Exercise 2: Collect and analyze logs

Exercise directions

Run a search for log events

Your ability to run a search depends on your Google edition, your administrative privileges, and the data source. You can run a search on all users, regardless of their Google Workspace edition.

-- --

Audit and investigation tool

To run a search for log events, first choose a data source. Then choose one or more filters for your search.

Step 1

If you’re not already signed in, sign in to your domain as the Administrator at admin.google.com.

Step 2

From the main menu, navigate to Security, select Security center, and then click Investigation tool.

Step 3

From the Data source menu, select the type of log event you need to access.

Step 4

Click ADD CONDITION, and then select an attribute from the menu.

Step 5

Select fields from the Pick an operator and Enter a value menus.

Step 6

To create multiple filters for your search, repeat steps four and five.

Step 7

Click SEARCH. You can also select GROUP RESULTS to sort your results by a specific attribute.