Improving consistency of Gmail data across the Security Investigation Tool and BigQuery

What’s changing 

In August 2022, we announced the movement of the existing Gmail logs in BigQuery to Google Workspace logs and reports in BigQuery, creating a single space to access all of your Google Workspace audit events. 

To further improve this experience, you’ll see all Gmail log events from the Security Investigation Tool (SIT) in your Google Workspace logs and reports in BigQuery. This includes device types and post-delivery actions (for example open, delete, clicked links, and attachment downloads). This change will give admins a more complete picture of Gmail activity happening in their domain, and bring consistency across reporting tools. 

Use the table below to familiarize yourself with the newly added columns — complete details can be found in our Help Center.

List of newly added columns



The event type corresponds to the Event attribute in Gmail log events in Security Investigation Tool.


The type of client or device where the action occurred, including: WEB, IOS, ANDROID, IMAP, POP3, and API.


Email address of the delegated user who performed the action on the account owner's behalf.


File attachment name.


Information about the post-delivery event.


Post-delivery action type.


Information about the user's interaction with message links, Drive items, or attachments.


The URL associated with the interaction, which is set only for link click interactions.


The unique ID of the Google Drive item associated with the interaction. This ID is used to access the item in Drive.


The target attachments of the interaction, which are set only for attachment interactions.


File extension (not MIME part type), not including the period.


Malware type, if malware is detected during message handling.


Attachment file name.


SHA256 hash of the attachment.

Getting started

Rollout pace


  • Available to Google Workspace Enterprise Essentials, Enterprise Standard, Enterprise Plus, Education Plus, Education Standard 
  • Not available to Google Workspace Essentials, Business Starter, Business Standard, Business Plus, Frontline, and Nonprofits, as well as legacy G Suite Basic and Business customers