onleeSentinel is a comprehensive security cockpit and centralized audit platform designed specifically for Google Workspace. It empowers IT administrators to monitor domain security alerts in real time, audit over 70 configuration controls against the official CIS (Center for Internet Security) Google Workspace Foundations Benchmark, and automatically detect configuration drift across their entire organization.

onleeSentinel seamlessly integrates into your Google Workspace ecosystem to transform raw log data and complex administrative policies into an intuitive, collaborative, and actionable dashboard.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🚀 CORE FEATURES & CAPABILITIES
━━━━━━━━━━━━━━━━━━━━━━━━━━━━

1. 📬 Inbox-Style Security Alert Management
• Centralized triage of alerts from the Google Alert Center (phishing campaigns, compromised credentials, suspicious logins, bulk Google Takeout exports, service disruptions).
• Email-inspired workflow: mark alerts as read/unread, filter by severity level (HIGH, MEDIUM, LOW, INFO), and focus on active threats.
• Direct 1-click investigation links to the Google Admin Security Investigation Tool and raw JSON payload viewers for SOC/SIEM incident response teams.

2. 🛡️ CIS Benchmark Compliance Audit Engine (70+ Controls)
• Automated security evaluation across 70+ controls aligned with the official CIS Google Workspace Foundations Benchmark.
• Comprehensive service coverage: Gmail, Google Drive, Google Meet, Google Calendar, Google Chat, Chrome enterprise policies, and core Admin Console security configurations.
• Granular Organizational Unit (OU) mapping with automatic resolution of organizational paths.
• Step-by-step remediation guidance with direct 1-click navigation to the exact setting in your Google Admin Console.
• Visual classification distinguishing between system-enforced policies (SYSTEM) and administrator-managed policies (ADMIN).

3. ⚠️ Configuration Drift Detection (Console Watcher)
• Establish and approve an organization-wide baseline for all security settings.
• Continuous automated comparison between live Google Workspace configurations and your validated baseline.
• Immediate visual detection and alert badges (⚠️ Modified) when an unauthorized setting change occurs.
• On-demand audit snapshots to inspect configuration integrity at any given moment.

4. 🌐 Integrated Threat Intelligence (CERT-FR)
• Automated ingestion of official security advisories and Common Vulnerabilities and Exposures (CVEs) from CERT-FR.
• Cross-correlates external vulnerability intelligence directly within your Google Workspace alert stream for proactive defense.

5. 📧 Automated Reporting & Instant Urgent Alerts
• Automated weekly executive report emailed every Monday morning summarizing domain health, weekly alert trends, and CIS compliance progression.
• Real-time critical threat triggers: immediate email notifications whenever a HIGH-severity security incident is detected.

6. 📱 Native Gmail Add-on
• Sidebar integration accessible directly within the Gmail interface.
• 24-hour alert summary widget providing instant visibility into high/medium severity alerts without leaving your inbox.
• Built-in interactive diagnostic card for real-time verification of Domain-Wide Delegation (DWD) status.

7. 👥 Multi-Admin Collaboration & Immutable Audit Trail
• Collaborative, shared workspace for Super Administrators and Delegated Administrators.
• Full accountability (Audit Trail): every rule validation or baseline update logs the exact timestamp and administrator email address.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🔒 DATA PRIVACY & SOVEREIGN ARCHITECTURE
━━━━━━━━━━━━━━━━━━━━━━━━━━━━

• Zero Third-Party Cloud Storage: onleeSentinel does not store your organization's audit records or configuration data on external servers.
• Private Storage in Your Own Google Drive: All audit baseline and validation history is stored in a private Google Sheet hosted exclusively within your primary administrator's Google Drive.
• Enterprise-Grade Security: Powered exclusively by official Google Cloud Platform APIs (Cloud Identity Policy API, Admin SDK Directory API, Alert Center API) using OAuth 2.0 authentication.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🎯 INSTALLATION TYPE & BEST PRACTICES
━━━━━━━━━━━━━━━━━━━━━━━━━━━━

• Installation Type: onleeSentinel requires an **Admin Install** via the Google Workspace Marketplace.
• Recommended Deployment:
  - Following the principle of least privilege, we strongly recommend **against deploying the app domain-wide to all standard end-users**.
  - Instead, select **"Certain groups or organizational units"** during installation and deploy onleeSentinel exclusively to an **Organizational Unit (OU) containing your administrators** or to a designated **Google Group containing your IT security administrators and analysts**.
• Requirements: Requires a Google Workspace Super Administrator or Delegated Administrator with administrative read permissions.
• 14-day full feature free trial available — no credit card required.