How do you use the Google Workspace security investigation tool to remove phishing email?

When one phishing email lands in dozens of Gmail inboxes, asking each user to delete it is too slow. The Google Workspace security investigation tool lets an admin find every copy and remove or quarantine it in one action. This guide covers which editions include it, the Gmail data sources, a step-by-step phishing cleanup, and how it differs from Email Log Search. It reflects Google's documentation at the time of writing (October 2026).

What is the security investigation tool?

Google describes it as a way to "identify, triage, and take action on security and privacy issues in your domain" (Google Workspace Admin Help). You pick a data source, build conditions from attributes, operators and values, run the search, and act on the results.

For email, it can "find and erase malicious emails, mark emails as spam or phishing, or send emails to users' inboxes." It also covers devices, users, Drive, Meet, Chat and more, which is useful when a phishing click turns into an account investigation.

You'll find it in the Admin console at Menu > Security > Security center > Investigation tool.

Which editions and privileges do you need?

This is where most admins get caught out. The tool has broader availability than its Gmail data.

Google's malicious-email walkthrough is explicit: "Gmail log events are available only with Frontline Plus, Enterprise Plus, and Education Plus editions" (Google Workspace Admin Help). On Business plans or Enterprise Standard, you won't have this path for removing mail; the alternatives are covered near the end of this guide.

For privileges, Google says you need "an administrator with Audit and investigation privileges." Super admins have them. For a custom role, under Services > Security Center > Audit and investigation (Google Workspace Admin Help):

• View lets the admin run searches and see results.
• Manage lets the admin change content, such as deleting an email.
• View sensitive content lets the admin open full messages and attachments, if a super admin has turned on the setting.

Which Gmail data sources can you search?

Gmail log events

Gmail log events record activity such as sends, deliveries, spam classification, quarantine and user actions like link clicks and attachment downloads. Useful attributes include To (Envelope), From (Header address), Subject, Message ID, Event and Date. Google says Gmail log events show up in "near real time (couple of minutes)" and are kept for 6 months (Data retention and lag times).

The Event attribute matters during an incident. Google lists events such as Link click and Attachment download, which help you see whether anyone interacted with the phishing message, not just received it.

Gmail messages

The Gmail messages data source searches "live-state data about Gmail messages", including All content (body text and common attachment types such as DOC, XLS and PDF), Attachment name, Label, Message ID, Sender and Subject (Google Workspace Admin Help). Google notes two limits: it doesn't include "URLs of links in the message body" in the content search, and you "can only search for data in messages that have not yet been deleted from Trash."

How do you find and remove a phishing email from every mailbox?

This follows Google's own procedure for reports of malicious email.

Step 1: Find one copy

1. Go to Security > Security center > Investigation tool.
2. Click Data source and choose Gmail log events.
3. Click Add Condition, choose To (Envelope), set the operator to Is, and enter the address of the user who reported it.
4. Add a Subject condition with Contains and words from the subject. Google says they "don't need to be an exact match".
5. Add a Date condition set to After the earliest time the email arrived.
6. Click Search.

Note the Message ID and the sender. If the user forwarded you the email, ask them to report it rather than forward it, so the headers survive. Our guide on how to read email headers shows where the Message-ID is.

Step 2: Widen to everyone

Remove the recipient condition and search again with just the subject and date. Google says the results now "include the email addresses of other users in your organization that received the malicious email." If the attacker varied subjects, search by From (Header address) or Message ID instead. Export the results before you act, so you have a record.

Step 3: Check for interaction

Add a condition on Event for Link click or Attachment download, keeping the sender or subject. Anyone who appears here needs follow-up: a password reset, a session sign-out and a check for new forwarding. Our guide on what to do after clicking a phishing link covers the user side.

Step 4: Act on the results

1. Select all results. To include every page, click the top checkbox, then Select All Results.
2. Click Actions and choose Delete messages, or another action from the table below.
3. Enter a justification, such as a ticket number.
4. Confirm, then click View to check the Result column.

Google says deletion "deletes messages from users' inboxes that match the message ID and owner", and that "erased messages will still be subject to any applicable retention rules and holds set in Vault."

What actions can you take on Gmail results?

From the Take action page, actions for Gmail messages and Gmail log events are:

Two cautions from Google:

• These actions "only apply to messages within Gmail, and don't include messages in Google Groups."
• Messages sent to quarantine go to the default quarantine, and if they're older than your Vault retention policy, "they're deleted instead of being sent to quarantine." Google gives the default retention as 30 days after the email was sent or received. See our guide to Google Workspace admin quarantine.

What safeguards should you turn on?

A tool that can delete mail across the whole organization deserves guardrails. As a super admin, open the gear icon on the investigation page:

• Require reviewer. When it's on, Google says an action on "more than 300 items (for example, more than 300 users or email messages)" needs a second admin to confirm it (Require reviewers for bulk actions).
• Enable action justification. Admins record why they acted.
• View sensitive content. Leave it off unless you need it. When an admin opens a message, they enter a reason, which Google records in the Admin log events.

Google also says "administrator queries and actions in the investigation tool can be reviewed in Admin log event data", so you can audit who deleted what.

How does it compare with Email Log Search?

They answer different questions. Email Log Search tells you what happened to one message; the investigation tool lets you act on many.

There's a middle ground on more editions: Reporting > Audit and investigation > Gmail log events lets admins with the Audit & Investigation privilege search Gmail log events, and Google's Gmail log events page says you can then use the security investigation tool to act.

What if your edition doesn't include it?

If you're on a Business edition or Enterprise Standard, you can't bulk-delete through the tool. Your options:

1. Use Email Log Search to identify recipients, then ask each one to delete the message and report it.
2. Block the sender or domain and tighten Gmail's advanced phishing and malware protection so the next wave goes to spam or quarantine.
3. Reset passwords and sign out sessions for anyone who clicked.
4. Consider stopping phishing before it reaches Gmail. An inbound filtering service such as iBlockSpam sits in front of Google Workspace as an inbound gateway and holds suspicious mail in quarantine before delivery.

Next steps

• Check which edition you're on before an incident, so you know whether the Gmail data sources are available.
• Give at least two admins the Audit and investigation privilege, and turn on Require reviewer and action justification.
• Write the cleanup into your email security incident response plan.
• Save an investigation template with the conditions above, so the next cleanup starts in seconds.
• After a cleanup, check whether the phishing email spoofed your own domain. If it did, look at your DMARC policy with the DMARC Checker.
• See how filtering fits with Gmail on our Google Workspace page.

Browse more guides on running email day to day.