n8n Google Drive Access Alerts + Weekly Security Email Digest

Know the moment Google Drive access turns unusual—hourly security alerts + a weekly digest

This n8n workflow monitors Google Workspace Drive audit logs to detect suspicious access patterns (like bulk downloads, access bursts, and first-time IPs) and immediately emails security alerts—then sends a firm-wide weekly activity digest. Every alert and digest is also logged through a separate compliance/audit n8n workflow.

What this workflow does

• Runs on two schedules: hourly for anomaly detection and weekly for a firm-wide access summary (last 7 days).
• Pulls Drive audit activity from the Google Workspace Admin Reports API, then normalizes each event (user, file name, matter reference pattern, timestamp, and IP address).
• Filters to access-only events—view, download, and print—and aggregates activity counts per user.
• Tracks “known” IP addresses per user over time and flags access from a newly observed IP after a baseline is established.
• Applies configured thresholds and a cooldown window to determine when an alert is required.
• Sends formatted security alert emails via SMTP for flagged users.
• Logs both alerts and the weekly digest by calling a separate n8n compliance workflow.

Use cases

• Detecting bulk downloads or sudden access bursts from a single account in Google Drive.
• Alerting security teams when a user accesses files from a new IP address not previously seen.
• Producing an executive-ready weekly security activity digest summarizing top access users across the firm.
• Maintaining auditability by routing results to a dedicated compliance/audit workflow.

Technical details

• Google Workspace Admin Reports API (Google OAuth2/API credential with domain-wide delegation and admin.reports.audit.readonly scope; uses Drive audit logs).
• SMTP email send (sender configured via FIRM_FROM_EMAIL).
• n8n nodes/approach: HTTP Request, Code, Filter, Split Out, Email Send, plus workflow logging to a separate compliance workflow.