The investigation tool is a powerful resource in the Admin console that gives insight into domain activity and allows admins to take bulk or targeted action on data. With it, you can identify, triage, and respond to security and privacy issues in your domain. It is part of the Security Center available to admins with Education Standard or Education Plus licensing.
Some common examples of how you can leverage the investigation tool include:
- Searching Gmail logs and messages to view email content, delete malicious emails, mark emails as spam or phishing
- Accessing Drive log data to change ownership, add/remove users, change permissions, view who has accessed a file
- Determining users who have not logged in recently and clean up accounts that shouldn't be active
Take a deeper look at configuration settings, investigation ownership, activity rules, custom charts, and actions available on our Investigation Tool section.