Save, Share, and Transfer Investigations in Google Workspace

The Investigation Tool allows Google Workspace administrators to search logs and reports for potential security issues, compliance concerns, or data anomalies.

What You'll Learn

This article walks you through how to

• Save investigations
• Share investigations
• Transfer investigations

You’ll learn how to use the Investigation Tool to effectively preserve and collaborate on data insights, ensuring compliance and streamlined workflows across your team.

Caution: The Investigation Tool returns 180 days of data from all logs. Gmail log search does have a limit of 30 days unless you have the message ID and recipient email address. You can export Google Workspace logs and usage reports to Big Query. Over time, this gives you access to data past the 30 day/6 month window. See Export your Google Logs to BigQuery for a Big Win.

Save an investigation

After creating an investigation, saving it to preserve your progress and findings is important, making it easier to revisit or share with your team. Here’s how:

1. Once you create an investigation in the Investigation Tool, click the Save icon.
2. Enter a title and description for the investigation.
3. Click Save.

Share an investigation with others

Collaboration is key when investigating security or compliance issues. You can share investigations with your teammates to collaborate on findings or assign tasks. To share an investigation:

1. Open the saved investigation in the Investigation Tool by clicking on the file folder icon.
   
2. Click on the quick access card for the investigation.
3. Click Share at the top left of the page.
   
4. Enter the email of people you want to share the investigation with in the User field and click Send. By default users are notified of the share.
   OR
   To share with anyone via link, Toggle the Shared link to ON and copy the link and then click Cancel to close the popup.
   

Change ownership of an investigation

When responsibilities shift or a different team member needs to take the lead, you can transfer ownership of an investigation. Once transferred, your access will be reduced to “viewer,” and the new owner will have full control over the investigation.

1. To change ownership of an investigation:
2. Open an investigation in the Investigation Tool.
3. Click Share at the top left of the page.
4. Change the permission of an existing user from Viewer to Owner.
   

Resource:

Save, share, delete, and duplicate investigations

Document Version	Date	Description of Change
1.0	9/10/2024	Rewrite, reverify