31 Audit-log export to SIEM/BigQuery

Workspace keeps its audit logs for a bounded period and offers only a console search over them. BigQuery Export streams the activity and usage events — login, admin, Drive, token — into a GCP project you control, where they outlive Google's retention window and can be queried properly. It is the substrate the WORM archive (№58) and the detection rules (№66) are built on, and the dataset region should match your data-region policy.

Documentation: About reporting logs and BigQuery ↗

Caveats

Enabling the export backfills history¹
Activity events land in BigQuery within about 10 minutes²
BigQuery Export requires Enterprise Standard+, Education Standard+, Frontline Standard+ or…³
The exported dataset is only as immutable as the GCP project it lands in⁴

Setup steps

open ↗
https://admin.google.com/ac/reporting/bigqueryexport · captured 2026-07-15
Reporting › Data integrations
Open Data integrations and configure BigQuery Export, pointing it at a GCP project you control (billing enabled).

BigQuery Export = On; Project = <dedicated logging project>; grant gapps-reports@system.gserviceaccount.com the project Editor role (or an equivalent IAM editor role) on that project

Set up service log exports to BigQuery ↗ Set up a BigQuery project for reporting logs ↗
Reporting › Data integrations
Select the dataset location and confirm the export covers activity events and usage reports.

Dataset region
matching your data-region policy (№24)
export
the date-partitioned activity + usage tables

Set up service log exports to BigQuery ↗
open ↗
https://admin.google.com/ac/sc/investigation · captured 2026-07-15
Reporting › Audit and investigation
Sanity-check that the source logs (login, admin, Drive, token) are populated in-console before relying on the export; then wait one full day and confirm the activity table has a partition for that date.

Verify the day's partition exists in the activity table (query _PARTITIONTIME)

About the audit and investigation tool ↗ Example queries for reporting logs in BigQuery ↗
Set the BigQuery dataset/table retention beyond Workspace's own log-retention window (that is the entire point of the export), and feed the WORM archive (№58) and detection rules (№66) from it.

Dataset default table expiration = never (or > your retention policy); onward sink to Bucket-Locked GCS

Data retention and lag times ↗

Ongoing maintenance

automatable: script Daily: alert if the newest exported event is older than 24h (fold into №52 heartbeat).

How to verify

Query the newest partition and check freshness — an export that silently stopped is the failure mode that matters.
```
bq query --use_legacy_sql=false 'SELECT MAX(time_usec) FROM `<project>.<dataset>.activity`'
```

v0.1.3Detectedition Ent/Edu/Frontline Std+, Ent Ess Plus policy #18 · #33 ↗