Chat Logs in Vault specific to Message ID?

[MASA77]

Hello.

I have a 'case' where I'd like to be able to view some Google Chat content that has recently been deleted by a user.

In the 'audit and investigation' logs pertaining to Chat and the user account referred to above, I can see the timestamped action of deletion, along with 'Message ID' and 'Room ID' of the deleted chats. I now want to tie that info to the user's actual chat data available via Vault - any ideas on how one would proceed with that?

Thanks,

Andrew

[Marcin_Milewski · Accepted solution]

Hey @MASA77,

You can find all available search operators of Vault in this HC article.

The ID of the message is not exposed in the Vault in the current version of service, so you would need to filter in the other way (for example by selecting only 'is:dm' to see direct messages). 

Hope this helps,
Best,
Marcin

[MASA77]

Thanks for this.  I guess I find it a bit disappointing that I've 'found' the results I want using the Audit / Investigation tool, but then still need to dig around in Vault - It would be fantastic If I could see the chat data / content from the Audit / Investigation search results.

[Marcin_Milewski]

I agree @MASA77 , Feel free and fill in the feature idea. It would be great to have an option to go directly to Vault from the investigation results. 

Best,
Marcin