Governance & Compliance - Search & Discover for Email

This article contains information on Mimecast's Unified Search feature, including setup requirements, role permissions, search creation, advanced filtering, AI analysis, and exporting data across multiple platforms like email and Slack.

Unified Search

Unified Search is an enhancement within Mimecast's Archiving, allowing users to perform a consolidated search across multiple data types, such as emails and collaboration platforms (e.g., Slack) via the Search & Discover application. It provides advanced AI-driven features like sentiment analysis, toxic speech detection, and multilingual support for investigations or early case reviews.

Prerequisites

• You need a Super Administrator or Full Administrator role in the Mimecast Administration Console to accept the disclaimer when first accessing Search & Discover for email.
• A Full Administrator or Super Administrator should log into the Mimecast Administration Console, go to Governance & Compliance in the left menu, and select Aware. Accept the Disclaimer to access menu options for administrators with Aware permissions.

• Once the Super Administrator accepts the Disclaimer, the menu options will become available to admins with the correct Aware permission, but they cannot access until their Roles in Aware have been assigned. See Aware - Creating a Role to create and assign roles.
• Assign Aware Permission to a custom role, or create or copy a custom role if you’re not already using one of the standard roles that includes this permission:
  • Super Administrator.
  • Full Administrator.
  • Reviewer.
  • Discovery Officer.
• Aware Permission is located under Account | Administrator Roles | Archive Menu | Aware.
• If the user does not appear in the Aware Roles configuration, verify the settings within the Email Security Cloud Gateway.

Creating a Search

1. Log into Mimecast Administration Console.
2. Navigate to Governance, Compliance & Insights | Aware.
3. Click Search & Discover.
4. Select the Create a New Search button.
5. To Execute a Search, select a Data Access Set. See Creating a Data Access Set to set up a New Data Access Set.
6. Once inside the search, you can see messages, search for specific messages using the search bar, apply filters for platforms, modifications, attachments, source and AI analysis as well as view Marked Content and Exports.

7. You can also view the search criteria used for the search by clicking View Search Parameters.

Exporting

1. You can either export All Content or Marked Content via the Export button.

2. Select the message export file type CSV, DAT, PDF or JSON.
3. Select whether you want to include images and files or generate .txt file.
4. Select the email export file type EML or PST and click Next.

15. Select the message context amount | Select create a single PDF for result context | include images and files for result context or both | Click Create Export. 

16. Once your export is available, you can download it.

17. To view and export the actual messages on Search & Discover, navigate to Search & Discover and select the recent search you'd like to view.

18. Select Marked Content, and the Slack message along with its context and the location of the keyword will appear in the sidebar. You can Export as PDF to get a snapshot of the message content.

19. You can also view the Mimecast AI Analysis.

20. For the email message, the message body is located at the bottom. It is displayed in plain text format by default. To view it in HTML format, click the toggle button.

21. You can view the email from either the sender's or the recipient's perspective by selecting Received View (Sender) or Delivery View (Recipient) from the dropdown menu.

See Also...

• Governance & Compliance - Search & Discover for Email - Getting Started