Identify Shared-in Google Drive Files from External users #
What does Shared-in mean?
A Shared-in file is a file where the owner is an external user from another Google Workspace domain. This external owner may have added a user from your Google Workspace domain as an Editor, Viewer, or Commentor.
These users appear within GAT+ highlighted in orange color, and if they own the file their email appears under the Owner heading.
Navigate to the GAT+ → Drive audit → Files tab.
Why are Shared-in files important to analyze?
- Data Leak – Files placed into a shared-in folder are immediately exposed to an external party.
- Identify the type of organizations collaborating with your business.
- Reach out to the external organization and let them know that their users are sharing files with members of your organization.
‘First seen in GAT+’ #
In GAT+, Files tab, we provide the following Search Operators, when defining your custom filter to query the metadata across your organization.
- First seen in GAT+
- First seen in GAT+ (relative)
These Search Operators combined with another like the Sharing Flag contains Shared-in can tell when (time & date) the file was first recognized by GAT+.
Note: ‘First seen in GAT+’ is a Search Operator unique within GAT+, Google API does not keep track of Shared-in files so GATLabs has developed unique code to identify these files.
The outcome of the above Custom filter
This will show you all the files that were:
- “Shared in” to your Google Workspace domain in the last 30 days.
Creating a scheduled report to find recently shared-in files #
Using the same custom filter and same Search Operators, we can schedule our filter to create daily, weekly, or monthly generated spreadsheets.
This scheduled report will produce a Google Spreadsheet of the most recently shared-in files over the last month.
Summary #
As a result of the filer and report you will see:
- On a scheduled occurrence (daily, weekly or monthly), a new report will be generated.
- The Google Sheet will contain all the newly discovered Shared files for the previous X days
- Below you will see the Owner (is external) – meaning it’s Shared In. Also, the Sharing flag contains Shared-in (Shared into your domain from an external domain).
