Updated and improved audit logs experience in the Admin console

16/05/2022

Agenda

What’s changing

Google is updating the user interface for audit logs in the Admin console to allow for richer insights and query based reporting capabilities. This will bring the experience inline with the security investigation tool and create a more unified reporting experience across the Admin console.

Some improvements you’ll notice are:

Enhanced search attribute options: Google've introduced a new search field that will help admins quickly find and apply search attributes. For larger lists (more than 15 items), admins will be able to pin commonly used attributes.
The ability to perform searches in “filter” or “condition builder” mode:
- In filter mode, admins can add simple parameter and value pairs, such as viewing externally shared files with sensitive data or external emails with attachments, to filter for search results.
- In condition builder mode, admins can view previously applied filters as conditions with AND/OR operators to further refine search results.
New data sources for the investigation tool: Google is expanding our list of data sources to 31 sources — see here for a complete list of data sources.

Who’s impacted

Admins

Why it’s important

Google hope this updated and streamlined experience makes it easier for admins to identify, triage, and act on security issues within their organization without having to switch between multiple tools. Additionally, by providing admins with new ways to set and filter for specific search attributes and establish reporting and activity rules, this will make it easier to stay apprised of what’s happening in their organization.

Additional details

Quản trị viên sẽ không thể xuất dữ liệu audit logs sang dạng CSV nữa, chúng chỉ có thể được xuất sang Google Sheets. Ngoài ra, bạn có thể nhận thấy việc đổi tên và hợp nhất các nguồn dữ liệu hiện có trước đây và các thay đổi nhỏ khác về giao diện người dùng. Để có danh sách đầy đủ những gì sẽ thay đổi, hãy xem bài viết này trong Trung tâm trợ giúp của chúng tôi.

What’s changing

Admins: The new audit and investigation page can be accessed in the Admin console by going to Reporting > Audit and investigation. Visit the Help Center to learn more about the improved audit and investigation experience, creating reporting rules and activity rules, and admin access to reporting rules & activity rules.
End users: There is no end user impact.