{"product_id":"n8n-google-drive-access-alerts-weekly-security-email-digest","title":"n8n Google Drive Access Alerts + Weekly Security Email Digest","description":"\u003ch3\u003eKnow the moment Google Drive access turns unusual—hourly security alerts + a weekly digest\u003c\/h3\u003e\n\u003cp\u003eThis n8n workflow monitors Google Workspace Drive audit logs to detect suspicious access patterns (like bulk downloads, access bursts, and first-time IPs) and immediately emails security alerts—then sends a firm-wide weekly activity digest. Every alert and digest is also logged through a separate compliance\/audit n8n workflow.\u003c\/p\u003e\n\n\u003ch3\u003eWhat this workflow does\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003e\n\u003cb\u003eRuns on two schedules:\u003c\/b\u003e hourly for anomaly detection and weekly for a firm-wide access summary (last 7 days).\u003c\/li\u003e\n  \u003cli\u003e\n\u003cb\u003ePulls Drive audit activity\u003c\/b\u003e from the \u003cb\u003eGoogle Workspace Admin Reports API\u003c\/b\u003e, then normalizes each event (user, file name, matter reference pattern, timestamp, and IP address).\u003c\/li\u003e\n  \u003cli\u003e\n\u003cb\u003eFilters to access-only events\u003c\/b\u003e—view, download, and print—and aggregates activity counts per user.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cb\u003eTracks “known” IP addresses per user\u003c\/b\u003e over time and flags access from a newly observed IP after a baseline is established.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cb\u003eApplies configured thresholds\u003c\/b\u003e and a \u003cb\u003ecooldown window\u003c\/b\u003e to determine when an alert is required.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cb\u003eSends formatted security alert emails via SMTP\u003c\/b\u003e for flagged users.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cb\u003eLogs both alerts and the weekly digest\u003c\/b\u003e by calling a separate n8n compliance workflow.\u003c\/li\u003e\n\u003c\/ul\u003e\n\n\u003ch3\u003eUse cases\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003eDetecting \u003cb\u003ebulk downloads\u003c\/b\u003e or sudden \u003cb\u003eaccess bursts\u003c\/b\u003e from a single account in Google Drive.\u003c\/li\u003e\n  \u003cli\u003eAlerting security teams when a user accesses files from a \u003cb\u003enew IP address\u003c\/b\u003e not previously seen.\u003c\/li\u003e\n  \u003cli\u003eProducing an executive-ready \u003cb\u003eweekly security activity digest\u003c\/b\u003e summarizing top access users across the firm.\u003c\/li\u003e\n  \u003cli\u003eMaintaining auditability by routing results to a dedicated \u003cb\u003ecompliance\/audit workflow\u003c\/b\u003e.\u003c\/li\u003e\n\u003c\/ul\u003e\n\n\u003ch3\u003eTechnical details\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003e\n\u003cb\u003eGoogle Workspace Admin Reports API\u003c\/b\u003e (Google OAuth2\/API credential with domain-wide delegation and \u003cb\u003eadmin.reports.audit.readonly\u003c\/b\u003e scope; uses Drive audit logs).\u003c\/li\u003e\n  \u003cli\u003e\n\u003cb\u003eSMTP email send\u003c\/b\u003e (sender configured via \u003cb\u003eFIRM_FROM_EMAIL\u003c\/b\u003e).\u003c\/li\u003e\n  \u003cli\u003en8n nodes\/approach: \u003cb\u003eHTTP Request\u003c\/b\u003e, \u003cb\u003eCode\u003c\/b\u003e, \u003cb\u003eFilter\u003c\/b\u003e, \u003cb\u003eSplit Out\u003c\/b\u003e, \u003cb\u003eEmail Send\u003c\/b\u003e, plus workflow logging to a separate compliance workflow.\u003c\/li\u003e\n\u003c\/ul\u003e","brand":"N8N Commerce","offers":[{"title":"Default Title","offer_id":45949934174387,"sku":"N8N-19191","price":29.99,"currency_code":"GBP","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0749\/6279\/6723\/files\/kwm9tGyo1vxKwd4VaEXmY_DMV64iMb.png?v=1788512438","url":"https:\/\/buyflowscripts.com\/products\/n8n-google-drive-access-alerts-weekly-security-email-digest","provider":"N8N Commerce","version":"1.0","type":"link"}