GFI MailEssentials Online Archive Configuration and usage

GFI MailEssentials Online Archive Configuration and usage

Contents Retention policies 3 Message tagging 4 Access rights 5 Journaling 5 Accessing archived messages 7 Archive search / Viewing archived messages 7 Tagging and Legal Hold 9 Message export 10 Auditing 11 GFI MailEssentials Online Archive: Configuration and usage 2

Retention policies Once archiving is active for your domain, you can define the parameters under which our service will archive messages, by defining one or more retention policies. (The initial setup of the archive service is done in the Management > Domains > Services section of the control panel; see the Quickstart guide for more information.) While you should have created a default policy as part of enabling the archive service for your domain, you can adjust the settings for this policy, or create new one(s), at any time. To do so, use the selector mechanism to choose a domain with the archive service enabled. Navigate to Management > Archive > Retention Policies. Click Add a new retention policy or edit an existing policy by clicking on that policy name. From the Add/Edit screen, you can define one or more rules to specify which emails should be archived and for how long. New messages are compared to the retention policies in order; the first policy to match a given message is applied to that message. For example, as your first retention policy, you could establish that any messages from the sending domain of whitehouse.gov will be retained for seven years. As the second retention policy, any messages containing Service Agreement in the subject line, and that include an attachment, should be retained for ten years. As the third retention policy, you could have a policy applied for all messages (i.e. all remaining messages that did not match an earlier policy) with a retention period of five years. By default, detected spam messages will not be included in your archive, although you can change this setting for any given retention policy. Messages that are initially detected as spam by the GFI MailEssentials Online service but are subsequently released by a user from quarantine and will be archived after they are released from quarantine. GFI MailEssentials Online Archive: Configuration and usage 3

Note that if a message does not match any retention policy, that message will not be archived. If you have multiple retention policies, we recommend having a default retention policy that applies to all messages as the last policy that will effectively be a catch-all policy. Message tagging Message tags can be used to identify or correlate certain messages for subsequent reference, similar to the concept of folders in an email client. For example, you could create a tag for a specific project, and associate relevant messages with that tag, to organize all email correspondence regarding that project. Tags can be established at the domain level, in which case they are considered public and accessible to all individual users within the domain. Tags can also be established by individual end-users, in which case they are considered private and are only accessible to that particular user. To create a tag, navigate to Management > Archive > Message Tags. You can create a new tag, view all messages associated with a given tag, or edit an existing tag by clicking on its name. The service also provides the option to merge two tags together so that messages associated with either of the two tags are associated with just a single tag. Individual users can create private tags for their own use in the Preferences > Archive Tags section of the control panel, where they can also see the available public tags created by an administrator. Once a tag has been created, messages can be associated with that tag by conducting a search for relevant archived emails in the Messages section of the control panel, then selecting and tagging those emails. Once a tag has been associated with a given message, that tag will remain unless or until you remove that tag from the message. There is no limit to the number of tags that can be assigned to a given message. GFI MailEssentials Online Archive: Configuration and usage 4

The service also allows for automatic tagging of messages, based on criteria that you define, similar to how retention policies can be created. Simply define one or more parameters, such as sender, recipient, subject line, body contents, etc., and all future messages archived by the service matching those characteristics will be automatically assigned that tag. Access rights By default, archived messages are accessible to the individual account(s) that received or sent those messages. In regions outside of Europe, domain administrators also have access to archived messages within a domain. To allow other individuals to access archived messages that they did not send or receive (i.e. archives of other users), administrators can set up one or more roles that define delegated access rights within the service. Each role allows one or more users at a domain the ability to view archived messages for one or more other users at the domain. This can be useful in allowing a manager to review employee correspondence, a company s legal department to audit litigation-related emails, or a project leader to read previous correspondence about a given project. GFI MailEssentials Online Archive: Configuration and usage 5

