--- language: "en" --- # Gimmal Discover ## Gimmal Discover Welcome to the documentation site for Discover, Gimmal's signature information governance product. Please select from one of the topics below to learn more. ### Topics #### [Product Information](https://docs.gimmal.com/alt/product-information.md) #### [Getting Started with Discover](https://docs.gimmal.com/alt/first-time-setup.md) #### [Administration](https://docs.gimmal.com/alt/administration.md) #### [Data Governance](https://docs.gimmal.com/alt/data-governance.md) #### [eDiscovery](https://docs.gimmal.com/alt/ediscovery.md) #### [Classification](https://docs.gimmal.com/alt/classification.md) #### [Analytics](https://docs.gimmal.com/alt/analytics.md) #### [Workflow Builder](https://docs.gimmal.com/alt/workflow-builder.md) #### [Integrations](https://docs.gimmal.com/alt/integrations.md) #### [Release Notes](https://docs.gimmal.com/alt/release-notes.md) #### [Technical Guides](https://docs.gimmal.com/alt/technical-guides.md) * #### [Video Education](https://docs.gimmal.com/alt/video-education.md) --- language: "en" --- # Adding New Agents When you decide to add a new agent to an existing connector, you should browse to the Administration area, select Configuration → Connectors, select the connector where you would like to add an agent, hover over the More button, and select the Agent List option. ![Screenshot (23).png](https://docs.gimmal.com/__attachments/a_543faf73fd73001a4443845e31b94633e3605d732447e29258dd4785fa03cd19/Screenshot%20(23).png?cb=7ef28a008554875e05fbeef68138aa41) You will see a list of agents currently installed on this connector. To add a new agent, hover over the Action button then click Add Agent. ![image-20250321-172558.png](https://docs.gimmal.com/__attachments/a_6ef90d9629bdd455185a2faef5813a64d896fd33d3a5f5b4394378eb4d394701/image-20250321-172558.png?cb=a32d49ee7cc64e6d62ee990f26c0e90a) In the dialog box select the type of agent you wish to install from the drop-down list and the installation mode (service or desktop). ![image-20220307-201828.png](https://docs.gimmal.com/__attachments/a_070c4ff37798fe52f104429f68d6aa58f708460be688b35249cc0f69dcc9f67b/image-20220307-201828.png?cb=63dca14ede8115f90abcb7713b22e725) Select an agent to install from the drop-down list then specify either service or desktop mode. Service mode is the normal selection for an agent that will be installed on a server (virtual or physical). Desktop Mode is designed for installation on workstations. Once selected, the specific configuration for that agent will be displayed. These options will be dependent upon the type of agent. See the [documentation](https://docs.gimmal.com/alt/technical-guides.md) on each specific agent for help with the settings. ## Force connector to communicate with the Discover service Deployed connectors are on a timer to communicate back to the Discover service and it could take a considerable time before a new agent is deployed. To speed up this process, refer to the section on forcing a connection to the Discover service on this [page](https://docs.gimmal.com/alt/monitoring-the-connector.md). --- language: "en" --- # Administration Select one of the following topics: * [Application Settings](https://docs.gimmal.com/alt/application-settings.md) * [User Setup](https://docs.gimmal.com/alt/user-setup.md) * [Download Center](https://docs.gimmal.com/alt/download-center.md) * [Connectors](https://docs.gimmal.com/alt/connectors.md) * [Data Sources](https://docs.gimmal.com/alt/data-sources.md) * [Data Targets](https://docs.gimmal.com/alt/data-targets.md) * [Data Owners](https://docs.gimmal.com/alt/data-owners.md) * [Groups](https://docs.gimmal.com/alt/groups.md) * [Automation](https://docs.gimmal.com/alt/automation.md) --- language: "en" --- # Administrative Settings ![image-20251015-203750.png](https://docs.gimmal.com/__attachments/a_395821855b6f23a894ee20abfc15e52153710aedcbea66909469bfd83ef94e9b/image-20251015-203750.png?cb=1d3fb4b5f29533c4146be6d69d105eb6) This page includes several sections, each of which is described in detail below. ## PDF Passwords It is not uncommon for PDF documents to be password-protected. This page allows you to create a list of possible passwords to try when the Discover attempts to access a protected PDF file. ![image-20251015-204454.png](https://docs.gimmal.com/__attachments/a_abbb83f5144ee461397a8293effeca657d3ea92a93cec47a096550d0f71767f6/image-20251015-204454.png?cb=78a96163a6984495680b6b722ea97681) ## OCR File Types The Discover Windows File Agent offers the ability to process image-based files using Optical Character Recognition (OCR) to attempt to extract text from the image. This setting allows Discover administrators to specify which file types are eligible for OCR processing. Clicking the Default button will pre-populate the box with known image-based file types. ![image-20251015-204424.png](https://docs.gimmal.com/__attachments/a_f35db065699d6384620371a91a05e656dd703ee5761dde4963a0da0548d6f4fc/image-20251015-204424.png?cb=572d3e0cfffeedffe53afad1bc31f3a3) ## File, Log \& Report Settings These settings control two distinct aspects of Discover. The File Size and Parsing Time Limit can prevent the Windows File Agent from spending an undue amount of time examining large files. If the Agent encounters a file that exceeds the size limit, that file will automatically be bypassed. Likewise, if a file exceeds the parsing time limit, the Agent will skip that file and move on to the next. ![image-20251015-204343.png](https://docs.gimmal.com/__attachments/a_dffe43fbce9a869b5aa6e08604af5689936da8b0a76fdfbe63c5bb552ec2da16/image-20251015-204343.png?cb=13841fdaeeb77ccbcccc87fa7b0ab6bf) The Log and Report retention settings determine how long those items will remain in a customer's Discover database before automatically being purged. ## Extended Attributes Clients may want to include extended information from their Entra/Active Directory in Gimmal Discover. This area allows those attributes to be defined. For example, the screenshot below shows an entry for the value CO, which creates a column in the Discover database where a user's country designator can be stored. ![image-20251015-204311.png](https://docs.gimmal.com/__attachments/a_c3e7b4aca2282d511d86fa5539c0eadbe8c9e3992f9d0be0e08117f4a54b16a9/image-20251015-204311.png?cb=2e1d0d31c1fb4d4091cfe64550356497) ## Enable Owner Auto Mapping Owner mapping is a process that attempts to automatically associate a Discover data target (i.e., mailbox, file share) with a particular Data Owner. These settings allow admins to specify what attribute should be used to make that association. For example, a Data Owner's last name appears as a home drive on the network. ![image-20251015-204247.png](https://docs.gimmal.com/__attachments/a_89ccfa84e5455f5f161f60071b9488a5d9d4a09c7097106fcf9b750a1a2c26fd/image-20251015-204247.png?cb=49f816c261aa5fdaae33acfcdd17eb25) ## Email Settings These settings allow customer-specific branding (images, headers, footers, etc.) to be applied to email messages sent by Discover. ![image-20251015-204221.png](https://docs.gimmal.com/__attachments/a_ae57ce7c7990ab9eeafd505d7e5d2196156823fa5c1be5aab1db8d0164620ef7/image-20251015-204221.png?cb=68369e1b06d747141e0c853b9a3dd1ff) ## Enable Deactivation of Data Targets Discover Data Targets may be transient. For example, folders in a network file share may not persist over an extended period. This setting allows Data Targets that have not been found by a Data Target Search to automatically be marked with an inactive status. ![image-20251015-204142.png](https://docs.gimmal.com/__attachments/a_e170a4fc84452f2c96bac92a77b33674f93878c2581f6db9f78e6ec0c9024c1a/image-20251015-204142.png?cb=e40565eef6f4b37978bd46733bb20de8) ## Automation Tokens Discover supports a [Data Owner Retention](https://docs.gimmal.com/alt/data-owner-retention-guide#DataOwnerRetentionGuide-Overview) process. Typically, the steps in the retention workflow are triggered by information imported from an external XML file. This screen allows the values that are being imported from the XML file to be defined. When an import occurs, these values are populated and may be used to initiate an activity like a Data Governance Policy. ![image-20251015-204118.png](https://docs.gimmal.com/__attachments/a_8023d88c065080a0ee2f0d12a2eeca55a757d2cfbf09ba00a5b218c0d7ac76f9/image-20251015-204118.png?cb=f3729a56fb2aadf6789153895402ea80) ## Legal Hold Settings Discover may trigger the litigation hold process available in Microsoft 365 to preserve data. The settings in this section determine whether that retention integration is enabled and what M365 content is eligible for retention. ![image-20251015-204049.png](https://docs.gimmal.com/__attachments/a_35f15a69384d1c007c36b5d97f61c64b6f4065bb5e8adefa9da886bfd984dddd/image-20251015-204049.png?cb=b6f44ddfd0892c5054ac16442ae3cd11) As a reminder, if you modify any of these settings, do not forget to click the Save button at the bottom of the page to preserve your selections. --- language: "en" --- # Agents While the Discover Connector is a single download, it deploys agent software specifically for each type of data source that you want the service to connect to. A single Connector can support multiple Agents. In order for you to deploy or configure an Agent, you must own a license to the specific data source. There are several data sources available, many of which require specific configuration steps. The following list describes the Agents that Discover supports and, where applicable, contains links to more detailed configuration instructions: * [Windows Files (typically network shares or user workstation hard drives)](https://docs.gimmal.com/alt/windows-file-path-agent.md) * PST Files * Exchange Mailbox/Archive (for Exchange 2013 or older) * [EWS Mailbox/Archive (for Exchange 2016 or newer and Microsoft 365)](https://docs.gimmal.com/alt/oauth_configuration_guide.md) * [SharePoint (2016 or later)](https://docs.gimmal.com/alt/oauth_configuration_guide.md) * [One Drive](https://docs.gimmal.com/alt/oauth_configuration_guide.md) * [Box](https://docs.gimmal.com/alt/box-agent-configuration.md) * [Google (Gmail or Google Drive)](https://docs.gimmal.com/alt/google-agent-configuration.md) * [OLEDB (SQL based structured data)](https://docs.gimmal.com/alt/oledb-agent-configuration.md) * [MSGraph (for Microsoft Teams)](https://docs.gimmal.com/alt/msgraph-agent-for-microsoft-teams.md) * [Apple Mac workstations](https://docs.gimmal.com/alt/installing-the-discover-mac-file-agent.md) --- language: "en" --- # All Owner Reports The All Owner Reports link in the Data Governance module allows you to view reports that were created by a workflow that included the "Notify Data Owners" option in a Save List action. These reports will also show in the Policy Reports view however this dedicated view will show only the Data Owner reports. The toolbar options are: * **Common** * **Select All** - Select all reports * **Clear All** - Clear selection of all reports * **Reset Grid -**Reset the view back to the default, such as all columns being viewable * **Export to CSV -** Export the list of policies to a CSV file * **Refresh Grid** - Reload the grid, showing any changes * **Action** * **Edit**- Modify the grouping options used to generate the summary * **Delete**- Delete a summary report and all of the data that was collected to generate it * **View Summary** - View a summary report --- language: "en" --- # All Tagged Reports The All Tagged Reports link in the Data Governance module allows you to view Data Owner reports that have had items labeled by the Owner. In the normal process, a workflow generates reports, and Data Owners receive an email alerting them that they have items requiring review. That email contains a link where the Data Owner may log in via an SSO session to review their items and attach a label indicating what action to take on each item (for example, Delete or perhaps Archive). Once the Data Owner has applied those labels, the report will be included in this view. These reports will also show in the Policy Reports view, however this dedicated view will show only the Data Owner reports with activity. The toolbar options are: * **Common** * **Select All** - Select all reports * **Clear All** - Clear selection of all reports * **Reset Grid -**Reset