WATCH IT WORK
Archiving and Monitoring
Adopt innovation while meeting oversight obligations and capture data from over 100 communication channels
WHAT TO WATCH FOR
- Capture and retention of 100+ channels in a single archive
- Content per message channel kept in native format with original conversational context intact
- Seamless and compliant storage & retention
- Advanced search & export for swift, easy, and thorough examinations
- Sophisticated supervision tools that allow for customizable supervision policies
- Unified, easy-to-use dashboard provides insight into organizations’ vulnerabilities across devices, networks, users and vendors
Video Transcription
Archiving and Monitoring
VIDEO TRANSCRIPTION
Davi Schmidt:
Hi everyone, welcome to our Watch It Work. I'm joined by Ryan Batiuk, Senior Solutions Engineer.
Davi Schmidt:
We're here to show you what a modern solution for archiving and compliance looks like. Let's go over the agenda so you know what to expect from us. First, I'll give a brief overview to familiarize everyone with Smarsh. Then I'll hand it over to Ryan, and he'll go over two different scenarios. How to quickly and accurately complete an audit request, and how to become more efficient in your reviews.
Davi Schmidt:
Let's talk about Smarsh. As technology continues to evolve, the financial services industry is faced with increasingly challenging records retention, and oversight requirements. Smarsh has been a key partner in helping organizations overcome these challenges. We help our customers manage the communications compliance process more quickly and effectively. Not to mention, we capture data from an industry leading 80 plus communication channels. Ryan let's jump into the demo.
Ryan Batiuk:
Let's do it. Let's go over into the two scenarios, and I'm going to switch over to the live system here. The two scenarios, how to quickly and accurately complete an audit request, and how to become more efficient in your reviews. Let's go over the first one, how to quickly and accurately complete an audit request.
Ryan Batiuk:
I'm here at the main dashboard here, and I can do a bunch of different things. I'm going to go and start in the cases area to show this scenario. Cases are great to start the workflow, or start the process of conducting the audit request. It starts by heading over to the case, you can see all of your active cases that you have going on. You can create a case here if you wish. But we're going to actually run a search and put it into an active case that we already have.
Ryan Batiuk:
Here's the new search page here, and you can see, I have different fields here on what to pick from. Content, you can just choose any kind of content that you want, email, instant messaging, social media. You can go and pick which ones you want. Microsoft Teams, or whatever you have that's applicable. I'm just going to leave it set to all content. It searches across all of my content here.
Ryan Batiuk:
For people, you can type in first name, you can type in an email address. If you have your group hierarchy synced with the system, you can actually click on the magnifying glass, and you can start typing in a person's name. So, an employee here. Here we have Jane Smith, and she has all these different identifiers mapped. She has her email address, phone numbers, instant message handles. She has all this already mapped to her. You could just click on her name, and it's going to search all of her identifiers here. Or you can click on the group that she's in, it'll search all of the content for all the users in that group. Great ways to populate the people field here with all this different kinds of identifiers here.
Ryan Batiuk:
In the keywords field, you can type in phrases like guarantee, risk, confidential. You can type in phrases like off the record, if you want to see if people are talking about going off the record. You can do proximity logic, risk followed by legal, within 10 words or so. You can add that. You can get more granular if you wanted to, and you can search through each specific field, the any and all, or your volume based logic.
Ryan Batiuk:
I'm just going to leave that collapsed. I'm just going to search all the fields at the same time. Let's do a search for off the record here, and we'll see if we get any results for that. For date range, we can go back in time and just pick which date you want. I'm just going to blank that out to go back to the very beginning, and then the advance, you can pick different other advanced criteria here, message types, you can do comments, direct messages, channel messages, audio files, things like that. Email directionality, you can filter out messages. If you want to do this message, or this person talking to this person, but not if it's a Gmail as a sender, you can filter out criteria as well.
Ryan Batiuk:
Let's go ahead and click on calculate, and we'll get our results before we run our search, just so we know we're in the right ballpark. 14 sounds good. Let's click on search. Let's say that our auditor was saying, anytime our employees were talking off the record, we want to have some kind of instance of that. So, what can we do to produce those messages back, and organize them with all the metadata that's intact there? You can see my off the record is being highlighted here. That's the phrase that I looked for.
Ryan Batiuk:
It also highlights other things that have hit policies, and we'll get to what policies are in the second scenario, but you can see it's all kinds of content. I have email, text message, instant message here. Well, this is LinkedIn, social media really, it's a messaging system on LinkedIn. You could just take a look. Here's what the email looks like.
Ryan Batiuk:
You'll be able to see the sender, and the two here, the subject line. Here's the message. Here's my phrase, off the record here. You can take some action here. You can add some and extra tags. You can add some notes. Now, for LinkedIn, you'll see when I click on LinkedIn, it brings this entire thread towards the message here. I clicked on off the record, the one result here, but it shows me the entire thread for LinkedIn here.
