Why am I getting Download or Transfer alerts when the user didn’t download anything?
In most cases, the alert was caused by files syncing between Google Drive and the user’s computer, usually through Google Drive for desktop. Google classifies a sync as a download. SpinOne then classifies it as either:
- A transfer, if a third-party app or sync tool was used.
- A download, if it was done directly through the Google Drive website.
How to check what happened
You can use the Activity Log in SpinOne to see whether a download event was associated with an application:
- Head to Cloud Monitor > Activity Log.
- Click the Activity type filter, select Drive download and Drive download external, and click Apply.
- Open a download event and check whether an Application is listed.
If an application name appears in the event, the event is a transfer, meaning an app moved the files rather than the user downloading them manually. Click the application’s name to open its assessment in Risk Assessment.
How to stop alerts from a trusted app
If you consider the application safe, add its Application ID to your Transfer policy under the Allowlist Transfers condition. Transfers by that app will no longer trigger alerts, and manual downloads will still trigger your Download policy.
Get more information on Google Workspace™ Backup Solutions