Admin data action log events

Depending on your Google Workspace edition, you might have access to the security investigation tool, which has more advanced features. For example, super admins can identify, triage, and take action on security and privacy issues. Learn more

As your organization's administrator, you can run searches and take action on security issues related to Admin data action log events. You can view a record of actions performed in the Google Admin console or the Google Workspace Admin SDK Reports API, such as when an administrator accessed, removed, and restored sensitive data from any events.

Forward log event data to Google Cloud

You can opt in to share log event data with Google Cloud. If you turn on sharing, data is forwarded to Cloud Logging where you can query and view your logs and control how you route and store your logs.

The type of log event data you can share with Google Cloud depends on your Google Workspace, Cloud Identity, or Essentials account.

Run a search for log events

(Advanced) If you want to automate queries when you run a search, you can use the Admin SDK Reports API instead. For details, go to Reports API Overview.

Your ability to run a search depends on your Google edition, your administrative privileges, and the data source. You can run a search on all users, regardless of their Google Workspace edition.

Audit and investigation tool

Security investigation tool

Supported editions for this feature: Frontline Standard and Frontline Plus; Enterprise Standard and Enterprise Plus; Education Standard and Education Plus; Enterprise Essentials Plus; Cloud Identity Premium. Compare your edition

To run a search in the security investigation tool, first choose a data source. Then, choose one or more conditions for your search. For each condition, choose an attribute, an operator, and a value.

Sign in with an administrator account to the Google Admin console.
If you aren’t using an administrator account, you can’t access the Admin console.
Go to Menu Security > Security center > Investigation tool.
Requires having the Security center administrator privilege.
Click Data source and select Admin data action log events.
Click Add Condition.
Tip: You can include one or more conditions in your search or customize your search with nested queries. For details, go to Customize your search with nested queries.
Click Attributeselect an option.
For a complete list of attributes, go to the Attribute descriptions section.
Select an operator.
Enter a value or select a value from the list.
(Optional) To add more search conditions, repeat steps 4–7.
Click Search.
You can review the search results from the investigation tool in a table at the bottom of the page.
(Optional) To save your investigation, click Save enter a title and descriptionclick Save.

Notes

In the Condition builder tab, filters are represented as conditions with AND/OR operators. You can also use the Filter tab to include simple parameter and value pairs to filter the search results.
If you give a user a new name, you will not see query results with the user's old name. For example, if you rename OldName@example.com to NewName@example.com, you will not see results for events related to OldName@example.com.

Attribute descriptions

For this data source, you can use the following attributes when searching log event data:

Attribute	Description
Actor	Email address of the user who performed the action
Target Event Data Source	Application from which data was accessed, removed, or restored An event can be uniquely identified by 3 fields: Event ID Data Source Name Time at which the event occurred
Date	Date and time of the event (displayed in your browser's default time zone)
Target Event IDs	Event IDs of the data that was accessed, removed, or restored An event can be uniquely identified by 3 fields: Event ID Data Source Name Time at which the event occurred
Search Query	Filters applied in the query used to fetch or process data
Justification	If justification text was required for the action, explanation provided by the admin
Target Event Date	Date which the target event occurred An event can be uniquely identified by 3 fields: Event ID Data Source Name Time at which the event occurred