{"id":399,"date":"2021-11-16T19:01:05","date_gmt":"2021-11-16T19:01:05","guid":{"rendered":"https:\/\/gatlabs.com\/knowledge\/?p=399"},"modified":"2022-02-16T10:44:51","modified_gmt":"2022-02-16T10:44:51","password":"","slug":"within-a-folder-which-users-shared-out-content","status":"publish","type":"docs","link":"https:\/\/gatlabs.com\/knowledge\/tech-tips\/within-a-folder-which-users-shared-out-content\/","title":{"rendered":"Within a Folder, Which Users Shared Out Content?"},"content":{"rendered":"\r\n

Within GAT+, it is possible to retrieve and analyze all actions (Event logs) occurring on a file or folder by any users within the Google Workspace domain. The most common and frequent actions are view or edit but there may be other actions like download, delete, or ACL modified. ACL stands for Access Control List (how a file is shared). Some actions are more concerning or interesting than others.<\/p>\r\n\r\n\r\n\r\n

Activity (Event Logs) in a folder and it’s content<\/h2>\r\n\r\n\r\n\r\n

You can begin by finding and viewing the file or folder you wish to analyze.<\/p>\r\n\r\n\r\n\r\n

Within the GAT+ tool, in the Drive auditing area, in the first tab, the Files<\/strong> tab. Start by applying a custom filter.<\/p>\r\n\r\n\r\n\r\n

\"\"<\/figure>\r\n\r\n\r\n\r\n

Recommended Search Operators: <\/strong><\/p>\r\n\r\n\r\n\r\n

    \r\n
  • File ID<\/strong> equal<\/em> …<\/li>\r\n
  • Title<\/strong> contains (case insensitive)<\/em> …<\/li>\r\n
  • Created<\/strong> After<\/em> …<\/li>\r\n
  • Owner<\/strong> equal<\/em> …<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\n
    \"\"<\/figure>\r\n\r\n\r\n\r\n

    Displayed Search Results<\/h3>\r\n\r\n\r\n\r\n

    Once the results appear after your custom filter search is complete, you have two options, one is to navigate immediately to the Events<\/strong> tab or to refine your search before clicking on the Events<\/strong> tab.<\/p>\r\n\r\n\r\n\r\n

    Narrow your search to the contents of a folder only. If you wish to do this, click on the dropdown icon next to the folder name.<\/p>\r\n\r\n\r\n\r\n

    Why narrow your search? <\/strong><\/p>\r\n\r\n\r\n\r\n

      \r\n
    • Avoid unnecessary noise<\/li>\r\n
    • You won’t see the Event logs of files you are not interested in.<\/li>\r\n
    • You may only care about the contents of a particular folder.<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\n
      \"\"<\/figure>\r\n\r\n\r\n\r\n

      Once inside the folder you selected.<\/p>\r\n\r\n\r\n\r\n

      Then click on the Events tab.<\/p>\r\n\r\n\r\n\r\n

      \"\"<\/figure>\r\n\r\n\r\n\r\n

      The filter definition you defined in the Files<\/strong> tab will be partially be brought over to the Events<\/strong> tab.<\/p>\r\n\r\n\r\n\r\n

      Note:<\/strong> By default the first page from the filter definition is carried over, we need to make changes so that the entire filter defintion from Files tab is carried to the Events tab.<\/p>\r\n\r\n\r\n\r\n

      Within the Events tab, click on the existing custom filter button (which is blue – Active filter applied) and modify it slightly.<\/p>\r\n\r\n\r\n\r\n

      Change the type of search from Selected Page Search<\/strong> to Filtered Files Search.<\/strong><\/p>\r\n\r\n\r\n\r\n

      \"\"<\/figure>\r\n\r\n\r\n\r\n

      Filtered Files Search<\/strong> means that the scope in the Events<\/strong> tab will be whatever filter you defined in the Files<\/strong> tab.<\/p>\r\n\r\n\r\n\r\n

      \"\"<\/figure>\r\n\r\n\r\n\r\n

      We also have to add<\/strong> an additional Search Operator like<\/p>\r\n\r\n\r\n\r\n

        \r\n
      • Event<\/strong> equal<\/em> ACL Change<\/li>\r\n
      • Shared Out<\/strong> equal <\/em>Yes<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\n

