Enterprise Archive Setup for Journaling

To configure Office 365 and Microsoft Exchange as the Content Sources in Enterprise Archive:

1. Click the Archive Management tab.

2. Click Content Sources from the Archive Management workspace.

3. Click Add besides the Content Sources pane (Content Sources [Add]).

4. Enter the required values for the Cluster Configuration fields:

   Fields	Description
   Cluster Name	Select a Cluster Name from the drop-down list, or type a new cluster name. The name should be alphanumeric and cannot be greater than 23 characters.
   Secret Key	The authentication password for the point product to ingest data in Enterprise Archive. The secret key is automatically generated.
   Cluster Description	When adding a new cluster (Cluster Name), provide a description for future reference. The description cannot be greater than 255 characters.

   Figure 9: Add Content Source - Email Journal

   

5. Select the Source Type as Email Journal from the drop-down list.

6. If Source Type is Email Journal, then enter the required values described in the following table:

   Fields	Description	Mandatory Field?
   Endpoint Name	The authentication name for the point product to ingest data in Enterprise Archive. The endpoint name should be alphanumeric and cannot be greater than 255 chars	Yes
   Internal Domain Names	Type all the domains, in separate lines. These domains are identified as INTERNAL by Enterprise Archive. The entire list of internal domains can be rendered invalid if a single row contains an invalid character. Enclose the domain names in quotations for the exact match. Example “EnterpriseArchive.com” smarsh.com outlook.smarsh.com salesforce.smarsh.com	No
   SMTP Address (SMTP email address)	This field is auto-generated by the exchange journal and is a read-only field. You must use this value in your journal rule for routing journal-ed emails to the given address that are maintained by the Smarsh Server.	No

   Advanced Options

   Exclude from Conduct (Supervisory Reviews):

   You can select this option to ensure historical content ingested into Enterprise Archive that has already been reviewed, can be excluded from being supervised by the Conduct application.

   • Enabling this checkbox will ensure this content is not part of any of the Conduct review queues and Conduct Admin search interfaces.

   • This content can however be searched for from the Archive Management, and Case Management search interface.

   • This content can be searched for from the Conduct Archive search interface, if the user has the Full Archive Access permission enabled.

   • Changes made to these settings will not be immediately visible. There may be a delay of up to seven hours after modifying this option to include or exclude content from being monitored by the Conduct application.
     

     Important

     Exclude from Conduct currently works at the Content Source level. Excluding one Endpoint ID from Conduct will exclude all other Endpoints within the Content source as per the current system behavior. Exercise caution when enabling this configuration.

     
     

   Chain of Custody

   • You can select the Enforce Chain Of Custody checkbox to ensure data integrity that can be implemented at the cluster level.

     • Enabling this checkbox will enforce a CoC check on all communication that is ingested from the content source. Communications that do not contain CoC hashes or fail the CoC check will be rejected.

     • Enabling/disabling the checkbox will prompt the user with an on-screen message requesting confirmation of the user action.

     • The enabling CoC action will be captured in the User Activity log.

     • This field is disabled by default. Contact Smarsh Support to enable this field.

7. From the Search Tier dropdown, select one for the following options:
   

   Note

   The Search Tier option is currently behind a feature flag, and will be visible only if the flag is enabled. Contact Smarsh support to enable this feature.

   • Tier 1: Applicable for ingestion and archival of day forward email communications.

   • Tier 2: Applicable for:

     • Ingestion and archival of day forward email communications.

     • Existing data migrated from legacy archives.

     • Mass marketing emails are ingested in real-time.

   • Promotion: Applicable for ingestion and archival of email communications promoted to Tier 1.

8. If the Promotion Policy flag is enabled, and if you select Promotion or Tier 2 from the Search Tier dropdown, you will see an option to select a Promotion Policy. Select one of the following Promotion Policy options:
   

   • None: No automatic promotion will be applied.

   • All Messages: All incoming messages will be automatically promoted to Tier 1.

   • If less than: This option allows you to set a time-based threshold for promotion. Messages that are younger than the threshold specified here will be promoted to Tier 1. Messages that are specified here will continue to be in Tier 1 until demotion capabilities are available. If you have chosen the If less than option, specify the following:

     • Number: Enter the numerical value for the time period.

     • Unit of Time: Select the unit of time (Years, Months, or Days).

     For example, if you set "If Less Than 3 Years," any message that is less than 3 years old will be automatically promoted to Tier 1.

     Note

     • The Promotion Policy option is currently behind a feature flag. Contact Smarsh support to enable this feature.

     • Multiple content sources for Tier-2 are supported, but this feature is currently disabled by default and requires enabling a feature flag. Once enabled, you can create multiple Tier-2 content sources. However, only one Tier-2 content source per cluster is allowed at a time. For assistance with enabling this feature, contact Smarsh Support.

9. Click Save. A Secret Key appears in the Add Content Source panel. You must use this Secret Key in the point product to send data to Enterprise Archive.
   The configured content source appears in the Content Sources window.