Configure settings for your investigations

From the security investigation tool, use the Settings window to configure settings for your investigations.

You must be signed in as a super administrator for this task.

Your access to the security investigation tool

• The security investigation tool requires a premium Google Workspace edition (Enterprise Plus, Enterprise Standard, or Education Plus).
• You can access logs using the Chrome browser for the Google apps you have installed. For example, Gmail.
• Your ability to run a search in the investigation tool depends on your Google edition, your administrative privileges, and the data source. If you're unable to run a search in the investigation tool for a specific data source, you can use the audit and investigation page instead. 
• You can run a search in the investigation tool on all users, regardless of the Google edition they have.

What you can configure

Investigation settings apply to all administrators in your organization. Using these settings, super admins can do the following:

• Turn on the Require reviewer setting to require reviewers for actions on large data sets—where over 300 items are affected.
• Allow admins with the appropriate privileges to view sensitive content.
• Require admins to enter justification text before they can view sensitive content.
• Allow admins with the appropriate privileges to enter justification text before performing actions in the investigation tool.

Turn on the Require reviewer setting

Require reviewers for bulk actions in the investigation tool:

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. In the Admin console, go to Menu  SecuritySecurity centerInvestigation tool.
3. Click Settings .
4. Turn on the Require reviewer setting.
5. Click Apply.

For more details and instructions, see Require reviewers for bulk actions.

Turn on the View sensitive content setting

Allow admins with the appropriate privileges to view sensitive content. This setting applies to apps such as email, chat messages, and chat attachments.

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. In the Admin console, go to Menu  SecuritySecurity centerInvestigation tool.
3. Click Settings .
4. Turn on the View sensitive content setting.
5. (Optional) Turn on the toggle button to require admins to enter justification text before viewing sensitive content. 
6. Click Apply.

For more details and instructions, see View sensitive content.

Note: If you previously had this setting turned off (for Gmail), admins who were able to access chat content won't be able to do so any longer. To make sure admins with the correct privileges can access chat content, you'll need to turn on the View sensitive content setting.

Turn on the Enable action justification setting

Allow admins with the appropriate privileges to enter justification text before performing actions in the investigation tool:

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. In the Admin console, go to Menu  SecuritySecurity centerInvestigation tool.
3. Click Settings .
4. Turn on the Enable action justification setting.
5. Click Apply.

Change the timezone in the investigation tool

You can change the global timezone in the security investigation tool. The timezone applies to search conditions and results. The timezone currently does not persist between sessions. 

To change the timezone:

1. Sign in to your Google Admin console.

   Sign in using an account with super administrator privileges (does not end in @gmail.com).

2. In the Admin console, go to Menu  SecuritySecurity centerInvestigation tool.
3. Click Settings .
4. Click the down arrow for the Timezone setting.
5. From the drop-down menu, choose from the list of timezones.
6. Click Apply.

Note: You can adjust the timezone for a search even after a search is completed and you have the results. Both the parameters you have entered and the results will be updated to the new timezone. For example, if your global timezone is Pacific time, and one of your search results displays a time parameter of 1:00 PM Pacific time, updating your timezone to Eastern time will change this search result to 4:00 PM Eastern time.