        If we don’t add the above Search Operators, the events log of each file from our filter definition will be returned. A simple Google Doc might have hundreds events that occurred on it.<\/p>\r\n\r\n\r\n\r\n

        Results Displayed on Events tab<\/h3>\r\n\r\n\r\n\r\n

        Once the results are shown, you can export the results to a Google Spreadsheet<\/p>\r\n\r\n\r\n\r\n

        \"\"<\/figure>\r\n\r\n\r\n\r\n

        Conclusion<\/h3>\r\n\r\n\r\n\r\n

        Within GAT+, you can filter and find the metadata of a folder, you can then enter the folder (recursively) meaning that everything within the folder is displayed, all of the contents are returned. Once you define your scope in the Files tab, you need to navigate to Events tab, thats where you see the Event logs in greater detail.<\/p>\r\n\r\n\r\n\r\n

        Event logs show every action taken on a file from the moment it was created (all actions have a timestamp).<\/p>\r\n\r\n\r\n\r\n

        Within the Events tab, we altered the filter slightly so we can ignore a lot of actions and only focus on a particular action, like when a person altered the ACL permissions and caused the file to be shared out (exposed to an external user outside of the Workspace domain).<\/p>\r\n","protected":false},"excerpt":{"rendered":"

        Within GAT+, it is possible to retrieve and analyze all actions (Event logs) occurring on a file or folder by any users within the Google Workspace domain. The most common and frequent actions are view or edit but there may be other actions like download, delete, or ACL modified. ACL stands for Access Control List […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","template":"","meta":{"footnotes":""},"doc_category":[21],"glossaries":[],"doc_tag":[24],"class_list":["post-399","docs","type-docs","status-publish","hentry","doc_category-drive-management","doc_tag-gat"],"year_month":"2026-04","word_count":544,"total_views":"1162","reactions":{"happy":"0","normal":"0","sad":"0"},"author_info":{"name":"Enrique Gomez","author_nicename":"egomez","author_url":"https:\/\/gatlabs.com\/knowledge\/author\/egomez\/"},"doc_category_info":[{"term_name":"Drive Audit & Management","term_url":"https:\/\/gatlabs.com\/knowledge\/tech-tips-category\/drive-management\/"}],"doc_tag_info":[{"term_name":"GAT+","term_url":"https:\/\/gatlabs.com\/knowledge\/tech-tips-tag\/gat\/"}],"yoast_head":"\nWithin a Folder, Which Users Shared Out Content? - GAT Knowledge Base<\/title>\n<meta name=\"description\" content=\"Within GAT+, it is possible to retrieve and analyze all actions (Event logs) occurring on a file or folder by any users within the Google Workspace domain.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/gatlabs.com\/knowledge\/tech-tips\/within-a-folder-which-users-shared-out-content\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Within a Folder, Which Users Shared Out Content?\" \/>\n<meta property=\"og:description\" content=\"Within GAT+, it is possible to retrieve and analyze all actions (Event logs) occurring on a file or folder by any users within the Google Workspace domain.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/gatlabs.com\/knowledge\/tech-tips\/within-a-folder-which-users-shared-out-content\/\" \/>\n<meta property=\"og:site_name\" content=\"GAT Knowledge Base\" \/>\n<meta property=\"article:modified_time\" content=\"2022-02-16T10:44:51+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2021\/11\/screenshot-gs.generalaudittool.com-2021.11.16-16_19_35-1024x342.png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/gatlabs.com\\\/knowledge\\\/tech-tips\\\/within-a-folder-which-users-shared-out-content\\\/\",\"url\":\"https:\\\/\\\/gatlabs.com\\\/knowledge\\\/tech-tips\\\/within-a-folder-which-users-shared-out-content\\\/\",\"name\":\"Within a Folder, Which Users Shared Out Content? - GAT Knowledge Base\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/gatlabs.com\\\/knowledge\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/gatlabs.com\\\/knowledge\\\/tech-tips\\\/within-a-folder-which-users-shared-out-content\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/gatlabs.com\\\/knowledge\\\/tech-tips\\\/within-a-folder-which-users-shared-out-content\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/gatlabs.com\\\/knowledge\\\/wp-content\\\/uploads\\\/2021\\\/11\\\/screenshot-gs.generalaudittool.com-2021.11.16-16_19_35-1024x342.png\",\"datePublished\":\"2021-11-16T19:01:05+00:00\",\"dateModified\":\"2022-02-16T10:44:51+00:00\",\"description\":\"Within GAT+, it is possible to retrieve and analyze all actions (Event logs) occurring on a file or folder by any users within the Google Workspace domain.