Hi Team
This is our situation:
DLP version 14.5 MP1 and is scanning and finding incident on an Exchange 2010.
It's necessary for a second level responder to locate the Exchange item that triggered the policy for further actions ( provide feedback to the user, move the email to a another mailbox, etc), this was requested by a specific Audit.
Once the incident is logged and the Responder is able to run the report for the Network Discover events it's possible to verify the Exchange incident but there's a problem, based on the DLP 14.5 Administration Guide, page 1208, on the Incident Details section there's a feature called [URL(open in browswer)] but the documentation only states the following "For SharePoint, this URL is the item on the SharePoint server. Click this URL to go to the item on the SharePoint server"
Problem Number 1: It´s not clear if this applies also for MS Exchange.
I assumed that the URL contains the OWA to the email that triggered the incident but it seems to require the credentials from the original owner in order to allow access to the document.
Questions:
1.Is this the only way to see it? for example why do an Exchange user with reviewing rights cannot have access? In the case of Sharepoint is not necessary to be the owner.
2. Is there a way to show the message ID on the Incident details?
Best Regards,