Creating a Case in Case Manager

Compliance officers can use the Case Manager to create cases and collect electronically stored information (ESI) for specific custodians and assets.

Procedure

1. From the navigation pane, go to Activate.

   The Activate page appears.

2. Click Case manager.

   The Case manager page appears.

3. Click Add Case.

   The Add Case dialog box appears.

4. In the Name box, enter the name of the case that you want to appear in the Case Manager.

5. From the Data Classification Plan list, select a plan to associate with the case.

6. From the Server Plan list, select a plan to associate with the case.

7. From the Data Collection list, select one of the following options:

   1. Continuous: Incremental data is collected continuously based on the Recovery Point Objective (RPO)of the Server Plan.

   2. One time only: Data is collected only once.

   3. Do not collect: No data is collected.

8. From the Data type list, select the solution that specifies the type of data that you want to collect for the custodians added to the case.

   • To collect email data from the mailboxes owned by the custodians, select Exchange Archiving.

   • To collect email data that contains any custodian's email address in the To, From, CC, or BCC fields from a journal mailbox, select Exchange Journaling.

   • To collect email data from a ContentStore client, select SMTP Journaling.

9. Expand Custodians, enter the names of the users or user groups or their email addresses and then click Add.

   Note

   • If you are processing Exchange Online data, then you must enter the SMTP address for the auto-matic suggestion feature to work.

   • If you are processing Exchange journal mailbox data, then you must enter the user mailbox email address and not the journal mailbox email address.

   • To add multiple custodians, separate each custodian with a comma. For example: user1@example.com,user2@example.com,user3example.com

10. Expand Additional Criteria, and then configure additional filter criteria for the data included in the case.

    Only the data that meets the filter criteria that you define are included in the case.

    • Keyword: Use this field to filter data in the case by keywords. For email data, only emails that contain the specified keywords in the subject, body, or any attachments will be included in the case.

    • Email: You can perform advanced email searches by setting the following criteria:

      Option	Description
      Email Address	Search for one or more email addresses that appear in the To, From, or CC fields of an email. If the email address is part of a distribution group email alias, the search will include emails with the email alias in the To, From, or CC fields. To search for multiple email addresses, separate each email address with a semi-colon (;) or a comma (,), and then select a logical operator: AND, OR, or NOT.
      Subject	Search by the subject of the email. To search for multiple subjects, separate each subject with a semi-colon (;) or a comma (,), and then assign a logical operator: AND, OR, or NOT.
      From	Search by the name of the sender. To search for multiple senders, separate each sender with a semi-colon (;) or a comma (,), and then assign a logical operator: OR or NOT.
      To	Search by the name of the receiver. To search for multiple receivers, separate each receiver with a semi-colon (;) or a comma (,), and then assign a logical operator: AND, OR, or NOT.
      CC	Search by the name and email address of the person in the CC list. To search for multiple names and email addresses, separate the values with a semi-colon (;) or a comma (,), and then assign a logical operator: AND, OR, or NOT.
      BCC	Search by the name and email address of the person in the BCC list. To search for multiple names and email addresses, separate the values with a semi-colon (;) or a comma (,), and then assign a logical operator: AND, OR, or NOT.
      Attachment Name	Search by the name of the email attachment. To search for multiple names, separate the attachment names with a semi-colon (;) or a comma (,), and then assign a logical operator: OR or NOT.
      Received Time	Search based on the time the email was received. Logical operator do not apply because only one received time is entered.

11. Click Save.

Result

Creation of a case will automatically trigger a collection job according to the schedule in the server plan associated with the case. If you want to run a collection job explicitly, click Submit Collection Job. For more information, see Submitting Collection Job from Case Manager.