Proofpoint Enterprise Archive. Legal Discovery and Supervision

Transcription

1 Proofpoint Enterprise Archive Legal Discovery and Supervision May 2014

2 Proofpoint Enterprise Archive Copyright and Trademark Notices Proofpoint Archive is proprietary software licensed to you for your internal use by Proofpoint Inc. This software is Copyright Proofpoint, Inc. The copying, modification or distribution of Proofpoint Archive is subject to the terms of the Proofpoint Software License, and any attempt to use this software except under the terms of that license is expressly prohibited by U.S. copyright law, the equivalent laws of other countries, and by international treaty. Proofpoint and Proofpoint Archive are trademarks of Proofpoint Inc. McAfee is a registered trademark of McAfee, Inc. and/or its affiliates in the US and/or other countries. Virus Scanning capabilities may be provided by McAfee, Inc. Copyright 2011 McAfee, Inc. All Rights Reserved. F-Secure Anti-Virus Copyright , F-Secure Corp. VMware, the VMware boxes logo, GSX Server, ESX Server, Virtual SMP, VMotion and VMware ACE are trademarks (the Marks ) of VMware, Inc. Voltage and Secure Messaging are registered trademarks of Voltage Security, Inc. Copyright Voltage Security, Inc. All Rights Reserved. Apache 2.2 licensing information is available at Perl (Practical Extraction and Report Language) is copyrighted by Larry Wall. It is free software and it is redistributed by Proofpoint under the terms of the Artistic License that comes with the Perl Kit, Version 5.0. Source is available at Regular expression support is provided by the PCRE library package, which is open source software, written by Philip Hazel, and copyright by the University of Cambridge, England. Source is available at ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/. Some database support in this solution is provided by MySQL. Copyright 1997, 2011, Oracle and/or its affiliates. All rights reserved. Copyright , 1998, 2004 Thomas Williams, Colin Kelley Permission to use, copy, and distribute this software and its documentation for any purpose with or without fee is hereby granted, provided that the above copyright notice appear in all copies and that both that copyright notice and this permission notice appear in supporting documentation. Permission to modify the software is granted, but not the right to distribute the complete modified source code. Modifications are to be distributed as patches to the released version. Permission to distribute binaries produced by compiling modified sources is granted, provided you 1. distribute the corresponding source modifications from the released version in the form of a patch file along with the binaries, 2. add special version identification to distinguish your version in addition to the base release version number, 3. provide your name and address as the primary contact for the support of your modified version, and 4. retain our contact information in regard to use of the base software. Permission to distribute the released version of the source code along with corresponding source modifications in the form of a patch file is granted with same provisions 2 through 4 for binary distributions. This software is provided "as is" without express or implied warranty to the extent permitted by applicable law. THIS SOFTWARE IS PROVIDED BY THE DEVELOPER ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE DEVELOPER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. Portions of this software are Copyright The FreeType Project ( All rights reserved. Additional graphical support is provided by libgd: Portions copyright 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002 by Cold Spring Harbor Laboratory. Funded under Grant P41-RR02188 by the National Institutes of Health. Portions copyright 1996, 1997, 1998, 1999, 2000, 2001, 2002 by Boutell.Com, Inc. Portions relating to GD2 format copyright 1999, 2000, 2001, 2002 Philip Warner. Portions relating to PNG copyright 1999, 2000, 2001, 2002 Greg Roelofs. Portions relating to gdttf.c copyright 1999, 2000, 2001, 2002 John Ellson ([email protected]). Portions relating to gdft.c copyright 2001, 2002 John Ellson Portions relating to JPEG and to color quantization copyright 2000, 2001, 2002, Doug Becker and copyright 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, Thomas G. Lane. This software is based in part on the work of the Independent JPEG Group. See the file README-JPEG.TXT for more information.

3 Portions relating to WBMP copyright 2000, 2001, 2002 Maurice Szmurlo and Johan Van den Brande. Permission has been granted to copy, distribute and modify gd in any context without fee, including a commercial application, provided that this notice is present in user-accessible supporting documentation. This does not affect your ownership of the derived work itself, and the intent is to assure proper credit for the authors of gd, not to interfere with your productive use of gd. If you have questions, ask. Derived works includes all programs that utilize the library. Credit must be given in user-accessible documentation. This software is provided AS IS. The copyright holders disclaim all warranties, either express or implied, including but not limited to implied warranties of merchantability and fitness for a particular purpose, with respect to this code and accompanying documentation. Although their code does not appear in gd 2.0.4, the authors wish to thank David Koblas, David Rowley, and Hutchison Avenue Software Corporation for their prior contributions. This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit ( zlib.h interface of the zlib general purpose compression library version 1.2.2, October 3rd, 2004 Copyright (C) Jean-loup Gailly and Mark Adler This software is provided as-is, without any express or implied warranty. In no event will the authors be held liable for any damages arising from the use of this software. Permission is granted to anyone to use this software for any purpose, including commercial applications, and to alter it and redistribute it freely, subject to the following restrictions: 1. The origin of this software must not be misrepresented; you must not claim that you wrote the original software. If you use this software in a product, an acknowledgment in the product documentation would be appreciated but is not required. 2. Altered source versions must be plainly marked as such, and must not be misrepresented as being the original software. 3. This notice may not be removed or altered from any source distribution. Jean-loup Gailly [email protected] Mark Adler [email protected] Unifont copyright Paul Hardy of Unifoundry.com ([email protected]) released under the terms of the GNU General Public License (GNU GPL) version 2.0. Tomcat, Log4j, Apache CXF Apache Copyright Apache Software Foundation Java JRE, JavaMail, Sun JavaServerFaces Copyright 1997, 2011, Oracle and/or its affiliates. All rights reserved. JBoss RichFaces Copyright Red Hat. Red Hat is a registered trademark of Red Hat, Inc. Proofpoint gratefully acknowledges contributions of the open source community to Proofpoint Archive. References to open source software used with Proofpoint Archive is collected into a single repository which can be found in the installed Proofpoint Archive package in src/opensource/opensource. That repository, consisting of the contributions from open source projects but not including the proprietary Proofpoint Archive software referred to above is a collective work that is Copyright Proofpoint Inc. You will find in this repository copies of the source code, or references of where to find, every open source program not referenced in this copyright notice, that was used in Proofpoint Archive. Copyright (c) 2005, Google Inc. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. Neither the name of Google Inc. nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. Copyright (c) , Daniel Stenberg, <[email protected]>. All rights reserved. Permission to use, copy, modify, and distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.

4 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. Except as contained in this notice, the name of a copyright holder shall not be used in advertising or otherwise to promote the sale, use or other dealings in this Software without prior written authorization of the copyright holder. Proofpoint uses the following components which are licensed under the Apache License Version 2.0: Glassfish Jasper API - Copyright All rights reserved. SLF4j - Copyright (c) QOS.ch. All rights reserved. (Under the MIT license.) Copyright Proofpoint, Inc. Proofpoint, Inc. All rights reserved. PROOFPOINT is a trademark of Proofpoint, Inc. All other product names and brands are the property of their respective owners.

5 Preface... 4 About this Guide... 4 Prerequisite Knowledge... 4 Other Sources of Information... 4 Contacting Proofpoint Technical Support... Error! Bookmark not defined. What s New in Version Introduction... 6 Proofpoint Archive: Part of the Proofpoint Family... 6 Proofpoint Archive Overview... 6 Accessing Proofpoint Archive... 7 About the Proofpoint Archive User Interface... 7 Adding Names to Entities... 7 Setting Preferences... 7 About Legal Discovery... 9 Information Management... 9 Identification, Collection and Preservation Phases of Electronic Discovery... 9 Analysis, Review and Processing Phases of Electronic Discovery... 9 Production and Presentation Phases of Electronic Discovery About Searching How Searching Works Search Steps Types of Search Criteria Using Boolean Logic for Content Searches Saving Search Criteria Performing Searches Content-Based Searching Location-Based Searching Attachment-Based Searching People-Based Searching Date-Based Searching Communication Flow-Based Searching InfoTag-Based Searching Working with Search Results How Search Results are Presented Working with Messages Found by a Search Message Properties Saving Results in Archive Folders Copyright Proofpoint, Inc. 1

6 Creating and Modifying Legal Holds About Legal Holds Types of Legal Holds Choosing a Legal Hold Type Discovery Segmentation Impact on Legal Holds Assigning Permissions for Legal Hold Access Working with Ad-Hoc Legal Holds Working with People-Based Legal Holds Sending Legal Hold Notifications Managing Legal Holds Releasing a Hold Exporting Legal Hold Information Proofpoint Content Collection About Content Collection Adding Content Collection to a Legal Hold Managing Collection Tasks Deleting Collection Tasks and Collected Files Viewing Collected Files in the Archive Exporting Messages Encryption s Role in the Export Process Understanding the Export Process Exporting Messages from Search Result Exporting Messages from a Folder Exporting Messages to FTP Site Managing the Export Progress Completing the Export Sharing an Export Job Specifying an Export Job Retention Period Viewing Exported Messages in Outlook Performing Supervision Functions About Supervision For Reviewers: Passing and Failing Messages For Senior Reviewers: Supervision Interface For Senior Reviewers: Review Tasks For Senior Reviewers: Issue Investigation and Management Tasks Viewing the Audit Trail About the Audit Trail Viewing Audit Trail Exporting Audit Trail Copyright Proofpoint, Inc. 2

7 Appendix A Search Criteria and Indexing Search Criteria: Keywords and Phrases Search Criteria: Special Characters Indexing Size Considerations Glossary Index Copyright Proofpoint, Inc. 3

8 Preface About this Guide This guide introduces Proofpoint Enterprise Archive and provides step-by-step instructions for using the system to perform advanced searches of your own or other peoples mail stored in the archive. This guide also explains specific functions related to legal holds and message review. These functions are available only to users who have the appropriate user access. Prerequisite Knowledge This document is intended for a business user with technology experience. You should be familiar with functions common to user interfaces, such as selecting multiple items using the Shift key and checking or clearing options. You should understand your company s electronic messaging policy. While Proofpoint Archive is a critical element of any message compliance system, you play an important role in ensuring that information is used appropriately. Access to the archive of messages comes with a responsibility to understand and apply the standards outlined in your company s electronic messaging policy. To take full advantage of advanced search functionality, some basic understanding of Boolean logic is helpful. While the Proofpoint Archive user interface attempts to shield you from these complexities, understanding the difference between A and B or C and A and (B or C) helps to ensure that you achieve expected results when searching the archive. Other Sources of Information This guide covers a number of topics addressing procedural information for day-to-day use. For other information, see: Online Help: Click the "help" button to display online help for the product. Finding Your Own Messages: Explains basic search processes available from Microsoft Outlook or OWA. Intended for users who will search the archive for messages from their own mailboxes. Reports: Explains available reports and how to generate them. Contacting Support If you need help resolving an issue, please contact your local help desk. Copyright Proofpoint, Inc. 4

9 Preface What s New in Version Revised explanation of disposition placeholder. Added Internet Explorer 11 (in compatibility mode) to supported browsers. Messages archived from social networks or other sources identified by icon. Improved description of some of the UI-based procedural steps. Copyright Proofpoint, Inc. 5

