The customer would like to view SAML logs for applications configured to use Google as the IDP for SSO.

These logs are in Google Workspaces under:

Menu > Reporting > Audit and investigation > SAML log events.

Alternative Routing: Security > Security investigation tool > Select SAML log events as the data source.

It would definitely help if you Huntress ITDR can ingest these events.