Search for Sensitive Information in the Cisco Webex Teams App

  • You must have the compliance officer role assigned to you to create and view reports.

  • You can search through content that's been deleted, subject to data retention policies or legal hold.

  • You can search through content for somebody who has left your organization, the data is stored since March 2019 and subject to your data retention policy.

  • You can search through the following content:

    • All content from spaces with one other person where someone in your company is a participant. This includes spaces with somebody who has left the company.

    • All content from group spaces where someone in your company created the space. This includes spaces created but no participants added and spaces where all the other participants have left the space.

    • Content that people in you company created from group spaces where someone in another company created the space.

    The following activities are captured in reports:

    • Messages—Message content posted into a space. When a message is edited, both the original message and the edited message are included, but there is no context between the two messages. When people respond to threads, the reply is stored but there is no context between the reply and the source of the thread.

    • Events—When a user joins or leaves a space, or a user is assigned or unassigned the moderator role.

    • Files Shares—Files shared in a space and snapshots created of whiteboards.

    • Whiteboards—An image for each whiteboard in the spaces is returned in the report. The image represents the version of the whiteboard on the end date of the report date range.

  • You can search through content posted within the last 90 days or if you have Pro Pack you can search through content that's older than 90 days.

  • You can download reports that are up to 10 days old. Reports that are older than 10 days are considered expired and you'll need to re-run the report to access that data.

  • All searches carried out by compliance officers are logged for audit.

  • eDiscovery supports the following proxies:

    • No authentication

    • Basic

    • NTLM on Windows—This proxy must be configured to work with the credentials from the operating system, manually entering credentials is not supported.

    • Negotiate (Kerberos) on Windows—This proxy must be configured to work with the credentials from the operating system, manually entering credentials is not supported.

1

From the customer view in https://admin.webex.com, go to Troubleshooting > Status > View eDiscovery.

2

Add your search information:

  • Email Address—Enter up to 500 comma separated email addresses either manually or click CSV Bulk Add to select a CSV file.
  • Space Names—Enter up to 5 comma separated space names.

    Space name matching is applied. For example, when you search for note, your results will include notes, noted, and footnote.

  • Date Range—Choose a date range for your search.

When you enter multiple values for Email Address and Space Names, the search engine uses these values as: [ (email_address1 OR email_address2) AND (space_name1 OR space_name2)]

3

Enter your report information:

  • Report Name—Enter a name for your report.
  • Description—[Optional] Add a description for your report.
4

Click Search & Generate Report.

Your search is queued and you can review the status of the report. The length of time to create your report depends on the amount of data that matches your search criteria.

When a report ZIP file reaches a limit of 5 GB or 100,000 files, then another ZIP file is created using the same name but postfixed with -1, then -2 and so on.

Install eDiscovery Download Manager

  • You must download the eDiscovery Download Manager to view any reports.

  • You must have the Compliance Officer role to run the eDiscovery Download Manager.

  • Ensure there is sufficient space on the computer to download large reports.

1

From the customer view in https://admin.webex.com, go to Troubleshooting > Status > View eDiscovery and click Download Manager.

2

Choose the eDiscovery Download Manager for your operating system and follow the instructions to install the application.

View Compliance Reports

You can only view compliance reports that you have created. You can review the status of your report and download the report using the eDiscovery Download Manager.

1

From the customer view in https://admin.webex.com, go to Troubleshooting > Status > View eDiscovery.

2

Click REPORTS to review all your reports.

Reports have one of the following status:

  • Searching—The report is continuing to search for information.

  • Completed—The report is complete.

  • Stopped—The report stopped running due to an issue.

  • Canceled—The report was canceled.

  • Expired—The report has expired.

3

Click on a report to review the report details, including status, date generated, description and a summary of the contents of your report.

  • Download Report—Downloads your report using the eDiscovery Download Manager. Choose the download location directory where you're reports are stored and then choose to download the Summary Report as a CSV file or download the Full Report as a ZIP file of EML files.

    The length of time it takes to download the report depends on the size of the report, your location, and your network bandwidth.

    When you use Outlook to view the EML files, add-ins for Outlook may block message content in your EML files, you can run Outlook in safe mode to view the message content.

  • Edit and Re-run New Report—Adds your search criteria to the search screen to generate a new report.

  • Delete Report—Deletes your report from the list.

  • Re-run Report—Refreshes the data in your report. You can re-run a report that has expired after 10 days.

Compliance Officer Role

Full administrators can assign the compliance officer role to any person within their organization. Full administrators can't assign the compliance officer role to themselves, another full administrator must assign the role to them.

If, for example, your company requires details for legal proceedings, as a compliance officer you can access the Cisco Webex eDiscovery Search and Extraction tool from Cisco Webex Control Hub. You can generate reports from here that contain all of the conversations held in Cisco Webex spaces and any files shared within those spaces.

As a compliance officer you can preserve data for legal proceedings, this data is also returned when you access the Cisco Webex eDiscovery Search and Extraction tool. For more information, see Manage Compliance Data for Legal Hold in Cisco Webex Control Hub

Administrators can limit the amount of messages and files that are kept by configuring a data retention policy. When that threshold is met, aging content gets purged.