10 Introduction This chapter introduces Proofpoint Enterprise Archive and its main interface elements. The chapter includes the following topics: Proofpoint Archive: Part of the Proofpoint Family 6 Proofpoint Archive Overview 6 Accessing Proofpoint Archive 7 About the Proofpoint Archive User Interface 7 Adding Names to Entities 7 Setting Preferences 7 Proofpoint Archive: Part of the Proofpoint Family Proofpoint offers a comprehensive solution for data protection and governance through an integrated, security-as-a-service platform. Complementing the Proofpoint data protection and security solutions, Proofpoint Archive allows your organization to archive and discover communication across all major communication channels including on-premise and cloud-based , instant messaging, social media and other web-based applications. Proofpoint Archive Overview Proofpoint Archive provides a complete message archiving solution that can protect your organization from legal liabilities and regulatory risks while improving storage management and end-user productivity. Its easy-to-implement, easy-to-use web interface offers fully secure archiving with robust search and discovery, supervision, and enforcement features. Proofpoint Archive securely stores your electronic messages for the retention period you specify, while keeping them fully searchable and retrievable in real-time (or with a batch process). At any time, archived messages can be easily viewed, retrieved to a user s inbox or exported to an Outlook data file or EDRM XML file. Proofpoint Archive includes features used to: design, edit and maintain an electronic messaging policy, including retention, enforcement and supervision rules perform advanced and comprehensive searches of a message s header, body, or attachments, easily meeting even the most stringent discovery requirements generate reports that help properly assess patterns and behavior, and help evaluate the effectiveness and enforcement of your policies manage mailbox sizes, removing storage-intensive attachments from Exchange while keeping those attachments accessible to Outlook users (stubbing) implement a systematic supervision process for selecting and reviewing the content of electronic messages based on your organization s policy for acceptable use of Note: Some functions are optional and may not be available to all users. Copyright Proofpoint, Inc. 6

11 Introduction Accessing Proofpoint Archive Note: Use Internet Explorer 8, 9, 10, or 11 (in compatibility mode) on the PC. You must have JavaScript enabled. 1. Open your web browser. 2. Enter the URL of the Archiving Appliance in the address bar of your web browser. The Login Screen appears. If it is blocked by a pop-up blocker, you need to allow pop-ups from this site before proceeding. Note: Your administrator can provide you with the URL of the Archiving Appliance. You may be able to access it using a similar URL to the one you use to access your mail server. For example, if you normally enter you would enter You may need to add the URL to your trusted sites list. 3. Optionally, choose the language you want used for the user interface. 4. Enter the user name and password you use to log in to your computer and click Enter. Note: You can also log in using your primary SMTP address or UPN. The Proofpoint Archive interface opens. Note: User names and passwords for Proofpoint Archive are fully integrated with your network user name and password. Whenever you change your password on the network, your password used to log in to Proofpoint Archive is also changed. After a period of 60 minutes of inactivity, you will be logged out automatically. If you attempt to perform a task using your open browser window after you have been automatically logged out, you will be prompted to log in again. Once you do, the action is performed. About the Proofpoint Archive User Interface Choose from the available modules by clicking on the module name in the top right of the interface. Choosing a module opens a new screen with a navigation menu of choices on the left. To return to the main screen where the different modules are shown, click the Proofpoint logo. When you click an item in the navigation menu, the workspace (right side of the screen) changes as a result. Adding Names to Entities When setting up some entities in Proofpoint Archive, you need to add names of Active Directory users and/or groups. The same mechanism is used everywhere this is necessary: 1. Enter all or part of the appropriate name. 3. Click Check Name. A list of suggested names appears for you to choose from, on two tabs: one listing names currently in Active Directory, the other listing names that were in Active Directory but have since been deleted. 4. Select the desired name and click Add. Setting Preferences Proofpoint Archive user interface preferences allow you to choose: the opening screen you see when you log on (for example, if you most often search messages, you can have the interface open with the E-Discovery module opened) preferred language defaults for standard (Personal Archive) or advanced (E-Discovery) searches (sort order, mailbox scope and date range) Copyright Proofpoint, Inc. 7

12 Introduction default sort order for Supervision review message lists 1. Click the in the top right corner of the interface, then click Preferences. The Preferences screen appears. 2. Click the appropriate tab and set your preferences. 3. Click Save. Copyright Proofpoint, Inc. 8

13 About Legal Discovery This chapter provides background information about electronic legal discovery. It includes the following topics: Information Management 9 Identification, Collection and Preservation Phases of Electronic Discovery 9 Analysis, Review and Processing Phases of Electronic Discovery 9 Production and Presentation Phases of Electronic Discovery 10 Information Management One of the best ways to reduce risk during legal discovery is to implement proactive information management practices. The foundation of such an approach is the establishment and enforcement of retention policies. Without clearly defined, and consistent applied, retention of information, it becomes very hard to prove that information was disposed of in the course of normal business as opposed to a malicious destruction of evidence. With Proofpoint Archive s policy component you can define, communicate and enforce retention of electronic communications. Capturing all communications in a searchable repository in an unalterable, de-duplicated form provides on-going litigation readiness. Identification, Collection and Preservation Phases of Electronic Discovery At the point that your organization suspects that a matter may arise, you want to be able to assess the risk to your organization. Collecting data from various sources just to perform early case assessment is often cost-prohibitive, so many firms fail to appreciate their position at this point. With a searchable repository, you can easily search for items that may be relevant and make appropriate plans for addressing the matter. This investigation capability also makes it easier to identify the scope of information that should be covered under a preservation order. With all content captured in the archive for some time period, it becomes the best place to implement a preservation hold (a legal hold, in Proofpoint Archive. Not only can Proofpoint Archive be used to hold existing content that is relevant to the matter, it can also be configured to actively evaluate and hold new messages as they are archived. This avoids the expensive, error-prone manual processes typically required for litigation holds. As information is collected on an ongoing basis, rather than at the point of a litigation hold, the process is quick and painless. Analysis, Review and Processing Phases of Electronic Discovery While the case progresses, you may need to perform ongoing assessment of the contents of the legal hold, for example, to prepare for meetings. The contents of all or just specific legal holds can be searched the same way as the archive can be. Advanced searching capabilities can be used to cull the dataset to focus on the relevant materials, which can then be exported to PST or EDRM XML files for integration into a litigation review platform. Copyright Proofpoint, Inc. 9

14 About Legal Discovery Production and Presentation Phases of Electronic Discovery For cases that do not require sophisticated review functionality, items that should be produced can be exported to PST or EDRM XML files for delivery directly to opposing counsel. Copyright Proofpoint, Inc. 10

15 About Searching This chapter provides an overview of the advanced searching feature in Proofpoint Archive. The chapter includes the following topics: How Searching Works 11 Search Steps 11 Types of Search Criteria 12 Using Boolean Logic for Content Searches 14 Saving Search Criteria 14 How Searching Works You can search within your own mailbox or across some or all of the mailboxes to which you have been granted access. Discovery users can search across the entire archive. If Discovery Segmentation is enabled, when searching the active archive or retention series, Discovery users can only search within the divisions to which they have been granted access. When searching their own mailbox or within legal holds, divisional filtering is not applicable. Discovery Administrators continue to have full access to the entire archive. To have Discovery Segmentation enabled, contact Proofpoint Professional Services. Searching falls into two types: standard (Personal Archive) or advanced (E-Discovery). Standard searching (Personal Archive) is intended for end users searching their own mailboxes. It offers the same features as those offered from within Outlook/OWA, and is described in Finding Your Own Messages. Advanced searching (E-Discovery) provides greater flexibility and control than standard searching. An advanced search contains one or more types of criteria that are combined, allowing you to constrain the search results to specific messages. While each type of search criteria (see "Types of Search Criteria" on page 12) is optional, a message must meet all of the specified criteria to be considered a match. To repeat a search, you can simply save its criteria and perform it again. The results of a search are displayed for you to work with. Search Steps Step 1: Open the Search Screen Open the E-Discovery module and, if necessary, in the navigation menu, click Search. The search screen opens. Note: You can choose a different language for the interface from the Language list. Copyright Proofpoint, Inc. 11

16 About Searching Step 2: Enter the Appropriate Search Criteria Specify search criteria using one of the available methods and click Search or press ENTER. For details about which special characters (such as punctuation marks) are and are not preserved in the archive, see "Appendix A Search Criteria and Indexing" on page 48. Note: You can, if you wish, simply leave all criteria blank, but this is not usually desirable because it may retrieve a large set of messages. Alternatively, you can repeat a recent or saved search: click Saved Searches (in the navigation menu) and navigate to and select the desired search name. Note: Executing a saved search rather than a new search simply applies the saved search criteria to the current data set. Since new messages are added to the archive all the time, search results are likely to be different each time you execute a saved search. Step 3: View Results Search results show both the criteria used for the search and the list of messages the search found. You can modify the search criteria and perform the search again, save the search criteria (see "Saving Search Criteria" on page 15), clear the criteria and start again, or work with the messages the search retrieved. Note: For users of Proofpoint Archive batch searching, search results are stored in a folder instead of being displayed on the screen. Types of Search Criteria You can choose to search using one or all of the following criteria: Content-Based Search Criteria Search for keywords (optionally, using Boolean AND/OR logic) that must appear in the message content, in the fields that you specify (subject, body, attachment and/or SMTP header). See "Content-Based Searching" on page 16. Location-Based Search Criteria Search for: only messages in a specific mailbox or mailboxes only messages that are part of a specific retention series only messages that are in a legal hold only messages that are in a specific legal hold, with the further ability to search only messages that were added to that hold manually only messages that are in the active archive messages in either the active archive or any legal hold. If you are searching based on retention series or active archive, you can also search the divisions to which you have access, provided that Discovery Segmentation has been enabled. See "Location-Based Searching" on page 17. Copyright Proofpoint, Inc. 12

17 About Searching Attachment-Based Search Criteria Search for messages that contain an attachment at all, or only for those with an attachment of a specific type. For example, you can search only for messages with Microsoft Word documents attached. See "Attachment-Based Searching" on page 19 This search looks only at attachment presence and/or type: if you want to search for the actual content of an attachment, use content-based search criteria. Note: You can combine attachment-based search criteria with content-based search criteria to look for a particular type of document that features particular words or phrases. For example, you can search for messages with Microsoft Word document attachments that contain the word Confidential. Date-Based Search Criteria Search for messages based on the date they were: sent archived (normally the same as the send date, but may be different for imported messages) available for disposition. See "Date-Based Searching" on page 20. Note: Messages available for disposition need to be removed from the archive using a process explained in the Policy Creation and Management document People-Based Search Criteria Search based on the people who sent or received the message (the parties), and on their participation in the communication (for example, whether they sent it or received it). Messages must match both the specified parties and their type of participation. See "People-Based Searching" on page 19. Communication Flow-Based Search Criteria Search for messages based on whether they were exchanged internally, received from an external address, or sent to an external address. See "Communication Flow-Based Searching" on page 21. InfoTag-based Scope Criteria Search for messages tagged with specific InfoTags (used to categorize a message). See "InfoTag-Based Searching" on page 21. Copyright Proofpoint, Inc. 13

