatus in~ ("NOT_STARTED", "IN_PROGRESS", "")
or isempty(MetadataStatus)
| where TimeGenerated < ago(7d)
| extend User = tostring(AlertData.email)
| project TimeGenerated, AlertId, Source, AlertType, MetadataSeverity,
MetadataStatus, MetadataAssignee, User, SecurityInvestigationToolLink
| order by TimeGenerated ascExplanation
This query is designed to identify alerts in Google Workspace that have not been resolved or assigned for more than 7 days. It focuses on alerts that are still in the "NOT_STARTED" or "IN_PROGRESS" status, or have no status at all, within the last 60 days. The query extracts relevant details such as the time the alert was generated, alert ID, source, type, severity, status, assignee, user email, and a link to the security investigation tool. The results are sorted by the time the alert was generated, in ascending order. This is useful for maintaining good triage practices and ensuring compliance with service level agreements (SLAs) in a Security Operations Center (SOC).
Details
David Alonso
Released: May 7, 2026
Tables
Keywords
Operators
Tactics