Due to a change by Google, Workbench is no longer able to search for related emails across Google Workspace inboxes in bulk. We are actively working on a workaround and will update this guide as soon as possible. In the interim, please reach out to Google to request they reinstate the export functionality for emails from BiqQuery.
The following procedure guides you through enabling logs for Gmail in BigQuery to make the most use of Expel Managed Phishing. For example, you can then run an investigative action that identifies recipients of malicious emails.
- Sign in to the Google Admin Console.
- Navigate to Apps > Google > Workspace > Gmail > Setup > Email Logs in BigQuery.
- Select the Enable checkbox and enter a Description.
- Select the project to which the service account belongs.
-
Enter gmail_logs_dataset as the name for the new BigQuery dataset and select SAVE.
-
From the IAM console in the project where the service account was created, select the pencil icon and add the role BigQuery Job User to the service account.
-
Search for and add BigQuery Job User and select SAVE.
- Navigate to BigQuery in the Google Cloud console: https://console.cloud.google.com/bigquery.
- Find the gmail_logs_dataset.
-
Open the menu on the right and select Open.
-
From the dataset details, select EDIT DETAILS, and then set the default retention from 60 days.
We recommend setting retention to 30 days.
-
Enter the length of time to retain the log tables and select SAVE.
-
Select SHARING and select Permissions.
- Under New principals, add the service account.
- Select the BigQuery Data Viewer role.
-
Select SAVE to close the panel.