What should you do when SysCloud detects anomalies in Google Workspace?

When SysCloud detects data change anomalies in Google Workspace, review the flagged items and take the required action, such as exporting the items, marking the alert as a true positive, or dismissing the alert.

Anomalies can be reviewed from:

• Dashboard > Data Change Insights
• Google Workspace archives

Review anomalies from the Data Change Insights dashboard

Step 1: Log in to the SysCloud backup application using your credentials.

Step 2: On the Home page, click the Data Change Insights quick link.

Step 3: Review the anomaly widgets:

• Newly added
• Changed
• Deleted
    

Step 4: Click the aggregate count in any widget to open the consolidated anomaly view. You can check all three tabs: High, Medium & Low.

Step 5: In the consolidated view, click on the count to further review the detected anomalies.

Step 6: Select the required Google Workspace app or user to drill down into the affected archive.

Step 7: Items flagged as anomalies are marked with the relevant anomaly tag, such as:

• Newly added anomaly
• Changed anomaly
• Deleted anomaly

Step 8: Click the anomaly tag to view the alert details in the side tray.

Review anomalies from Google Workspace archives

Step 1: Log in to the SysCloud backup application using your credentials.

Step 2: Go to Archives.

Step 3: Select Google Workspace from the app selector on the left panel.

Step 4: Click the filter icon.

Step 5: Use the Anomaly filter to locate users, shared drives, or items with anomaly alerts.

Step 6: Open the required user, shared drive, or archive item.

Step 7: Continue using the anomaly filter, if required, until you reach the item-level archive view. For example, if you open the Contacts archive, you will get the below view.

Step 8: Review the items marked with anomaly tags. If you do not see the anomaly, use the filter again on the archive view.

Step 9: Click the anomaly tag to view the alert details in the side tray.

Step 10: Act on an anomaly: From the anomaly side tray, choose the required action:

• Export: Export the flagged anomaly items for review, investigation, or record-keeping.
• Mark as True Positive: Mark the anomaly as valid if the detection is accurate.
• Dismiss: Dismiss the anomaly after review, or if the item was incorrectly flagged.
    

Step 11: Check the status for the actions initiated:

• Export: Go to Reports > Export report. The list in CSV format will be available zipped in a file and the download link will be available for 7 days.
    
• Mark as True Positive: Go to Reports > Mark as true positive report to view the status of the Mark as True Positive action.
    
• Dismiss: Go to Reports > Dismiss report to view the status of the dismiss action.