Analyze Google Workspace Audit Logs Step by Step

TL;DR. Drop your Workspace exports (Admin console CSV, Reports API JSON, GAM CSV, Gmail settings JSON; loose, zipped or gzipped) on the analyzer home page. You get a verdict with reasons, findings mapped to MITRE ATT&CK with one-click evidence, an incident timeline, an entity pivot and a remediation checklist. It runs as WebAssembly in your browser: the logs never leave your machine. Five minutes with the "Try a sample" button shows the whole flow on a fictional case.

This is the practical companion to the investigation guide. It explains what the tool does with each file, how to read its output and where its judgement ends.

Before you start: what to collect

The verdict is only as good as its inputs. The minimum for a suspected mailbox compromise:

Add Drive, Admin, SAML, Takeout and Groups for scope. How to get each one: export Google Workspace audit logs.

Step 1: load the files

Open the home page and drop everything you have: loose files, a folder, a ZIP, .gz, all mixed. The tool:

• recognises Admin console CSV exports by their English headers and event titles ("Successful login", "Download"…) and maps them back to API names;
• reads GAM gam report … CSVs (id.time, actor.email, name…);
• reads Reports API activities.list pages, arrays or JSON Lines, flattening nested parameters;
• reads Gmail API settings responses and takes the mailbox owner from the folder name (gmail-settings/jane@example.com/filters.json).

Files are streamed in 4 MiB chunks in a Web Worker, so multi-gigabyte exports work. Above 200,000 events it keeps only the events a rule can use for display, and it caps display at 600,000 (every event is still counted). Adding more files later re-runs the analysis on everything.

Step 2: read the verdict, then the coverage

The verdict has three levels:

• Compromised: a critical finding (a correlation chain) fired, or high-severity findings from two different categories hit the same account.
• Suspicious: at least one medium or high finding.
• Clean: nothing fired. That is not proof of absence.

Read the coverage panel right after. It lists each log source with its event count and time span, and the sources that were not provided. A "clean" result without the OAuth log or the Gmail settings means you haven't looked at two of the three usual persistence mechanisms.

Step 3: review each finding and its evidence

The Findings tab sorts detections by severity. Each finding shows the account, the time span, the number of events, a summary of distinct values (IPs, scopes, filter criteria, recipients) and its MITRE ATT&CK techniques. Show evidence filters the event table to exactly the events behind it.

The 37 rules are plain JSON in the source repository (rules.json). The main families:

For each finding, ask the account owner the obvious question. Travel, a VPN egress or an approved app explain many single findings. They don't explain a chain.

Step 4: build the timeline and pivot

The Incident timeline tab lists every event that supports a finding, in order, with bursts collapsed (for example "×24 events" for a download burst). Gmail settings are snapshots without a timestamp, so they come last. Toggle UTC or local time before you write anything down.

The Entities tab is where scoping happens:

• Users: event counts, first and last seen, IPs, countries, findings;
• IP addresses: ASN, hosting tag, users seen, flagged or not. Pivot from the attacker's IP to every other account it touched;
• OAuth apps: scopes, grants, API calls. Did the lure app reach other users?
• Drive files: downloads and sharing changes per file;
• External addresses: forwarding targets, filter forwards, delegates, send-as, recipients of flagged mail, Drive shares, group members.

The All events tab has free-text filtering, a "flagged only" switch, sorting and CSV export. Exported cells are guarded against spreadsheet formula injection.

Step 5: work the remediation checklist

The Remediation tab turns the findings into ordered steps. Contain the session, reset the password, review 2SV, remove forwarding, filters and delegates, revoke and block the app, review domain-wide delegation, admins and SSO, review Drive sharing and Takeout, warn suppliers, check payments, preserve logs, block IPs. Each step says which findings it comes from. The rationale for the order is in the first-hour checklist. The ticks are kept on the page only.

Finally, export the JSON report (verdict, findings, timeline, entities) and a filtered CSV for the case file.

How it compares with Google's security investigation tool

Google's own security investigation tool (in some editions) searches the same log sources live and can act on them, for example deleting messages. It does not correlate events into a verdict. The analyzer here does the opposite: it doesn't touch the tenant, and it runs cross-source rules on exported files. You can use both: search in Google's tool, export, analyze here.

Limits you should state in your report

• English Admin console exports only. Other console languages aren't mapped yet.
• Country-based rules need network info (Reports API networkInfo or a country column). There is no GeoIP lookup.
• No allow-lists yet: known VPN egress IPs and approved apps will fire.
• Message content, Vault exports, Email Log Search, device and Chrome logs are out of scope.

More on the data itself: audit log limitations. A complete run on the sample: fictional BEC investigation example.