Save and share investigations

This feature is available for Beta customers.

As an administrator, you can create, save, and share investigations. This enables you to collaborate with others in your organization—both administrators and users—and to retain search criteria so that you can manage investigations for ongoing use.

Note: You also have the option to build a search for an investigation without saving it.

Create and save investigations

To create, save, and share an investigation:

  1. Sign in to the Google Admin console at
    Be sure to sign in using your administrator account, and not your personal Gmail account.
  2. At the top, click Menu Menu and select Security and then Investigation tool.
  3. Choose a data source for your search; for example, Device log events, Devices, or Gmail log events.
    You can include one or more conditions in your search. For details about conditions that are available for each data source, see Customize searches within the investigation tool.
  5. Click SEARCH.
  6. Click Save Save.
  7. Type a Title and Description for the investigation.
  8. Decide how your investigation will be shared.
    For example, you can set up the sharing so that anyone with the link to the investigation can access it as long as they are signed in to the investigation tool.
  9. Click SAVE.

Share investigations

After you create an investigation, you can share it with other users.

  1. In the investigation tool, click an investigation to open it.
  2. Click Share.
  3. Enter the usernames of people you want to share the investigation with. 
  4. Click DONE.
Was this helpful?
How can we improve it?