Ryan Batiuk:
You can see what kind of context was being talked about for this particular message. Context is really helpful, especially things with like instant message and text message. People talk with really shorthand phrases, and sentences. You have to really get the context to understand what they're talking about, and this could still be important for your audit request.
Ryan Batiuk:
It might change the entire way that the conversation went down. So, the auditor could use that as more evidence to make a determination and some kind of investigation, or just checking in on things. So, maybe these are all important. You can go and check all of these messages here. You can go and check messages here, or you can just do all messages. Send all messages to that case. Remember the case area?
Ryan Batiuk:
I had active cases. You can start a new case on the fly. New audit request, and you can build a new one, but I'm going to put it into an active one that I already have. I already have audit requests here. I'm going to place these messages in there, these 14 messages in there. And then let's go back to our active cases, and let's take a look at additional things that we can do once we have messages in inside of a case.
Ryan Batiuk:
Let's go to our audit request here, and we can click on edit just to look at some additional settings. You can add additional users to the case if you have to have different people collaborate on it, outside of council, or some other type of party, so you guys can work on the case at the same time. Legal teams, you can all work on it. You can apply your hold. If you have retention with the Smarsh system, you might have maybe seven years or so, could be your default retention setting. That's a common one for our customers. You can have messages have a hold applied towards them. So that way, when they're getting close to that purge time, they won't be purged because they're being held by this legal hold here.
Ryan Batiuk:
And then once you release the hold, they'll just go onto their natural retention period cycle here. It's a great way to build data collections for your data to conduct this audit. You can also click on contents, and view the contents of the case. Now, you can do further filtration, calling of the data refinement, because you want to give the auditor exactly what they're looking for. You don't need to over produce. That could be putting yourself at risk. You might want to take out all these things have to do with the word, maybe like Bitcoin, right? That's not important for what kind of audit that you're being requested information for. You can either remove these messages, you can look at these two, and you can go on remove them one at a time, or you can remove them in bulk.
Ryan Batiuk:
You can add tags, mark things for privileged or responsiveness, and you can add additional tags here. You can then of course, filter by your tags, or use the filtering pain to again, put further refinements. It's like you're searching and refining the criteria within your case here. When you're all done with your case, you've done all of your column, your refinement, you can go down, and you can click on export, and you can export and package up your audit into various formats here, email, PST, NSF, or native, put a password on it. You can have it download within the app, or you can have it download to an external area, or an external destination, like another FTP site for a regulator, or a third party e-discovery tool to do further analysis on it, so you can push items right to that location.
Ryan Batiuk:
Those are the great ways where you can find the data that meets the criteria for that audit, collect the data into a case, refine it further, and then get it out of the system and over to fulfill that audit request. And that's how you would officially do that and handle that task much more quickly and accurately.
Davi Schmidt:
Thanks, Ryan. Let's jump into that second scenario, how to become more efficient in your reviews.
Ryan Batiuk:
All right, let's do it. For that, I'm going to go over to our home screen. This shows our main dashboard, and I'm going to show you the area that we're going to get into, which is the queues. Now, the way that you configure the queues really starts with policies. Lexicon policies, you may be familiar, you may know about these. You may have some, new features, we get them all the time. We always have some nice new features to go over. You can see my library here of policies. They range with different types of themes. Gifts and entertainment, misconduct, information, all kinds of different things.
Ryan Batiuk:
I'm going to explore the insider information. We also offer these policies. If you want us to build some, we have some out of the box policies that we can implement that are very easy to get started.
Ryan Batiuk:
For your policy, you can actually build the criteria right in here, a very simple to use system. You can build it based off sender, recipient, subject body. A lot of these are based off of body. These are going to be messages that have this phrase or keyword in the body. Let's say an email, or an instant message comes in, and it has a certain phrase in it, or a certain keyword, right? These are all keywords that have to do with insider information.
Ryan Batiuk:
If a message comes in and hits these, then we're going to change the status, we're going to add a flag. You can add some action items here to trigger what happens to that message. Now that we have messages triggering on the policies, now we can automatically populate the queues based on these hits. So, back to my queues, I have a flag by policy queue, and 48 messages got flagged, and then they replaced inside of this queue.
Ryan Batiuk:
I can click on the queue, and think of this as my policies are working in the background. My goal is to, at the start of the day, if that's your workload, you can have these trigger every day, or every week, or every month, depending on how frequent you do your review. So, every day I log in, I just go right to the queue. Everything was done for me. My policies are running automatically, my queues are populating automatically. All I can do is go in and just review these 48 messages. All the work was done for me. I don't have to go and search my lexicons every single time.
