Within GAT+, it is possible to retrieve and analyze all actions (Event logs) occurring on a file or folder by any users within the Google Workspace domain. The most common and frequent actions are view or edit but there may be other actions like download, delete, or ACL modified. ACL stands for Access Control List (how a file is shared). Some actions are more concerning or interesting than others.
Activity (Event Logs) in a folder and it’s content #
You can begin by finding and viewing the file or folder you wish to analyze.
Within the GAT+ tool, in the Drive auditing area, in the first tab, the Files tab. Start by applying a custom filter.
Recommended Search Operators:
- File ID equal …
- Title contains (case insensitive) …
- Created After …
- Owner equal …
Displayed Search Results #
Once the results appear after your custom filter search is complete, you have two options, one is to navigate immediately to the Events tab or to refine your search before clicking on the Events tab.
Narrow your search to the contents of a folder only. If you wish to do this, click on the dropdown icon next to the folder name.
Why narrow your search?
- Avoid unnecessary noise
- You won’t see the Event logs of files you are not interested in.
- You may only care about the contents of a particular folder.
Once inside the folder you selected.
Then click on the Events tab.
The filter definition you defined in the Files tab will be partially be brought over to the Events tab.
Note: By default the first page from the filter definition is carried over, we need to make changes so that the entire filter defintion from Files tab is carried to the Events tab.
Within the Events tab, click on the existing custom filter button (which is blue – Active filter applied) and modify it slightly.
Change the type of search from Selected Page Search to Filtered Files Search.
Filtered Files Search means that the scope in the Events tab will be whatever filter you defined in the Files tab.
We also have to add an additional Search Operator like
- Event equal ACL Change
- Shared Out equal Yes
If we don’t add the above Search Operators, the events log of each file from our filter definition will be returned. A simple Google Doc might have hundreds events that occurred on it.
Results Displayed on Events tab #
Once the results are shown, you can export the results to a Google Spreadsheet
Conclusion #
Within GAT+, you can filter and find the metadata of a folder, you can then enter the folder (recursively) meaning that everything within the folder is displayed, all of the contents are returned. Once you define your scope in the Files tab, you need to navigate to Events tab, thats where you see the Event logs in greater detail.
Event logs show every action taken on a file from the moment it was created (all actions have a timestamp).
Within the Events tab, we altered the filter slightly so we can ignore a lot of actions and only focus on a particular action, like when a person altered the ACL permissions and caused the file to be shared out (exposed to an external user outside of the Workspace domain).
