Security Center Improvements: Gmail content, saved surveys, and more

What changed?

We make it easier to assess and manage threats and improve your security by using G Suite security center. With these changes, super admins or delegated admins with appropriate permissions can:

• View Gmail content directly in the investigation tool when email content is needed to understand potential security risks to users or domains during an investigation. 
• Choose whether to include deleted Gmail content in search results and restore emails recently deleted by the user when requested as part of a security investigation. 
• Use “Group-by” to group search results around specific attributes when querying logs in the investigation tool.
• Save and share investigations with other security administrators.
• See new charts and use new data sources related to user login logs.  

Note that to view Gmail content, the administrator must have super admin status or permissions See content details. Additionally, those administrators will be required to add verification for accessing email content, which is then stored with a log recording their access. See more details below.

Who will be affected? 

Only administrator

Why do you use it?  

G Suite Security Center helps you protect your organization with security analytics and best practice recommendations from Google. It provides a unified security dashboard, a tool to investigate and remediate threats, etc. These new features will help you easily assess and manage threats in the tool and helps you collaborate with colleagues to improve security. 

How to get started  

• Admins: Use our help center to learn more Security center and investigative tools. 
• End users: No action. 

Additional details

• Investigate, remediate, search, and recover Gmail content in the investigation tool

Malicious emails can be an important source of data for administrators investigating attacks or identifying other potential security risks. Now, super admins or admins with permissions See detailed content, Allows entering verification for email content access requests that match their risk criteria directly in the investigation tool. They can also choose whether to include deleted emails as part of the investigation. Use our help center topics Learn more about Gmail content in the investigation tool. 

This helps you understand the full email risk landscape and can help quickly identify and address security and privacy issues in your domain. 

•  “Group-by” – options around specific search attributes when retrieving logs in the investigation tool.

When you customize a search in an investigation tool, you can group items by a specific search attribute to quickly understand the depth of an issue. For example, when conducting a search based on device log events, you can group search criteria based on the device model. Use our support center to learn how added group options when customizing search.

• Save and share investigations in the investigation tool

We want to ensure administrators can work together to assess their organization's exposure to security issues. Admins, can now save their investigations in the security investigation tool and share them with the rest of the admins to improve collaboration. Use our help center to Learn how to save, share, and change ownership of surveys. 

• User logs in the security center

There are new charts in the Security Dashboard and new data sources in the investigation tool related to user login logs and user status within the organization. Use our help center to see more how to search and investigate user log events. 

Source: Gimasys