the view back to the default, such as all columns being viewable * **Export to CSV -** Export the list of policies to a CSV file * **Refresh Grid** - Reload the grid, showing any changes * **Action** * **Edit**- Modify the grouping options used to generate the summary * **Delete**- Delete a summary report and all of the data that was collected to generate it * **View Summary** - View a summary report --- language: "en" --- # Analytics This module in Discover is geared towards enlightening you on all the electronically stored information (ESI) within your organization. Using Discover's distributed architecture and its ability to reach into multiple data silos, the data type specific agents can be configured to collect high-level metadata and statistical information of all the data. The collected details are visualized in intuitive charts providing quick insight into your environment. The Analytics portion of Discover will allow you to create custom dashboards of the most relevant charts and also provide a trending analysis of the same information collected over time. Select one of the following topics: * [Analytics Summary](https://docs.gimmal.com/alt/analytics-summary.md) * [Analytics Configuration](https://docs.gimmal.com/alt/analytics-configuration.md) * [Analytics Reports](https://docs.gimmal.com/alt/analytics-reports.md) * [Dashboards](https://docs.gimmal.com/alt/dashboards.md) --- language: "en" --- # Analytics Configuration Use the Configuration section of the Analytics module to setup the collection of the necessary information from the targeted data stores. The data collection process is executed in a distributed fashion by the Discover agents with access to each of the stores. The collected data is then transmitted to the Discover service in XML format where the data from all the data stores is consolidated and summarized and the reports generated. The toolbar has the following options: * **Action** * **Start Analysis** - Begin collecting information from the data source * **Stop Analysis** - If Analytics is currently processing, this will stop the process * **More** * **Execution Status** - Displays the current status if Analytics is currently processing There are three options on the configuration dialogue, General, Targets, and Analysis Schedule. Select the Edit button to change the configuration on any of the tabs. * **General**- Allows you to choose which data sources to run analytics on * **Targets**- Allows you to choose which data targets to run analytics on. You can select from devices, owners (members), or groups. * **Analysis Schedule** - Sets the schedule of when to run the analytics process --- language: "en" --- # Analytics Reports Select one of the following topics: ## [Standard Reports](https://docs.gimmal.com/alt/standard-reports.md) ## [Trend Reports](https://docs.gimmal.com/alt/trend-reports.md) --- language: "en" --- # Analytics Summary The Summary screen of the Analytics module displays cumulative details about the analysis gathering processes that have been configured and collected in your environment. The Targets block outlines the number of Data Targets whose data has been collected in the most recent run of the process. The target total is broken down by the count of targets managed by Data Owners, the number of targets found on Devices that don't have Data Owners, and finally, the total number of Data Sources that were accessed by the process. The Previous Runs block indicates the number of times the analysis process has been executed and more granular details about the most recent run. The block on the right displays real-time information on the currently running analysis process, including a count of the actual targets on which the process has completed as a percentage of the total number of targets slated for the current run. ![image-20250328-202552.png](https://docs.gimmal.com/__attachments/a_06e7f39fb618f99634b754e34bc42a09cec53af953af99188c9c58d78e5a7aea/image-20250328-202552.png?cb=7a2882040d286b8dd8c328e7ed6b7b66) --- language: "en" --- # Application Settings Gimmal Discover offers several configuration settings that control various features. These settings can be accessed by clicking on the gear icon found in the upper right-hand side of the Discover dashboard: ![image-20251015-202055.png](https://docs.gimmal.com/__attachments/a_98b23d68e0550b1f20160bb0f0b5c630a66b1ab2971c7d5b4444b97e6f1bbbf7/image-20251015-202055.png?cb=71988407de663b7b320c79931333b377) Each page in the settings area is described in more detail in the links below. * [General Settings](https://docs.gimmal.com/alt/general-settings.md) * [Administrative Settings](https://docs.gimmal.com/alt/administrative-settings.md) * [Policy \& eDiscovery Settings](https://docs.gimmal.com/alt/policy-ediscovery-settings.md) * [Classification \& Connector Settings](https://docs.gimmal.com/alt/classification-connector-settings.md) --- language: "en" --- # April 2021 **Feature updates** * **Platform rebrand:**The platform has been rebranded Gimmal Discover. AI/NLP for PII: Gimmal is introducing a static Natural Language Processing (NLP) model for PII that is designed to identify name and/or address information. Microsoft 365 Legal Hold Support: Ability to enable or disable the ability to set Microsoft 365 litigation holds for Exchange and retention labels for OneDrive and SharePoint. **General:** * Connector and Agent assembly version numbers are now displayed on the Discover dashboard. Assembly numbers often are incremented when a patch is released for a Discover component. * The data-target grid now displays the date that a search was created and the date it was last updated. * The automatic update behavior for Connectors will default to obtaining the installation files from Discover's Content Delivery Network (CDN). * Additional notification options have been added for clients using data owner retention **Data Governance:** * For clients using Discover's automation feature, there is now an option to add or remove data owners/targets to existing policies. * New colored icons on the policy list page that use different shapes to indicate statuses for schedules (On/Off) or policy enabled/disabled. * Administrators may now optionally cancel targets currently processing (or pending) at the agent when a policy time out occurs. * Multiple data targets may now be selected when canceling a policy on the Policy Execution page (previously each target had to be canceled separately). * Workflow Editor: * There is now support for generating summary reports when using the workflow Allow Partial option. Setting the Allow Partial option in a workflow is highly recommend as it will provide more efficient processing. * Data Governance automation has been extended with new tokens to update a policy by adding or removing owners. * There is now support for capturing all instances of a keyword when examining content. (Previously, Discover Agents stopped after locating the first occurrence of a keyword match.) **eDiscovery:** * A new search continuity option is now available when creating an eDiscovery search. This setting determines how keyword matching will be performed by allowing three options: * Simple will stop searching after the first occurrence of any keyword is found * Complete will search for every occurrence of the keyword terms * Exhaustive will search for every occurrence of the keyword terms including honoring any proximity settings in the search syntax (i.e. Gimmal NEAR(5) Software). * Along with the new keyword options, there is also a new snippet option that determines if snippets will be returned for the first keyword hit only or for all keyword hits. * When creating a new eDiscovery collection, there is now an option to save workstation collections to a local folder first. This is very helpful in the event the network collection location is not accessible by the workstation (i.e. VPN access not available). When this option is configured, collected files will be stored locally until the network location becomes available. **Workflow Editor:** * A new option added to the "move message" action enhances support for partial matching on folder names by allowing that check to include all subfolders. **Agents:** * Multiple enhancements have been made to the Box Agent. * Discover now supports modern authentication (sometimes referred to as oAuth) for Microsoft 365 PowerShell calls. PowerShell is typically used to obtain information such as a list of mailboxes or retention policies. * Credential testers are now available in the Connector Status application for all supported cloud data sources. These testers are a useful way to validate that the entered credentials can successfully access the target content repositories. **Resolved issues** * Updates to the CDN download process used when new Connector/Agent versions become available now handle machines with older versions of the Microsoft .NET framework. * Notification emails now accurately indicate when Agents are installed or removed. * Resolved an issue with the incorrect identification of inactive targets. * Resolved an issue with Data Target and Owner searches being over-written when they are created manually from a template. * Fixed issue which caused the message subject to not be included in the fast search criteria for Exchange EWS messages. * Several fixes were introduced to address performance in the hub, policy sharing views, and other miscellaneous user interface elements. --- language: "en" --- # April 2024 Discover Maintenance Release This release introduced cloud updates to address the two critical customer issues described in the table below: | **Issue Number** | **Description** | |------------------|-----------------------------------------------------------------------------------------------------------------------------| | 91263 | Changes to the cloud web service to support Connector installations being performed by the MSI installer package | | 91208 | Using the delete file action with the 'move to recycle bin' option in a OneDrive workflow was permanently deleting the file | --- language: "en" --- # April 2025 Release The April 2025 release of Gimmal Discover features an updated user interface (UI) design for the dashboard. The modern look and feel rolling out in this release was part of a larger Gimmal initiative to standardize and unify the user interfaces across our core product offerings. It is important to note that there are no functional changes in the way Discover operates; the UI updates are purely visual. More detail about the UI update is shared in this recording of the [customer release webinar](https://youtu.be/hZdQYqEc7QM). Along with the UI update, this release also includes support for the latest Microsoft Entra PowerShell command. Microsoft has announced that it is retiring the Azure AD PowerShell commands (refer to this [link](https://techcommunity.microsoft.com/blog/microsoft-entra-blog/action-required-msonline-and-azuread-powershell-retirement---2025-info-and-resou/4364991)) that Discover previously used when issuing Entra AD queries. | **Issue Number** | **Description** | |------------------|------------------------------------------------| | **101345** | Update PowerShell Modules MSOnline \& Azure AD | *** ** * ** *** ## **Important Information** If your organization uses either: * Data Owner target searches in Azure/Entra * EWS Mailbox data target searches in Azure/Entra You **must**install the new PowerShell module and force an update of the Connector and EWS Agent components in the Discover dashboard to keep those queries operational. ### Installing the PowerShell Module Log in to the server where your Connector and/or EWS Agent is installed. Open a PowerShell session as an administrator and issue this command: install-module Microsoft.Entra -force -AllowClobber Note, the PowerShell version should be version 5. After issuing the install command, Gimmal recommends running the command Import-Module Microsoft.Entra, then issuing a get-installedmodule command to verify the Entra components show as version 1.0.7 Also, the previously used module MSOnline is no longer required by Gimmal Discover ### Updating the Connector/Agent Log in to the Discover dashboard. Open Administration/Configuration/Connectors. Select a Connector, hover over the More button, then select 