gws-alertcenter

What This Skill Does

The gws-alertcenter skill is a powerful automation module for the OpenClaw AI agent, specifically designed to interface with the Google Workspace Alert Center API (v1beta1). This tool provides security administrators and IT operations teams with the ability to programmatically manage, monitor, and remediate security alerts across their organization. By utilizing this skill, agents can perform granular tasks such as retrieving specific alert details, managing metadata, and executing batch operations like deleting or undeleting security notifications. It serves as a central bridge between the raw alert data provided by Google Workspace and the automated workflows designed to keep an enterprise secure.

Installation

To integrate this skill into your OpenClaw agent, execute the installation command: clawhub install openclaw/skills/skills/googleworkspace-bot/gws-alertcenter. Before you begin, ensure you have completed the prerequisite setup outlined in gws-shared/SKILL.md. This setup includes verifying your authentication tokens and confirming that global flags for your environment are configured. If you encounter missing configuration files, run gws generate-skills to establish the necessary base requirements for the alert center module.

Use Cases

This skill is essential for teams managing large-scale Google Workspace environments where manual alert review is inefficient. Common use cases include: 1. Automated Triage: Automatically fetching and summarizing high-priority alerts to incident response channels. 2. Security Cleanup: Batch deleting legacy alerts that have been processed to maintain a clean security dashboard. 3. Auditing and Compliance: Periodically pulling metadata for all alerts to generate compliance reports or feed into a SIEM (Security Information and Event Management) system. 4. Emergency Recovery: Quickly undeleting alerts that were marked for deletion by mistake or during mass cleanups.

Example Prompts

1. "Check the Alert Center for any new high-severity security incidents from the last 24 hours and summarize them."
2. "List all current alerts in the system and generate a metadata report for those involving suspicious login activity."
3. "Batch delete all alerts currently marked as 'resolved' to clean up our incident management dashboard."

Tips & Limitations

When using the gws-alertcenter skill, always remember that marking an alert for deletion triggers a 30-day grace period; after this timeframe, the data is purged from the Google Workspace database and cannot be recovered. Always verify alert IDs using the get method before running batch operations to avoid data loss. Utilize gws schema alertcenter.<resource>.<method> frequently to ensure you are providing the correct input parameters, as API schemas can evolve. Finally, since this skill modifies security states, ensure that the service account linked to your OpenClaw agent has the appropriate granular permissions within the Google Admin Console to avoid 'Permission Denied' errors during execution.