The Animus
GAM Incident Console · Investigate one account and respond with precision.
Sign in to begin.
Enter The Animus · District sign-in
Access is limited to approved district responders. Your role controls remediation access.
Sign in with Google1 · The Dossier · Find account
2 · Select evidence
Expand a category to investigate. Opening a panel does not run any queries.
Login events Sign-in logs, account activity, and Eagle Vision
Sequential per-user API calls; 250 activity records per feed maximum. A capped result is marked below.
The Memory Archive · Event evidence
Hover over a column heading for the original GAM field name. Scroll horizontally to inspect all fields.
Eagle Vision · Login IP review
Latest 15 successful logins outside the configured known network IPs, compared with earlier successes outside that list in a 30 day, 500 activity sample. Excludes 61 configured exact addresses and the district subnet 163.248.243.0/24. An unfamiliar IP is a lead, not proof of compromise; VPNs and proxies can change it. Google suspicious indicators are shown separately, including known network IPs. The Login feed retains events from excluded IPs.
Gmail Activity logs and recipient mail response
Gmail · Activity evidence
One per-user report, capped at 250 activities. Sent-mail discovery and exact-copy previews remain separate actions below.
The Courier · Recipient mail response
Start with only this user's recent Sent mail. Messages appear here only when their visible To/Cc/Bcc headers contain more than 10 addresses. Select one to discover candidate recipients, then verify exact copies in chosen district mailboxes before permanent deletion.
Header addresses and current group membership are candidates, not proof of delivery. Group expansion, forwards, aliases, and historical membership can differ. The exact Message-ID is checked in each selected mailbox. Permanent deletion cannot be undone from Gmail; assess retention and Vault holds first.
Google Drive Observed file access and reviewed share response
The Codex · Fraudulent Drive share
Use one exact file ID. Drive access events show accounts that viewed, previewed, downloaded, edited, printed, or copied the file in the available 30 day report. This is observed activity, not a complete list of link clicks. Shared-drive, inherited, group, and public-link permissions need separate review.
Recent operations · Review queued, completed, or interrupted work
3 · The Hidden Blade · Account containment
Each action applies only to the account shown above. Type the full email address when prompted. Actions are written to the local audit log. Sign-out does not revoke OAuth grants or necessarily clear 2SV trusted-device state. A Google password reset does not change the external IdP password.