eDiscovery Cases - How it works

Background

When the company is large, and there is no need to collect data on all users, you should use cases.

The idea of a case is that it fills the eD with data of a specific user that is needed between the set dates.

A case is always referring to historical data.

As for July 24- it is only supported by Webex.

The table structure is defined here: https://agatsoftware.atlassian.net/wiki/x/CIBzzQ (for internal use)

eDiscovery cases page

This page allows you to create a case. You need to enter the user and dates when creating a case, and you can add comments on the case.

Once created, the CASB adapter will pick it up based on the status “New” and start fetching and inserting the messages and files the user sent into the eD. The messages table will contain the caseID for each message.

The system does not allow the creation of cases that overlap dates for the same user.

Once the case is done, the Adapter will email the case creator to let him know it is ready for review. The email will contain a link to the eD, filtering the records for the user and the case dates.

You can also open the eD records of a case from the case page by filtering by caseID.

On this page, you can also delete the case review set, which will delete all records from the eD. The case record will still be left for auditing and the case record status will be set to “Deleted”. When destroying a case, the user, time, and case information will be inserted into security auditing.

Example

Go to Admin Portal>eDiscovery>eDiscovery Cases

Open

Press on “ADD“, enter the UPN of the user whose messages you want to view, choose the messages dates and leava a comment if you like

Open

Press “SAVE“ and you should see that the record has been added to the list

Press on “Link to eDiscovey“ and all the messages sent/received by the user during the selected times will appear: