Drive log events provide admins with visibility into their organization’s user activity in Drive. Previously, download activity for files triggered by the use of Google Workspace APIs was not visible to admins as a Drive log event. 

Today, we’re adding audit logs for these API-based actions to the security investigation tool and the audit and investigation tool to expand upon an admin’s ability to identify, triage, and take action on security and privacy issues in their domain. 

Admins: This feature will be ON by default. No action is required, relevant events will appear in the logs automatically. Use our Help Center to learn more about Drive audit logs. Note: Your ability to run a search depends on your Google Workspace editions, your administrative privileges, and the data source. You can run a search on all users, regardless of their Google Workspace edition. End users: No end user impact. 

This feature is now available 

Available for Google Workspace: 

Business Starter, Standard, Plus Enterprise Standard, Plus Essentials Starter, Enterprise Essentials, Enterprise Essentials Plus Education Fundamentals, Standard, Plus, Teaching and Learning Upgrade