Google Workspace Logging - Email Attachment Name

[PaulH_uk]

Hi,

As part of security monitoring and response, I'd like to be able to identify the attachment name using the logs from Google Workspace. Within Google Admin Investigation tool the attachment name is displayed, but it does not appear to be included in log files we export to our SIEM. I therefore have to pivot between tools rather than automate response from my security tooling.

Is this something that is simply missing from the logging and something we need to request from Google? Or is it a local configuration problem my-end?

It would be very useful to identify mass email spam campaigns, identify malicious attachments and/or business data/files too.

Thanks!