find "resource name" from Vault log search

[ad-Josh Townsend]

I'm investigating mis-use of the Google Vault function. Need to see what emails were viewed by a particular user that had the super admin role.  In Reporting > Audit and investigation > Vault log events", I found a hit on the user, and in the event, it provided a long string named "resource name".

Does GAM have a command that would identify a given "resource name" based on a Vault logged event from a user?

[Ross Scroggs]

I doubt it; send me a Meet/Zoom invitation, show me the example and we'll go from there.

Ross

----

Ross Scroggs

Ross.S...@gmail.com

On Apr 29, 2024, at 3:01 PM, 'ad-Josh Townsend' via GAM for Google Workspace <google-ap...@googlegroups.com> wrote:

I'm investigating mis-use of the Google Vault function. Need to see what emails were viewed by a particular user that had the super admin role.  In Reporting > Audit and investigation > Vault log events", I found a hit on the user, and in the event, it provided a long string named "resource name".

Does GAM have a command that would identify a given "resource name" based on a Vault logged event from a user?

--
You received this message because you are subscribed to the Google Groups "GAM for Google Workspace" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/2e0b61b5-0056-48f1-a8c7-3a1340d8a2b8n%40googlegroups.com.

[David Pavek]

Hi,

I am trying to do the exact same thing. Were you able see what the user opened? I was at a conference recently and spoke with some google product engineers. They said, as the super user you should be able to see the document/email using GAM. They went on to say that the resource name string was the metadata from the object viewed.