Investigation Tool Recipe: Users With Auto Forward On for Their Emails

Problem 

You need to find users who their Gmail setup to auto forward.

Steps

  1. Open the Investigation Tool.
    Security > Security center > Investigation tool
  2. Select Gmail log events as your data source.
  3. Click Add Condition.
  4. Add the following condition:
    Event > is > Autoforward
  5. Click Group Results.
  6. Select Owner from the group drop-down.
    InvToolForwardEmail.png
  7. If you are happy with the investigation you built and want to retain it, click Save Investigation, located on the right.
  8. Click Search. The search results show those with auto forwarding set to ON. If there are no results, no one has the setting ON.

See our full list of Investigation tool recipes


 

Document Version Date Description of Change
1.0 1/10/2024 Meeting Kyle Monday 1/13 - is this tied to any settings and did I set it up correctly? I am not getting results
1.1 1/13/2025 Published

Articles in this section

See more