18 About Searching Using Boolean Logic for Content Searches In addition to entering words and phrases, you can also use basic Boolean logic to refine or expand searches. The following elements are supported: Term AND OR Meaning Indicates that the words/phrases are both required. As spaces between words and/or phrases are treated as an AND, use of this keyword is generally not required. Usage: Bob Smith AND factory Indicates that one or the other of the words/phrases is required, but they don t both have to be in the message for it to match. Usage: Bob Smith OR factory - hyphen Indicates that the following word or phrase must not be in the message. Usage: Bob Smith factory () brackets Indicates a grouping of logical elements for evaluation. Generally brackets are only required when you combine AND and OR logic in a single search. Usage: ( Bob Smith OR Mary Jones ) AND factory ~ tilde Inserting a tilde followed by a number lets you do a proximity search to find matches within the proximity of the original results. In the example, all documents that contain search terms within 3 words of searchtermb will be found. Usage: searchterma searchtermb ~3 Note: The operators AND" and "OR" must be entered with capital letters. The lower case versions are used to search for content containing the words and and or themselves. Saving Search Criteria Your three most recent sets of search criteria are automatically saved and available by clicking Saved Searches in the navigation menu of the E-Discovery module, in a system-created folder called Recent Searches. Searches are identified by their occurrence (most recent, next most recent and third most recent). If you find yourself frequently searching for the same things, it may be useful to create the criteria for future use: each time you use a saved search (by clicking on its name), the search is carried out as defined in the criteria. The results may vary, depending on which messages are currently in the archive. To keep your saved searches organized, store the search criteria in a folder. You can optionally share a folder with other users. To create a folder to organize saved searches: 1. Open the E-Discovery module and, if necessary, in the navigation menu, click Search. 2. In the navigation menu, click Saved Searches, The Saved Searches screen appears. 3. Click New Folder. 4. When prompted, enter a name for the new folder and click OK. The folder is created. Note: Within a given level, folder names must be unique. For example, you cannot have two folders directly under Saved Searches that are both called "Complaints", but you can have a "Complaints" folder in a Customer folder and a "Complaints" folder in an Internal folder. Note: To remove or rename a folder, right-click on it and choose Delete or Rename. Copyright Proofpoint, Inc. 14

19 About Searching Saving Search Criteria To save search criteria: 1. Execute a search, then click Save Search. The Save Search screen appears. 2. In the Save search in tree, select the folder in which the search criteria should be saved. - or - Create a folder in which to save the search criteria by clicking New Folder and entering a folder name. 3. Enter a Name for your saved search criteria. Note: Within a given folder, the names of saved searches must be unique. 4. Click Save. The Save Search screen closes. Note: To remove or rename a saved search, click on the Rename. To share search criteria: 1. Save search criteria in a folder (as described above). 2. In the navigation menu, click Saved Searches. 3. Click on the on the right side of the screen and choose Share. The Sharing Details screen appears. to the right of the saved search and choose Delete or 4. Enter the user with whom you want to share the search criteria folder and click Add. 5. Click Save. Copyright Proofpoint, Inc. 15

20 Performing Searches Performing Searches This chapter explains how to perform searches using different types of criteria. It includes the following topics: Content-Based Searching 16 Location-Based Searching 17 Attachment-Based Searching 19 People-Based Searching 19 Date-Based Searching 20 Communication Flow-Based Searching 21 InfoTag-Based Searching 21 Content-Based Searching To enter individual content-based search criteria: 1. Check the options for the parts of the message (body, subject, attachment and/or header) that should be searched. 2. In the "Enter word or phrases..." field, enter the words or phrases (in quotation marks) to search for. Note: You can use basic Boolean logic in your searches. See "Using Boolean Logic for Content Searches" on page Click Search. To enter a set of keywords as content-based search criteria: 1. Click Helper (to the right of the field used to enter words or phrases). The Keyword Editor screen appears. 2. Enter the keywords to search for. Multiple words on one line are interpreted as a phrase. Note: You can paste a list of keywords from the Clipboard into the Find box. 3. Choose whether the search should include exact matches, exact matches and potential matches, or only exact matches (see below). 4. Click Save. The keywords you specified appear, in the correct syntax, In the "Enter word or phrases..." field. 5. To add additional words/phrases for searching, click Helper again. Calling out potential matches is useful when you have messages that could not be fully indexed by Archive. There are several reasons why a message cannot be fully indexed: a message is encrypted, an attachment is corrupted, an attachment is password protected, and so on. When searching for a message, the default behavior for Archive is to return only messages that match exactly the keyword search criteria. But with advanced search, you have the option to modify the default behavior to include potential matches or only return potential matches. This is useful when potential matches need to be identified so that they can be processed separately. The Keyword Editor contains a Query Builder function: 1. In the Keyword Editor, click Query Builder. The keywords specified in the editor (if any) appear in the bottom portion of the screen. You can enter or paste from the clipboard additional keywords in the top portion of the screen. 2. Choose whether the message must contain one (OR) or all (AND) of the keywords. 3. Choose how the two lists work together: messages must either match both lists (AND) or either list (OR). 4. Click Save. Copyright Proofpoint, Inc. 16

21 Performing Searches Location-Based Searching Searching Based on Retention Series or Legal Hold 1. Click Active Archive. A new screen appears. 2. Choose the scope of the search. To search: within a specific retention series, select it from the retention list both the active archive and all legal holds, click Active archive and all legal hold (Discovery Administrators only) just legal holds click All legal holds (Discovery Administrators only) within a specific legal hold select from the holds list and choose whether or not you want to show only items manually added by users Note: When searching based on retention series or active archive, you can also search the divisions to which you have access, provided that Discovery Segmentation has been enabled. Divisions that are grayed out in the list are those to which you do not have access. Note: If searching across all legal holds, the same message may be found in several of those holds. As a result, the message will appear several times in the results list. If in place of a message you see this message has been disposed, the message has been removed from the legal hold (because it belonged to a custodian who has been removed): such messages cannot be viewed. 3. Click Save. The selection screen closes. 4. If desired, specify the mailboxes you want to search by following one of the procedures below. Specifying mailboxes will limit your search results to those messages in the legal hold that are associated with those mailboxes. Typically, specifying mailboxes requires you to be a Discovery user, however, if you have been granted access to a legal hold, you can search all mailboxes in that legal hold. Note: Even if Discovery Segmentation is enabled, it is not applicable if you are searching your own mailbox. You can search a maximum of 1024 mailboxes. Searching Imported Data Pending Verification (Discovery Administration Users Only) Note that messages found using these procedures cannot be exported, retrieved, or copied to an archive folder. 1. Click Active Archive. A new screen appears. 2. Click Imports in Staging - Archive. - or - Click Imports in Staging - Legal Hold and choose the legal hold in which to search. 3. Click Save. Copyright Proofpoint, Inc. 17

22 Performing Searches Searching Based on Mailbox To search all or just your mailbox: 1. Click All Mailboxes (just below the field used to enter words or phrases). A new screen appears. 2. To search all mailboxes, leave the default All mailboxes selected. - or - To search just your mailbox, click My Mailbox. 3. Click Save. The selection screen closes. To search specific mailboxes by group: 1. Click All Mailboxes (just below the field used to enter words or phrases). A new screen appears. 2. Click Only search in the following mailboxes. 3. Specify the group name, following the steps in "Adding Names to Entities" on page 7. All mailboxes belong to members of that group are included in the search. Note: You can search on a maximum of 1024 mailboxes. 4. Click Save. The selection screen closes. To search specific mailboxes by user: 1. Click All Mailboxes (just below the field used to enter words or phrases). A new screen appears. 2. Click Only search in the following mailboxes. 3. Copy and paste up to 150 SAM account names or addresses into the box (duplicates are automatically removed). - or - Specify the user name, following the steps in "Adding Names to Entities" on page Repeat until all mailboxes are added. Note: The mailboxes that you can see are controlled by the permissions assigned to your user account. You can search on a maximum of 1024 mailboxes. 5. Click Save. The selection screen closes. To search mailboxes identified in imported list (Discovery Users Only): 1. Prepare the list of mailboxes to be imported, with a maximum of 150 SAM account names or addresses separated by newlines or semicolons (;). Optionally, copy the names to the clipboard. 2. Click All Mailboxes. A new screen appears. 3. Click Import. 4. Click Browse to navigate to the location of the file containing mailboxes to be searched and click Open. - or - Click Paste from clipboard and paste the list of mailboxes. The names appear in the box (duplicates are automatically removed). 5. Continue to import or add mailboxes as desired, to a maximum of 1024 mailboxes. 6. Click Save. The selection screen closes. Copyright Proofpoint, Inc. 18

23 Performing Searches Attachment-Based Searching 1. Check the Has Attachment checkbox. 2. Choose the scope of the search. To search for messages with: any type of attachment, choose <any type> (the default) a specific type of attachment, choose a file type from the list or, if the type is not shown, choose Other from the list and then, in the text area, type the file extension of attachments for which to search Note: You can enter multiple file extensions with a space between them. Do not enter periods or wildcards, such as *. 3. Click Search. People-Based Searching 1. From the list under the Mailbox/Archive selection area, select the type of participation (see below). 2. You are prompted to choose the party for the search: click Add and identify the party as described below. If you chose Then you need to Internal Person Department, Role, Partner (searches for belonging to the people in the selected user group) External Person Display Name (searches for messages sent or received by the person or group matching the selected display name) Domain (searches for messages sent by anyone in the selected domain) Specify the name - or Enter a personal Internet address for the person. From the Select a list, choose the department, role or partner. Enter the person s Internet address and click Add. Repeat for additional addresses for the person. Enter the display name. Enter the Internet domain name. When evaluating a message, if any of the elements that define a party match, then the message is said to include that person. For example, if a party was defined as being the Active Directory user John Smith with the Internet mail address [email protected], a message sent to either [email protected] or any of the addresses associated with the Active Directory user John Smith would be said to include that party. 3. Click Save. The screen closes and the selected party is added to the list. Specifying the Participation To do this Find messages where at least one of the selected parties is either the sender or recipient of the message. Use if you don t care whether the parties are senders or recipients. Select this criteria From or To ANY of these parties Find messages where all of the selected parties are either the sender or recipient of the message. Use if you want to match only messages where all the specified parties are participating as either senders or recipients. From or To ALL of these parties Find messages where at least one of the specified parties is the sender of the From ANY of these Copyright Proofpoint, Inc. 19

24 Performing Searches To do this message. Use if you want to match only messages coming from specific parties. Find messages where at least one of the specified parties is the recipient of the message. Use if you want to match only messages received by specific parties. Find messages where all of the specified parties are the recipient of the message. Use if you want to match only messages where all of the parties are recipients. Select this criteria senders To ANY of these recipients To ALL of these recipients Using the From ANY of these senders criteria to identify the senders, find messages only where one of the specified parties is a recipient of the message. Using the From ANY of these senders criteria to identify the senders, find messages only where all of the specified parties are a recipient of the message. From ANY of these senders & To ANY of these recipients From ANY of these senders & To ALL of these recipients Find messages exchanged between the selected roles or departments. Use if you want to find messages exchanged between any member of a role or department and any member of another role or department. Between ANY of these role/department pairs Note: A "sender" is the name shown in the FROM field of the message. A recipient is a name shown in any of the TO, CC or Bcc fields. Date-Based Searching Entering Sent or Archive date-based search criteria: 1. From the Date/Time list, choose the type of date criteria. To search based on the date messages were sent, choose Send Date. - or - To search based on the date messages were added to the archive, choose Archive Date. 2. Leave the default of "any date" or choose one of the following modifiers: To specify... Choose... the date that messages must have been sent on the last date that messages must have been sent on the earliest date that messages must have been sent on the earliest and the latest date that a message must have been sent on messages sent during the current week messages sent during the current month messages sent during the current year On Before After Between This Week This Month This Year. messages sent during the last specific number of days Last 30 days. Last 90 days. Last year The system displays the appropriate number of calendar fields (for example, if you chose Between, it will display two fields). 3. Click in the appropriate calendar field, then click the desired date. Use the arrow keys if necessary to navigate through months and years. Note: Between date range criteria are inclusive of the end dates. All other date range criteria are exclusive of the specified date. If you specify a search for anything between today and tomorrow, messages from both days will be included. If you specify a search for anything before or after today, today s messages are NOT included. 4. Click Search. Copyright Proofpoint, Inc. 20

