compromise_sweep
Run a read-only post-compromise check for one Google Workspace account: review activity, state, OAuth grants, sweep attacker IPs across domains, and inspect Gmail forwarding, filters, and delegates.
Instructions
The Google-side follow-through after ONE account is confirmed compromised, in one call.
Four questions, each answered from its own source and reported in its own section so that a failure in one never hides the others:
activity: what the account did (user_activityfor the window, flags first -- a2sv_enrollfrom the attacker is the item that survives a password reset). A Reports failure stays in this section aserror; the others are still attempted with their own grants.state/grants: what the account is now (get_user: suspended, 2SV enrolled, last login) and which OAuth grants can read or act on content (grants.risky: mail / Drive / contacts / admin scopes; sign-in-only grants are listed but not called out).ips: whether the same sources reached other accounts (ip_activityacross every configured domain for the addresses inips, or, when none are given, for the addresses on the account's own flags -- which include the attacker's, and also the owner's own when they authorized an app or re-authenticated -- capped at SWEEP_MAX_IPS, newest first). The swept account itself is excluded fromother_accounts; a shared egress address (a campus NAT, a gateway host that impersonates accounts) legitimately shows other accounts, so readother_accountsagainst where the address sits.gmail: the settings an attacker leaves behind to keep reading mail (auto-forwarding, forwarding addresses, filters that forward / delete / archive, delegates, send-as aliases and reply-to) plus what the mailbox sent in the window as counts and recipient domains -- never a subject or body. Itskindsays whether it could be read at all:ok,partial(a settings section or the sent summary failed --section_errors/sent.errorsay which; the rest stands),api_disabled(the Gmail API is off in the service account's own Cloud project),no_grant(nogmail.readonlyDWD grant) orerror. A failure is reported as such, never as "nothing found".
highlights lists the facts a responder acts on, one line each, and
checklist what remains to do or verify by hand (second-factor
removal, session sign-out, recovery contacts, message content). Nothing
here changes the account; the identity provider's side of the incident
(and any other SaaS) stays with the caller.
Read-only: Reports API activities().list, Directory users().get
and tokens().list, and Gmail settings.* reads plus
messages().list / messages().get(format="metadata") with the
To / Cc / Bcc / Date headers only.
Args:
username: Exact user email of the compromised account.
hours: Window length ending now, for activity, the IP sweep and sent
mail.
ips: Comma-separated attacker addresses to sweep, at most
SWEEP_MAX_IPS (more is refused, not truncated). Default: the
addresses on the account's own flags, newest first, same cap.
max_pages: Page budget per application for the account's activity
(the IP sweep uses its own small budget).
max_sent: Sent messages whose envelope is fetched, concurrently
(the count covers everything listed).
domain: Configured [domain.*] section for the account. Default:
resolved from the username's suffix. The IP sweep always covers
every configured domain.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ips | No | ||
| hours | No | ||
| domain | No | ||
| max_sent | No | ||
| username | Yes | ||
| max_pages | No |