Ryan Batiuk:
I have this queue configured to have all kinds of content in it. It's a blended type of queue, so there's all types of mixed content. You can see the emails just like you saw earlier. If I were to look up this policy here, you can see here's the from, the to. You can see why a message flagged from the rules hit here. You can see even over here, which policies, it actually hit on policy rule matches, things like that. You can see why it hit on certain types of rules here for email. This flagged on the word guarantee, so I can click on that. Again, you get that same thread of the experience just like you saw earlier. That threading lives throughout the whole system.
Ryan Batiuk:
This you make a more accurate review, you have your context of what the people are talking about. So sure, it says guarantee, and you can see which rule it hit on, but you want to know everything that transpired in that conversation.
Ryan Batiuk:
What you do next is you also use the action panel here on the right hand side to conduct the actual action of the review. You have nice big buttons like review. You can have queues set to escalate. You can add further metadata here, additional tags if you wanted to, if you have it programed. You want to escalate it, you can have it where you can add tags. Additionally, here as the next step, say I want to add, this is a bribery. This is part of that too. This should be escalated. Now, I'm conducting my review that just left this queue and went to my escalation queue. Maybe somebody else is looking at that. Maybe that's my second bucket that I have for conducting reviews. I'm one message down. Here's a Twitter message. I can just click on review, and it just goes to the next message.
Ryan Batiuk:
This is my workflow. You see I'm down to 45. You can do messages in bulk too. If you want to go and say, I've read these already, or I can just look this over, and see that it's a comment that's fine. You can do messages in bulk as well. Again, making it very easy to conduct your reviews and become more efficient in them. That's how you can build lexicon policies automatically, populate queues, and you can easily dive into the system, go right into a queue and start reviewing messages with these.
Davi Schmidt:
Awesome. Thanks for walking us through all of that. I have a couple of questions. Can you ingest historical data?
Ryan Batiuk:
We can, yes. We can ingest historical data. If you have a current mail store, or a current mail server, just getting messages out of that would be the first step. Exporting messages into common email type formats. We accept those open standard formats. That export would be served to us either via encrypted hard drives that you can ship to us, or you can create a secure channel over an SFTP, and we can securely fetch it that way.
Ryan Batiuk:
We take the export that came from your system, and we can ingest into our system, and it's as easy as that. We do everything ourselves with our data management team. And once the data's there, you could just back date your searches, and everything is fully indexed. And it's like your data always lived here. Very easy to pull in historical data.
Davi Schmidt:
Great. How long can you hold data for?
Ryan Batiuk:
We hold data for a default of seven years. That's the common amount of time that a lot of our financial service customers have to hold their data for. And that's a perfect amount of time. You don't want to hold it for longer if you don't have to because that could put you at risk. Seven years is the perfect amount of time. That's what you're required to.
Ryan Batiuk:
You can hold things longer with using the legal holds, or customers can control their own retention periods as well. They can reduce the retention periods, or they can increase them if they need to hold their data for longer, or they want to retain it for a shorter period of time.
Davi Schmidt:
Great.
Ryan Batiuk:
We sure do, yeah. We have different types here. I'll actually show you some. If I pull up here, here's an example. This is a Facebook Workplace message, and just a test message that we've edited just to show the editing capabilities. But I can load the whole thread here. You can see. Somebody made a post, somebody made a comment, somebody replied, and then somebody edited the main post here. You can see how the comment was edited. And you can see how it has the little tag edited here, as well as the comment was edited also. These are all fully tracked, and these would flag just like any other message, but we still retain the original edit as well.
Davi Schmidt:
Awesome. That is about all the time we have. If you think of any other questions afterwards, feel free to email us at advantage@smarsh.com. Thank you for joining us today and thank you Ryan for walking us through everything.
Ryan Batiuk:
Thanks so much guys. Take care.
“The value of Smarsh comes from its ability to capture, sort, display and export a variety of data types, from emails to tweets. It's all accessible from a centralized dashboard. Smarsh also provides excellent customer support.”
-- Maxwell R Rich, Esq. Deputy General Counsel and Chief Compliance officer at Republic“Data security was a big concern since our legacy vendor didn't encrypt data at rest. Smarsh solved that problem by encrypting the data at transit and at rest, mitigating the risk of a data leak.”
“You can see what kind of context was being talked about for this particular message. Context is really helpful, especially with things like instant message and text message. People talk with really shorthand phrases, and sentences. You have to really get the context to understand what they're talking about, and this could still be important for your audit request.”
“The Smarsh Enterprise Archive is a breath of desperately needed fresh air in a world still locked in old and stale digital archives.”
Do you trust that your content is secure?
Build to scale without compromising as your data volume grows