Posts

Google Drive: File Type Search

The file type table in Drive audit shows all of the files across your entire domain. Once you click on a particular file category, the filter will be applied and those files will appear in the Drive result table so you examine them in greater detail.

GAT+ File Type Search

When it comes to Google Drive, GAT returns all document details for all users by default. You can filter by any selection range using the custom filters button.

Apply custom filter

Once these results are returned you can then add further filter criteria on top of the Type filter.

For example:

Drive files filter

Note:  This search will return files of type Spreadsheet and which are also shared out of your domain.

 

Remember if this is a frequent search, you can ‘Apply & Save’ it.

How to Remove a G Suite User’s Access Rights

Easily remove G Suite users who have access to files they shouldn’t. Using GAT+ you can remove users from being editors or readers of files.

click to remove permissions

You can remove users by clicking on the drop-down menu next to their email address. The menu that appears will allow you to remove the user from one file or multiple files within the current filter which you have applied.

Here’s how you can remove deleted G Suite accounts as editors or viewers to Google Drive files.

A Content Search Feature in the Drive Audit

We have included a tab in the new Drive Audit UI for ‘Content Search’. This search is equivalent to the ‘Full Text’ search but it will allow for safe searching of all the files in ‘scope’ for any string being searched for.

Seeing Everyone’s Future Events – Scheduling a Report for Newly Created Events

GAT+ Calendar audit provides an effective and efficient way to audit the security and exposure of your domain users calendars. Not only can you modify permissions on primary and secondary calendars, you can also audit calendar events, past and future. As with all GAT audits, you can audit for a user, group, OU or the entire domain. In this helpful guide, you will learn how to view all of the past and future events and you learn how to remove events and participants from them.

 

Schedule a Job to report newly created future events each day.

In the Calendars Audit, select the ‘Events’ tab.

1. Set the period to ‘future’, this will show all forward events set for the next year.

In the Calendars Audit, select the ‘Events’ tab.

2. Click on the ‘Apply custom filter’ icon to see only those created today (Select from today’s date)

Click on the ‘Apply custom filter’ icon to see only those created today (Select from today’s date)

3. Now click on the ‘Apply custom filter’ button again so we can schedule this filter to run automatically to provide us with a report of all of the newly created future events each day.

click on the ‘Apply custom filter’ button again so we can schedule this filter to run automatically

Make sure to set the occurrence to run ‘Every day – after midnight’. Don’t worry about refreshing the created date, GAT+ will automatically move that forward whenever this scheduled job runs.

Click on the ‘Apply & Schedule’ button to activate this scheduled job.

 

Event Management

Now that we know how to schedule for newly created events for each day, Let’s review other things we achieve within the Calendar Event area.

 

Some quick actions you can take on events:

  • Delete an event or all recurring events.

  • Delete particular attendees from an event or for all occurrences of that recurring event.

Delete particular attendees from an event or for all occurrences of that recurring event.

 

Scheduled Reports in the new GAT+ UI

Creating a Scheduled Job

In the new GAT+ UI, you can easily create a scheduled job on a particular filter you have applied. For example, if you want to report on files changed since yesterday and to receive a report on it every day you can click on the ‘Apply custom filter’ in Drive Audit.

click on the ‘Apply custom filter’ in Drive Audit

 

Select the following parameter ‘Updated’ and set it to yesterday’s date. Creating scheduled reports is done by clicking on the ‘Scheduled’ checkbox on the drive file filter menu.

Creating scheduled reports is done by clicking on the ‘Scheduled’ checkbox on the drive file filter menu

I will set this report to run ‘Every day – after midnight’ and make sure the Enabled checkbox is ticked.

 

You can share this report with multiple admins and or users by adding their email address into the ‘Recipients’ field.

 

Note: Since this scheduled job is reporting on files changed since yesterday and its set to run every day after midnight, GAT+ will automatically increment the yesterday date.

 

You may be interested in expanding the above report, to report on files shared in and changed since yesterday or files shared out and changed etc.

To do this, you can simply expand on the filter and add another filter parameter. Click on ‘Add rule’ and select the ‘Sharing Flags’ parameter and set it to ‘Shared in’.

Click on ‘Add rule’ and select the ‘Sharing Flags’ parameter and set it to ‘Shared in’.

This will report on files shared in and changed since yesterday.

 

Note: You can change the search parameters to report back on all file types and or exposures. For more details contact support@generalaudittool.com

 

Viewing your scheduled jobs

 

Under the Configuration area of GAT+ you can view all the scheduled jobs which have been created by super admins by clicking on ‘Scheduled reports’

In this section, you can modify the existing scheduled reports.

 

Apply Permission Changes Down the Folder Tree

We’ve added a “recursive” option in the File Management. The recursive option will apply the permission changes right down the folder tree, covering files and subfolders.

  1. Search for the folder, using the Title parameter or the Folder Search Type when you click on a ‘Apply custom filter’ funnel icon.

Select the filter option

Enter the title of the folder.

enter the title

  1. Regardless of the search you use, once the folder appears you can click the drop-down next to the folder and select “Apply permission Change to this folder (recursive)”.

Or you can select multiple folders at the same time, by clicking on ‘Toggle selectable’ and then select the folders you want to make permission changes to.

and then select File Management button.