25 Performing Searches To enter Disposition or Retention date-based search criteria: 1. From the Date/Time list, choose the type of date criteria: To search based on the date messages can be disposed, choose Target Disposition Date. - or - To search based on the date messages were archived for indefinite retention, choose Indefinite Retention. 2. Choose the date as above. Note: You cannot search based on target disposition date if searching within a legal hold, since all items in the legal hold have the same disposition date. Communication Flow-Based Searching From the Flow list, choose: Internal (messages sent between people within the company) Inbound (messages sent from an external address) Outbound (messages sent by someone within the company to at least one external address) InfoTag-Based Searching In the InfoTags area, click beside one or more InfoTags. Clicking sets one of three possible states: selected, excluded and not selected. Select InfoTags to retrieve any messages tagged with any of the selected InfoTags (for example, if you select both News and Travel, you retrieve messages tagged with either of those InfoTags). Exclude InfoTags to ignore messages tagged with any of the excluded InfoTags. Copyright Proofpoint, Inc. 21

26 Working with Search Results This chapter explains the various functions that can be performed on messages retrieved by a search. It includes the following topics: How Search Results are Presented 22 Working with Messages Found by a Search 23 Message Properties 23 Saving Results in Archive Folders 24 How Search Results are Presented By default, the messages found by the search are listed on the left of the search screen, and, once a message is selected, the Preview of the selected message appears on the right. The toolbar can be used to change this. Note: Messages from social networks or other sources are identified by a unique icon. The list shows basic information about 15 messages at a time, sorted by the criteria specified in your preferences (see "Setting Preferences" on page 7). To move through the pages of a multi-page result list, use the navigation buttons at the bottom of the list. Note: If your search retrieves many matches, consider narrowing your search criteria to avoid having to navigate through pages. The results list is temporary and will be replaced by your next search. To gather the results for further analysis, save the search results in a folder: see "Saving Results in Archive Folders" on page 24 Copyright Proofpoint, Inc. 22

27 Working with Search Results Working with Messages Found by a Search To Display the message details Turn search term highlighting on and off (If you searched for words or phrases, the part of the message containing the words or phrases that matched your search criteria is underlined in yellow) Print messages Download the message s attachment Retrieve messages to your inbox or forward to another mailbox View the properties of the message Change the sort order Do this Click on the message in the list. On the toolbar, click Select the message(s) and, on the toolbar, click Print or right-click and choose Print. Display the message details and click on the attachment name. Depending on your browser configuration, you either see the attachment in a new browser window or are prompted to save or open it. Select the message(s) and, on the toolbar, click Retrieve. Choose whether to send the message(s) to your inbox or forward to another address that you enter and, optionally, enter comments that will appear to the recipient. Select a message and, on the toolbar, click Properties. The multi-tab Message Properties screen, explained below, appears. Click anywhere in the heading of the list and choose the desired sort order: rank (most relevant first) sent (newest first, oldest first) size of message (largest first) size of largest attachment (largest first) Rank sorts messages based on how closely they match the search criteria. A message s ranking is represented by stars, with four stars representing the highest ranking (closest match). Sent sorts messages based upon the date the message was sent. Because the index organizes messages in half-hour groupings, messages sent within the same hour may be out of order relative to one another. Copy messages to a folder See "Creating Archive Folders" on page 24. Export messages See "Exporting Messages from a Folder" on page 37. Message Properties To display message properties for the selected message, from the search results, select the message and, on the toolbar, click Properties. Message properties are shown in the following tabs: The General tab shows a message s size, the time/date it was sent, received and archived, whether the message and its attachments are fully searchable, and other information. The Recipients tab shows the people who received the message (Discovery users only). The Header tab shows the SMTP header of the message. The Audit Trail tab shows the audit trail for the message (Discovery users only). If Discovery Segmentation is enabled, the Divisions tab shows which divisions this message was tagged with when it was archived. Note: On all but the General tab, you can click Copy to Clipboard to copy the information shown on the tab. Copyright Proofpoint, Inc. 23

28 Working with Search Results Saving Results in Archive Folders About Archive Folders Creating Archive Folders Each time you perform a search, since the archive s contents have most likely changed, the search results will likely differ. To save a snapshot of the results of a particular search performed at a specific time, you can create a folder, called an archive folder. An archive folder does not contain the messages themselves, just links to messages in the archive. This means: adding items to or deleting them from an archive folder does not affect the archive once a message has been removed from the archive, it can no longer be accessed from a folder, even if the folder still has a link to that message future searches using the same criteria as used to create the folder in the first place do not affect the folder contents, even if those searches retrieve additional messages Archive folders exist in a hierarchy of folder/sub-folder. Within a given level, folder names must be unique. For example, you cannot have two folders directly under My Folders called News, but you can have a News folder within an Industry folder as well as a News folder within a Company folder. Archive folders can contain the results of several searches: you either copy or move messages from one folder to another or add new search results to an existing folder. If a message added to a folder already exists in the folder, a duplicate will not be made. To view the contents of an archive folder, you simply click on the folder name. The same functions that are performed on search results can be performed on a folder s contents. Note: If you search an archive folder and see, in place of a message, this message has been disposed, the message has been removed from the archive and cannot be viewed or worked with. To add items to a new or existing archive folder: 1. If necessary, execute a search. 2. Select messages to be added to the folder. 3. On the toolbar, click Copy to Folder. The Copy To Folder screen appears, listing available folders. 4. Select the folder in the tree to which you want the messages added - or - Select a location in the tree and click New Folder to create a new folder under that location. Note: You cannot add items to the My Folders root itself, only to the folders that it contains. 5. Choose what should be included in the folder: only the most recent xx results all results only the selected items Note: Only one copy of a message can exist in a folder. If the folder already contains a message identified here, a second copy will not be added to the folder. 6. Click Save. The Copy To Folder screen closes and the copy process begins in the background. A confirmation message appears when the copy is complete. Note: Depending on the number of items in the search results, it may take several minutes for all of the items to be added to the folder. When you view the contents of a folder, if items are still being copied to that folder, a progress icon appears in the header: see "To check the status of the copy/move between archive folders process:" on page 25. Copyright Proofpoint, Inc. 24

29 Working with Search Results To create an empty archive folder for future use: 1. In the E-Discovery module, on the navigation menu click My Folders (to add a top-level folder) - or - Click the beside a folder (to create a sub-folder underneath it). 2. Click New Folder. 3. When prompted, enter a name for the new folder and click OK. Within a given level, folder names must be unique. The folder is created. To share an archive folder 1. From the E-Discovery module, in the navigation menu, click My Folders, then click the beside the folder you want to share and choose Share. 2. Choose the user(s) with whom you want to share the folder and click Add. 3. Click Save. Managing Archive Folders To remove or rename a folder Note: Deleting a folder removes all of its contents. 1. In the E-Discovery module, in the navigation menu, click My Folders, then click the beside the folder you want to remove or rename. 2. Choose Delete or Rename. If you chose Rename, the name becomes modifiable. If you chose Delete, you are prompted to confirm deletion. To copy or move items between archive folders: 1. In the E-Discovery module, in the navigation menu, click My Folders, then open the folder containing the items to be copied. 2. Select the messages you want to copy to another folder. 3. Right-click and choose Copy to Folder. The Copy To Folder screen appears. 4. Select the folder to which you want the messages added You can create a folder as well: select a location, and click New Folder to create a new folder under that location. Note: You cannot add items to My Folders root folder itself, only to the folders that it contains. 5. Choose whether items should be copied or moved to the selected folder. 6. Click Save. The Copy To Folder screen closes and the copy process begins in the background. To check the status of the copy/move between archive folders process: 1. Click My Folders in the sidebar and open the folder to which you copied or moved messages. A list of the messages contained in the folder appears. A title area shows the name of the folder. An icon appears beside the folder name if there are still items being copied to the folder. 2. Click on the icon. The Copy To Folder Status screen appears. Here you can see the description of what is currently being copied to the folder. To move messages between subfolders of an archive folder: 1. Open an archive folder and select one or some of its contents. "Move Selected to..." appears just below the toolbar, followed by the name of each subfolder. 2. Click the subfolder to which the selected message should be moved. Copyright Proofpoint, Inc. 25

30 Working with Search Results Note: This function is useful to create a form of review workflow, for example, with folders such as "relevant", "not relevant", "bulk" and "confidential".. To delete items from a folder: 1. In the E-Discovery module, in the navigation menu, click My Folders, then open the folder containing the items to be deleted. A list of the messages contained in the folder appears. 2. Select the message(s) and, on the toolbar, click Delete. - or - Right-click on a message and choose Delete From Folder. You are prompted to confirm the deletion, and the items are removed from the folder. Note: Deleting items from a folder does not remove them from the archive. Copyright Proofpoint, Inc. 26

31 Creating and Modifying Legal Holds This chapter explains how to create the different types of legal holds. Using these functions requires special access rights that may not be available to all users. For background information on the role of legal holds in the legal discovery process, see "About Legal Discovery" on page 9. This chapter includes the following topics: About Legal Holds 27 Types of Legal Holds 27 Choosing a Legal Hold Type 28 Discovery Segmentation Impact on Legal Holds 28 Assigning Permissions for Legal Hold Access 28 Working with Ad-Hoc Legal Holds 29 Working with People-Based Legal Holds 29 Sending Legal Hold Notifications 30 Managing Legal Holds 31 Releasing a Hold 32 Exporting Legal Hold Information 32 About Legal Holds A legal hold stores copies of messages in the active archive that need to be retained for legal purposes. As a result, disposing of messages from the active archive does not affect the legal hold s content. Once a matter is complete, you can release the hold, making the messages available for disposition. (Disposition is explained in Policy Creation and Management). The users whose messages appear in a legal hold are called custodians. The contents of legal holds can be searched in the same way the rest of the archive can be searched. Access to specific legal holds can be restricted to only specified users. Types of Legal Holds Ad-Hoc Legal Holds An ad-hoc legal hold contains all messages that meet the criteria specified in the rules associated with the legal hold. For example, you can specify that the legal hold is to contain all messages exchanged between two specific parties. The rules used to populate ad-hoc legal holds are the same as used in policies and are explained in Policy Creation and Management. When it is created, this type of legal hold begins adding messages, as they are archived, based on the rule criteria. It does not automatically capture historical messages, although you can search for messages, place them in a folder, and manually add them to the legal hold. Note: If the messages being manually added to the ad-hoc legal hold already exist in that hold, the messages will be duplicated. People-Based Legal Holds A people-based legal hold contains messages belonging to specific users, known as hold custodians. When it is created, the Archive populates a people-based legal hold with messages from the active archive and all other legal holds that belong to those users. It will continue to add messages on a go-forward basis. Copyright Proofpoint, Inc. 27

32 Creating and Modifying Legal Holds Choosing a Legal Hold Type Feature Ad-Hoc People-Based Contains messages that Match rule(s). Belong to specific AD user. Historical mail captured? No Yes When rules change Content unchanged Content added or removed Content can be manually added? Yes (from a folder) No Users can see which of their messages No No are in a hold and add other messages? Duplicate messages appear in hold? Yes No Discovery Segmentation Impact on Legal Holds For large organizations containing multiple units or divisions, the Discovery Segmentation functionality allows messages to be tagged as belonging to a set of business units or divisions as the message is archived. When Discovery Segmentation is enabled for a customer, a Discovery User can only create legal holds on messages within the divisions to which they have been granted access. This allows legal teams to perform legal discovery and hold tasks on the divisions for which they are responsible, while denying them access to information belonging to other divisions. Discovery Administrators continue to have full access to the archive and can create legal holds across the entire archive. Note: If no division can be resolved during archiving, the message is tagged with No Division. Discovery Users can be granted access to search mail tagged with No Division in the same fashion as any other division. Assigning Permissions for Legal Hold Access Users and groups can be given permissions to search, view the definition of and/or modify the definition of a specific legal hold. As the creator of a legal hold, by default, you have all these permissions. To assign permissions for legal hold access: 1. In the E-Discovery module, in the navigation menu, click Legal Holds. Locate a legal hold, either by clicking the appropriate alphabetical tab or by searching on the Search tab. 2. Select the legal hold and, on the toolbar, click Properties. The legal hold screen appears. 3. Click Modify. 4. On the Permissions tab, click Add and choose whether to add a user or a security group. A new screen appears. 5. Specify the user or group name, following the steps in "Adding Names to Entities" on page 7 6. Check all the appropriate permissions for the user or security group. 7. Click Save. Note: Discovery Administrators automatically have all rights to all legal holds. Copyright Proofpoint, Inc. 28

