Many security center tasks are recorded though the Admin log event data source in the security investigation tool. This log data enables you to track the history of tasks performed in your Google Admin console, including which administrator performed the tasks.
For example, as a super admin, you might want to view what a delegated admin has done with drill-downs on the security center dashboard. You can go to Admin log events data and search for the admin's name. Using the results of this search, you can see which charts the admin has generated, and which filters were used on those charts.
Audit logs are always written; you can't configure, exclude, or disable the events.
Parameters for audit log events include the admin's name, the chart's name, and the range of dates queried. A new log event is created each time a user adds or removes a filter. If multiple filters are present, they are listed in a comma-delineated format.
For more details and instructions, see Admin log events: Security investigation tool.
Note: Admin activity on the security health page isn't audited. However, actions resulting from the information on the security health page are audited in that specific setting’s existing audit logs.
Your access to the security investigation tool
- The security investigation tool requires a premium Google Workspace edition (Enterprise Plus, Enterprise Standard, or Education Plus).
- You can access logs using the Chrome browser for the Google apps you have installed. For example, Gmail.
- Your ability to run a search in the investigation tool depends on your Google edition, your administrative privileges, and the data source. If you're unable to run a search in the investigation tool for a specific data source, you can use the audit and investigation page instead.
- You can run a search in the investigation tool on all users, regardless of the Google edition they have.
Log event data for the security center dashboard
In Admin log event data, you can find details about these security center dashboard events:
- Security Chart Drill-down—When an admin drills down on charts in the dashboard
- Security Chart Export—When an admin exports a chart in the dashboard
- Security Chart Drill-down Export—When an admin exports the drill-downs on charts in the dashboard
Log event data for the investigation tool
In Admin log event data, you can find details about these events in the investigation tool:
- Query performed
- Action performed
- Action completed
- Action cancelled
You can find details about these events when reviewers are requested for bulk actions:
- Action confirmed
- Action rejected
- Action verification requested
- Action verification request expires
