Google Workspace Drive Audit Log Events

Location

Description

Google Drive and shared-drive audit events covering file access, downloads, external sharing, permission changes, ownership transfers, and bulk data movement indicators.

Forensic Value

Drive audit events are high-value evidence for insider threat, token abuse, and data-exfiltration cases. They identify exactly which documents were accessed or shared, by whom, from which IP, and whether sharing or permission changes expanded exposure.

Tools Required

Collection Commands

Reporting > Audit and investigation > Drive log events > Filter by actor, owner, shared-drive, and document ID > Export evidence

GET https://admin.googleapis.com/admin/reports/v1/activity/users/all/applications/drive?startTime=2026-03-01T00:00:00.000Z

Collection Constraints

• •Drive audit logging shows file actions and sharing metadata, not a preserved copy of the document content.
• •Shared-drive and cross-domain visibility depends on admin scope and retention settings at export time.

MITRE ATT&CK Techniques

References