To delegate these additional access rights, navigate to Management > Archive > Access Rights. When creating a role, note that both the privileged logins with the additional access rights, and the mailboxes to which they have access, must have the archive service enabled. Once the additional access rights have been granted to a given user, that user will be able to log in to our interface with their individual user account and view not only their own archived messages, but also the archives of the users you defined. Journaling The GFI MailEssentials Online Archive service typically captures inbound and outbound messages via the GFI MailEssentials Online service. However, internal emails sent within a domain remain on the local mail server and are not seen by GFI MailEssentials Online. In order to capture and archive internal non-internet email, our service makes use of journaling, which is a feature available on most mail servers. When journaling is enabled on a mail server, all messages processed by the server are copied and stored in a journaling mailbox. The GFI MailEssentials Online Archive service uses the IMAP protocol to connect to the mail server to download messages from that journaling mailbox, which allow the service to archive the internal messages for the domain. Once those messages are downloaded, they are deleted from the journaling mailbox, so as not to take up unnecessary space on the mail server. After journaling is enabled on the mail server (see below for further notes on this), navigate within the control panel to Management > Archive > Journaling. GFI MailEssentials Online Archive: Configuration and usage 6

Here, you can provide the information our service needs to access the journaling mailbox, including the server s hostname or IP address, the use of IMAP or IMAPS, the port, and the journaling email address and password. You can also specify which messages should be captured from the journaling mailbox; the default is for our service to only capture internal messages and to filter out inbound and outbound messages. Messages that are filtered out of the journaling mailbox (such as inbound and outbound messages that are already captured via GFI MailEssentials Online) can be automatically deleted from the journaling mailbox to save space on the mail server. You can also specify the type of journaling used on the mail server. We recommend the use of envelope journaling, which will provide the archive service with the most detail about the messages. With envelope journaling, the mail server creates a new message for each email, encapsulating the full original message including all headers, as an attachment to the new message in the journaling mailbox. Alternatively, the service supports BCC journaling. With BCC journaling, the mail server simply sends a blind copy of each message to the journaling mailbox, which can be accessed by the archive service. Note that the process of enabling journaling on the customer s mail server differs dependent on the mail server software in use, but is generally straightforward. Please refer to your server s documentation for more information, or contact our support team if you would like any assistance. You ll also need to make sure that your firewall allows an incoming IMAP connection to the mail server from GFI s networks (these are the same IP addresses from which incoming SMTP traffic should be allowed). With the journaling enabled, the archive service downloads messages from the journaling mailbox every few minutes. Correspondence captured via the journaling process should be viewable in the message archive within a few minutes. You can view a history of connections from the archive service to the journaling mailbox in the Reports > Logs > Journaling Log section of the control panel. GFI MailEssentials Online Archive: Configuration and usage 7

Accessing archived messages Archive search / Viewing archived messages Using a domain-level login or an end- user login, customers can search and view their message archives by navigating to Messages > Message Archive. Messages can be found via a text search that allows for a simple query. You can also conduct more complex searches using AND, OR, NOT, and quotation marks to refine the search. The + and - symbols can be used in place of AND or NOT. For example: Washington NOT George An advanced search mechanism allows searches based on sender or recipient, date range, subject line, body/ attachment text, retention policy, message tags, the presence of attachments, and other criteria. Note that for security reasons, archived messages are accessible only to individual user accounts, i.e. by the sender or recipient of a given message, but not by other users. In the Americas and in the Asia-Pacific region, domain-level administrators are also able to view messages for the domain. Organizational level logins, partner level logins, and distributor level logins are able to manage the configuration of the archive service but are restricted from the ability to view the archived messages, in deference to the privacy of individual end-users. (Organizational administrators and partners can view archived messages through screen sharing with an end-user, or by using a domain-level login.) Archived messages should be visible in the control panel, i.e. accessible via a search, within a few minutes of those messages being passed through the GFI MailEssentials Online service or being accessed through the journaling mechanism. Tagging and Legal Hold Once messages have been found by a search, you can apply a tag to one or more messages. Multiple tags can be applied to any message. Tagged messages can be easily referenced at a later date by browsing to the Messages > Tagged Messages section of the control panel. GFI MailEssentials Online Archive: Configuration and usage 8