33 Creating and Modifying Legal Holds Working with Ad-Hoc Legal Holds To create ad-hoc legal holds: 1. In the E-Discovery module, in the navigation menu, click Legal Holds. The Manage Holds screen appears. 2. Click Add. You are prompted to choose the type of legal hold you want to create 3. Choose Ad-Hoc Legal Hold and click Next. The Ad-Hoc Legal Hold Entry screen appears. 4. On the General tab, enter a Name for the legal hold. Note: Legal hold names must be unique. 5. Optionally, add to the Description and Comments tabs. 6. On the Permissions tab, identify users who can work with this legal hold entry. See "Assigning Permissions for Legal Hold Access" on page In the Settings panel, click Identification Rules and define the rules to be used to populate the legal hold. For details on these rules, see the Policy Creation and Management document. Note: The Status function on the Settings panel is used to manage legal holds. 8. Click Save. The screen closes and the hold is created. To manually add messages to an ad-hoc legal hold: 1. In the E-Discovery module, in the navigation menu, click My Folders, then click the name of the folder containing the messages you want to add to the hold. A list of the messages in the folder appears. 2. To add all the messages in the folder to the hold, in the toolbar click Add to Hold. - or - Select specific messages click Add to Hold. The Add to Hold screen appears. 3. From the Add items to list, choose the legal hold to which items should be added. Note: Messages in the archive folder that are also already in the hold are duplicated in the hold. 4. Click Hold. The Add to Hold screen closes and the messages are copied, in the background, into the legal hold. Note: Depending on the number of items in the folder, it may take minutes or hours for all of the items to be copied to the hold. A job is used to copy messages to a hold: the status of this job is viewable in the hold properties.. Working with People-Based Legal Holds To create a people-based legal hold: 1. In the E-Discovery module, in the navigation menu, click Legal Holds. The Manage Holds screen appears. 2. Click Add. You are prompted to choose the type of legal hold you want to create 3. Choose People-based Legal Hold and click Next. The People-Based Legal Hold Entry screen appears. 4. On the General tab, enter a Name for the legal hold. Note: Legal hold names must be unique. 5. On the Permissions tab, identify users who can work with this legal hold entry. See "Assigning Permissions for Legal Hold Access" on page 28. Copyright Proofpoint, Inc. 29

34 Creating and Modifying Legal Holds 6. Optionally, add to the Description and Comments tabs. 7. In the Settings panel, click Identification Rules and add the users whose messages are to be included in the hold. You can add users manually or by importing from an Active Directory group, text file, or the clipboard (see below). Note: The Status function on the Settings panel is used to manage legal holds The File Collection panel is used for the optional Content Collection module.. 8. Click Save. The screen closes and the hold is created. To add users to a people-based legal hold manually: 1. On the Identification Rules tab, specify the user name, following the steps in "Adding Names to Entities" on page If Discovery Segmentation is enabled, you can further filter by division. Note that you can only include messages within the divisions to which you have been granted access. Divisions that are grayed out in the list are divisions to which you do not have access. To add users to a people-based legal hold by importing: 1. On the Identification Rules tab, click Import Users. The Import Users wizard opens. 2. Choose the source for the users to be imported: an Active Directory group, a file, or text from the Clipboard. Note: A maximum of 1000 users can be imported at a time. 3. To import by Active Directory group, enter the name of the group (and optionally, click Check Group). The current members of that group will be added to the legal hold. Note: If membership in the group changes, re-importing the group will add additional users from the group to the legal hold. Existing users, even if they are no longer in the Active Directory group, will remain in the legal hold. To import from a text file containing SAM account names or SMTP addresses, click Browse and browse to the location of the file. To import from the Clipboard, copy the list of users (for example, the list of recipients of an message), then click Paste from clipboard. Formatting will be stripped out 4. Click Next. A list of users to be imported, and a list of those users, if any, who cannot be imported, appears. 5. If the import list is not as you require or expect, click Cancel and resolve the issue. Otherwise, click Finish, The listed users are added to the legal hold. Sending Legal Hold Notifications Legal hold notifications can be sent to custodians associated with a people-based legal hold. The notifications feature manages the tracking and reporting of legal hold notices. It automatically creates hold instructions, sends notices to specified custodians, issues periodic updates and reminders, and allows tracking of custodian compliance. This feature is offered through integration with Legal Hold Pro. Custodians of a people-based legal hold are tagged to indicate the name of the people-based legal hold(s) to which they are associated, then uploaded to Legal Hold Pro for use in notifications. Note: Legal holds for which notification is being used must have names with no more than 75 characters. Each custodian of the legal hold must have no more than 200 characters in their display name, SAM account name and SMTP address. To enable notifications for a legal hold: 1. In the E-Discovery module, in the navigation menu, click Legal Holds. Locate a legal hold, either by clicking the appropriate alphabetical tab or by searching on the Search tab. Copyright Proofpoint, Inc. 30

35 Creating and Modifying Legal Holds 2. Click on a people-based legal hold and, on the toolbar, click Notifications. If you are not a Legal Hold Pro user, you see a screen describing the application, with a link to more details. If you are a Legal Hold Pro user, you are a menu of choice: click Upload Custodians to Legal Hold Pro. A list of hold custodians in the selected legal hold appears. 3. Click Next. When upload is complete, the screen changes to show information on uploaded custodians, and any errors that occurred during the upload. 4. To complete the process, you need to, within Legal Hold Pro, associate the uploaded custodians with a legal hold. To do this now, click Close and launch Legal Hold Pro. To close the screen and do this later, click Close: in the future, you can click Notifications again and choose Launch Legal Hold Pro. Note: After uploading custodians for a legal hold, if you add hold custodians to that legal hold in the archive, you will need to repeat this process to upload the new custodians. Similarly, if you delete custodians from a legal hold in the archive, this change will not be automatically reflected in Legal Hold Pro. Managing Legal Holds To modify a legal hold: 1. In the E-Discovery module, in the navigation menu, click Legal Holds. 2. Click on the legal hold you want to modify and, on the toolbar, click Properties. The Hold Properties screen appears. 3. Click Modify and make the appropriate changes. Note: If Discovery Segmentation is enabled, it is possible to add divisions to existing legal holds. However, divisions cannot be removed. If you need to remove divisions from a legal hold, you must create a new legal hold containing the appropriate divisions. Note that changes may have different impacts on different legal holds: For ad-hoc legal holds, changing the rules does not affect the contents of the hold prior to the change in rules. For people-based legal holds, adding an Active Directory user to the identification rules adds content for that user to the hold. For people-based legal holds, deleting a user from the identification rules disposes content for that user from the hold. To monitor the progress of adding messages to a hold: 1. In the E-Discovery module, in the navigation menu, click Legal Holds. 2. Click on the legal hold for which you want to see information and, on the toolbar, click Properties. The Hold Properties screen appears. 3. Click Status. Two tabs of status information appear: the Events tab shows when requests to add items to the hold were placed and what their current status is the Status Info tab shows statistics related to the legal hold Note: Legal Hold events can have a blocked status if a processing error occurs. Proofpoint Technical Support monitors this activity and will take corrective action automatically. Copyright Proofpoint, Inc. 31

36 Creating and Modifying Legal Holds Releasing a Hold Once a matter has been closed and the messages that have been copied to a legal hold are no longer required, you can release the hold. Releasing a hold marks it as being available for disposition. An appropriate user must authorize the disposition of messages in the hold before they are actually removed from the system: see Policy Creation and Management. Note: If you have permission to dispose of messages, releasing the hold will automatically perform both actions. To release a hold: 1. In the E-Discovery module, in the navigation menu, click Legal Holds. The Manage Holds screen appears. 2. Click on the legal hold that you want to release and on the toolbar, click Release Hold. A warning screen appears. 3. Enter a comment. 4. Click Release Hold and Dispose. A confirmation window appears. Exporting Legal Hold Information Exported legal hold information can be useful for more detailed analysis or reporting. You can export two views: The legal hold list includes a row for each legal hold, showing the number of messages contained in that hold. The legal hold custodians includes a row for each person on each legal hold. Legal hold information is exported in CSV format. The resulting file can be opened in Excel. Opening an exported legal hold list and filtering by hold name produces a row for each custodian on that hold. Opening exported legal hold custodian data and filtering by person produces a row for each hold that applies to that person (custodian). To export hold-related information: 1. In the E-Discovery module, in the navigation menu, click Legal Holds. The Manage Holds screen appears. 2. On the toolbar, click Export, then Export Legal Hold List or Export Legal Hold Custodians. A confirmation message appears, and a confirmation message is sent to you. When the export process is complete, the resulting csv is ed to you. Copyright Proofpoint, Inc. 32

37 Proofpoint Content Collection This chapter introduces the optional Proofpoint Content Collection Module and explains how to use it to preserve files in a legal hold. The chapter includes the following topics: About Content Collection 33 Adding Content Collection to a Legal Hold 33 Managing Collection Tasks 34 Deleting Collection Tasks and Collected Files 34 Viewing Collected Files in the Archive 35 About Content Collection Proofpoint Content Collection is an optional feature that allows files on corporate file servers or in any site, sub-site, document library, or folder in SharePoint to be retained in a people-based legal hold. This provides a unified, protected, and searchable legal hold repository of both files and messages. The Proofpoint Enterprise Governance file server agent must be installed on the corporate file servers containing the files to be collected. The Proofpoint Governance SharePoint agent must be installed on the Proofpoint Farm. The SharePoint agent requires services account access: it tracks and can upload to the archive only files in locations to which it has access. For help in setting up this module, contact Proofpoint Professional Services. Note: Office 365 SharePoint online is not yet supported. Content Collection involves adding file collection tasks to an existing People-Based Legal Hold. Initially, these tasks copy files in the designated location and store the copies in the archive. Optionally, at a configurable interval, files added to the location, or previously copied files with changed content, are copied to the archive. Note: Unless configured to do so, Content Collection is not repeated automatically, although the file collection task can be re-run. Automatic collection of new/changed files is a configurable option. Once in the archive, files can be searched for and viewed in the same way as messages. Note: Since People-Based Legal Holds point to a mailbox, if you want a legal hold that includes just files, not messages, you will need a placeholder user/mailbox added to your Active Directory. Create a People-Based Legal Hold for this placeholder user (whose name will appear on the deleted tab), then add content collection to the legal hold. Adding Content Collection to a Legal Hold 1. In the E-Discovery module, in the navigation menu, click Legal Holds. The Manage Holds screen appears. 2. Select the people-based legal hold to which you want to add Content Collection and click Properties. The Hold Properties screen appears. 3. In the Settings panel, click File Collection. The File Collection tab appears. 4. Click Modify, then Manage File Collections. A new screen appears, listing the collection tasks (if any) already belonging to this legal hold. 5. Click Add. The Add New Collection screen appears. 6. Enter a Name for the collection and the UNC Path to the files to be collected. Copyright Proofpoint, Inc. 33

