Configure settings for your investigations

Security investigation tool

From the security investigation tool, use the Settings window to configure settings for your investigations.

You must be signed in as a super administrator for this task.

Your access to the security investigation tool

  • Supported editions for the security investigation tool include Enterprise Plus and Education Plus.
  • Admins with Cloud Identity Premium, Enterprise Standard, and Education Standard can also use the investigation tool for a subset of data sources.
  • Your ability to run a search in the investigation tool depends on your Google edition, your administrative privileges, and the data source. If you're unable to run a search in the investigation tool for a specific data source, you can generally use the audit and investigation page instead.

What you can configure

Investigation settings apply to all administrators in your organization. Using these settings, super admins can do the following:

  • Turn on the Require reviewer setting to require reviewers for actions on large data sets—where over 300 items are affected.
  • Allow admins with the appropriate privileges to view sensitive content.
  • Require admins to enter justification text before they can view sensitive content.
  • Allow admins with the appropriate privileges to enter justification text before performing actions in the investigation tool.

Turn on the 'Require reviewer' setting

Require reviewers for bulk actions in the investigation tool:

  1. Sign in to your Google Admin console.

    Sign in using an account with super administrator privileges (does not end in @gmail.com).

  2. In the Admin console, go to Menu ""and then"" Securityand thenSecurity centerand thenInvestigation tool.
  3. Click Settings "".
  4. Turn on the Require reviewer setting.
  5. Click Apply.

For more details and instructions, see Require reviewers for bulk actions.

Turn on the 'View sensitive content' setting

Allow admins with the appropriate privileges to view sensitive content. This setting applies to apps such as email, chat messages, and chat attachments.

  1. Sign in to your Google Admin console.

    Sign in using an account with super administrator privileges (does not end in @gmail.com).

  2. In the Admin console, go to Menu ""and then"" Securityand thenSecurity centerand thenInvestigation tool.
  3. Click Settings "".
  4. Turn on the View sensitive content setting.
  5. (Optional) Turn on the toggle button to require admins to enter justification text before viewing sensitive content. 
  6. Click Apply.

For more details and instructions, see View sensitive content.

Note: If you previously had this setting turned off (for Gmail), admins who were able to access chat content won't be able to do so any longer. To make sure admins with the correct privileges can access chat content, you'll need to turn on the View sensitive content setting.

Turn on the 'Enable action justification' setting

Allow admins with the appropriate privileges to enter justification text before performing actions in the investigation tool:

  1. Sign in to your Google Admin console.

    Sign in using an account with super administrator privileges (does not end in @gmail.com).

  2. In the Admin console, go to Menu ""and then"" Securityand thenSecurity centerand thenInvestigation tool.
  3. Click Settings "".
  4. Turn on the Enable action justification setting.
  5. Click Apply.

Change the timezone in the investigation tool

You can change the global timezone in the security investigation tool. The timezone applies to search conditions and results. The timezone currently does not persist between sessions. 

To change the timezone:

  1. Sign in to your Google Admin console.

    Sign in using an account with super administrator privileges (does not end in @gmail.com).

  2. In the Admin console, go to Menu ""and then"" Securityand thenSecurity centerand thenInvestigation tool.
  3. Click Settings "".
  4. Click the down arrow"" for the Timezone setting.
  5. From the drop-down menu, choose from the list of timezones.
  6. Click Apply.

Note: You can adjust the timezone for a search even after a search is completed and you have the results. Both the parameters you have entered and the results will be updated to the new timezone. For example, if your global timezone is Pacific time, and one of your search results displays a time parameter of 1:00 PM Pacific time, updating your timezone to Eastern time will change this search result to 4:00 PM Eastern time.

Was this helpful?
How can we improve it?

Need more help?

Sign in for additional support options to quickly solve your issue

Search
Clear search
Close search
Google apps
Main menu
Search Help Center
true
73010
false
false