Similarly, you can apply a Legal Hold to one or more messages. Applying the Legal Hold supersedes the existing retention policy associated with a given message, and will cause the archive service to retain that message indefinitely. Like tagged messages, messages that are in Legal Hold can be easily searched for at a subsequent date. Note that messages in Legal Hold consume double the disk space in calculations of storage consumption. Message export Some or all of the messages stored in the archive service for a given domain can be exported at any time via an integrated utility in the Management > Archive > Export/Restore Messages section of the control panel. Because the archive may contain a substantial amount of data for a given domain, the export process is handled in two steps. First, an administrator defines the specific messages to export, which might be messages with a given retention policy or message tag, within a certain date range, or associated with one or more particular email addresses. A custom filename can also be specified. Once the criteria for the export has been defined, click the button at the bottom of the page to request the archive file. As the second step, the main page in the Export/Restore Messages section of the control panel will show a list of all export files that have been requested in the last week, including any export files that are currently in the process of being generated. Once a new export file has been generated, the file should be displayed as a link and can be downloaded. Note that for the same privacy reasons as described above governing access to individual archives, the export capability is available to domain administrator logins, but not to organizational-level, reseller, or distributor logins. GFI MailEssentials Online Archive: Configuration and usage 9

Auditing The GFI MailEssentials Online Archive service keeps a detailed log of all actions and configuration changes to the archive service, to provide third-party verification of an organization s compliance with a given archive policy implementation. The audit log encompasses activation or deactivation of the service; enabling or disabling of the archive service for individual mailboxes; the creation, editing, or re-ordering of retention policies; creation or editing of delegated access rights; journaling configuration changes; and the import or export of messages. For each action, the archive service tracks the responsible login, source IP address, and timestamp. The service does not log individual searches or the creation or application of message tags. To access the archive log, navigate to Reports > Logs > Archive Log in the control panel. Note that there is a separate log for the journaling, located at Reports > Logs > Journaling Log, which tracks all connections or connection attempts to the journaling mailbox. GFI MailEssentials Online Archive: Configuration and usage 10

USA, CANADA AND CENTRAL AND SOUTH AMERICA 15300 Weston Parkway, Suite 104, Cary, NC 27513, USA Telephone: +1 (888) 243-4329 Fax: +1 (919) 379-3402 ussales@gfi.com 33 North Garden Ave, Suite 1200, Clearwater, FL 33755, USA Telephone: +1 (888) 243-4329 Fax: +1 (919) 379-3402 ussales@gfi.com UK AND REPUBLIC OF IRELAND Magna House, 18-32 London Road, Staines-upon-Thames, Middlesex, TW18 4BP, UK Telephone: +44 (0) 870 770 5370 Fax: +44 (0) 870 770 5377 sales@gfi.co.uk EUROPE, MIDDLE EAST AND AFRICA GFI House, San Andrea Street, San Gwann, SGN 1612, Malta Telephone: +356 2205 2000 Fax: +356 2138 2419 sales@gfi.com AUSTRALIA AND NEW ZEALAND 83 King William Road, Unley 5061, South Australia Telephone: +61 8 8273 3000 Fax: +61 8 8273 3099 sales@gfiap.com For a full list of GFI offices/contact details worldwide, please visit http://www.gfi.com/contactus Disclaimer 2012. GFI Software. All rights reserved. All product and company names herein may be trademarks of their respective owners. The information and content in this document is provided for informational purposes only and is provided as is with no warranty of any kind, either express or implied, including but not limited to the implied warranties of merchantability, fitness for a particular purpose, and non-infringement. GFI Software is not liable for any damages, including any consequential damages, of any kind that may result from the use of this document. The information is obtained from publicly available sources. Though reasonable effort has been made to ensure the accuracy of the data provided, GFI makes no claim, promise or guarantee about the completeness, accuracy, recency or adequacy of information and is not responsible for misprints, outof-date information, or errors. GFI makes no warranty, express or implied, and assumes no legal liability or responsibility for the accuracy or completeness of any information contained in this document. If you believe there are any factual errors in this document, please contact us and we will review your concerns as soon as practical.