'Update Connector and Agents'. ![image-20250404-135944.png](https://docs.gimmal.com/__attachments/a_e16cd17e429b28254f845b318e4b15d93136ab23bab562f073ffc777bf8c0cea/image-20250404-135944.png?cb=80fa4b2e7419bd8199b37ec7212aae94) The next time the Connector performs a check-in, it will pick up this command and begin the update process. To verify that the Connector/Agent updates have completed successfully, verify that the following assembly numbers are shown: **Connector: 2022.1.25090.30135 (or above)** ![image-20250405-134624.png](https://docs.gimmal.com/__attachments/a_9ece7ec9330099aa46abb7e468942365efca964b99784311f52fa87e84346b3e/image-20250405-134624.png?cb=13fcad9f0efae4f84e6cfa7161c3745a) **EWS Agent: 2022.1.25090.30135 (or above)** ![image-20250405-162852.png](https://docs.gimmal.com/__attachments/a_2568bb65b26019b47c145f3a7e4f06037c31abd292651a7e8e13c680f24c3f8c/image-20250405-162852.png?cb=502da8b9f760498b56306286ee743270) --- language: "en" --- # Assets The Assets page lists the classification by individual devices. The following options are available on the toolbar: * **Common** * **Reset Grid -**Reset the view back to the default, such as all columns being viewable. * **Export to CSV** -- Generates a CSV file of the list of workflows. * **Refresh Grid** - Reload the list showing any changes. * **Action** * **Show Targets** - Displays the data targets with classified items for the device. * **Classified Items**- Displays all the items classified for the device on the Results page. * **Owner Results** - Displays the classified items that belong to the owner. *** ** * ** *** Data Targets Selecting any device on this list, or selecting Show Targets on the Action button will display a list of data targets with classified items for the device. There are two options available for the targets. * **Classified Items**- Displays all the items classified for the data target on the Results page. * **Owner Results** - Displays the classified items that belong to the owner. --- language: "en" --- # Audit The audit page provides a complete record of any classification related activity including policy executions and requests to remove or re-classify content. From this view you can also access the detailed log files for the process. Select any process, hover the Action button and select Classification Policy Execution, or just select the link in the Status column. Each step of the policy execution is shown. Select any item, select one of the following: * **View Log** - View the log file generated by the specific execution * **Download log**- Download the log file --- language: "en" --- # Automation Automation provides a way to trigger specific processes within Discover, including: * Creating a Data Target search * Creating a Data Owner search * Creating a Policy * Starting a Policy * Updating a Policy (adding Data Targets, enabling/disabling schedules, adding/removing Data Owners) An automation sequence is typically triggered by an XML file that contains customer-specific information. This document describes how the automation process works. There are several steps required to configure a Discover automation process. They include: * Designating a location for the automation files * Defining automation fields to be imported in the Discover settings * Creating templates that the automation process will use for new items (i.e., creating a policy, Data Target search, etc) * Creating the automation in the Discover dashboard Each step is described in more detail in the following sections. *** ** * ** *** ## Automation Files Automation files are XML files used to initiate a Discover automation process. These files are picked up from a file share location by a Discover connector. The location that is monitored for automation files is specified in the connector settings: ![Screenshot (29).png](https://docs.gimmal.com/__attachments/a_ff90e5dfa90799b14a7ff36588970444e08acab3014f29a4a7261009d164465d/Screenshot%20(29).png?cb=8287e1ecaf413a8dabcd91c16430e86e) ## Defining Automation Fields The information being ingested from an automation XML file is stored in the Discover database. You must configure the fields that will be used to store that information within the settings area of your Discover dashboard. To begin, click the gear icon found at the upper right of the dashboard, select Settings, then choose the Administrative tab. Scroll down the right side of the screen to the area labeled *Automation Tokens.*Click the Action button, then select Add to enter the values for the data that will be imported. The example below shows defining the settings for an automation that will import a series of SharePoint site URLs to create Data Target searches. Please note: If you plan to use automation, the Automation Title and version tokens shown in the screenshot below must be defined for the automation process to run successfully. ![Screenshot (65).png](https://docs.gimmal.com/__attachments/a_c235fb6cbae546ffc95116b14ae6bf800929cae2d0d9948bad3dafe700729e01/Screenshot%20(65).png?cb=c610dc59388f7f4b30b4c6326f3907ff) Each automation token contains four values: * **Display Name**- this is the name of the token shown within Discover * **Description**- a text field that describes the purpose of the token * **Token** - this is the tag that will be present in an import XML file to identify the content to import * **Type** - the format of the data (Boolean, Date, Number, or Text) Please refer to the XML File format section below to see how these tokens are defined within the import file. *** ** * ** *** ## Creating a template Automation may be used for different purposes, including creating Data Target or Data Owner searches, or for creating a policy. For these use cases, a template provides the placeholder text that the automation will populate along with the other parameters the search requires (for example, what Connector will execute the search). The example below shows a Data Target search template being edited. To add a template: * Click on Administration at the top of the dashboard, select Configuration from the left-hand navigation, then Connectors. * Under the Action button, select Searches. * Under the More button, select Search Templates. ![image-20250324-192725.png](https://docs.gimmal.com/__attachments/a_a51efb2ba4bdb7f8a51a2d776b728360b75d67f1cd3d7558c1b1efe545fa2c1f/image-20250324-192725.png?cb=c9b74840de469ddd23c27fdd94a78147) The Token buttons circled in red allow you to select the piece of information that will be populated from the incoming XML file when the automation process creates the Data Target search. It is important to add a token to the Name portion of the search to avoid creating duplicate data target searches. *** ** * ** *** ## Defining the Automation Automations are located in the left-hand navigation pane of the Administration module. To create a new automation, click the Action button, then select Add. Enter a name for the automation process and click Add. ![image-20250324-193045.png](https://docs.gimmal.com/__attachments/a_678d4f6be5543b3efe3b5ec401e70cd81b9c0b42d3c94ffbb07dcdfc94e996a8/image-20250324-193045.png?cb=6eff3a062c6d5443d5eb895e70e22555) The automation you just created will now show in the grid. Click the selection box to the left of the automation name, then select Automation Steps under the Action button. ![image-20250324-193232.png](https://docs.gimmal.com/__attachments/a_465ee0adc099796ae6343977d0486a54894deced74a498586dc39a587eff55d2/image-20250324-193232.png?cb=00eedc9991e31c1a901cc4960173019b) Click the Action button and select Add to enter a new automation step: ![image-20250325-190659.png](https://docs.gimmal.com/__attachments/a_57663cf781a94200530fea36ebdb8671f576a07b6ae6d9c4b658f612b26a777c/image-20250325-190659.png?cb=d4d69e84626c037c7d1a1ec95b62ad12) And supply the following values: * Select an order. Automations may perform more than one task (for example, create a Data Target search and create a Policy); the order value will determine what sequence the steps are performed in * Select an automation step type from the drop-down list. The automation step types that are available are shown in the screenshot below. Our example shows creating an automation that will add new SharePoint Data Target searches using the type 'Create Target Search' ![image-20220307-205728.png](https://docs.gimmal.com/__attachments/a_c4305dfec38272882479de4f0c2f5f4bdb4e5821e7815133f9e2b93fe62326ce/image-20220307-205728.png?cb=40f83f8085871f8da53adfdb5644ae71) * Select a source. Typically, sources are one of the templates discussed earlier. In this example, the SP Search template was selected. * Store Automation Token Values. If the automation is importing values that need to be saved in the Discover database, tick this box. If you are unsure, check the store token values box as a precaution. Click the Save button to update your automation step. Here is an example of the completed automation step: ![image-20221005-173522.png](https://docs.gimmal.com/__attachments/a_35ca4e51e62fa74bbb22d58862f548c48f877d2fdbb8eeeee9eb1248ad0f9224/image-20221005-173522.png?cb=f9da90129f0af04bebd0f271668ed981) ## Automation Files Once the automation steps have been configured, the Connector will begin monitoring the designated file location for new XML import files. When a new file is found, its information is imported, triggering the appropriate automation, and the source XML file is deleted. Below is an example of an automation XML file for the SharePoint Data Target search as described in the previous steps. When this file is placed into the automation files location, it will trigger an automation process named "SP Automation". In our example, this automation creates a SharePoint Data Target search using the information stored in the template "SP Search" along with the site URL: https://portal.exampledomain.com/project That is imported from the XML file. *** ** * ** *** ## Example Automation XML File Format **\** **\** **\** **\SP Automation\** **\** **\** **\sharepointTagPath\** **\\\>** **\** **\** **\** **\** For more information about how Discover automation can be used, please contact your Gimmal services team. --- language: "en" --- # Azure AD Certificate Installation This certificate is required if customers intend to query Azure Active Directory to obtain group information. It must be installed on the machine where the EWS Agent is deployed. Follow the steps outlined below to install the certificate: Begin by right-clicking the certificate .pfx file and either selecting 'Install PFX' or 'Open' from the context menu to launch the certificate import wizard. On the welcome screen select the Local Machine radio button then click Next: ![image-20220317-171834.png](https://docs.gimmal.com/__attachments/a_2b999037d472b9eca9fd9d2a6d51fdfc8b2713f7381309c5c48d558b7d16e0b8/image-20220317-171834.png?cb=1938e789140caf17be93efb121804dd2) Use the Browse button to locate the certificate .pfx file, select the file then click the Next button to continue: ![image-20220317-171901.png](https://docs.gimmal.com/__attachments/a_e45b60f052ca00e2d49cf2ae5a34103e20f25045e7a76c7cab3229bb1e3f50ca/image-20220317-171901.png?cb=dcd2601831edad90473b5ec4fbcd11a7) Enter the password used to generate the certificate, select the boxes shown below then click Next ![image-20220317-171924.png](https://docs.gimmal.com/__attachments/a_b2c16ab83e695fe9b391edd8d22fc321a566903bf7539ebe75786175bfbb943d/image-20220317-171924.png?cb=117e1e075b27384eff38b69d40db7321) Select the radio button allowing you to select a certificate store, click the Browse button, select Personal then click the Next button: ![image-20220317-171945.png](https://docs.gimmal.com/__attachments/a_a2e29b19d42fef711c78438a41c6be5469bd2e4ee5fc15dbe379dd44d47f5d25/image-20220317-171945.png?cb=59c3b414f139bdfdf71b520bdfeed1a4) Verify the settings and click Finish to install the certificate To confirm, the certificate is correctly installed, do the following: * Click the Start/Run menu option and enter MMC (Microsoft Management Console) on the command line * From the file menu click Add/Remove Snap-in, then select Certificates in the Available Snap-ins list ![image-20220317-172011.png](https://docs.gimmal.com/__attachments/a_f93a4b14dd59842025dd47e2674c814959f93501c075e8e86fc4a734259fec87/image-20220317-172011.png?cb=f4f2750d2a6c5617020c2f2cbfa380bd) Click