Password vaulted apps log events

See admin and user activity related to password vaulted apps

Password vaulted apps were available in Enterprise, Education Standard and Education Plus editions until June 2022. Shutdown of this feature started on September 21, 2022, and will complete by June 21, 2023. Learn more

As your organization's administrator, you can run searches and take action on password vaulted apps log events. For example, you can see records of credentials access for an app. Password vaulted apps log event data includes both admin and user access logs.

Note: For details on when data becomes available and how long it's retained, go to Data retention and lag times

Run a search for log events

Your ability to run a search depends on your Google edition, your administrative privileges, and the data source. You can run a search on all users, regardless of their Google Workspace edition.

To run a search in the security investigation tool, first choose a data source. Then, choose one or more conditions for your search. For each condition, choose an attribute, an operator, and a value

Attribute descriptions

For this data source, you can use the following attributes when searching log event data:

Attribute Description
Actor Email address of the user who performed the action
Actor group name

The group name of the actor. For more information, go to Filtering results by Google Group.

To add a group to your filtering groups allowlist:

  1. Select Actor group name.
  2. Click Filtering groups.
    The Filtering groups page appears.
  3. Click Add Groups.
  4. Search for a group by entering the first few characters of its name or email address. When you see the group you want, select it.
  5. (Optional) To add another group, search for and select the group.
  6. When you finish selecting groups, click Add.
  7. (Optional) To remove a group, click Remove group .
  8. Click Save.
Actor organizational unit Organizational unit of the actor
Application credential name Name of the application credential used
Application installation name Name of the accessed application
Application username Username used to access the application
Client version Version of the Apps User Hub or browser extension used to access the application
Date Date and time of the event (displayed in your browser's default time zone)
Event The logged event action, such as User accessed Password Vaulted app.

Manage log event data

Take action based on search results

Manage your investigations

Supported editions for this feature: Frontline Standard and Frontline Plus; Enterprise Standard and Enterprise Plus; Education Standard and Education Plus; Enterprise Essentials Plus; Cloud Identity Premium. Compare your edition

Was this helpful?

How can we improve it?
9933714778284888696
true
Search Help Center
true
true
true
true
true
73010
false
false
Search
Clear search
Close search
Main menu
false
false