How to Manage Domain-Wide Downloads in Google Workspace

GAT Shield is a Chrome extension that allows admins to track and view user behavior in Google Workspace. Google Workspace Admins can set up real-time alerts based on the behavior of end-users. In this post, we’ll go through the ‘Downloads’ section of GAT Shield and how it can be used by admins to view and manage all downloads happening across their domain.

Audit domain Downloads #

Navigate to GAT Shield (1) -> Audit (2) -> Downloads (3) There you can see the table (4) with all files downloaded by your users through their Chrome browsers.

NOTE: By default, there is a Date filter set up for the “Last 24 Hours” (1). If there are no records returned by Shield (2), it means there were no downloads happening within that time frame. Change the Date filter to different (3) to review other records.

In addition to seeing who downloaded the file you can also view the URL, download date, where the files were downloaded files from, the file format, where it’s stored, its size, when the download started, and when it finished. If some of the auditable columns are not displayed by default, you can enable them by going to the “Column” button (1) and selecting the ones you want to display on the dashboard from the list (2).

How to Manage Domain-Wide Downloads in Google Workspace? #

Apart from a Date filter you can apply any filter needed to achieve the searchable results needed for auditing purpose.

Start by applying filters #

Let’s use a filter to find a specific set of results. Using the “Advanced” button , start creating a desired filter to search for a specific OU. To do so, navigate to Shield (1)→ Audit (2)→ Downloads (3)→ Advanced (4)  The new window appears where you can start building the query (5). In this example we used the following conditions to build up the filtering option (6):

• User org. unit – enter the org. unit needed
• MIME – enter the mime type (e.g.”text/csv“)

When ready, hit the “Submit” button (7). Results based on the filter will be displayed (1) in a table. All results can be exported to a spreadsheet or CSV file for further analysis (2), and a scheduled report can be configured (3) based on a predefined filter.

View details #

When hovering the cursor over to the right-side of each record, the “Details” icon will appear (1) to view all the details pertaining to that download. The information about that particular download will be displayed in detail. Here you will also have access to the Users (1), Device (2) and GAT Shield instance details (3) such as Shield UUID.

Find the device that the file was downloaded on #

To identify the device the file was downloaded to, copy the Shield UUID displayed in the Shield Extension section of the Details window. Then, go to Audit (1) -> User/Device Geo-Reporting (2) and create a filter by clicking the Advanced button (3). This will bring up the Query Builder window (4), where you can  paste the Shield UUID for filtering purpose (5). Once you’re done, Submit your query (6). Now we have received information about:

• Shield version
• the User was running
• the serial number if they are using a Chromebook and the OS of the device.
• Also, get their public IP private IP and geolocation information such as city and country.

This example can help you find what device the file was downloaded on.

Set up an Alert rule for Downloads #

To do this, navigate to Shield (1)→ Alerts (2) → Rules (3) → + New Alert Rule (4)  The New Alert Rule configuration window is displayed (5) where you can select the Type: Downloads (6) to start creating the alert. See this article that explain step by step how to set up the alert for downloading files: How to Report and Remove Files Downloaded by Google Workspace Users with GAT Shield