The Investigation Tool Defined

The investigation tool is a powerful resource in the Admin console that gives insight into domain activity and allows admins to take bulk or targeted action on data. With it, you can identify, triage, and respond to security and privacy issues in your domain. It is part of the Security Center and is available to admins with Education Standard or Education Plus licensing.

Some common examples of how you can leverage the investigation tool include:

• Searching Gmail logs and messages to view email content, delete malicious emails, mark emails as spam or phishing
• Accessing Drive log data to change ownership, add/remove users, change permissions, view who has accessed a file
• Determining users who have not logged in recently and cleaning up accounts that shouldn't be active

Look deeper at configuration settings, investigation ownership, activity rules, custom charts, and actions available on our Investigation Tool section. 

Document Version	Date	Description of Change
1.0	9/6/2024	Minor text updates, reverify