For more details about which data sources are available in the investigation tool, go to Data sources for the security investigation tool.

API · Google Apps Script · AppSheet · Mobile · iOS · Android · Beta · Additional Google services · Weekly Recap · Other · Google Workspace Add-ons · rss_feed · arrow_back Back · September 19, 2018 · Admin console · Rapid Release · Scheduled Release · We launched the investigation tool as an Early Adopter Program (EAP) in July and are now making it generally available (GA).

Instead of crafting dozens of search queries, you pass GHunt a single email address; it logs into Google on your behalf, queries private-but-unprotected APIs, and returns structured JSON you can feed into other analytics platforms. The tool effectively turns Google’s ecosystem into one giant, queryable database. The current public version (v2.2.0, June 2024) offers five investigation modules:

Investigation tool does not have an API.

September 17, 2025 - Check the Google Workspace Forensics tactics used to conduct the digital investigation on G Suite Applications and extract Google Apps Data

Now with the logs and urgency for Audits and Investigation Google gives you the premium feature to look into the end-user activities with a Powerful Tool of Investigation.

An alert affecting a customer · Output only. The unique identifier of the Google Workspace account of the customer

Using the investigation tool, you can identify all users in your domain that have received the message (for example, a phishing email).

Jump to content · for Education · Sign in · Google Classroom · Google Workspace admin · Google Cloud · Contact sales · Gemini now has added data protection. Chat with Gemini to save time, personalize learning and inspire creativity

Create a custom chart related to your investigation that's displayed on the security dashboard ... From the left-navigation menu, click SecuritySecurity centerInvestigation tool.

December 18, 2023 - The Google Workspace Security Investigation Tool is vital for security investigations in Google Drive. Here’s how to get started.

December 18, 2023 - Google Workspace’s Security Investigation Tool is key for more powerful investigations in Google Workspace. Here’s how to set it up.

Security Command Center API provides access to temporal views of assets and findings within an organization.

In August 2022, we announced the movement of the existing Gmail logs in BigQuery to Google Workspace logs and reports in BigQuery, creating a single space to access all of your Google Workspace audit events. To further improve this experience, you’ll see all Gmail log events from the Security Investigation Tool (SIT) in your Google Workspace logs and reports in BigQuery.

Loading application · Your web browser must have JavaScript enabled in order for this application to display correctly

May 16, 2023 - The #1-rated Google Workspace investigation tool trusted by thousands of admins to detect breaches, track user activity, and prove compliance, all from a single, clear dashboard.

June 13, 2025 - Access to the Investigation Tool is not available on all tiers and requires specific administrator privileges. Google Workspace Editions: The tool is exclusive to higher-tier editions, including Enterprise Plus, Education Plus, and Enterprise Essentials Plus.

April 17, 2024 - Using this tool, you can search for the malicious email and quarantine it from inboxes from a single dashboard. As mentioned, there are many other logs as well. You'd want to ensure the user is fully investigated to understand the incident and not miss unauthorized changes or activity. For example, reviewing Google Drive logs for suspicious activity, Takeout logs for exported data, and more!