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/gatlabs.com\\\/knowledge\\\/tech-tips\\\/within-a-folder-which-users-shared-out-content\\\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/gatlabs.com\\\/knowledge\\\/tech-tips\\\/within-a-folder-which-users-shared-out-content\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/gatlabs.com\\\/knowledge\\\/tech-tips\\\/within-a-folder-which-users-shared-out-content\\\/#primaryimage\",\"url\":\"https:\\\/\\\/gatlabs.com\\\/knowledge\\\/wp-content\\\/uploads\\\/2021\\\/11\\\/screenshot-gs.generalaudittool.com-2021.11.16-16_19_35.png\",\"contentUrl\":\"https:\\\/\\\/gatlabs.com\\\/knowledge\\\/wp-content\\\/uploads\\\/2021\\\/11\\\/screenshot-gs.generalaudittool.com-2021.11.16-16_19_35.png\",\"width\":1906,\"height\":636},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/gatlabs.com\\\/knowledge\\\/tech-tips\\\/within-a-folder-which-users-shared-out-content\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/gatlabs.com\\\/knowledge\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Tech Tips\",\"item\":\"https:\\\/\\\/gatlabs.com\\\/knowledge\\\/tech-tips\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Within a Folder, Which Users Shared Out Content?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/gatlabs.com\\\/knowledge\\\/#website\",\"url\":\"https:\\\/\\\/gatlabs.com\\\/knowledge\\\/\",\"name\":\"GAT Knowledge Base\",\"description\":\"Your source of all things GAT\",\"publisher\":{\"@id\":\"https:\\\/\\\/gatlabs.com\\\/knowledge\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/gatlabs.com\\\/knowledge\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/gatlabs.com\\\/knowledge\\\/#organization\",\"name\":\"GAT Labs Knowledge Base\",\"url\":\"https:\\\/\\\/gatlabs.com\\\/knowledge\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/gatlabs.com\\\/knowledge\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/gatlabs.com\\\/knowledge\\\/wp-content\\\/uploads\\\/2021\\\/11\\\/Group-1159.svg\",\"contentUrl\":\"https:\\\/\\\/gatlabs.com\\\/knowledge\\\/wp-content\\\/uploads\\\/2021\\\/11\\\/Group-1159.svg\",\"width\":361,\"height\":97,\"caption\":\"GAT Labs Knowledge Base\"},\"image\":{\"@id\":\"https:\\\/\\\/gatlabs.com\\\/knowledge\\\/#\\\/schema\\\/logo\\\/image\\\/\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Within a Folder, Which Users Shared Out Content? - GAT Knowledge Base","description":"Within GAT+, it is possible to retrieve and analyze all actions (Event logs) occurring on a file or folder by any users within the Google Workspace domain.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/gatlabs.com\/knowledge\/tech-tips\/within-a-folder-which-users-shared-out-content\/","og_locale":"en_GB","og_type":"article","og_title":"Within a Folder, Which Users Shared Out Content?","og_description":"Within GAT+, it is possible to retrieve and analyze all actions (Event logs) occurring on a file or folder by any users within the Google Workspace domain.","og_url":"https:\/\/gatlabs.com\/knowledge\/tech-tips\/within-a-folder-which-users-shared-out-content\/","og_site_name":"GAT Knowledge Base","article_modified_time":"2022-02-16T10:44:51+00:00","og_image":[{"url":"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2021\/11\/screenshot-gs.generalaudittool.com-2021.11.16-16_19_35-1024x342.png","type":"","width":"","height":""}],"twitter_card":"summary_large_image","twitter_misc":{"Estimated reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/gatlabs.com\/knowledge\/tech-tips\/within-a-folder-which-users-shared-out-content\/","url":"https:\/\/gatlabs.com\/knowledge\/tech-tips\/within-a-folder-which-users-shared-out-content\/","name":"Within