As an administrator, you might become aware of a malicious email that has been received by several users in your organization.
Using the investigation tool, you can identify all users in your domain that have received the message (for example, a phishing email). You can then use the investigation tool to delete the email from your users' Gmail inboxes (note that log data might take up to a few minutes before being available in the investigation tool).
- In addition to deleting an email, you can also use the investigation tool to take other actions, such as marking an email as spam, marking it as phishing, or sending it to the user's inbox.
- Some features in the security investigation tool—for example, data related to Gmail and Drive—are not available with Cloud Identity Premium or Enterprise Standard editions. For details see Data sources in the investigation tool.
Your access to the security investigation tool
- Supported editions for the security investigation tool include Enterprise Plus and Education Plus.
- Admins with Cloud Identity Premium, Enterprise Standard, and Education Standard can also use the investigation tool for a subset of data sources.
- Your ability to run a search in the investigation tool depends on your Google edition, your administrative privileges, and the data source. If you're unable to run a search in the investigation tool for a specific data source, you can generally use the audit and investigation page instead.
Find and delete malicious emails1. Get started with your investigation
- Sign in to use the investigation tool.
- From the Data source menu, click Gmail log events.
- Click Add Condition.
- From the Condition menu, click To (Envelope).
- Change the condition to Is.
- In the To (Envelope) field, enter the username of the user who received the malicious email—for example, email@example.com.
- Click ADD CONDITION.
- From the Condition menu, click Subject, and make sure the condition is set to Contains (the default option).
- In the Subject field, enter words that match the subject of the malicious email—for example, Dancing Santa.
(The words in your search don't need to be an exact match of the email's subject.)
- Click ADD CONDITION.
- From the Condition menu, click Date.
- Change the condition to After.
- In the Date field, enter the earliest date and time when the suspicious email was received by your users.
- Click SEARCH.
After you finish the above steps, the search results are displayed in a table at the bottom of the page. The table displays the date and time the message was sent, the message ID, the subject, the sender's email address, and the recipient's email address.
To export these search results to your My Drive folder, click the Export buttonat the top of the table.
For more details, see View search results in the investigation tool.
- Remove the Recipient condition from the above search criteria by clicking the button on the right side of the Recipient row. Your search will then include only the Subject and Date criteria.
- To search for other users that may have received the malicious email, click SEARCH.
The search results are displayed in a table at the bottom of the page. Similar to the search results in step 1 above, the table displays the date and time the message was sent, the message ID, the subject, the event type, and the sender's email address. However, the results also include the email addresses of other users in your organization that received the malicious email.
- To export these search results to your My Drive folder, click the Export iconat the top of the table.
- In the table at the bottom of the investigation tool, click the checkbox to select all. This automatically checks each box in the current page of the search results.
- From the ACTIONS menu, click Erase messages.
- Type in a name for the deletion task such as ERASE 10 MESSAGES.
- In the confirmation window, click ERASE.
This action deletes messages from users’ inboxes that match the message ID and owner, either sender or receiver depending on the event type, corresponding to the selected Gmail log events. Erased messages will still be subject to any applicable retention rules and holds set in Vault (for more details about retention rules and holds, see the Vault Help Center).
Note: In addition to erasing an email, you also have the option to take other actions such as marking the email as spam, marking it as phishing, or sending to the user's inbox.