1. Expel Help Center
  2. Expel Managed Phishing
  3. Get Started With Managed Phishing

Enabling Gmail Logs in BigQuery

The following procedure guides you through enabling logs for Gmail in BigQuery to make the most use of Expel Managed Phishing. For example, you can then run an investigative action that identifies recipients of malicious emails. 

 

  1. Sign in to the Google Admin Console.
  2. Navigate to Apps > Google > Workspace > Gmail​ > Setup > Email Logs in BigQuery.

  3. Select the Enable checkbox and enter a Description.

  4. Select the ‌project to which the service account belongs.

  5. Enter gmail_logs_dataset as the name for the new BigQuery dataset and select SAVE.

    mceclip1.png

  6. From the IAM console in the project where the service account was created, select the pencil icon and add the role BigQuery Job User to the service account.

    mceclip8.png

  7. Search for and add BigQuery Job User and select SAVE.

    mceclip9.png

  8. Navigate to BigQuery in the Google Cloud console: https://console.cloud.google.com/bigquery.

  9. Find the gmail_logs_dataset.

  10. Open the menu on the right and select Open.

    mceclip2.png

  11. From the dataset details, select EDIT DETAILS, and then set the default retention from 60 days.

    We recommend setting retention to 30 days. 

    mceclip3.png

  12. Enter the length of time to retain the log tables and select SAVE.

    mceclip13.png

  13. Select SHARING and select Permissions.

    mceclip4.png

  14. Under New principals, add the service account.

  15. Select the BigQuery Data Viewer role.

  16. Select SAVE to close the panel.

    mceclip15.png

Related articles