Investigating incidents with the Google Workspace investigation tool

The alert center in the Admin console collects notifications about potential problems in your domain: suspicious sign-ins, government-backed attack warnings, phishing that reached inboxes, devices compromised, admin changes. Click an alert to see details and the affected users. On Enterprise editions you can open an investigation straight from an alert in the security investigation tool.

Two things to set up before you need them: make sure alert notifications go to a monitored address (not one person's inbox), and give the people who respond the right admin privileges in advance. The alert center API can also feed alerts to a ticketing or monitoring system.

There are two related tools, and which you have depends on edition:

Gmail log events (Reporting > Audit and investigation > Gmail log events; requires the Audit & Investigation privilege) record message delivery and handling. Typical questions:

• Who received the phishing email? Search by sender, subject or message ID, then see every recipient and what happened to each copy.
• Did anyone reply or forward? Search for messages from internal users to the attacker's address or domain.
• Did the compromised account send mail? Search by sender for the affected user across the incident window.
• Remediation: in the security investigation tool, select the messages and delete them or move them to quarantine across all mailboxes at once.

1. 01

   Viewing message content

   Searches return headers. Viewing the body requires a supported edition (Google lists Frontline Plus, Enterprise Plus, Education Standard and Plus), a super admin to enable content access in the investigation settings, and a justification entered by the admin each time.

• Drive log events record actions such as View, Create, Edit, Rename, Print, Delete, Upload and Download, with the actor, IP address and document.
• Visibility and access changes show when a file was shared externally or made public, and the audience domain.
• Google notes that users external to your domain appear as anonymous in some events, except when they view or edit a document in certain conditions, so external access may not always be attributable to a named person.
• An 'Impersonation' field indicates an app used domain-wide delegation to act on a user's behalf: important when the culprit is an integration, not a person.
• In the investigation tool, Actions > Audit File Permissions lets you see who has access to the files in your results and remove it.

• User log events record sign-ins, failures, logouts and 2SV events, with IP address and whether a second factor was used ('Is second factor').
• Look for sign-ins from unfamiliar IPs or countries, successful sign-ins without a second factor on accounts that should be enforced, and suspicious login events Google has flagged.
• Check OAuth log events and Token log events for third-party apps the user authorized during the incident window. Google lists OAuth data as arriving with up to a few hours' lag and token events within a couple of hours.
• Check Admin log events if an admin account is involved: role grants, 2SV changes, forwarding settings, new users.

Sources: Google Workspace Admin Help: 'About the alert center', 'About the security investigation tool', 'Take action based on search results', 'Use the security investigation tool to view sensitive content', 'Gmail log events', 'Drive log events', 'User log events' and 'Data retention and lag times'.

1. 01

   Know the windows

   Google retains most log event data for 6 months, but Email log search covers only 30 days. Start preserving on day one.

2. 02

   Export results

   Export search results to Google Sheets or CSV. The investigation tool can export action results to a Sheets file in the admin's My Drive. Copy exports out of the tenant to access-controlled storage.

3. 03

   Record the method

   Note each search's data source, filters, date range, time zone, who ran it and when.

4. 04

   Hash the exports

   Record hash values of exported files so you can show they weren't changed later.

5. 05

   Preserve mailboxes and files

   Logs show activity, not content. Use Google Vault holds to preserve the mail and Drive content you may need; see our guide to Vault retention and holds.

6. 06

   Get advice

   If personal information was involved, talk to counsel about notification obligations before you finalize conclusions.