a Folder, Which Users Shared Out Content? - GAT Knowledge Base","isPartOf":{"@id":"https:\/\/gatlabs.com\/knowledge\/#website"},"primaryImageOfPage":{"@id":"https:\/\/gatlabs.com\/knowledge\/tech-tips\/within-a-folder-which-users-shared-out-content\/#primaryimage"},"image":{"@id":"https:\/\/gatlabs.com\/knowledge\/tech-tips\/within-a-folder-which-users-shared-out-content\/#primaryimage"},"thumbnailUrl":"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2021\/11\/screenshot-gs.generalaudittool.com-2021.11.16-16_19_35-1024x342.png","datePublished":"2021-11-16T19:01:05+00:00","dateModified":"2022-02-16T10:44:51+00:00","description":"Within GAT+, it is possible to retrieve and analyze all actions (Event logs) occurring on a file or folder by any users within the Google Workspace domain.","breadcrumb":{"@id":"https:\/\/gatlabs.com\/knowledge\/tech-tips\/within-a-folder-which-users-shared-out-content\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/gatlabs.com\/knowledge\/tech-tips\/within-a-folder-which-users-shared-out-content\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/gatlabs.com\/knowledge\/tech-tips\/within-a-folder-which-users-shared-out-content\/#primaryimage","url":"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2021\/11\/screenshot-gs.generalaudittool.com-2021.11.16-16_19_35.png","contentUrl":"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2021\/11\/screenshot-gs.generalaudittool.com-2021.11.16-16_19_35.png","width":1906,"height":636},{"@type":"BreadcrumbList","@id":"https:\/\/gatlabs.com\/knowledge\/tech-tips\/within-a-folder-which-users-shared-out-content\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/gatlabs.com\/knowledge\/"},{"@type":"ListItem","position":2,"name":"Tech Tips","item":"https:\/\/gatlabs.com\/knowledge\/tech-tips\/"},{"@type":"ListItem","position":3,"name":"Within a Folder, Which Users Shared Out Content?"}]},{"@type":"WebSite","@id":"https:\/\/gatlabs.com\/knowledge\/#website","url":"https:\/\/gatlabs.com\/knowledge\/","name":"GAT Knowledge Base","description":"Your source of all things GAT","publisher":{"@id":"https:\/\/gatlabs.com\/knowledge\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/gatlabs.com\/knowledge\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/gatlabs.com\/knowledge\/#organization","name":"GAT Labs Knowledge Base","url":"https:\/\/gatlabs.com\/knowledge\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/gatlabs.com\/knowledge\/#\/schema\/logo\/image\/","url":"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2021\/11\/Group-1159.svg","contentUrl":"https:\/\/gatlabs.com\/knowledge\/wp-content\/uploads\/2021\/11\/Group-1159.svg","width":361,"height":97,"caption":"GAT Labs Knowledge Base"},"image":{"@id":"https:\/\/gatlabs.com\/knowledge\/#\/schema\/logo\/image\/"}}]}},"knowledge_base_info":[],"knowledge_base_slug":[],"_links":{"self":[{"href":"https:\/\/gatlabs.com\/knowledge\/wp-json\/wp\/v2\/docs\/399","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/gatlabs.com\/knowledge\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/gatlabs.com\/knowledge\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/gatlabs.com\/knowledge\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/gatlabs.com\/knowledge\/wp-json\/wp\/v2\/comments?post=399"}],"version-history":[{"count":5,"href":"https:\/\/gatlabs.com\/knowledge\/wp-json\/wp\/v2\/docs\/399\/revisions"}],"predecessor-version":[{"id":2964,"href":"https:\/\/gatlabs.com\/knowledge\/wp-json\/wp\/v2\/docs\/399\/revisions\/2964"}],"wp:attachment":[{"href":"https:\/\/gatlabs.com\/knowledge\/wp-json\/wp\/v2\/media?parent=399"}],"wp:term":[{"taxonomy":"doc_category","embeddable":true,"href":"https:\/\/gatlabs.com\/knowledge\/wp-json\/wp\/v2\/doc_category?post=399"},{"taxonomy":"glossaries","embeddable":true,"href":"https:\/\/gatlabs.com\/knowledge\/wp-json\/wp\/v2\/glossaries?post=399"},{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/gatlabs.com\/knowledge\/wp-json\/wp\/v2\/doc_tag?post=399"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}