This feature is available with G Suite Enterprise, G Suite Enterprise for Education, Drive Enterprise, and Cloud Identity Premium editions.
To get started with the investigation tool:
- Sign in to the Google Admin console at admin.google.com.
Be sure to sign in using your administrator account, and not your personal Gmail account.
- Click Security.
- Click Investigation tool.