Using the Google Workspace Admin Console or Google Vault it’s a difficult task for a super admin to find all of the emails sent or received by the entire organization or sub-group of users in a clear and readable way. That’s why the Email auditing in GAT+ is so important. For any filter you create, you can see who was involved with sending or receiving of those emails.
From the GAT+ side-menu go to the email audit section.
While in the first tab.
Click on the ‘Apply custom filters’ button.
Add the dates to capture the previous 24 hour period.
In the search definition area, the following search parameters were applied.
Sent date after or equal MM/DD/YYYY HH:MM
Received date before or equal MM/DD/YYYY HH:MM
Once you have selected the look-back period, apply the filter. In the above example, we’re looking back one day, you can have your custom look back cover a date range you need to audit.
Now when the filter is applied, click on the ‘Sender/Receiver’ tab, the filter will be carried over to this area!
The first table will show you the number of emails sent from your domain’s users.
The second table shows the number of emails each local user received (including, cc’s and bcc’s).
The third table shows you all of the external senders and the number of emails they sent in the last 24 hours.
The fourth and last table will show you the external receivers and how many emails they received in the last 24 hours.
You can export each table to see further details.