the Add button and on the Certificates snap-in dialog select the radio button for Computer account then click the Next button. In the Select computer dialog, choose Local computer then click the Finish button. This will return you to the Add or Remove Snap-ins dialog, click OK to save your settings, and return to the MMC. There should now be an entry for Certificates (Local Computer) shown in the navigation tree. Select it to open the list, then select Personal, and Certificates. ![image-20220317-172033.png](https://docs.gimmal.com/__attachments/a_39f1c703974d4e0dfdf6c26b16146201dda903afd3a03e1313be04a445bce5d5/image-20220317-172033.png?cb=224eca10fd9b5bccd4a80a62c3e5ae33) The app registration certificate should now show up in the list. --- language: "en" --- # Entra/Azure AD Configuration ## Introduction As part of the move to a Microsoft 365-centric architecture, often on-premises Active Directory information is migrated into Entra Active Directory (AD). Discover fully supports obtaining user or group information from Entra AD. This document describes how to configure this access. Note: The commands required to access Entra AD are only supported by 64-bit machines. If you plan to use Entra AD, please make sure you are installing on a 64-bit operating system with 64-bit components (i.e., Outlook if required). ## Section 1: PowerShell Setup/Access Any Discover Connector server that will be performing queries into Entra AD must have the following PowerShell module loaded: * Microsoft.Entra You can verify if this module is present by launching a PowerShell session as Administrator, then issuing the following command: **get-installedmodule** If the module is present, the response to that command will show the following: ![image-20250404-155932.png](https://docs.gimmal.com/__attachments/a_477c3dbf8fb4d5998da65b58002885d7da964d03686c0b3eb7373fc7265ca6de/image-20250404-155932.png?cb=a2cb12e2b2880e8ed6a5427f4e2a3102) If the modules are present, the Discover machine is prepared to access Entra AD. Please continue with configuring the data target search as described in Section 2. If the modules are not present, continue with the installation instructions shown in this section. ### Installing Microsoft.Entra Install the Microsoft.Entra module by issuing this command from a PowerShell session: install-module Microsoft.Entra -AllowClobber As shown below, this command will also present a confirmation prompt. When it does, press Y to proceed ![image-20250404-155625.png](https://docs.gimmal.com/__attachments/a_2441f1841e5f94a9004c346da4c4266628d52c96fb4689603fa57d12145b7abf/image-20250404-155625.png?cb=47be8fd779e5c4807e15cef5a1fd97f3) ## Section 2: Discover Configuration Once the PowerShell module has been loaded, there are two locations where Entra-related settings should be verified within your Discover configuration. First, the PowerShell authentication type and URL should be verified in the Connector settings. Also, the PowerShell account information should be verified in the Connector Status Utility. If you are using Oauth (Modern) Authentication, please skip the Connector Settings section, and refer to the setup directions included in the [Oauth Configuration Guide](https://docs.gimmal.com/alt/oauth_configuration_guide.md), then return to Section 3 of this document ### Connector Settings To validate the PowerShell authentication and URL in the Connector settings, log in to the Discover dashboard. Either click the red Connectors block on the home page or click Administration, then Configuration/Connectors. ![image-20250404-182738.png](https://docs.gimmal.com/__attachments/a_d3de2bf89c8182c3c140435925683f666cf7f46bb2b5b5aa36f8d3a0a6186d79/image-20250404-182738.png?cb=8449313919438d15b9de872d44ce0101) Select a Connector, hover over the More button, and choose connector settings ![image-20250404-182836.png](https://docs.gimmal.com/__attachments/a_22e5515ad902bff858850f32ba141d5c13561077dfdb563f5ff7e775d21b2a63/image-20250404-182836.png?cb=755f2a9b06da04af06d3874739b8508f) Check the advanced box, then select the tab for Connector settings and scroll to the bottom of the page to locate the settings for PowerShell Auth Type and URL, and verify the settings are correct for your environment. ![image-20250404-182958.png](https://docs.gimmal.com/__attachments/a_2673a5db7c3be8b4648d5a70894cb63d2d35bc332cf13a7eb97c7c48c64051b1/image-20250404-182958.png?cb=b5ac98d9b8457a842c285e12decf1003) If your settings are correct, move on to the Connector Status Utility Settings section of this document. If you do modify the settings, be sure to click the blue Update button at the bottom of the form. Return to the Connectors screen, then hover over the Action button and click Download Configuration File. ![image-20250404-183136.png](https://docs.gimmal.com/__attachments/a_632602a11a2192fed373eaa2d67621953270874789df8cae1bab388233655dbf/image-20250404-183136.png?cb=43c178d6aecbb43263cb42373f90258a) Selecting this option will force an update of the Connector settings from the Discover database to the local Connector server. Gimmal recommends restarting the Connector service on the server to ensure the updated settings are in effect. ### Connector Status Utility Settings Log into the Connector server and launch the Connector Status Utility by clicking the desktop icon shown below. ![image-20220317-171109.png](https://docs.gimmal.com/__attachments/a_20fcd55ecaf031c7948445209f36afecd94279c07a107dfc7c2228014a776859/image-20220317-171109.png?cb=7412aba6a72b08754ff40cb106efca54) If your server does not have a desktop icon, locate the file SherpConnectorStatus.exe file in the folder C:\\Program Files (x86)\\Sherpa Software\\Sherpa Connector And launch the utility from that location. Click on the Credentials hyperlink, then click the Connectors tab: ![Screenshot 2026-10-01 112631.png](https://docs.gimmal.com/__attachments/a_f65f59290fcf616fa71569cf7e0aabd14714723bcc19b3dbee01ede816f99712/Screenshot%202026-10-01%20112631.png?cb=01cdb5a015c2a037f9dd8907129b2b8c) In the middle of the form, check the box that says 'Use Azure Registration Credentials' then supply the values required in the 'Azure oAuth PowerShell Credentials' area. If the credentials are correct, continue with Section 3: Entra AD Data Target Searches in this document. If you need to enter (or modify) the credentials, be sure to click the Save button at the bottom of the form. Then close the Connector Status Utility, and restart the Connector Service to ensure the latest credential information is being used by the service. ## Section 3: Entra AD Data Target Searches for Data Owners Once the Entra AD components are in place, Discover should be able to query Entra AD through a Data Target search query. In the Discover Administration module, select Configuration then Connectors. Hover over the Action button and select Searches: ![image-20250404-183820.png](https://docs.gimmal.com/__attachments/a_7124e49ec13c096445ddefe1013a52764a00a7d6376b89637ae074ff7210aa9c/image-20250404-183820.png?cb=46c4372362de8dfe5d031831855e5279) On the search screen, hover over the Action button and select Add. From the Type drop-down list select Data Owners. ![image-20220317-171257.png](https://docs.gimmal.com/__attachments/a_5043fb198a61773a7c6ae918f70681062abc1aa612f3e425b5c3de64d6513758/image-20220317-171257.png?cb=6d3743617569bb47090cbe50fc8c2308) Supply a name for the search type, then select the 'Search For' option shown below to reference an Entra AD group. Then set the 'Search By' to Specific Connector and select your Connector device using the Edit button. ![image-20220317-171340.png](https://docs.gimmal.com/__attachments/a_efed2d4558b59f00e96d6226ee4d19296dd46dfeeba1e808faa98650d5a9f138/image-20220317-171340.png?cb=15be759cc38c0279dfe9705919bd7f44) Click the Find Entra AD Group tab at the top of the form and supply the name of the Entra AD group that you would like Discover to query for user information. Note: You may only specify one group name for each search. To search for additional groups, create multiple Entra AD searches ![image-20220317-171445.png](https://docs.gimmal.com/__attachments/a_5865bde4c92f996faf3cb471e200cbd17d63d270950df62a38c598cd6751505f/image-20220317-171445.png?cb=7424101f3d0b8ee04e7232649c486423) If you would like to create a corresponding group within Discover (this step is optional), check the 'Synchronize search results with external group' box and supply a name for the Discover group to be created. When finished, click the blue UPDATE AND RUN button to queue the search for execution. The next time the Connector device checks in, it will pick up the search request and perform the query. ## Section 4: Entra AD Data Target Searches for EWS Mailboxes If you are using Discover to manage Exchange mailboxes in Microsoft 365, you can also obtain a list of mailbox data targets through an Entra query. Like Data Owners (described in Section 3), the process begins with creating a search from the connector screen. In this case, select EWS Mailboxes as the type of Data target ![image-20250404-190000.png](https://docs.gimmal.com/__attachments/a_c05bbed28407e393a9889866ec97878774444dd5b1ba899616d1c323ae643cee/image-20250404-190000.png?cb=b7309c259bc4a40299b0a8de7b2ca551) In the search list drop-down box labeled "Search For" select the option "Find EWS Mailboxes from an Active Directory group in Azure". ![image-20250404-190059.png](https://docs.gimmal.com/__attachments/a_4c7981bea31acf8a9f764398259d36abb9ba8d00bc8fcf8407e479443b20afb6/image-20250404-190059.png?cb=0f7fa486888584b21ee662870b982f4a) When finished, either click the Add button, then select the search and run it, or open the search in edit mode and click the blue UPDATE AND RUN button to queue the search for execution. The next time the Connector device checks in, it will pick up the search request and perform the query. ## Appendix A - Testing Entra/AD group queries using PowerShell If you are having difficulty obtaining group information from Entra/AD, it may be helpful to issue the PowerShell commands directly to determine if additional troubleshooting information is available. Initiate a PowerShell session as an administrator and issue the commands shown below. Note, you will need to replace the items shown within \[\] brackets with the appropriate pieces of information from your configuration: $Secure_String_Pwd = ConvertTo-SecureString '\[PASSWORD\]' -AsPlainText -Force $certObj = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2('\[PATH TO CERTIFICATE PFX FILE\]', $Secure_String_Pwd) Connect-Entra -TenantId '\[TENANT ID\]' -ApplicationId '\[CLIENT ID\]' -CertificateThumbprint $certObj.Thumbprint -NoWelcome $group = Get-EntraGroup -filter "displayname eq '\[GROUP NAME\]'" Get-EntraGroupMember -GroupId $group.id \| select ObjectId,UserPrincipalName,Mail,DisplayName,GivenName,SurName,MailNickName,Department,PhysicalDeliveryOfficeName --- language: "en" --- # Box Agent Configuration ## Introduction: This document describes the configuration steps that are necessary to allow Discover to manage content stored in a Box repository. ## Section One -- User Creation ### Verify the Box edition The Discover Box Agent supports the following versions: Business, Business Plus, or Enterprise. To validate that you have one of these editions, please log in to the Box Admin site using the following link: After logging in, verify that you are using one of the supported Box editions. That information can be found on the screen shown below: ![image-20220317-172247.png](https://docs.gimmal.com/__attachments/a_ed1272976c9cc9d03dce0853f127bb7400889fad04eed4d3f7263dddbe5096b3/image-20220317-172247.png?cb=213716eb8f0b11234784ec1c95cb7565) Next, click on the 'Users \& Groups' option in the left-hand navigation pane, then click the button labeled '+ Users': ![image-20220317-172304.png](https://docs.gimmal.com/__attachments/a_1bfed4bd39387eda88f0d6e41b859ff805e419d15a7cdfc3a55d5586ccb879a7/image-20220317-172304.png?cb=6eb1add9ef0970436fdad54266a5f80c) Fill out the highlighted sections in 'Edit User Account Details' and 'Edit User Access Permissions' as shown below (at a minimum): ![image-20220317-172343.png](https://docs.gimmal.com/__attachments/a_3e5afeaff488f9476e8f882c277c841e92bf75ad69f209d27be5300ff9541f8f/image-20220317-172343.png?cb=c9d42eb3db6316ca0be53c9f816ddb4c) Click