38 Proofpoint Content Collection The collection name is used as the name of the collection task. To allow the messages and files to be disposed of separately, the collection name is also automatically added, as a user, to the Identification Rules portion of the legal hold. 7. Click Save & Execute. The collection task begins. You can monitor its status on this screen or display details: mouse-over the task, or select it and click Status. For information on understanding task status, see "Managing Collection Tasks " on page If necessary, repeat to add additional content collection tasks to the legal hold. 9. Close the screen to return to the legal hold definition, and save the revised legal hold. Managing Collection Tasks Collection tasks can have a status of In Progress, Failed, or Completed. A status of Completed means the task has completed, but it is possible that not all files in the designated location were collected. If necessary, you can retry the task, as described below. Changes to the contents of the designated location for content collection do not affect the content already collected. Files that were in the designated location at the time the collection task last ran, but have subsequently been deleted, remain in the collection. 1. In the E-Discovery module, in the navigation menu, click Legal Holds. The Manage Holds screen appears. 2. Select the people-based legal hold to which Content Collection has been added and click Properties. The Hold Properties screen appears. 3. In the Settings panel, click File Collection. The File Collection tab appears. 4. Click Modify, then Manage File Collections. A new screen appears, listing the collection tasks belonging to this legal hold. 5. To view details of a task s status, mouse-over the task or select it and click Status. To modify a task, select it and click Edit, make the necessary changes, and click Save & Execute. To retry a task, select it and click Edit, then click Save & Execute. Note: A failed collection task will resume at the point of failure. A partially successful legal hold will attempt to gather any files that were not successfully gathered in the previous pass, including any files added to the location since then. Deleting Collection Tasks and Collected Files To remove collected files from the archive and ensure they are not collected again, you need to delete both the collection task and the user added for that task. 1. In the E-Discovery module, in the navigation menu, click Legal Holds. The Manage Holds screen appears. 2. Select the people-based legal hold performing the Content Collection task whose files you want to delete. The Hold Properties screen appears. 3. Click Modify. 4. In the Settings menu, click File Collection. The File Collection tab appears. 5. Click Modify, then Manage File Collections. A new screen appears, listing the collection tasks belonging to this legal hold. 6. Select the task you want to delete and click Delete. You are prompted to confirm. 7. Close the screen to return to the Legal Hold definition. 8. In the Settings menu of the Legal Hold, click Identification Rules. Copyright Proofpoint, Inc. 34

39 Proofpoint Content Collection The current Identification Rules for the legal hold appear. In addition to the actual users whose mailboxes are included in the legal hold, a name was added for each collection task in the legal hold. 9. Select the name of the collection task and click Delete. You are prompted to confirm. 10. Click Save. Viewing Collected Files in the Archive Performing a search within a legal hold will display files in a form that mimics the look of an message. Copyright Proofpoint, Inc. 35

40 Exporting Messages This chapter explains how to export search results, either directly or from folders, so that messages can be viewed by individuals using Outlook. It includes the following topics: Encryption s Role in the Export Process 36 Understanding the Export Process 36 Exporting Messages from Search Result 37 Exporting Messages from a Folder 37 Exporting Messages to FTP Site 38 Managing the Export Progress 38 Completing the Export 38 Sharing an Export Job 39 Specifying an Export Job Retention Period 39 Viewing Exported Messages in Outlook 39 Encryption s Role in the Export Process Messages are stored in Proofpoint Archive in encrypted form, and the encryption key is required to decrypt the data into a readable form. This key is maintained on the Archiving Appliance as an integral part of allowing you to search the archive. When you export data from the archive, the Proofpoint Network gathers the messages to be exported, but the data remains in encrypted form until it is processed by the Archiving Appliance. Understanding the Export Process Optionally, messages can be placed in a folder before being exported. If messages are exported directly from the search results, they are automatically placed in a folder as well as being exported. Note: For batch search users, messages are always found in a folder. Exporting messages is done via an export job. When you initiate an export in the user interface, the job is queued for processing in the background. You can check its status at any time, but will also receive an message when the job is finished. You do not need to be logged in for the export to be processed. Note: If other users have shared export jobs with you, you will see those jobs in the "Shared With Me" tab when, in the E-Discovery module, you click Exports. Messages can be exported to either an Outlook Personal Folders file (PST) or an EDRM XML file. Exporting to PST allows the messages to be viewed and managed using Microsoft Outlook. All of the richness of the original message is maintained because the data remains in format. Multiple PST files will be created if you export more than 1GB of data (since each PST file has a maximum size of 1GB). Note: Contact Proofpoint support if you want to have the PST threshold limit changed. Exporting to ERDM XML produces a zip file containing an XML file that lists all the message files exported an MD5 hash file a folder containing the exported raw MSG files. Copyright Proofpoint, Inc. 36

41 Exporting Messages You can import the contents of the zip file to view the original message, using any third party application able to read DRM XML files. In addition, you can view the contents of individual messages (MSG files) in Outlook. Once an export is complete, exported messages can be automatically uploaded to an FTP site you specify when defining the export. Exporting Messages from Search Result If your search criteria includes multiple mailboxes (up to 25), you can choose to create one export job per mailbox, resulting in one PST or EDRM XML file per mailbox. 1. Execute a search, select the messages you want to export and click Export. The Export from Search screen appears: the bottom of the screen shows the estimated length of time of the export. 2. Enter a name for the export, and choose the type of export. 3. If appropriate, check Create job per mailbox. If you chose to create one job per mailbox, the mailbox name is appended to the job name to perform a unique name, and a separate PST or EDRM XML file will be created by each job. 4. Optionally, enter a Description for the export job. 5. Optionally, choose the appliance you want to use for the export. 6. To upload the export to an FTP site, follow the instructions in "Exporting Messages to FTP Site " on page Click Export. The Export screen closes and the export process begins in the background. Note: Depending on the number of items selected, it may take minutes or hours for all of the items to be exported. 8. While the export process is underway, you can monitor its progress. Follow the steps in "Managing the Export Progress" on page When the export process is complete, you will receive an telling you this. Follow the steps in "Completing the Export" on page 38 Exporting Messages from a Folder To export the contents of a folder: 1. In the E-Discovery module, on the navigation menu click My Folders. 2. Click the to the right of the folder containing the messages you want to export and choose Export. The Export Folder screen appears, showing the estimate length of time the export will take. 3. Enter a name and, optionally, description for the export job. Note: Export names must be unique. 4. Choose the type of export file to be created. 5. Optionally, choose what appliance you want to use for the export. 6. To upload the export to an FTP site, follow the instructions in "Exporting Messages to FTP Site " on page Click Export. The Export screen closes and the export process begins in the background. Note: Depending on the number of items in the folder, it may take minutes or hours for all of the items to be exported. 8. While the export process is underway, you can monitor its progress. Follow the steps in "Managing the Export Progress" on page When the export process is complete, you will receive an telling you this. Follow the steps in "Completing the Export" on page 38 Copyright Proofpoint, Inc. 37

42 Exporting Messages Exporting Messages to FTP Site 1. To upload the export to an FTP site, on the Export from Search or Export from Folder screen, click Add FTP Information. The Upload Exported Files screen appears. 2. Enter information about the FTP site (address, port, and username/password with access to the site). If necessary, you can test the FTP connection before proceeding (click Test Connection). 3. Click Done. Managing the Export Progress User Managers can view and delete a job belonging to any user: the user is notified by . To monitor the progress of an export job: 1. In the E-Discovery module, in the navigation menu, click Exports and choose the appropriate tab (to work with your own exports or exports shared with you). The Exported Data screen appears. For each job, you can see the export status. 2. Click on the export job for which you want to see information. 3. Click Properties. The Export Item Properties screen appears. From here you can see when the job was created, and each time its status changed. To cancel an export job: 1. In the E-Discovery module, in the navigation menu, click Exports and choose the appropriate tab (to work with your own exports or exports shared with you). 2. Click on the export job that you want to cancel then, on the toolbar, click Delete. A confirmation window appears. 3. Click OK. The job is cancelled. Note: An export job must be in the "Ready" state to be cancellable. To delete an export job and any downloadable data: 1. In the E-Discovery module, in the navigation menu, click Exports and choose the appropriate tab (to work with your own exports or exports shared with you). 2. Click on the export job that you want to delete. 3. On the toolbar, click Delete. A confirmation window appears. 4. Click OK. The job, and any exported data, is removed. Note: An export job must be cancelled before it can be deleted. Completing the Export 1. In the E-Discovery module, in the navigation menu, click Exports. 2. Click on the export job that has the data you want to download and, on the toolbar, click Download. The export job file list dialog is displayed. 3. Click Download Now beside the file you want to download. 4. When prompted by the browser, click Save and navigate to the location where the file should be saved. Copyright Proofpoint, Inc. 38

43 Exporting Messages The download process starts. When the download is complete, the exported files of the appropriate type are in the directory specified. If you exported to PST, to view the exported messages in Outlook, follow the procedure below. Your exported files are downloaded to the archive appliance where they remain until they are deleted by a User Manager. (See "Managing the Export Progress" on page 38 for more information about manually deleting files.) Completed export files stay on the appliance and can fill up disk space. To avoid this problem, you can choose to have the application automatically delete exported files after they have reached a specific retention period. To do this, you must contact Proofpoint support to request a retention period for your export jobs. If you uploaded the export to an FTP site, you can retrieve it from that site. If you do not specify in the export definition to have the export files automatically removed from the appliance, you can do that manually once the export is complete. Sharing an Export Job 1. In the E-Discovery module, in the navigation menu, click Exports. 2. Click the beside the job you want to share and choose Share. 3. Choose the user(s) with whom you want to share the job and click Add. Those users can monitor and download the results of the export. 4. Click Save. Specifying an Export Job Retention Period First, make it a regular practice to review your export jobs ensuring they have been downloaded by the person who requested them. To schedule regular deletions of export jobs: 1. Contact Proofpoint support and ask them to configure your archive deployment to include an export retention period. 2. Specify the number of days after which completed export jobs should be deleted. The appliance checks every 12 hours to locate completed files that have exceeded the export retention time. Completed files that fit this description are automatically deleted. Note: It is important to remember that all completed export files will be deleted and no warning will be sent prior to deletion. Export files cannot be recovered after deletion, but you can always run another search and export the results. Viewing Exported Messages in Outlook To view the PST file containing exported messages within Microsoft Outlook: 1. Open Microsoft Outlook. 2. On the File menu, select Open, then select Outlook Data File The Open Outlook Data File screen appears. 3. Select the.pst file you want to open, then click OK. The Open Outlook Data File screen closes. The name of the folder associated with the data file appears in the Folder List. 4. Select the name of the folder in the Folder List. The contents of the exported data appear within Microsoft Outlook. Note: To view the Folder List, on the Go menu, click Folder List. Copyright Proofpoint, Inc. 39

44 Performing Supervision Functions This chapter introduces concepts and procedures for systematic review of the content of messages using the optional Proofpoint Archive Supervision functions. The chapter includes the following topics: About Supervision 40 For Reviewers: Passing and Failing Messages 41 For Senior Reviewers: Supervision Interface 42 For Senior Reviewers: Review Tasks 42 For Senior Reviewers: Issue Investigation and Management Tasks 44 About Supervision Your Role in Supervision As a Supervision user, you are responsible for reviewing messages to determine if they comply with your company s policies. The messages you will review fall into three general categories: messages that the system has identified and flagged as potentially violating a specific policy messages that the system has randomly picked for review messages that another reviewer has flagged as potentially violating a specific policy Messages that require review appear in a review queue. You see only those messages that you are allowed to review (for example, only messages that belong to people who report to you). Note: Messages sent by an internal person (an employee) are considered to be owned by the sender, not by those who received them. Messages sent into the company from external people (non-employees) are considered to be owned by the first internal party on the To, cc or bcc lines. In environments with a review team, all team members see the same queue. Opening a message for review locks the message: other team members cannot review it. In addition to the message content, messages seen in the review queue indicate what, if any, policies they may have violated, and, if appropriate, the risk level associated with that violation. Reviewing Messages Your system may have been set up for standard review or hierarchical review. Standard Review In standard review, the messages you see are those that belong to a set of users, whether or not they may have violated a specific policy. You can pass or fail these messages, removing them from the queue. When you fail a message, you indicate the policies you believe it has violated. Hierarchical Review In hierarchical review, you may be either a general reviewer or an expert reviewer. If you are a general reviewer, you see only messages the system has randomly selected. You can pass or fail these messages. Passing a message removes it from the queue, failing it may escalate it to an expert reviewer (for example, a legal specialist) to review, depending on the policies you indicate the message may have violated. If you are an expert reviewer, you see only messages that have been flagged (by the system or another reviewer) as potentially violating the specific policies for which you are an expert. Copyright Proofpoint, Inc. 40