  1. You can then apply any permission change you wish and when the Recursive option is enabled, the permission change will be applied down the folder tree.

You can then apply any permission change you wish and when the Recursive option is enabled

See Where Certain Files Are On The Domain ‘Drive’

Keeping an organised Team Drive or myDrive folders structure is important so important that GAT+ has a specific tab called Folder Tree. The Folder Tree audit area lays out all of the folder structures for all your users myDrives and Team Drives.

 

You can now search for a specific Team Drive or users myDrive. Once you’ve located the folder you can descend through the folder tree.

You can now search for a specific Team Drive or users myDrive

Click on the folder name to display the ‘Detailed view’ and the ‘Files list’.

Click on the folder name to display the ‘Detailed view’ and the ‘Files list’.

See the detailed view

In the ‘Files list’ you can apply a custom to filter to find files based on a multitude of different search criteria.  You can click on the drop-down menu for any file and remove a particular editor or reader.

apply a custom to filter to find files based on a multitude of different search criteria

 

Powerful Things You Can Do from the Drive Audit List in GAT

This article shows you a few powerful things you can do in Google Drive Audit with GAT+.

1) Find the folder you want
find the folder you are looking for
and using the drop-down, find the contents.
click on "show contents of this folder"
2) Remove an editor or viewer from one or more files.
Once you select the files in the folder, you can remove an editor from one or many …
remove an editor from one or many
3) To see the full viewer or editor history of a file. Just select the file name and click the drop-down beside it.
Click on show events

View File Contents: How to silently copy or view files

To silently download or view files in your G Suite, do the following:

 

  1. In Drive Audit, search for the files you wish to view or download the contents of. You can use the ‘Apply custom filter’ button to search and find the specific files across your domain’s Drive.

use the ‘Apply custom filter’ button to search and find the specific files

 

  1. Here, I have carried out an arbitrary search for files owned by Marketing OU members. To do this I changed the type of search to a User/Group/OU search type. I used the ‘Add Rule’ button to combine multiple search operators. I only want to return file type which are Docs and which have been updated after June 1st, 2018.

use the ‘Add rule’ button to combine multiple search operators

Once you’re happy with your search criteria click on ‘Apply’ or if you wish to use this filter later on, save it by clicking on ‘Apply & Save’.

 

  1. Now click on the tick icon called ‘Toggle selectable’, this will allow you to select any file/folder. To select a file click on the checkbox on the left-hand side of the file name. You can select all files or individually select multiple files.

click on the tick icon called ‘Toggle selectable’

  1. Once the files you want to view or download are selected, click on the ‘Files operation’ button next to the ‘Toggle selectable’ icon. In the drop down menu you will see the option ‘Access permissions granted’ (for viewing/downloading file contents). Click on this option.

click on the ‘Files operation’ button next to the ‘Toggle selectable’ icon

  1. Now we have to send a fresh request to our security officer, Click on the tab called ‘New request’. Select an a sufficient amount of time to have access to the files you selected. You also have an optional area to type a short message to your security officer. Once you are satisfied click on ‘Send request’.

Click on the tab called ‘New request’. Select an a sufficient amount of time to have access to the files you selected.

  1. The following email will be sent to your security officer.

This email will be sent to your security officer

The security officer can click on the link in the email and they’ll be taken to the approval area in GAT+. In the Grants section, the security officer can see exactly which files he is giving access to before approving.

the security officer can see exactly which files he is giving access to before approving.

The Access Log keeps track of all the actions the super admins and security officers are taking.

the Access Log

  1. The requestor/Super admin can now return to Drive audit, click on ‘File Operation’ and select ‘Access permissions granted’ and under the ‘Current requests’ tab select the approved request.

access permissions granted tab on GAT+

  1. In the Actions column, click on the drop-down menu to see the options to download or Show file. When Show file is pressed you will gain silent access into that file.

In the Actions column, click on the drop-down menu to see the options to download or Show file.

 

Calendar Audit

Calendar Discovery

GAT+ supports full domain wide automatic calendar discovery and exposure classification.

GAT discovers all calendars, even those imported automatically. It also classifies them by exposure type.

Here’s a short video tutorial about the Google Calendar Audit

 

GAT can reveal all google calendars in your domain

You can click on the Apply Custom filter button to search for a particular calendar.

Apply Custom filter button to search for a google calendar

There are a multitude of different search operators you can use and also combine together to find the right calendar.

 

User Audit, Calendar Tab

In addition GAT has extended the User audit to show the numbers of calendars per user and the number of events per user, both past and scheduled.

see google calendar's past and future events with GAT+

The values under Calendars, Past events, Future events and Total columns are all clickable. Clicking on any value will take you to the Calendar audit section so you can view those events in detail.

 

Event Discovery

In addition to the automatic calendar discovery, GAT can report on domain-wide automatic event discovery.

select 'calendar events'

With the addition of ‘events’ reporting, Admins can now examine the past and future appointment list of users on the domain. This can be particularly useful for departing employees who may have future appointments management need to be aware of.

select the dropdown arrow

Managing Past/Future events:

  • Ability to delete an instance of an event
  • Ability to delete all recurring events
  • Remove users from events and/or recurring events