the Save button. ![image-20220317-172411.png](https://docs.gimmal.com/__attachments/a_7e64aac5042590a06dc5acc0f796ba0103318c4419f4d7f416b3e2a1069ae208/image-20220317-172411.png?cb=8623fd8261b7daac88a960f108f0f554) Log back into the Box using the new account you just created, then click on the profile icon found in the upper right-hand corner: ![image-20220317-172427.png](https://docs.gimmal.com/__attachments/a_56b184a03bb732f72f6b73db59362f14bb1718bafa92b9c612635064c938cda6/image-20220317-172427.png?cb=8c2f2fb97a4c79917b7b431b721bd791) Click the down arrow and then click on 'Account Settings'. Scroll down to 'Authentication', check the box beside 'Require 2-step verification', enter a cell phone number, and verify the code sent via text message. Click 'Save Changes' once complete. ![image-20220317-172454.png](https://docs.gimmal.com/__attachments/a_ab0e96e3a084a784354b3021b04534e12924fdd374aca622e7ac05f828d6c832/image-20220317-172454.png?cb=0756adda4118db2ebae35f252d54ac3b) ## Section Two -- Creating the Box App Before Discover can manage information stored in the Box environment, it must be registered as an app in the Box developer portal. Creating the app allows you to specify the permissions that Discover requires and generates the security information that must be supplied when installing the Discover Box Agent. Access the Box developer portal using the following link: Click the 'Go to Dev Console' button and use the login credentials from Section One to access the site: ![image-20220317-172515.png](https://docs.gimmal.com/__attachments/a_175a6a63bb03199e1962decc7879fab9722efff461244bf44d46d268d9ab4d8d/image-20220317-172515.png?cb=cb0bd7da512479e23bc5f390f4a02296) After logging in, click on the 'Create New App' tile: ![image-20220317-172533.png](https://docs.gimmal.com/__attachments/a_36b5472b7fdd3907fef1069974e7352812486920c8b3bfa51e8b53e48bb4dcc5/image-20220317-172533.png?cb=4836fdd9aa6251d1319067afefd950e0) Select the 'Custom App' tile and then click 'Next': ![image-20220317-172546.png](https://docs.gimmal.com/__attachments/a_4577b6e59de05d9ac033ed2fd2e88c525593f5fd140500d2cc815b5a2fe13bdb/image-20220317-172546.png?cb=e691844d2e52de17f2f04144d8fbc66f) Choose the 'OAuth 2.0 with JWT' server authentication method, then click 'Next': ![image-20220317-172601.png](https://docs.gimmal.com/__attachments/a_7b7315c51a805d24bb030fa4eebe1a88a77f171261301367d9c031298cb7e283/image-20220317-172601.png?cb=9c5ac6f2a5f19e0c7d1efa3efb958e49) ![image-20220317-172608.png](https://docs.gimmal.com/__attachments/a_65520e8539b0becb3d8721b159b43bd4d96fdf17aa5936070a5fb9da6b9205c5/image-20220317-172608.png?cb=9c5ac6f2a5f19e0c7d1efa3efb958e49) ![image-20220317-172616.png](https://docs.gimmal.com/__attachments/a_8ac9db30101161f620edb5705016551ac8a9b56797d1d89dca54c98c77fddaf2/image-20220317-172616.png?cb=9c5ac6f2a5f19e0c7d1efa3efb958e49) Enter a name for the new Box app (we recommend something related to Discover), then click the 'Create App' button: ![image-20220317-172634.png](https://docs.gimmal.com/__attachments/a_edde29198f8ecc788076175ab586e321231360592afbf691638be457c56e586a/image-20220317-172634.png?cb=493db6a0b884588c512d3b8cd06c72ed) Box will verify that your new app has been created. On this verification screen, click the 'View Your App' button ![image-20220317-172652.png](https://docs.gimmal.com/__attachments/a_c9c2096e1e81b7d8f318a2ee52b41c2dd49b7306b663609dc9ae94e101074995/image-20220317-172652.png?cb=33699311296e19987cefd2a8ed8be45a) Once on the app configuration page, select the 'General' option in the left-hand navigation pane, then apply the settings detailed below: ![image-20220317-172707.png](https://docs.gimmal.com/__attachments/a_41b9059aa735fbce30390d1e914e49de2f40ccdb8716d78376ddf9fcf473ae8c/image-20220317-172707.png?cb=60fa8187f144080745cbdae9c7c5520d) In the App Authorization section, Click on the 'Review and Submit' button. Review App Authorization Submission -- add a description of the App being requested, and then click the 'Submit' button. This will email the Admin account an approval link required to activate the app. ![image-20220317-172809.png](https://docs.gimmal.com/__attachments/a_401be5495291aaa1bb2a45314da1eb8249c08b6e461184919f2cf88015d4b4b5/image-20220317-172809.png?cb=7606124d19794425e9693aba9e8d1c53) Next, click on the 'Configuration' link in the left-hand navigation pane. Then scroll down to the following sections: Application Access: Click the 'Enterprise' radio button Application Scopes: Click ++ALL++ checkboxes ![image-20220317-172927.png](https://docs.gimmal.com/__attachments/a_f1c699849b6f5fc7118c9216f14589e9a4f4f90fe405025180de6cddaca02199/image-20220317-172927.png?cb=4701b083d143d42c1e1040e3ec370e02) Advanced Features: Enable both options Add and Manage Public Keys: Click the 'Generate a Public/Private Keypair', this will send a 2-step verification code to the cell phone number provided in section one (also a JSON file will be downloaded to the local machine) ![image-20220317-173034.png](https://docs.gimmal.com/__attachments/a_fcef3b81ecc24ba2ff9c4d9e5cf058bc057b67783519a810bc3e926fcdc8038b/image-20220317-173034.png?cb=6a52680e6f3221ce86aca31a553f9079) **CORS Domains**: Enter '[http://localhost:3333](http://localhost:3333/)' into the text field ![image-20220317-173051.png](https://docs.gimmal.com/__attachments/a_9b6d19dc6cd1f190542797b99a0de8cb61b09262cf993ad6778a71f2902e7232/image-20220317-173051.png?cb=163262857f8a8369a975b97a98a0c586) Click the 'Save Changes' button found in the ++upper right-hand++ corner to save these configuration settings. ![image-20220317-173110.png](https://docs.gimmal.com/__attachments/a_a45a13f8625340550732addb0d8774e1164442dd3a2f9c539066d2638731ba5a/image-20220317-173110.png?cb=59fcda9a46d89c4f28aac97e58deb300) ## Section Three -- Installing the Discover Box Agent NOTE: Install the Box Agent through the Add Agent List option in the Agents List page of the Discover dashboard (outlined below). You may also install the Box Agent when initially installing the Connector and Agents using the Connector Setup program downloaded from the Download Center of the Discover console. **Discover** **Box Agent Installation:** The Box Agent for Discover can be installed from the web dashboard by following the steps outlined below. 1. Go to the 'Administration' tab at the top of the dashboard. In the left-hand navigation pane, click on 'Configuration', then 'Connectors'. * Choose the connector device by checking the appropriate box. * Click on the More button and choose 'Agent List'. ![image-20250409-183007.png](https://docs.gimmal.com/__attachments/a_37892e97fab7c08584f2cd8dd2ed030bd0fc6c7cba5d90abcb4f8b665682d3d1/image-20250409-183007.png?cb=b2f9985a52dc8947f64e1a68333b24d2) Click on the Action button, then select 'Add Agent'. ![image-20250409-183134.png](https://docs.gimmal.com/__attachments/a_24019ea8dc5f7b7cfef31f8190a9336fe8f627f55fe36d0da7db15f44ed80aa9/image-20250409-183134.png?cb=151ec0eca2bda0c047fe12f8d857b3a5) Select the 'Box Agent Service'. ![image-20220317-173515.png](https://docs.gimmal.com/__attachments/a_1c71266cf5cc009201cc0a49edc75b7a65aa102883d5a97e7d27f48805f76cff/image-20220317-173515.png?cb=91a651971647215aeca3cff25d8ac223) Next click on the 'Box Settings' tab. Use the 'Choose File' button to locate the Box JSON file. Importing the JSON file should populate the remainder of the fields shown on the Add Agent screen below: ![Screenshot 2024-11-08 112314.png](https://docs.gimmal.com/__attachments/a_2e85d7c6fb081fa9ae012eb36cfc708c59641ae087a04aeb32cf514161ac6853/Screenshot%202024-11-08%20112314.png?cb=ea12fc849b2cce27308f047183127a72) Then click the 'Add' button to begin the Agent installation. There are two ways to speed up the installation of the agent. On the Connector server either: * Shutdown and restart the Gimmal Connector service, or * Open the Gimmal Connector Status tool and click the 'phone home' button shown below. Note, if you need to change or update the Box Agent credential settings after the Agent is installed, that may be done by clicking on the ++Credentials++hyperlink in the Connector Status tool. ![image-20220317-173621.png](https://docs.gimmal.com/__attachments/a_37ae39dc25c478e32a7d40d81fbfddfd5c09267bb520001b4f3359f26ae2c484/image-20220317-173621.png?cb=ec83ae9bc1dc1a2b509b54b274d96328) After the Box Agent service has been installed, proceed with adding a Data Target search for Data Owners (using the Box Accounts option) and for Box File Paths. Important: When adding the Data Target searches, the order matters. Ensure that you create a Data Owners search first, then run that search to add the Box owner accounts. Once those are available in the Discover dashboard, create and run an AD Data target search for Box File Paths. For more information on building Data Target searches, please refer to this: [Searching for Data Targets](https://docs.gimmal.com/alt/data-target-searches.md) --- language: "en" --- # Classification Discover Classification is designed to help you organize your electronic content into defined categories by applying labels as metadata elements. These labels can then be used to easily manage information throughout its lifecycle. Select one of the following topics to learn more: * [Summary](https://docs.gimmal.com/alt/summary.md) * [Labels](https://docs.gimmal.com/alt/labels.md) * [Assets](https://docs.gimmal.com/alt/assets.md) * [Classification Workflows](https://docs.gimmal.com/alt/classification-workflows.md) * [Classification Policies](https://docs.gimmal.com/alt/classification-policies.md) * [Results](https://docs.gimmal.com/alt/results.md) * [Exceptions](https://docs.gimmal.com/alt/exceptions.md) * [Audit](https://docs.gimmal.com/alt/audit.md) --- language: "en" --- # Classification & Connector Settings ## Classification Settings ![image-20251015-210619.png](https://docs.gimmal.com/__attachments/a_00dd9b3c6de5b523082692228d74ce3f9a3189c0c082bc579106ab60a2c6069b/image-20251015-210619.png?cb=01a919f5d105b66d27b5785358b59178) Options on the Classification page are described in detail below. ### Classification Labels Discover allows users to establish a set of Classification labels that can be applied to designate how a content item is to be categorized. These labels may indicate a privacy level (i.e., personal, private, public, confidential, etc.) or they may reflect a records classification taxonomy (for more information on how Discover Classification labels interface with Gimmal Records, refer to this [link](https://docs.gimmal.com/alt/integrating-with-gimmal-records-management)). This settings page allows administrators to add, edit, or delete a Classification label. Labels may then be applied as a metadata element to content items through the use of workflows and policies in the Classification module of Discover. ![image-20251015-210850.png](https://docs.gimmal.com/__attachments/a_164abb77e1569d348b3966e331ee81044bbca42caabd34dfcad6d7c0f2043c69/image-20251015-210850.png?cb=cd4eab89859f03a2275057549c2364c8) In addition to labels, there are two other options on this page: * A timeout value that can be applied to the change/remove label process. This setting is particularly useful when the content items are resident on a workstation that may be offline for an extended period of time. * Reset the last modification date of a file after applying a Classification label. This prevents the Classification process from permanently changing a file's last modified date. ## Connector Page ![image-20251015-210928.png](https://docs.gimmal.com/__attachments/a_49ee8d3ef31781a02b699ff3a168d81d62455ec675ba1b38dad511933859c403/image-20251015-210928.png?cb=2d20397a623bb5fb9c0121bef12d1f34) ### Global Connector Options * Connectors unresponsive for: Discover Connectors report to the cloud on a scheduled basis. This (optional)setting determines how many days without a check-in should occur before a Connector's status is set to inactive. * Enable deletion of inactive Connectors: If this setting is checked and a corresponding number of days is specified, inactive Connectors will automatically be removed from the database * New Connector delays: When a new Connector service is added to the database, this setting will automatically prevent it from processing any selected activities for a specified number of hours. There are