Enable Gmail Logs in BigQuery

Due to a change by Google, Workbench is no longer able to search for related emails across Google Workspace inboxes in bulk. We are actively working on a workaround and will update this guide as soon as possible. In the interim, please reach out to Google to request they reinstate the export functionality for emails from BiqQuery.

The following procedure guides you through enabling logs for Gmail in BigQuery to make the most use of Expel Managed Phishing. For example, you can then run an Investigative Action that identifies recipients of malicious emails.

1. Sign in to the Google Admin Console.
2. Navigate to Apps > Google > Workspace > Gmail​ > Setup > Email Logs in BigQuery.
3. Select the Enable checkbox and enter a Description, such as "Gmail logs".
4. Select the ‌project to which the service account belongs.
5. Enter "gmail_logs_dataset" as the name for the new BigQuery dataset and select SAVE.
6. From the IAM console in the project where the service account was created, select the pencil icon, then search for and add the BigQuery Job User role to the service account.

1. Select SAVE.
2. Navigate to BigQuery in the Google Cloud console.
3. Find the gmail_logs_dataset, then open the menu on the right and select Open.

1. From the dataset details, select EDIT DETAILS.
2. Change the Default maximum table age to 30 days (Expel's recommendation).
3. Select SAVE.
4. Select SHARING > Permissions.

1. Under New principals, add the service account.
2. Select the BigQuery Data Viewer role.
3. Select SAVE to close the panel.