u/Hazy_Arc

Before I reinvent the wheel, has anyone developed an alert or custom script to notify administrators when a Workspace user has sent an excessive amount of emails (i.e., indicative of an account compromise)?

I'm thinking something along the lines of pop an alert if a single account sends >50 (or 100) emails in a 24 hour period. I looked through the canned security rules in Workspace but didn't see anything that accomplished that.