A group in Google email can either be an address or a collection of people (all the members of firstname.lastname@example.org).
This is an important distinction for auditing purposes. Sometimes you want to audit for the group address, sometimes you want to audit for the collection of people.
GAT email auditing now supports both views.
To audit for email sent specifically from the address ‘email@example.com’ search for the address in the general search field
To audit for all the email sent by members of the group, use the Local User/Group search field
You can select the direction with the ‘Sent/Received’ filter.
It also works for Organization Units (and sub-OU’s if you include them in the tree).
An example use case might be to look at all emails ‘sent’ from ‘sales’ and create a second filter for emails ‘received’ by ‘support’, then go to the tab ‘Recent Filters’ and combine the two searches to see all the emails sent from members of sales to members of support.
While this feature is available in the Business Intelligence beta analyses, it is typical that large domains have too large data sets for local browsers to handle the BI processing. This filter set in the email auditing module allows the larger domains to get the spreadsheets they require for all group email activity.