Connect read-only
Connect a Workspace administrator with audit-report and customer-profile access. Flare verifies the customer ID you enter and requests only read-only report and customer scopes.
Identity and administrator activity
Investigate Google Workspace audit logs with evidence
Review suspicious logins, administrator role and security-setting changes, and new OAuth grants. Flare ranks unusual activity, preserves selected event evidence, and explains what to verify next.
Early access. Check availability for your account in Connectors. Manual analysis only.
Turn Google Workspace audit activity into an investigation queue
Reads login, admin and token Reports API activities for one verified Workspace customer. Does not read Gmail or Drive content, other Reports applications or a full directory. Available history and reporting delays depend on Google.
Review ranked findings
Flare assesses current-window evidence with available historical context, then ranks noteworthy activity by severity and explains why it matters.
Investigate the evidence
See which streams were fetched, any truncation and selected event excerpts. Ask follow-up questions against the retained result. Findings are investigative leads, not proof that all activity is safe.
Start with the event, then verify the sequence
Each finding keeps the source, actor, UTC window, and selected event evidence visible so your team can confirm what happened in Google before deciding how to respond.
Suspicious login followed by an administrator change
Review the login result and available context, then compare the nearby administrator event with an approved task or the user’s expected activity.
New authorization for an unfamiliar application
Inspect the application, actor, event name, selected parameters, and UTC sequence before confirming whether the access was expected.
Unexpected role or security-setting change
Trace the administrator, affected target, and adjacent activity, then validate the change against a ticket or an authorized owner.
Useful audit-log answers without a SIEM project
Bounded access and retention
Flare uses read-only access and retains analysis results with selected supporting evidence—not a complete copy of your logs.
Using another source?
Explore GitHub Enterprise Cloud audit coverage, access requirements and availability.
Start with real evidence
See what changed in Google Workspace.
Connect your verified account, choose a time window and run an analysis. Scheduled runs, deploy webhooks and file uploads under this source are not supported.
Get started