Google Workspace
Admin, login, Drive and Gmail audit logs from the Reports API.
Category
Identity
Setup
About 10 minutes
Events Wardell reads
Logins, admin actions, Drive sharing, OAuth grants
A service account with read-only Reports API scopes is all Wardell needs. Drive, login, admin and token events arrive within five minutes, which is as fast as Google publishes them.
Detections cover mass downloads, external sharing of sensitive folders, new OAuth apps with Gmail scopes and admin privilege changes.
What Wardell watches
Mass download and external share detections
Third-party OAuth app review
Super admin change alerts
Suspend user from a case
Try it on your own logs
Connect this source with a read-only key. Within 48 hours a Wardell analyst sends a written report of what it would have caught.
