Using Google's Audit API to monitor google apps email

Question

I need to get some admin users using google apps gmail the ability to monitor their employees email. Have you used Google's Audit API to do this.

I wish there there was a way for the admins to just click a view my users email but that doesn't be the case.

If it matters the application is a rails app. The email is completely done on googles mail through google apps. Anyone that has done this any advice would be helpful.

Update! 500 points for this one!

I'm using ruby on rails hosting an app on heroku. The email is completely hosted with google apps standard, not business so we will have to upgrade, and the DNS is with zerigo which you already know if you use heroku.

Answer 1

Well, I hadn't planned on extending the gdata-ruby-util gem :), but here's some code that could be used for the Google Audit API based on Google's documentation. I only wrote a create_monitor_on method, but the rest are pretty easy to get.

Let me know if it works or needs any rewrites and I'll update it here:

    class Audit < GData::Client::Base

      attr_accessor :store_at

      def initialize(options = {})
        options[:clientlogin_service] ||= 'apps'
        options[:authsub_scope] ||= 'https://apps-apis.google.com/a/feeds/compliance/audit/' 
        super(options)
      end

      def create_monitor_on(email_address)
        user_name, domain_name = email_address.split('@')
        entry = <<-EOF
        <atom:entry xmlns:atom='http://www.w3.org/2005/Atom' xmlns:apps='http://schemas.google.com/apps/2006'>
        <apps:property name='destUserName' value='#{@store_at}'/>
        <apps:property name='beginDate' value=''/>
        <apps:property name='endDate' value='2019-06-30 23:20'/>
        <apps:property name='incomingEmailMonitorLevel' value='FULL_MESSAGE'/>
        <apps:property name='outgoingEmailMonitorLevel' value='FULL_MESSAGE'/>
        <apps:property name='draftMonitorLevel' value='FULL_MESSAGE'/>
        <apps:property name='chatMonitorLevel' value='FULL_MESSAGE'/>
        </atom:entry>
        EOF

        return true if post('https://apps-apis.google.com/a/feeds/compliance/audit/mail/monitor/'+domain_name+'/'+user_name, entry).status_code == 201
        false
      end   
   end

Then use it elsewhere like this:

auditor = Audit.new
auditor.store_at = 'this-username'
auditor.clientlogin(username, password)
render :success if auditor.create_monitor_on('[email protected]')

My suggestion is to create one core email address that all the email monitors are sent to, so your admins' inboxes aren't slammed with everyone else's mail. Then in your Rails app, use Net::IMAP to download the messages you want from that master email account. i.e., you can create a link that says "View Joe's Email" and the method does something like this:

require 'net/imap'

imap = Net::IMAP.new('imap.gmail.com', 993, true)
imap.login('[email protected]', password)
imap.select('INBOX')

messages = []
imap.search(["TO", "[email protected]").each do |msg_id|
  msg = imap.fetch(msg_id, "(UID RFC822.SIZE ENVELOPE BODY[TEXT])")[0]
  body = msg.attr["BODY[TEXT]"]
  env = imap.fetch(msg_id, "ENVELOPE")[0].attr["ENVELOPE"]
  messages << {:subject => env.subject, :from => env.from[0].name, :body => body }
end

imap.logout
imap.disconnect

Then you can put those messages in your view -- or send them all in one bulk email, or whatever you want to do.