I wrote a short post about the Investigation Tool included in Google Workspace Enterprise plan and how it can be such a powerful tool for both administrators and security people who need to work with Google Workspace events and logs. Well, earlier today I noticed Google added a bunch of new event sources that makes the tool a mighty one.
Google Workspace Security Investigation Tool
If you are a security person who works with Google Workspace, this tool is indispensable. It allows you to review logs for many of the Google services and to remedy security or privacy concerns.
Ahmed Musaad
Following the addition of these new sources, all of Google services' logs are practically available for auditing and review through the investigation tool. While all these new sources are very helpful, I can just think of how tremendously useful the SAML, OAuth, Directory Sync, and LDAP events will be for security people.
The New Sources
Google added the following event sources to its investigation tool:
- Access Transparency log events
- Admin log events
- Calendar log events
- Classroom log events
- Context-aware access log events
- Currents log events
- Data Studio log events
- Directory Sync log events
- Graduation log events
- Groups enterprise log events
- Groups log events
- Jamboard log events
- Keep log events
- LDAP log events
- Meet log events
- OAuth log events
- SAML log events
- Takeout log events