daily_brief
Consolidate login audit and external sharing data across all domains into one security summary. Identify account locks, suspicious logins, and drive exposure events.
Instructions
One-call security summary across all configured domains.
Aggregates login_audit (account locks, suspicious logins) and
drive_external_sharing (external grants, new link exposure, and
untargeted_external_transitions — see that tool's docstring).
max_pages / samples are passed through to the drive scan;
max_pages defaults to the same page budget as the standalone tool,
so both report the same counters for the same window (samples
defaults lower here and only trims the example lists). Per-domain capped in the
summary means at least one underlying scan was partial — treat that
domain's counts as lower bounds (see capped_events in the drive
section for which probes were cut short).
Synchronous: on a large tenant this can exceed a client's ~60s tool-call
timeout. If it does, use daily_brief_start + daily_brief_result
(same result, run in the background) or lower max_pages.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| hours | No | ||
| samples | No | ||
| max_pages | No |