Aug 27 2020 12:07 PM - edited Aug 28 2020 07:58 AM
Hey Team,
Does anyone know how I can generate a report on SupervisionPolicyHitKeywords? We have several supervision policies that have been configured in the security and compliance center and I would like to be able to provide a report on which keywords are being hit, and the frequency, count.
I have tried using unified audit log, and that shows everything but the keywords themselves. Also Graph API Doesnt seem to offer any solutions.
Thanks,
Robert
Aug 28 2020 08:50 AM
Not sure I've ever seen report by keywords. @Christophe Fiessinger might be able to prove me wrong :)
Aug 28 2020 10:33 AM
Thanks Vasil.
I tried using this command here:
Search-UnifiedAuditLog -StartDate 08/21/2020 -EndDate 08/23/2020 -RecordType ComplianceSupervisionExchange -Operations SupervisionRuleMatch
It works in that it shows the policy hit but not the keyword hit.
Robert
Aug 31 2020 12:20 PM
Hey Guys,
Any updates? I was hoping someone might be able to help me out with this commad/request/report.
Thanks,
Robert
Aug 31 2020 01:18 PM - edited Aug 31 2020 01:20 PM
Aug 31 2020 01:18 PM - edited Aug 31 2020 01:20 PM
@Robert Bollinger great to hear you are using Communication Compliance. We don't provide an API nor the Audit logs will help get count of keywords match today. We do plan to deliver such report around October timeframe.
Aug 31 2020 05:07 PM
Thanks Christophe. Yes we are using it extensively, on a 20K seat tenant, but monitoring about 240 or so users as part of a group. We're utilizing RegEx Expressions to to capture data based on multiple conditions. (Support had to help out here, and they did!!). AS well as Keyword based reporting.
Do you know of a way to a report of user activity on messages? For Example, if a user reviewed 10 messages, that were pending as part of a policy, can we report on the actions those users took? Such as Escalate for Investigation, Tag As, False Positive?
Thanks,
Robert
Sep 01 2020 10:07 AM
@Robert Bollinger we are getting ready to rollout new reports that will help, just sent you a private message with my contact info to follow-up.