daily_brief
Aggregate login audits, account-protection changes, and external Drive sharing across all configured domains into one security summary, flagging suspicious activity and partial scans.
Instructions
One-call security summary across all configured domains.
Aggregates login_audit (account locks, suspicious logins),
account-protection changes (account_changes: 2-Step Verification
enrolled/disabled, passkeys added/removed, Advanced Protection turned off,
password and recovery address/phone edits, mail forwarding out of the
domain; each row says whether it came from outside the GWSADM_SITES_INI
table and from which country (GWSADM_IP2ASN), and is flagged with
flag_reasons -- foreign (outside GWSADM_HOME_COUNTRIES),
unknown_origin, after_suspicious_login -- flagged rows first, at
most 50 listed, total counts all; suspicious_login_coverage says
whether the last reason is complete) and
drive_external_sharing (external grants, new link exposure, and
untargeted_external_transitions — see that tool's docstring).
max_pages / samples are passed through to the drive scan;
max_pages defaults to the same page budget as the standalone tool,
so both report the same counters for the same window (samples
defaults lower here and only trims the example lists). Per-domain capped in the
summary means at least one underlying scan was partial — treat that
domain's counts as lower bounds (see capped_events in the drive
section for which probes were cut short).
Synchronous: on a large tenant this can exceed a client's ~60s tool-call
timeout. If it does, use daily_brief_start + daily_brief_result
(same result, run in the background) or lower max_pages.
Tool call template
This tool declares no required parameters. Add optional parameters from the input schema as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {},
"name": "daily_brief"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| hours | No | ||
| samples | No | ||
| max_pages | No |