delay settings for policies, eDiscovery searches, and Analytics. * Allow auto updates of Connectors: When new versions of the Connector software (or Agents that the Connector is managing) become available, this setting determines if the updates should be installed automatically. If automatic updating is specified, administrators can determine if those updates occur immediately or after a specified number of days. ### Connector Categories * When a Connector service is installed, it can be assigned to a category. This page allows administrators to add, edit, or delete a category. When clients have a large number of Connectors, the category can be useful in organizing or sorting the list. ### Custom Data Source Properties * This option allows administrators to define new custom properties that can be added to an item on a SharePoint site. Note: This setting is currently only supported for SharePoint As a reminder, if you modify any of these settings described in this document, do not forget to click the Save button at the bottom of the page to preserve your selections. --- language: "en" --- # Classification Guide ## Classification Overview Gimmal Discover Classification provides a way to organize data-at-rest so it can effectively be used to drive business processes, enforce retention guidelines, and streamline eDiscovery. Customers can get started with the Classification process by completing three easy steps. ![worddavec743693ff345d32b171f469e87906c8.png](https://docs.gimmal.com/__attachments/a_1ab533c560e6f580735a948f595bdc29b2d260c36a3016326b1c53f3490da99d/worddavec743693ff345d32b171f469e87906c8.png?cb=ec743693ff345d32b171f469e87906c8) * **Define Classification Labels**. Labels allow organizations to assign a category to their unstructured information based on their individually tailored definitions. These categories may include Confidential, Public, Contracts, etc. * **Apply Classification Criteria**. Depending on a company's classification scheme, at-rest data is then examined by a workflow process where a label is automatically attached. For example, items with social security numbers may be labeled "Confidential," while those that contain purchase order patterns are labeled as "Contracts," and so on. * **Manage or Search Based on Classification**. After successfully applying Classification labels, an organization may use them to enforce its compliance requirements by automatically deleting outdated content, enforcing retention policies, or performing eDiscovery searches. The Classification landing page provides a graphical overview of your labeled content. The pie chart at the top of the page reflects the percentage of content marked with each classification label you have defined. The accompanying table provides a count of the labeled results for each content source (email, files, and social). Below this row, there is a separate pie chart for each of the source content types. These charts reflect the percentage of results labeled with that content type. ![image-20250409-183734.png](https://docs.gimmal.com/__attachments/a_af2fbaca7971bb2c6edb9d327f26c72caaf24c98463d6d7c1d138b8da116eb46/image-20250409-183734.png?cb=170477b49fc2c5a2a3d890994094dc43) Classification Overview ### Labels Gimmal Discover classification works by adding labels as extended metadata properties to each content type (email, files, SharePoint, etc.) so those items can be tracked and managed in aggregate. Clicking the Labels link in the left-hand navigation pane will allow you to manage classification labels. Gimmal Discover ships with the pre-defined classification labels: confidential, public, private, and No Classification. Any of these pre-defined labels may be removed except No Classification, which is a system-provided category reserved for marking content that will always be exempt from classification processing. You may also add your classification labels by hovering over the Action button and clicking Add. Once a classification policy has been run, this view also provides a sum of the total of items that carry a specific label, along with a count of the classified items in each category (email, files, or social). ![image-20250409-184106.png](https://docs.gimmal.com/__attachments/a_7a8c94eefe8ca542bb530d69d7bb46f99334157b2a95ba2993f69c80f836f2de/image-20250409-184106.png?cb=70dbd224b9974ea5536452db1628297a) Adding Classification Labels If you have previously classified content, you may also select a label on this page, then hover over the More button and click one of the categories (files, email, social) to load a detailed grid view of the items from that category that have been classified. For example, selecting the Confidential label and then clicking More/Email Results will display a list of all email items currently classified as Confidential. ### Assets The Assets view of Classification provides a view of all the locations where information containing Gimmal Discover classification tags resides. These locations may include: file servers, desktops, Exchange servers, SharePoint sites, or Google (Gmail or GDrive). After selecting an Asset, you may hover over the green More button to drill into more detail about your classified information by selecting: * Show Targets - for example, show each folder on a network file share that has classified information * Classified Items -- for example, show each file on a network file share that has classified information * Owner Results -- show every classified item that is associated with a data owner ![image-20250409-184251.png](https://docs.gimmal.com/__attachments/a_9be6f93e8c0f9ca4f00365a6257d916ceb7bef8386e2ff213a7c76e506a3bbcf/image-20250409-184251.png?cb=157378e83643b7cc36a6f6177e3552b9) Classification Asset List ### Workflows Classification workflows are where the business rules for classifying information are defined. Gimmal Discover provides one pre-built classification workflow template for each content type (files, emails, SharePoint, etc.). These templates may be accessed through the Workflow Editor application and modified to accommodate your specific business rules. For example, files containing a Social Security number pattern could be classified as confidential. Since there can only be one Classification workflow per content type, it's important to clearly define the various criteria that should be evaluated to assign the proper classification category. The example below shows files being examined for specific keyword terms, and matching items being labeled as "Confidential". ![Screenshot 2025-04-09 145344.png](https://docs.gimmal.com/__attachments/a_bc217dec78753d608ca9ce334580435e0d234e60fbebc76aeef0fa35bcdf0f4f/Screenshot%202025-04-09%20145344.png?cb=48e3d6d13b64c5f8a02df89c938ee058) Example Classification Workflow ### Policies After editing workflows, they must be attached to a policy to perform the classification. During this step, you designate what Gimmal Discover data targets the classification should be applied to. The new policy creation screen is very similar to the one found in Data Governance. First, provide the new policy a name, then select the workflow from the drop-down list and specify whether full-text should be retrieved for the items being classified. There is one notable difference in a classification policy: the option to 're-classify' previously classified items. By default, Gimmal Discover will skip an item that already carries a classification label. Checking this box will instruct Gimmal Discover to examine all data targets and change the classification label if applicable. ![Screenshot 2025-04-09 151342.png](https://docs.gimmal.com/__attachments/a_6ade66f7d36a7c6e56e70fb838c7118447d949efdcec65318654de13954fe33a/Screenshot%202025-04-09%20151342.png?cb=8dc872a2897600e296e7a88f3597aeb6) Classification Policy Just as in Data Governance, the next step is to assign data targets. Policy data targets may include specific devices, users, groups from Active Directory, or targets (i.e. file shares, SharePoint sites, etc.) not associated with a data owner. Finally, like Data Governance policies, the Classification version may be configured to run automatically on a scheduled basis or set to run on demand. ### Results The Results view in Classification provides a master list of all classified content. Any item tagged with a classification label will be displayed in this list. ![image-20250409-191703.png](https://docs.gimmal.com/__attachments/a_743574fe1f81a60e4e74da575d4a8ff3acbdf8b553010e68680312a7fb9c1c68/image-20250409-191703.png?cb=66e37c9e59a1a3f097ba1eb96bf45f93) Classification Results List Like other grid displays in the Gimmal Discover dashboard, each column may be sorted in ascending or descending order by clicking the column header. You may also click on the ellipses (three dots) symbol in any grid column header in order to see additional filter options. There are other options available from the Results view to help you manage classified content. If you select one or more classified items, then hover over the Action button, the additional actions available are: * Change or Remove classification labels * View the pending list of changes or remove tasks that are queued * Submit the pending change or remove requests for processing ### Exceptions The exceptions view will provide a detailed list of any content source where the classification process failed. From this view, you may also select a specific source and attempt to change or remove its classification. ### Audit The audit view provides a complete record of any classification activity that has occurred. This may include policy runs, changing a classification, or removing a classification label. You may select any entry on the Audit view to see more detail about what occurred during that process by clicking on the checkbox to the left of the appropriate entry, hovering over the Action button, and clicking on "Classification Policy Execution" ![image-20250409-191949.png](https://docs.gimmal.com/__attachments/a_490dbaf7fce72ff1b0c21855092458c175cdec8e81290c826310281fb5a7bcb2/image-20250409-191949.png?cb=9a31b071adb392f89efcb86e5ad3cffd) Classification Audit List ## Using Classification in Data Governance Classification labels are available as additional decision criteria for each content type and can be evaluated within a Data Governance workflow just like any other meta-data property: ![worddavbcf1382711c96c1ace7d74dcbb1a3e4d.png](https://docs.gimmal.com/__attachments/a_901025f601f5dc01a246067ccb98b2aab11b624d06ffdd8750d2f731dfd1eddb/worddavbcf1382711c96c1ace7d74dcbb1a3e4d.png?cb=bcf1382711c96c1ace7d74dcbb1a3e4d) By combining a classification test with other decisions (i.e., age, date, content), it is very easy to apply retention rules to a content source. For example, delete any confidential file older than 7 years. ![Screenshot 2025-04-09 153317.png](https://docs.gimmal.com/__attachments/a_18574c2b9c6912bf8619f1f9586b383215a81e23313eb39ed4b730bc7fca72ad/Screenshot%202025-04-09%20153317.png?cb=ce4cdd660c66fe5262d63eb579619665) Testing a File Classification Label in a Governance Workflow ## Using Classification in eDiscovery Classification labels appear as another criteria option when building an eDiscovery search. The screen capture below shows the 'Select Criteria' screen displayed when creating a new search. Checking the box 'Classification Criteria' will open the list of available classification labels that may be selected. You can click on a single label to select it or hold down the Ctrl key and click multiple items to add more than one label to your search. ![image-20250409-194016.png](https://docs.gimmal.com/__attachments/a_2f62caec1f9a462aa95289ba8628d59ec83a6574d7f1d0375ba45dac0cbf3a68/image-20250409-194016.png?cb=505ff19f8fd1dde1e2fb60c1f2867e5f) Classification Criteria in eDiscovery ## Appendix A - File Classification Metadata When Discovery applies a classification label to a file, that information is stored in the alternate data stream (ADS). As shown in the PowerShell screen capture below, the name of the ADS created by Discover is dtSearchXML-x-sherpa. Within that ADS entry, there will be a property called x-sherpa-classifytag which contains the label. To view the label, issue the command shown below in PowerShell (replace FILENAME with the actual name of the file within the quotes). Get-content -Path "FILENAME" -Stream dtSearchXML-x-sherpa In the example shown below, PowerShell confirms that the classification tag Confidential has been applied to the file. ![DiscoverClassification_ADS_Property.png](https://docs.gimmal.com/__attachments/a_0bc2e6a7fb77b3a426b1593313f7eb7a404bb5a6efb7fb96b437ea641b0e0657/DiscoverClassification_ADS_Property.png?cb=13f85f1aaf779b7fafe00b1ee2c75f76) --- language: "en" --- # Classification Policies Like Data Governance workflows and policies, in order for a classification policy to execute, it must be added to a policy. Policies belong to the user who created them and will not be visible to other users unless they are shared. *** ** * ** *** ## Viewing policies Navigate to Classification, then select Policies to view the list of policies you have created. The toolbar has the following options: * **Common** * **Select All** - Select all policies * **Clear All** - Clear selection of all policies * **Reset Grid -**Reset the view back to the default, such as all columns being viewable * **Export to CSV -** Export the list of policies to a CSV file * **Refresh Grid** - Reload the view showing any changes * **Action** * **Add** - Add a new policy * **Edit** - Edit the selected policy * **Delete** - Delete the selected policy * **Start Policy -**Start the selected policy * **Stop Policy -** Stop the selected policy if it is running * **Request Logs -**Queues a request to the agent to forward the partial log file of any policy that is running ![image-20250328-202133.png](https://docs.gimmal.com/__attachments/a_8845955779cc137a796be3536ca327184133208c067117a577a5fd33c370bb71/image-20250328-202133.png?cb=9c5ad5ead8c1619cd00d7d45583ba48f) Classification Policies ## Create a Policy 1. To create a new policy, hover the Action button and select Add. 2. Complete the fields displayed: * **Name** - A user-assigned name for the policy. The value defaults to "New Policy," so you'll want to give it a more descriptive name * **Workflow** - Select a workflow from the drop-down menu. Workflows define the core functionality of a policy. These are constructed either by using the wizard on the web or by using the Workflow Builder. Each data source type only has one workflow associated with it. * **Schedule Time Zone** - This option allows you to choose the time zone where this policy will be applied. It will be used in conjunction with the scheduled time of the policy to kick off at the appropriate time in the selected time zone. This field defaults to the time zone setting for the current user in Discover. If a time zone default is not set, the application will default to UTC. * **Process results after policy completes** - if a workflow timeout has caused the policy to end in the data center, accept late reporting results from agents * **Retrieve Full Text** - if the policy generates a report, export the text of the report items and store in the cloud * **Reclassify previously classified items** - if items that have already been classified are encountered, they will be reclassified ![image-20220316-193310.png](https://docs.gimmal.com/__attachments/a_6b128062abde9472eb54a37f59a8fa460c7f3c75667b7d063e68e888830612c3/image-20220316-193310.png?cb=02f8bb4ebb1b2e72d78e60d9a6ab0359) Select Next to add Data Targets 1. Hover the Action button and select an option * **Add Members**- Allows you to add devices, owners, or groups as data targets * **Add Non-Owned Targets** - Allows you to add a non-owned data target for any source * **Delete**- Delete the selected targets Select Next to create schedules 1. Hover the Action button and select an option * **Activate Schedule** - Activate the selected schedule * **Deactivate Schedule**- Deactivate the selected schedule * **Add -**Add a new schedule * **Edit**- Edit an existing schedule * **Delete** - Delete the selected schedules Select Create to save the policy --- language: "en" --- # Classification Workflows The [Workflow Builder](https://confluence.gimmal.com/display/ALT/Workflow+Builder) application contains a classification template for each data source type supported. These workflows are used to test for different criteria then apply a label corresponding to the result of that test. There can only be a single classification workflow for each data source type. All classification rules must be represented in this single workflow. There are two options for each workflow available: * **View Workflow** - Opens a view of the workflow * **View Classification Policies** - View the classification policies associated with the workflow --- language: "en" --- # Classifying SharePoint Items in Gimmal Records It can be difficult to organize and manage the content contained in network file shares or SharePoint. This process becomes critically important if the content item should be tracked as part of the corporate records strategy. Fortunately, Gimmal Discover and Gimmal Records can help. Using the Classification module of Gimmal Discover, content items can be labeled as belonging to a particular record category. This label is attached to a content item as extended meta-data that can then be used in Gimmal Records to attach the content item to a record plan and manage it throughout its lifecycle. ## Creating the custom column in SharePoint The first step in the process is to make sure the correct meta-data placeholder has been added to the SharePoint sites, here is how that can be accomplished: * Ensure the Classification module is provisioned for the client's tenant site in the Discover Administration portal (typically this would be done by the Gimmal DevOps team) * Install the Discover SharePoint agent in the tenant environment * Create a [Data Target Search](https://docs.gimmal.com/alt/data-target-searches.md) for each of the SharePoint sites (on-premises or online) that will be classified with Discover When the Data Target search is processed, it will automatically add a custom column called xSherpaClassifyTag to each of the lists in all SharePoint managed sites as shown below ![image-20220714-202044.png](https://docs.gimmal.com/__attachments/a_3d1352f31f2ac106909a706a8619c5600ed77c3a3300b6b9031a3016e961f624/image-20220714-202044.png?cb=37c127038e1e31b1922b20c57755bcc0) ## Classifying the SharePoint Documents Now that the metadata tag has been created, it can be populated with a value by the Gimmal Discover Classification module using these steps: * Log in to the Discover dashboard, select the Classification module at the top of the dashboard then select the Label option in the left-hand navigation pane. Create the [labels](https://docs.gimmal.com/alt/labels.md) that will be used to classify content (i.e., accounting, legal, confidential, etc.) * Using the Discover Workflow Builder application, edit the pre-defined Discover SharePoint Classification Workflow and configure the appropriate criteria to identify and classify SharePoint documents * Log in to the Discover dashboard, navigate to the Classification module, and create a Classification policy using the SharePoint Classification workflow and targeted at the relevant sites The Discover policy will navigate the lists within the target sites and set the xSherpaClassifyTag column to the appropriate classification values on each of the documents that meet the criteria defined in the workflow ![image-20220714-202534.png](https://docs.gimmal.com/__attachments/a_4b42ed6ba8f9a54ec6eba0cc3502c69f6c14de6786831f2c3a4452d2c712968b/image-20220714-202534.png?cb=ec45b76b670478dc9d2f5a7f73ae5001) ## Setting up a File Plan in Gimmal Records for Classified Documents * Login to the Gimmal Records tenant and force a crawl of the Sharepoint site(s) that has been classified * The classified documents should now include the xSherpaClassifyTag property with the associated classification value ![image-20220714-202642.png](https://docs.gimmal.com/__attachments/a_56737c9233b7d78c1387f9c61870aad6189f832cb5fc2705791526ff597b6a37/image-20220714-202642.png?cb=7568ebaac09dcfcd25b37a9703877368) * In the Plan section of Gimmal Records, you can now create a Classification Rule using the xSherpaClassification tag property to set up the necessary retention and disposition schedule ![image-20220714-202707.png](https://docs.gimmal.com/__attachments/a_6a60c26d2f242dc21327c313665123ae27005123b076ba20a0ddd9ac011b2d0c/image-20220714-202707.png?cb=b46e2aece66afabd9313c57139960bd4) More information about the Gimmal Discover Classification module can be found at this link: [Classification Module](https://docs.gimmal.com/alt/classification) --- language: "en" --- # Connectors Discover Connector/Agent components may be used to manage content located on network resources (i.e., Exchange servers/network file shares) or individual user workstations. When managing network resources, these components are typically installed on one or more virtual application servers. Each application server may support multiple Agents; however, each installation is a bit different, and (depending upon the volume of information) your environment may require more than one application server to distribute workloads. Gimmal typically recommends starting with one virtual application server and scaling to additional server installations if load balancing is required to complete Discover processes in a timely fashion. ## Application Server installation To manage network resources, we recommend installing Discover components on a virtual application server that meets, or exceeds, the following requirements: * Operating System: Windows Server 2012, 2016, 2019, or 2022. Gimmal recommends installing Discover components on a 64-bit operating system, if you plan to use the SharePoint Agent this is a requirement * Minimum of 8GB RAM allocated (16 recommended) * Minimum of 1GB of free disk space (note, installation requires much less but certain Discover processes like eDiscovery searches may require working space) * NOTE: If you plan to use indexing with the Discover File Agent, system requirements may vary. Please refer to the [Indexing Guide](https://docs.gimmal.com/alt/indexing_guide.md) for more details. * A service account with administrative privileges on the application server. Each Discover Agent may have unique credentials, so it is not necessary to have a single account with permissions to all content that will be managed. * Microsoft .NET Framework version 4.8 or above If you plan to use Discover to manage on-premises Microsoft Exchange 2010, 2013, or PST content, a version of Microsoft Outlook. This software must be installed on the application server to supply the Microsoft MAPI components. After installing Outlook login to the server using your Discover service account credentials, launch the application, and create a valid Outlook profile that can access one of your mailboxes or PST files (this profile will be required when installing the Agent) ## Desktop Installation * Operating System: Windows 10, or Windows 11 * Minimum of 4GB RAM allocated * Minimum of 1GB of free disk space (note, installation requires much less but certain Discover processes like eDiscovery searches may require working space) * Microsoft .NET Framework version 4.8 or above * Gimmal recommends installing Discover desktop components under the Windows Local System authority. If you do not wish to use Local System then a service account with administrative privileges on the workstation and sufficient rights to access the content you intend to manage (i.e. access to the PST files you plan to search) will be required. If you plan to manage PST files on the workstation a version of Microsoft Outlook (2013 or 2016 recommended) must be installed on the desktop to supply the Microsoft MAPI components. To continue, select one of the following topics: ## [Deploying a Connector](https://docs.gimmal.com/alt/deploying-a-connector.md) ## [Monitoring the Connector](https://docs.gimmal.com/alt/monitoring-the-connector.md) ## [Agents](https://docs.gimmal.com/alt/agents.md) --- language: "en" --- # Custodians The Custodians button found in the left-hand pane of the eDiscovery module provides a master custodian list showing all custodians across all the matters managed through Gimmal Discover. ![image-20250328-201210.png](https://docs.gimmal.com/__attachments/a_9e60614c53a32d11b5bd54b036e4f1f72729c853a4f0738046aaa1c3f975a2df/image-20250328-201210.png?cb=27f7b36e1751f5927a50a570314ac601) The