45 Performing Supervision Functions Passing a message may remove it from the queue or, if the message is flagged as potentially reviewing multiple policies, may make it available for the review of another expert reviewer. Failing a message removes it from the queue. Note: You may see, in the Supervision queue, in place of a message, this message has been disposed, the message has been removed from the archive and cannot be viewed or worked with. Types of Reviewers You may be either a reviewer or a senior reviewer. If you are a reviewer, you see only a single message a time, from oldest to most recent. You simply choose to pass or fail a message and do not perform any other functions. If you are a senior reviewer, you can perform review functions on messages that you choose from list. You can also perform other monitoring and resolution processes, including batch processes. Note: Batch processes, which generally defeat the purpose of supervision, are typically used to clear the review queue of repeat messages (such as SPAM) or to clear the queue in the event of a backlog. For Reviewers: Passing and Failing Messages To pass messages: 1. In the Supervision module, in the navigation menu, click Messages Review The next message that you are able to process appears showing, at the top, a list of any policies it may have violated. 2. To pass the message without comments, on the toolbar, click Pass. -or- To pass the message with comments, click Pass with comments. Add your comments in the screen that appears. The message is flagged as a pass (not violating any policy) and the next message appears for processing. Note: In a hierarchical review process, the message may still be seen by another reviewer if policy violations for which you are not an expert have been identified. To fail messages: 1. In the Supervision module, in the navigation menu, click Message Review. The next message that you are able to process appears showing, at the top, a list of any policies it may have violated. 2. Click Fail/Escalate. The Review Violations and Comments screen appears, listing the policies that your company requires messages to comply with. 3. Check the checkbox beside each policy that you feel the message violates. 4. In the Comments field, enter comments that explain your choice. Comments may appear in notifications sent to interested parties. 5. Click OK. The Review Violations and Comments screen closes. The message is flagged as violating the selected policy entries, any notifications that are configured for the selected policies entries are sent and the next message appears for processing. Note: Even if you fail a message, it may still be escalated if other higher-priority policy violations for which you are not an expert have been identified. Copyright Proofpoint, Inc. 41

46 Performing Supervision Functions For Senior Reviewers: Supervision Interface Function Message Review Description Displays the next available message for you to review. Message List Unreviewable Queue Reports Displays a list of all messages available to be reviewed. Shows details of circumstances that resulted in messages that could not be reviewed being placed in the queue. Usually this is because no reviewer has been assigned permissions to review such messages. This list indicates what changes need to be made in order to have those messages processed. Shows status information for each reviewer, including the number and age of items available for each reviewer. Generate Supervision-related reports. Note: The default sort order for each list can be set using Preferences (see "Setting Preferences" on page 7). Within the Message List, you can choose to show messages based on a variety of criteria, including status. Statuses include: unreviewed and escalated messages that require review, either because they have not yet been reviewed, or because they were marked with a violation type for which you are an expert reviewer deferred messages for which review has been deferred by any reviewer passed messages passed by any reviewer failed messages failed by any reviewer closed messages failed by another reviewer and subsequently closed, indicating the issue has been resolved ignored messages that have been ignored For Senior Reviewers: Review Tasks To review and, optionally, process messages: 1. In the Supervision module, in the navigation menu, click Message List. 2. Use the fields at the top of the screen to specify the criteria for which messages appear on the list and click Update List. 3. Click on the message(s) with which you want to work. Note: Use the Control or Shift keys to select multiple messages, as you would in a Windows application. The message details appear, showing any potential violations previous reviewers, or the system, have identified. 4. Choose a function to perform on the message (see below). To Do this Find related messages Print messages Right-click on the message in the list and choose Find Related in Archive(see "Finding Potentially Related Messages" on page 44). Select the messages to be printed and, on the toolbar, click Print. Download the message s attachment Retrieve messages to your inbox View the properties of the selected message. Display the message details and click on the attachment name. Depending on your browser configuration, you either see the attachment in a new browser window or are prompted to save or open it. Select the messages to be retrieved and, on the toolbar, click Retrieve. The messages are sent to your Outlook inbox automatically. On the toolbar, click Properties. The multi-tab Message Properties screen appears. Copyright Proofpoint, Inc. 42

47 Performing Supervision Functions Change the sort order Click anywhere in the heading of the list and choose, from the menu that appears, the desired sort order. The default sort order presents messages in this order, from oldest to newest in each category: - Messages failed (escalated) by another reviewer - Messages the system suspects of violating a policy - Randomly selected messages You can also sort by send date (newest or oldest first). Pass or fail the message See below. Defer processing the message Comment on the message Ignore the message Display the message s supervision history Select the message to be deferred and, on the toolbar, click Defer. You are prompted to add comments explaining the deferral. Any existing suspected policy violations remain intact. Select the message and, on the toolbar, click Comment. You are prompted to enter comments. Right-click on the message and choose Ignore. You are prompted to enter comments. Note: Ignored messages are not considered processed, and therefore do not impact the percentages in reports. Click See Review History in the header bar of the open message. A list of the supervision actions taken on the message, including added comments, appears. Note: You are often prompted to enter comments. These comments may appear in notifications sent to interested parties. To pass messages: 1. Select the message(s) you want to pass. 2. To pass the message without comments, on the toolbar, click Pass. -or- To pass the message with comments, click Pass with comments. Add your comments in the screen that appears. Note: If you have a single message selected, clicking Pass means passing without comments. If you have multiple messages selected, clicking Pass means passing with comments. The same comment applies to all selected messages. The message(s) are flagged as passed (not violating any policy) and the view pane is updated. To fail or escalate messages: 1. Select the message(s) you want to fail or escalate. 2. On the toolbar, click Fail/Escalate. A new screen appears, listing the policies that your company requires messages to comply with. 3. Check the checkbox beside each policy that the message(s) violates. Note: When you fail multiple messages, all of them are assigned the same violations. 4. Enter comments that explain your choice. Comments may appear in notifications sent to interested parties. 5. Click OK. The new screen closes. The message is flagged as violating the selected policies, any notifications that are configured for the selected policies are sent and the view pane is updated. Copyright Proofpoint, Inc. 43

48 Performing Supervision Functions For Senior Reviewers: Issue Investigation and Management Tasks Tracking Issues to Resolution Indicating that a message has violated a specific policy is only the first step in resolving the issue. To ensure that the policy violation is addressed, further steps (such as training or disciplinary action) are necessary. This process is supported by the Archive. Messages, whether passed or failed, are moved to a specific list that can be viewed. Furthermore, messages in these lists can have a comment attached to them. For a passed message, the comment can be useful to indicate the reasons for passing a message that others might find problematic. For a failed message, the comment can be used to track steps taken to remedy the situation. Once the issue is entirely resolved, the message can be marked as closed. This removes it from the failed messages list, leaving that message to reflect only outstanding issues. Closing a Failed Message Close failed messages once action has been taken to resolve the issue. This makes it easier to identify issues that have not been dealt with yet. To close a failed message: 1. Open the Message List and choose, from the Show list, Only Failed Messages. 2. Select the message to be closed. 3. On the toolbar, click Close. A new screen appears, prompting for your comments about the closed message. 4. Enter review comments. 5. Click OK. Forwarding or Retrieving Messages You can either retrieve a message to your Inbox for further work or can forward the message to another party, internal or external, for their input. The recipient sees the original message as an attachment. When the recipient opens the attachment, they see a link to the message in the archive. Clicking on this link allows them to log into the Archive, and go directly to the message. To forward or retrieve a message: 1. Select the message(s) you want to forward or retrieve. 2. On the toolbar, click Retrieve. The Retrieve screen appears. 3. To retrieve the message to your inbox, select Retrieve to my inbox. -or- To forward it to someone else, select Forward to and enter the SMTP of the recipient(s). Optionally, enter comments to be used in the body of the message the recipient sees. 4. Click OK. A confirmation message appears. Finding Potentially Related Messages While reviewing a message you may encounter suspicious activity that warrants further investigation. To aid this investigation, you can search the archive for messages with similar information. Copyright Proofpoint, Inc. 44

49 Performing Supervision Functions To find potentially related messages: 1. Right-click on a message and choose Find Related in Archive. The Find Related in Archive screen appears. 2. Choose when you want to find: messages that have a similar subject line messages that were sent within specified number of days of the selected message messages that were sent or received by any the parties you specify 3. Click OK. A search is performed and the results are displayed to you. You can perform any of the usual functions on these messages. Copyright Proofpoint, Inc. 45

50 Viewing the Audit Trail This chapter describes how to use the audit trail to see information on specific activities performed by users. It includes the following topics: About the Audit Trail 46 Viewing Audit Trail 46 Exporting Audit Trail 47 About the Audit Trail Discovery users can use the audit trail to view: Search criteria entered by users, including user name and date. Search activity performed within a given time period. You can do this by exporting a search activity report. Messages viewed by users, including user name, date and Proofpoint Archive function used to view the message. Attachments viewed by users, including message the attachment belongs to. They can also view any message associated with an activity by clicking on the entry in the audit trail. User Managers can view the audit trail to view: Successful logins Unsuccessful login attempts Note: The audit trail for a specific message can be viewed by right-clicking on the message in the results list. Viewing Audit Trail To view the audit trail: 1. In the Administration module, in the Reports section, click Audit Trail. The Audit Trail screen appears. 2. Optionally, specify a time limitation for the activities by choosing from the Event Date list. Depending on what you choose, you may be prompted for more information. For example, if you choose an Event Date of On, you are prompted to choose the date. 3. Optionally, display information only for a specific user by enabling the (Performed by) Specific option and entering a name. 4. Optionally, specify the kind of activities you want to view by checking the appropriate items in the area on the right. Discovery users can see Searches, Message View and Attachment View activities, while User Managers can see Login (successful or unsuccessful) activities only. You can choose one or several activities to display. 5. Click Update List. A list of the activities that meet the specified criteria appears. For message-related activities, you can select the message to see its details on the right. To sort the list, click anywhere in the header and choose a sort option. Copyright Proofpoint, Inc. 46

51 Viewing the Audit Trail Exporting Audit Trail Admin users can also view a report of search activity performed within a given time period. You can generate a CSV file that can later be viewed in Excel. The report will include: Mailboxes searched Key search criteria used User who searched Date of the search Which types of attachments were searched 1. In the Administration module, in the Reports section, click Audit Trail. 2. Select an appropriate date range. 3. On the toolbar, click Export, then Export Searches. The export job is created and a confirmation message appears. You will receive an with the results attached as a zipped CSV file. Copyright Proofpoint, Inc. 47

