We launched the investigation tool as an Early Adopter Program (EAP) in July and are now making it generally available (GA). It will help G Suite admins and security analysts identify, triage, and remediate security threats within their organization. This tool builds on the existing capabilities in the security center to help admins:

  • Identify security issues within their domain using advanced search capability.
  • Triage threats targeting users, devices, or data.
  • Take bulk actions to limit the propagation and impact of threats.


Since our EAP announcement, we’ve been hard at work using the feedback from participants to improve the product. As a result, this release will have the following key new features:

  • Enhanced security to prevent insider risk - You can now require a second admin to verify large actions in the investigation tool.
  • More fine-grained visibility while investigating incidents - Email header analysis allows you to see important attributes and the delivery path for the email. We’ve also added visibility into Team Drive settings and the ability to modify access permissions directly from the tool.
  • Simplified interface - With user auto-complete, emails and names from your organization will be auto-completed as you type parameters in the investigation tool.
We hope the investigation tool helps you manage your organization’s data security. See the Help Center for more information on the tools available to provide visibility into security issues in your domain.

Launch Details
Release track:
Launching to both Rapid Release and Scheduled Release

Editions:
Available to G Suite Enterprise and Enterprise for Education editions only

Rollout pace:
Full rollout (1–3 days for feature visibility)

Impact:
Admins only

Action:
Admin action suggested/FYI

More Information
G Suite Updates blog: Triage and remediate threats with new investigation tool in G Suite security center Early Adopter Program
G Suite blog: Gain deeper organizational insights with new features in G Suite

Launch release calendar
Launch detail categories
Get these product update alerts by email
Subscribe to the RSS feed of these updates