Supported editions for this feature: Enterprise Plus, Education Plus. Compare your edition
As an administrator, you might need to view sensitive content of a Gmail message, Chat message, or Chat attachment as part of an investigation. Using the investigation tool, you can find the message and view its contents. You can also investigate whether a DLP rule violation is a real incident or a false positive.
Important:Before you can view sensitive message content, a Super Admin will need to adjust the investigation tool settings to provide access to administrators in your organization. For details and instructions, see Configure settings for your investigations .
Before you begin
You need the View sensitive contentprivilege to view sensitive message content. For details, see Admin privileges for the investigation tool .
View sensitive email content
Step 1: Get started with your investigation- Sign in to use the investigation tool .
- From the Data sourcelist, select Gmail messagesor Gmail logs.
Note:Gmail data sources are available only with Enterprise Plus and Education Plus editions.
- Click Add Condition.
- Using the menus, search for the email you want to see. For details, see Customize searches within the investigation tool .
- Click Search.
- In the search results, for the Gmail message you want to investigate, click the subject or message ID.
You’ll see the message header. To view contents of the message, you need to provide justification (see step 2).
- At the top of the message header, click Message.
- Enter the reason why you need to view the message contents. The reason you enter is recorded in the Admin audit log.
Tip:Remember to include important information, such as a ticket number or if legal counsel gave approval to view the message. - Click Confirm.
After you provide justification to view the message, you’ll see the contents of the message. Then, you can take the following actions on the message:
- Delete message
- Mark as spam
- Mark as phishing
- Send to inbox
- Send to quarantine
From the Messagetab or Threadtab, you can also view VirusTotal reports related to email attachments. For details and instructions, see View VirusTotal reports from the investigation tool .