52 Appendix A Search Criteria and Indexing Search Criteria: Keywords and Phrases Item Sample Description Keywords cat Return all items where the keyword cat is found in the . Phrases The dog chased a cat Return all items where the string The dog chased a cat is found in the . Phrases must be wrapped in quotes. Wildcard NOT SUPPORTED Multi character (*) or single character (?) wild cards are not supported. AND (cat AND dog AND tiger) Return all items where Cat, Dog and Tiger are found within the same . OR (cat OR dog OR tiger) Return all items where any of Cat, Dog or Tiger are found in the NOT (cat AND dog) Return all items where Cat and not Dog is found in the . Use dash in front of keyword you wish to avoid. Proximity "cat dog"~3 Return all items where Dog is within 3 words of Cat. Place words in quotes and use tilde (~) along with number of words within (3). Only two terms can be compared. Combining Operators cat AND (dog OR tiger) Return all items where Cat and either Dog or Tiger are found within the same . Combining Operators (cat OR dog) AND (tiger OR wolf) Return all items where either Cat or Dog AND either Tiger or Wolf is found within the same . Combining Operators (cat AND -dog AND tiger AND wolf) Returns all items where cat is found without any of dog, tiger or wolf Search Criteria: Special Characters If you want to search for special characters in the archive, such as punctuation marks, currency indicators, or decimals, etc., use these tables to see how Proofpoint Archiving stores such characters. This helps when structuring queries to find specific terms and legal hold definitions. Searching for characters that are not preserved will not produce search results. Special Character Description Content Search Term: Finds: Apostrophes Preserved in the index except when used in possessive form I ll tell you something. I ll tell you something. Ill tell you something. I ll tell you something. No result Apostrophes In the possessive form ( s) the apostrophe and the s are removed so you may search for either. If a possessive form is misspelled, you need to add it as a term if required. Jim s phone rang jim s phone rang jim phone rang jims phone rang Jim s phone rang Jim s phone rang No result Periods used as decimals Preserved in the index Periods used in acronyms Removed. NOTE: this only occurs if F.D.A. all the periods are present. If one is missing then you will need to search using the periods as they appear. FDA F.D.A F.D.A. FDA F.D.A. FDA F.D.A. F.D.A. F.D.A. FDA FDA No result Copyright Proofpoint, Inc. 48

53 Appendix A Search Criteria and Indexing Special Character Description Content Search Term: Finds: FDA No result F.D.A F.D.A Umlauts & Accents Our index does not map accented characters to "a corresponding" unaccented character. källén kallen källén kallen källén kallen källén No result No result kallen Ampersand Supported when used as part of term R&D (with no spaces). If there are spaces R & D around the ampersand, then it is removed. black&white black white Jack & Jill R&D R&D black&white black&white Jack Jill R&D No result black&white No result Jack Jill Greek Characters Converts uppercase character to lower case character. Ω ω either Ω or ω either Ω or ω Ω or ω Ω or ω Punctuation marks in and around numbers Dash, underscore, slash, commas and periods are all preserved if there is a number on either side (no spaces) of the punctuation character. Otherwise, they are not Abc-123 preserved in the index. abc-def RTP\ RTP_ RTP\ Abc-123 Abc 123 abc-def abc def RTP\ RTP RTP_ RTP RTP_23 RTP\1234 RTP\ RTP\ No result No result Abc-123 No result No result abc-def abc def RTP\ RTP\ RTP_ RTP_ No result RTP\1234 No result No result Currency symbols ( $ ) Removed. $ $ $ $100 $ Registered, trademark, The special character is removed Copyright Copyright Copyright and other similar characters Copyright Proofpoint, Inc. 49

54 Appendix A Search Criteria and Indexing Indexing Size Considerations As messages are placed in the archive, a full text search index of each message is created. The index includes multiple index fields to capture message content and other elements such as information about the sender and recipients of the message, the message s body, and the contents of its attachments (the first 10MB of each). The search index has a limit of 10,000 terms per field. Since all attachment data is stored in a single field, if the combined index of all attachments on a message exceeds 10,000 items, terms appearing beyond the 10,000th term will not be in the index and therefore not searchable, although the message in its entirety is archived. Copyright Proofpoint, Inc. 50

55 Glossary Term Access rights Active archive Appliance Archive Archiving Appliance Archive folder Batch Search Custodian Department Discovery Segmentation Description Rights that give users access to specific Proofpoint Archive functions. Set by making users members of specific Proofpoint Archive security groups in Active Directory. The full contents of the archive. Does not include any messages that have been disposed of from the archive but remain in legal holds. See Archiving Appliance. Proofpoint Archive function that stores electronic messages for specific retention periods. A sealed, fixed-purpose server installed within your corporate network or, optionally, a virtual machine. Integrates with Microsoft Exchange and Active Directory. Holds encryption keys. Hosts Proofpoint Archive user interface. A folder containing links to a set of messages found by a specific search and saved to a folder. Service that allows batch searching only, with the search taking place as a background process. Search results are placed in a folder for further analysis. Some functions are not available in this service. The users whose messages appear in a legal hold. A Proofpoint Archive user group, representing users who belong to an organizational unit. Allows for logically segregating archived data based on a division value. Designated users can perform search and legal hold tasks against data belonging to the divisions to which they have been granted access. Discovery User Proofpoint Archive user who can search archived messages in any mailbox. Disposition Process of removing a message from the archive when its disposition date has been reached. Expert reviewer Individual with specialized knowledge useful for determining if messages pass or fail. Associated with specific acceptable use policy entries. External person Someone who does not work for your company. InfoTag Internal person Journaling Mailbox Legal hold Nonce Metadata assigned to a message to characterize it for searching and policy entry use. Someone who works for your company. Mailbox that records messages flowing into and out of an organization. Accessed by Archiving Appliance to retrieve messages for processing. Container for messages that have reached the end of this disposition period but need to be retained for legal purposes. A randomly-generated, cryptographic token used to prevent replay attacks. Partner Pass/fail A Proofpoint Archive user group, representing external users such as lawyers or customers. Rules can apply to partners. Used in Proofpoint Archive Supervision. Reviewers determine if messages pass (do not contravene acceptable use policy entries) or fail (contravene acceptable use policy entries). Policy document Printed (PDF) version of electronic messaging policy. Policy entries Main components of an electronic messaging policy; specify what the policy is to enforce. Proofpoint Network Purpose Where data resides, in encrypted format. Archiving Appliances perform specific purposes (archiving, user interface, exporting, stubbing). Any appliance can serve all or some of these purposes. Real-Time Search Service that allows searching in real-time, placing the search results in the results list for further analysis. Retention period The period of time a message is intended to be retained, under normal circumstances. Determined by the retention policies active at the time the message was archived. Retention series Messages archived according to the same retention policy. Role Security Group A Proofpoint Archive user group, representing users with similar job functions. Rules can apply to roles. A Proofpoint Archive -specific Active Directory group. Used to control access to the Archive. Copyright Proofpoint, Inc. 51

56 Glossary Stub Stubbing Method of reducing storage size by replacing stored attachment with link to original attachment stored in the archive. Optional functions that manage mailbox sizes by replacing large attachments with links to the archive. Stubbing Policy A policy used to determine what mailboxes, and what folders in those mailboxes, to stub, and what size of attachments to stub. Stubbing time window Supervision Configured time period during which stubbing takes place. Optional functions used to design, edit, maintain and perform reviews of messages for acceptable use. Supervision user An Archive user who can review and evaluate other person s messages. Depending on privileges, this user may also be able to perform other review functions such as batch processing and reviewing messages processed by other reviewers, or be able to view reports about the number and nature of violations of the corporate electronic communications policy. User group User manager Role, department (internal person) or partner (external person). A Proofpoint Archive user who can assign privileges to other users and who can create and manage roles and departments. Copyright Proofpoint, Inc. 52

57 Index Index ad-hoc legal holds about, 27 creating, 29 archive folders about, 24 A copying items between, 25 creating, 24 deleting items from, 26 monitoring, 25 remove, 25 rename, 25 attachment-based searching about, 13 performing, 19 audit trail about, 46 exporting, 47 viewing, 46 B Boolean logic in searching, 14 cancel export, 38 C commenting on messages, 43 communication flow-based searching about, 13 performing, 21 content collection deleting files, 34 monitering tasks, 34 viewing files, 35 Content Collection about, 33 content-based searching about, 12 performing, 16 cotent collection setting up, 33 date-based searching about, 13 performing, 20 default home screen, 7 default search criteria, 7 deferring processing of messages, 43 discovery segmentation D impact on legal holds, 28 discovery segmentation and searching, 11 displaying found message, 23 EDRM XMLfile, exporting to, 36 encryption and exporting, 36 expert reviewer, 40 export E cancel, 38 completing process, 38 delete, 38 monitoring progress, 38 retaining jobs, 39 share job, 39 viewing exported messages, 39 export job, 36 exporting from folder, 37 from search results, 37 to FTP, 38 exporting legal holds, 32 exporting messages about, 36 Copyright Proofpoint, Inc. 53

58 Index monitoring progress, 38 failing messages senior reviewers, 43 finding related messages, 44 folders about, 24 sharing, 15 folders - see archive folders, 24 FTP site for export, 38 general reviewer, 40 F G H hierarchical review. about, 40 highlight in found message, 23 home screen, setting default, 7 ignoring messages, 43 inbox, retrieving messages from message list, 42 inbox, retrieving messages from results list, 23 indexing limitations, 50 InfoTag-based searching about, 13 performig, 21 keywords in searching, 48 legal hold content collection, 33 notifications, 30 legal hold notifications, 30 I K Legal Hold Pro integration, 30 legal holds about, 27 L ad-hoc, about, 27 ad-hoc, creating, 29 choosing the right type, 28 controlling access to, 28 exporting, 32 modifying, 30, 31 monitoring progress of, 31 people-based, about, 27 people-based, creating, 29 releasing, 32 types of, 27 location-based searching about, 12 performing, 17 message division, 23 message list printing messages, 42 sort order, 43 message ownership, 40 message properties, 23 messages M commenting on, 43 deferring process of, 43 downloading attachment from message list, 42 downloading attachment from results list, 23 failing (senior reviewers), 43 finding related, 44 finding related (senior reviewers), 44 ignoring review of, 43 passing (reviewers), 41 passing (senior reviewers), 43 printing from message list, 42 printing from results list, 23 retrieving to inbox from message list, 42 retrieving to inbox from results list, 23 reviewing, 40 reviewing (senior reviewers), 42 supervision history, 43 MSG files, 36 Copyright Proofpoint, Inc. 54

59 Index overview, 7 passing messages reviewers, 41 senior reviewers, 43 people-based legal holds about, 27 creating, 29 people-based searching about, 13 performing, 19 phrases in searching, 48 printing messages from message list, 42 printing messages from results list, 23 properties of message, 23 PST file,exporting to, 36 reasons for using legal discovery, 9 retention of export jobs, 39 retrieving messages to inbox from results list, 23 review queue, 40 reviewer about, 41 reviewing messages, 40 reviewing messages, senior reviewers, 42 saving search criteria, 14 search criteria default, 7 saving, 14 sharing, 15 types, 12 search results display, 22 O P R displaying message, 23 highlight in, 23 printing messages, 23 S saving in archive folders, 24 sort order, 23 viewing message property, 23 working with, 22 searching about, 11 basic steps, 11 saving results in archive folders, 24 saving search criteria, 14 search criteria types, 12 senior reviewer about, 41 tasks, 42 sharing search criteria, 15 sort order in message list, 43 sort order in search results, 23 sort order, default, 7 special characters in searching, 48 standard review about, 40 steps in searching process, 11 subfolders, moving messages between, 25 supervision about, 40 commenting on messages, 43 deferring process of messages, 43 hierarchical review, 40 history, 43 ignoring messages, 43 interface, 42 issue investigation and management, 44 review queue, 40 standard review, 40 tasks of senior reviewer, 42 tracking issues, 44 what gets reviewed, 40 user interface, 7 XML file, 36 U X Copyright Proofpoint, Inc. 55

60 Copyright Proofpoint, Inc. 56