Depending on your Google Workspace edition, you might have access to the security investigation tool, which has more advanced features. For example, super admins can identify, triage, and take action on security and privacy issues. Learn more
As your organization's administrator, you can run searches and take action on security issues related to Contacts log events. For example, you can view a record of actions to track changes. This information is helpful when you troubleshoot issues or when your users notice discrepancies or unexpected changes to their Contacts. Log entries usually appear within 30 minutes of the user action.
Run a search for log events
Your ability to run a search depends on your Google edition, your administrative privileges, and the data source. You can run a search on all users, regardless of their Google Workspace edition.
Attribute descriptions
For this data source, you can use the following attributes when searching log event data:
Attribute | Description |
---|---|
Event | The logged event action, such as Delete a contact, Add to contacts, or Create bulk new contacts |
Note: If you gave a user a new name, you will not see query results with the user's old name. For example, if you rename OldName@example.com to NewName@example.com, you will not see results for events related to OldName@example.com.
Manage log event data
Manage search results column data
Export search result data
When and how long is data available?
Take action based on search results
Manage your investigations
Supported editions for this feature: Frontline Standard; Enterprise Standard and Enterprise Plus; Education Standard and Education Plus; Enterprise Essentials Plus; Cloud Identity Premium. Compare your edition