https://www.googleworkspaceforensics.com/en/blog Latest from Blog en Mon, 28 Sep 2026 22:07:49 GMT https://www.googleworkspaceforensics.com/en/blog/google-workspace-audit-log-limitations https://www.googleworkspaceforensics.com/en/blog/google-workspace-audit-log-limitations What Google Workspace audit logs can't tell you: 6-month retention, lag times, export row caps, CSV vs Reports API fields, license gaps and other blind spots. Florian Amette Sun, 27 Sep 2026 00:00:00 GMT https://www.googleworkspaceforensics.com/en/blog/google-workspace-bec-investigation-example https://www.googleworkspaceforensics.com/en/blog/google-workspace-bec-investigation-example A fictional business email compromise in Google Workspace, worked from the audit logs: AiTM sign-in, OAuth grant, hidden filter, fraud mail and Drive theft. Florian Amette Thu, 24 Sep 2026 00:00:00 GMT https://www.googleworkspaceforensics.com/en/blog/google-workspace-incident-response-checklist https://www.googleworkspaceforensics.com/en/blog/google-workspace-incident-response-checklist A first-hour checklist for a compromised Google Workspace account: preserve logs, cut sessions and OAuth tokens, remove forwarding and filters, stop payments. Florian Amette Mon, 21 Sep 2026 00:00:00 GMT https://www.googleworkspaceforensics.com/en/blog/google-workspace-admin-role-sso-abuse https://www.googleworkspaceforensics.com/en/blog/google-workspace-admin-role-sso-abuse If a Google Workspace super admin is compromised: Admin log events for new admins, role grants, SSO changes, delegation, mail routing and compliance rules. Florian Amette Fri, 18 Sep 2026 00:00:00 GMT https://www.googleworkspaceforensics.com/en/blog/google-drive-mass-download-exfiltration https://www.googleworkspaceforensics.com/en/blog/google-drive-mass-download-exfiltration Detect data theft in Google Workspace: Drive mass download bursts, external sharing, public links, owner transfers and Google Takeout exports in audit logs. Florian Amette Wed, 16 Sep 2026 00:00:00 GMT https://www.googleworkspaceforensics.com/en/blog/google-workspace-domain-wide-delegation-risks https://www.googleworkspaceforensics.com/en/blog/google-workspace-domain-wide-delegation-risks Domain-wide delegation security risks: how an API client can impersonate every user, the Admin log events that record it, DeleFriend and what to review. Florian Amette Mon, 14 Sep 2026 00:00:00 GMT https://www.googleworkspaceforensics.com/en/blog/suspicious-oauth-app-google-workspace https://www.googleworkspaceforensics.com/en/blog/suspicious-oauth-app-google-workspace Investigate a suspicious OAuth app in Google Workspace: read token log authorize and activity events, judge Gmail and Drive scopes, revoke and block the app. Florian Amette Sat, 12 Sep 2026 00:00:00 GMT https://www.googleworkspaceforensics.com/en/blog/gmail-forwarding-rule-hacker https://www.googleworkspaceforensics.com/en/blog/gmail-forwarding-rule-hacker How to find the Gmail forwarding rule or hidden filter a hacker left in a Workspace mailbox: the log events, the Gmail settings to export and what to delete. Florian Amette Thu, 10 Sep 2026 00:00:00 GMT https://www.googleworkspaceforensics.com/en/blog/google-workspace-suspicious-login-2sv https://www.googleworkspaceforensics.com/en/blog/google-workspace-suspicious-login-2sv Investigate a Google Workspace suspicious login: is_suspicious, hosting ASNs, new countries, impossible travel, failed-login bursts, 2SV and recovery changes. Florian Amette Tue, 08 Sep 2026 00:00:00 GMT https://www.googleworkspaceforensics.com/en/blog/analyze-google-workspace-audit-logs https://www.googleworkspaceforensics.com/en/blog/analyze-google-workspace-audit-logs Step by step: load Google Workspace audit exports into a free in-browser analyzer, read the verdict and evidence, build a timeline, work the remediation list. Florian Amette Sat, 05 Sep 2026 00:00:00 GMT https://www.googleworkspaceforensics.com/en/blog/export-google-workspace-audit-logs https://www.googleworkspaceforensics.com/en/blog/export-google-workspace-audit-logs Export Google Workspace audit logs for an investigation: Admin console CSV, the Reports API (activities.list), GAM reports and Gmail settings, with limits. Florian Amette Thu, 03 Sep 2026 00:00:00 GMT https://www.googleworkspaceforensics.com/en/blog/google-workspace-compromise-investigation https://www.googleworkspaceforensics.com/en/blog/google-workspace-compromise-investigation How to tell if a Google Workspace account was compromised: which audit logs to pull, the event names that matter, how to correlate them and what to rule out. Florian Amette Tue, 01 Sep 2026 00:00:00 GMT