Embedded Files
As your organization's Administrator, you can run searches and take action on Google Vault log events. For example, you can view a record of actions performed in the Vault console, such as which users edited retention rules or downloaded export files.
Let's see the scene
Let's see the scene
In this exercise, you'll view and customize a Vault audit report for your organization. Note that, because you just set up your domain, there will be limited data available to view in your report.
Emergency alert! HR has emailed you with an urgent request.
Exercise directions
Exercise directions
Part 1: Generate an audit report for Vault user actions
Step 1
If you’re not already signed in, sign in to your domain as the Administrator at admin.google.com.
Step 2
From the main menu, navigate to Security, then select Security center, and click Investigation tool.
Step 3
From the Data source dropdown menu, select Vault log events.
Note: For certain Google Workspace editions, Vault log events can be accessed from the main menu by selecting Reporting and then Audit and investigation.
Step 4
Click ADD CONDITION.
Step 5
From the Attribute menu, select Date. Leave After selected in the Operator menu.
Step 6
In the Date field, select the date that is 30 days prior to today’s date.
Step 7
Click SEARCH. This should generate a report of user activity.
Step 8
Click Export all. Enter Vault user actions in the Export name field and click EXPORT. In the Export action results section, there should be a link to a Google Sheet called Vault user actions containing the audit report.
-- --
Part 2: Generate an audit report for Project X
Step 1
Sign in to vault.google.com.
Step 2
Click Matters.
Step 3
Click on the row for Project X.
Step 4
From the Search tab, select Gmail from the Service menu.
Step 5
From the Entity menu, select All accounts.
Step 6
In the Start date field, enter the date that is 30 days prior to today’s date. In the End date field, enter today’s date.
Step 7
Click SEARCH. Search results may be limited since the domain is new.
Step 8
Click EXPORT. Enter Project X Gmail audit in the Name field and click EXPORT.
Step 9
Click on the EXPORTS tab for Project X. You should see a row for the report you just created. Hover over that row and click Download to download the report.
Help Center resources
Help Center resources
For more information on generating audit reports, please explore the Google Workspace Admin Help Center.
Page updated
Report abuse