Insider Risk, eDiscovery and Audit

What it is

Three Purview solutions help an organisation investigate what happened to its data. Insider risk management spots risky behaviour by people inside the organisation. eDiscovery finds and preserves content for legal cases. Audit records the actions taken across Microsoft services, so they can be searched later.

How it works

Insider risk management

Not every threat comes from outside. An employee may leak data on purpose, copy files before leaving, or break a policy by mistake. Insider risk management helps find these risks while protecting the privacy of staff.

It works in stages.

1. Policies are built from templates that fit a risk, such as data theft by departing users, data leaks, or security policy violations.
2. Indicators are the activities it watches, such as downloading many files, copying to a USB drive, emailing to a personal address or removing labels from labelled files.
3. Alerts are raised when a user's activity crosses a threshold, and they get a risk score.
4. Cases are opened so that an investigator can review the evidence and decide what to do, for example by involving HR or legal teams.

Privacy is built in. User names can be anonymised by default, and access is limited to people in specific roles.

eDiscovery

eDiscovery is the process of finding and handing over electronic content, such as email, documents and chat messages, for a legal case, an investigation or a regulatory request. Purview supports it with these steps.

• Case: a container that holds the work for one matter, with the people allowed to see it.
• Hold: preserves the content of chosen people or locations, so it cannot be deleted while the case runs.
• Search: finds the content that matches keywords, dates and people.
• Review and export: lets reviewers read the results, tag them, and export them for the legal team.

There are two levels. eDiscovery Standard supports cases, holds, search and export. eDiscovery Premium adds features for large or complex cases, such as managing the people involved in a case, reviewing in depth and analysing the data.

Audit

Audit records activities across Microsoft services, such as a file being opened, a mailbox being accessed or an admin changing a setting. Each is saved as an audit record that can be searched, which helps with forensic investigation, internal checks and compliance.

Records can be searched in the Purview portal, using the user, the activity and a date range.

Choosing the right solution

A worked scenario

A firm learns that a senior engineer has resigned. Insider risk management, using the departing user template, notices that the engineer downloaded a large number of design files and copied them to a USB drive. It raises an alert and opens a case for investigators. At the same time, the company is facing a legal dispute, so legal counsel creates an eDiscovery case, puts the engineer's mailbox and OneDrive on hold and searches for relevant messages. To confirm exactly what happened, an investigator searches the audit log for the engineer's file activity in the last month.

An eDiscovery workflow

1. Legal creates a case and adds the people who may work on it.
2. A hold is placed on the mailboxes, sites and chats that may contain relevant material.
3. Searches use keywords, dates and people to find content.
4. The results go to a review set, where reviewers read, tag and exclude items.
5. The final set is exported for the legal team or the court.

Insider risk and privacy

Insider risk management is meant to find real risk without watching everyone closely. It only looks at the activities named in the policy, assigns a risk score and, by default, shows pseudonymised user names to reviewers. Only people in the right role groups can open cases, and the work is auditable. Communication compliance is a related solution that checks messages for inappropriate content, such as harassment or the sharing of confidential information.

Searching the audit log

An audit search takes a date range, the users, and the activities of interest, such as file deleted or mailbox accessed. The results list the time, the user, the activity and the item. For a user who denies deleting a file, this gives evidence of who did it and when. Records are available for 180 days in Audit (Standard), so an investigation has to begin within that period unless the organisation has longer retention.

Which solution answers which question?