> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/workspace-protections/google-drive-security.md).

# Google Drive Security

#### Overview <a href="#h-overview" id="h-overview"></a>

Automated File Detection & Response allows customers to automate enforcement actions across Google Drive to continuously protect against unwanted sharing and excessive permissions. Customers are able to :

* Create and save file search strings as detections
* Configure automated remediation flows for a detection
* Choose from email, grace period, and revoke external access to build a remediation
* View & manage detection matches and insights in the issues UI

#### Instructions <a href="#h-instructions" id="h-instructions"></a>

A. Create a new detection:

1. From the left navigation, expand **Google Drive Security**, then click **Detections**.
2. Click on Create New Detection in the top right of the page.
3. Enter a name and description of your choice.
4. Enter your Detection criteria using our search UX and prompts . This will start to populate matching results for preview.
5. Click on Create Detection to save.
6. On the right hand panel - you can toggle the enabled button to activate/deactivate the detection.
7. On the right hand panel- click on Add Remediation to start building your remediation workflow. Follow step B for individual remediation configurations.
8. You can choose between email, grace period and revoke external access.

B. Remediations:

1. Once you click on Add Remediation you will be able to choose between the different remediation types. You can repeat this for each step in your remediation workflow. Note: A workflow can open with a grace period, but a grace period always needs an action after it, and you can't place two of them back to back. Once revoke external access is in the workflow, you can't add an email or grace period after it.
2. Click on email remediation/grace period/Revoke external access from the dropdown and continue with the corresponding instructions. A. Email Remediation : Choose amongst file owners for mydrive, shared drive admin per your settings, security team & individual account email as recipients. Customize email content per your preference and click on save. B. Grace Period : Choose from time periods listed in the dropdown or customize to a duration of your choice. Click on Save. C. Revoke External access : Type in any external domains you want to keep access for in the external domain access field. Choose if you would like to update general settings or keep them as they are. Click on save.
3. You can view your complete remediation flow on the right hand panel.

C. Activate your file detection and response:

1. Once you have configured your detection criteria and remediation workflow, you can activate the remediation and detection when ready.
2. Turn on the toggle for remediations - this will execute the workflow for every file that matches the detection criteria.
3. Set the detection to enabled. When prompted for historical sync, choose yes if you want to apply the detection to previously synced files. If not, detection will apply to all new file activity moving forward by default.
4. You are now ready to use your file detection & remediation. Issues will start getting created and show up in **Google Drive Security** > **Issues**.
5. Please repeat the steps here for any file detection you want to build.

D. Viewing and managing issues:

1. Once your file detections and response are active, issues will get created and be available in **Google Drive Security** > **Issues**. An issue is unique to the combination of file and detection.
2. Issues are grouped by detection as default, you can choose to change this to no grouping in the top right of the page.
3. Once you click on an individual issue, you can view the remediation history, remediation summary and the issue status.
4. Issue status: A. Issue status types - Open, In progress, Ignored, Resolved B. An issue stays open as long as the detection criteria stays true and is resolved when it is no longer true. These checks are performed any time there is new file activity. C. If you would like to pause the automated flows for an issue, you can change issue status to ignored with reasons including false positive. D. If you want to mark an issue as being worked on you can switch it to in progress. E. Issue options will continue to expand in upcoming releases to offer a wide range of capabilities.

E. Other product information:

1. As part of our detections functionality, you will be able to use pre-built detections available in the product. For Okta customers : The detection named ‘File shared externally by Okta off-boarded account’ identifies externally shared files owned by users suspended in Okta. You can customize the remediation flow per the steps in part B. This detection can be used to enhance your offboarding flows with Google Drive.
2. Material's built-in Google Drive coverage also includes higher-precision detections that flag files in a sensitive category when they're shared externally or shared through a public link. Because they key off sensitive categories, these detections give you tighter default coverage on the Drive sharing that carries the most risk. They're available for customers with Advanced licenses.
3. Example configuration - A. Detection criteria : category.any and shared.externally B. Remediation : Email file owner , Grace period 1 day, Email security team, Revoke external access


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.material.security/workspace-protections/google-drive-security.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.