1. Choose the audit source that can answer the question
Google Workspace exposes different audit activities for different questions. Login activity can show explicit password and SAML sign-ins. Administrator activity records changes made in the Admin console. OAuth token activity helps trace third-party application authorization and access changes.
Do not treat one source as complete Workspace coverage. Google documents additional sources in the Admin console, while Flare’s current connector is deliberately limited to login, admin, and token Reports API activities.
Google references: Reports API login activity and security investigation data sources
2. Bound the investigation by user and UTC time
Write down the reported time, convert it to UTC, and add a deliberate buffer. Search the smallest relevant source first, then widen the window or move to adjacent sources. The Reports API supports source-specific queries, event names, time bounds, and pagination.
For suspicious-login review, Google documents an is_suspicious filter on login success events. That signal is useful context, but it is not a verdict and it does not cover every authentication path.
3. Reconstruct the actor, action, and access path
- Who?
- Confirm the affected user or administrator and whether the actor is expected for the account.
- What?
- Record the application, event name, parameters, and result from the original entry.
- When?
- Keep exact UTC timestamps and inspect nearby events before and after the trigger.
- How?
- Compare login type, OAuth application, and available network or device context.
- Target?
- Identify the setting, user, token, or application affected by the action.
- Intent?
- Validate the activity against tickets, administrator work, and the user’s account of events.
4. Prioritize combinations of unusual signals
- Suspicious login plus sensitive follow-up: a flagged login followed by administrator or OAuth changes deserves prompt review.
- Unexpected administrator action: security settings, roles, or account changes without a matching approved task.
- New OAuth application: a third-party app or changed authorization that the user and administrator cannot explain.
- Activity outside the normal path: an unfamiliar actor, time, application, or sequence is stronger when several signals coincide.
5. Record what the evidence cannot establish
Google notes that the login activity report covers explicit password and SAML-based SSO logins, not every possible authentication event. Available history, lag, fields, and sources vary. Absence from a bounded query is not proof that no activity occurred.
Preserve the source, query bounds, event identifiers, and unresolved questions. If the activity remains unexplained, follow your incident process for session, account, and application review.
Where Flare fits
Rank supported Workspace evidence for a small team.
Flare reads login, admin, and token Reports API activities for one verified Workspace customer, ranks noteworthy activity, and retains selected supporting evidence. It does not read Gmail or Drive content, other Reports applications, or a full directory.
Early access, manual analysis only. Choose a window of up to 30 days and check the coverage panel for truncation; each run retains up to 1,000 unique in-window provider records. Scheduled runs, deploy webhooks, and file uploads under this source are unavailable.
Findings are investigative leads—not proof that all activity is safe or malicious.