details displayed on the Custodian's screen are: * Name - The name of the custodian * Matters - The number of matters the custodian has been assigned to; clicking the count will display the list of those matters. Please note that this count is limited to the matters you have access to. * Holds - The number of matters for which the custodian has been put on hold; clicking the number will list the holds assigned to the custodian. * Expected Release Date - If the holds that this custodian has been assigned to have a close date, this column will display the latest of those dates. If any of the holds do not have a Close Date identified, this value will remain blank. * Suspension Start Date -- If a custodian has been suspended from a matter, the date the suspension began * Suspension End Date - If a custodian has been suspended from a matter, the date of suspension will end The Action button in the toolbar provides options to temporarily remove a custodian from a matter (and associated hold notices) or remove the suspension. The More button on the toolbar provides options to generate a custodian report or filter the custodian list to show active (open) matters or show active holds only. --- language: "en" --- # Dashboards Combining individual [Standard Reports](https://confluence.gimmal.com/display/ALT/.Standard+Reports+v2021-04) created through the Discover Analysis Reports, you can create one or more dashboards to more conveniently view the latest results of the data analysis. You may also choose a default dashboard that can be configured to be viewed on the Discover home page when you log in. Dashboards you create are exclusive to your account; other Discover users in your organization will not have access to your dashboards. *** ** * ** *** The Dashboard page, accessed by selecting the Analysis module and then the Dashboard option on the left side navigation, will allow you to create a new dashboard, edit the reports displayed in an existing dashboard, delete a dashboard, and set that particular dashboard as your default Discover home page. ![image-20250328-204751.png](https://docs.gimmal.com/__attachments/a_03d72bce05c4d29636feec53a8e1a919dd6a193e3939a9945cfcb321dd6c89a2/image-20250328-204751.png?cb=07951970fab7edfe30234f7e4e22ec89) *** ** * ** *** ## Add a New Dashboard Hover the Action button, and select Add to create new dashboard. ![image-20250328-205614.png](https://docs.gimmal.com/__attachments/a_c19c46f0f07f28daa873f300e6f8a46144fa106ae63917753863ef8678b7454b/image-20250328-205614.png?cb=0d5216b1d0b8e2e85d4c4e51c07318e9) Give the dashboard a name and check the [Standard Reports](https://confluence.gimmal.com/display/ALT/.Standard+Reports+v2021-04) you would like to add to the dashboard. Once saved, click on the dashboard in the dropdown list to view the dashboard. The reports displayed will show the details from the most recent completed analysis of the data collected from your environment. *** ** * ** *** ## Edit/Delete Dashboard Hover the Action button and select Edit or Delete. *** ** * ** *** ## Add Dashboard to the Discover Home Screen To replace the default Discover dashboard with a custom one you have created, select the gear icon at the top right corner of the Discover dashboard and select Settings. On the General settings tab, change the value of the 'Set Home Page' option from Default Dashboard to one of the custom dashboards you have created. ![image-20250328-205313.png](https://docs.gimmal.com/__attachments/a_4c7a5db72dc09bd52cf106415c5f0680d2ac50b842e554ea30292fa3ca27a06f/image-20250328-205313.png?cb=cb493b0c7ab31193c6d3d7ca206c8715) --- language: "en" --- # Data Governance Data Governance policies may be used to manage the data targets (mailboxes, SharePoint content, file shares, etc.) that are linked to Discover. These policies can be configured to support a wide variety of business processes, from discovering sensitive information to enforcing retention criteria. Policies are made up of: * A workflow - which determines the actions that will be taken * Data Targets -- either people, devices, or groups (Discover offers several grouping mechanisms) * An optional schedule - Policies may be run on-demand, or they may be configured to run regularly according to a schedule From an operational perspective, when a policy is started (either manually or via schedule) it results in a request being queued for each Connector. Each Connector periodically polls Discover to determine if there is a database request pending for one of the Agents that it manages; it is important to note that the Connector is responsible for initiating all communications with the cloud. Initiating communications from the Connector minimizes the need for custom firewall settings and helps alleviate concerns over possible tampering with a communication session. When a Connector check-in occurs and there is a policy waiting for one of its Agents, the policy manifest is downloaded for local execution. The agent then attaches to the designated managed target (e.g., mailbox), applies the business logic outlined in the policy workflow, and forwards appropriate results (reports, log files, etc.) back to the Connector, which in turn transfers that information back to the hosted environment. After all of the Agents assigned to a policy have either reported in or exceeded a timeout period, the policy is marked as complete, and the log files are transferred from the Connectors to the Discover dashboard, providing a complete audit trail. You can learn more about the components of Discover's Data Governance module by clicking on any of the following links: * [Workflows](https://docs.gimmal.com/alt/workflows.md) * [Policy](https://docs.gimmal.com/alt/policy.md) * [Policy Templates](https://docs.gimmal.com/alt/policy-templates.md) * [Reports](https://docs.gimmal.com/alt/reports.md) *** ** * ** *** ## Workflows Discover policies utilize workflows to map out the sequence of steps that will take place when a policy is executed. Workflows are developed using either the simplified web editor or a desktop application called the Workflow Editor which is available from the Discover download center. This editor provides a flowchart-like interface for designing complex workflows. The diagram below shows the web view of a workflow that is designed to create an inventory report of files exceeding 5 MB in size. ![image-20220315-154927.png](https://docs.gimmal.com/__attachments/a_ddfa78d8c365b3496cbc3f41e82aea4de4781bf0b9d046b95227b38c0a4fbb20/image-20220315-154927.png?cb=18237f1a4009a74d24adaae522eae6bf) Discover Workflow Example - creating a file inventory report The Workflow Editor communicates with the Discover dashboard, allowing authorized users to save workflows to the hosted site or download workflows created in the web editor for additional edits. Once a workflow has been saved to the dashboard, it becomes available for a policy to use. *** ** * ** *** ## Policies A policy provides the implementation package for each Discover workflow. When creating a [policy](https://docs.gimmal.com/alt/policy.md), clients provide instructions on how the workflow should be executed (for example run in live or test mode), what data targets the workflow should process (i.e. workstations, mailboxes, file shares, etc.) and whether the policy should be triggered automatically on a scheduled basis. --- language: "en" --- # Data Owner Retention Guide ## Overview Data Owner Retention is a feature that becomes available when a Discover customer has the 'advanced policy' option added to their provisioning. It allows administrators to define a set of labels that data owners can apply to their content items on a Discover report. These labels can then be used to power a disposition process. For example, data owners could apply a "delete" label to items that are no longer useful to them, and that label could be tested in a Discover Data Governance workflow to trigger the delete action. This guide is divided into three sections: configuration, Data Owner interaction, and administration. ## Configuration ### Defining Labels Typically, the first step in configuring Data Owner retention is to define the labels that your team will use to mark their content with. This can be done in the settings area of Discover. Click the gear icon in the upper right-hand of the dashboard, select Settings, then open the tab labeled Policy. On this page, you can use the Action button to add new labels. Once a Data Owner attaches one of these labels to a report item, that label can be used within a workflow to trigger a specific action (i.e., deleting a file). ![Screenshot (63).png](https://docs.gimmal.com/__attachments/a_4e23cbdd1cbddf2c51dccad16211c31d8d943a3a3851866d2b5c2dc0081c29f3/Screenshot%20(63).png?cb=d56bf798170cbcdb78ab3860ad149004) ### Single Sign-On To access the portal where Data Owners review and label their content, Discover requires that single sign-on (SSO) be configured. If your SSO provider is Microsoft Azure, the screen capture below shows the portal configuration settings: ![worddav4b9e94cedad4d39d06cc54d607e7d00b.png](https://docs.gimmal.com/__attachments/a_3e1c7823a01fdbc8ad4880c22bfaccd6393e137987722c47f8bcd2f79dfa2835/worddav4b9e94cedad4d39d06cc54d607e7d00b.png?cb=4b9e94cedad4d39d06cc54d607e7d00b) Please note that some browsers disable third-party cookies by default. One of the consequences of this is that applications that rely on third-party services for authentication may stop working reliably. This occurs because the session ID of the web session the browser has with the application, typically stored in a cookie, is lost in the transaction with the third-party provider (Azure or Entra in this case). Discover has implemented mechanisms to allow third-party cookies for this scenario, but if SSO is not reliably working from a Discover login, one possible issue is that the session cookie may be being cleared. After establishing the SSO provider settings, the Discover SSO options may be entered on the Single Sign-On tab in the settings area. For more information on configuring single sign-on, refer to the [SSO Technical Document](https://docs.gimmal.com/alt/sso-configuration-using-azure-ad.md) ### User Retention Settings The final configuration step takes place on the User Retention page. This page contains several sections where specifics about the Data Owners may be configured. ![Screenshot (64).png](https://docs.gimmal.com/__attachments/a_17d682698992f91461401813d92edddc7464c074c14b023ede4fee3753ecad26/Screenshot%20(64).png?cb=eadd37c7dc12a1281e630d2946fe8d54) **Enabling User Retentio**n -- This section contains a check box that enables the data owner retention feature. Along with that setting, you can configure an email action to take place when all owners have completed the review of their content, and to bypass that notification if a particular user has expired. **Email Message Configurations**-- This area allows you to define the characteristics for a series of email notices the Data Owner will receive, including sender (address \& name), CC, BCC, Subject, Body, and branding graphics. The areas for Subject and Body allow for rich text (photos, links) and also support the use of Discover tokens to supply information such as the report name, number of active days for review, etc. IMPORTANT: When adding email configurations, be sure to define at least one with the type "Default". The Default message will be the first email triggered when a data owner report is run. After the Default email has been sent, subsequent reminders may be defined based on a frequency that you specify. **Owner Report Instructions** --This area allows you to provide instructions that a data owner will see when they review their report items. This text typically details how the various labels available to the data owner will affect an item that they mark. **Enabling Owner Activity Limit** s -- Checking this box allows administrators to specify how long each Data Owner's report will remain active. Specify the number of days and, optionally, a reminder frequency (this option generates an email reminder to each Data Owner that they have pending items to review). When a report passes the Active Period specified on this screen, each item that a Data Owner has not labeled will automatically receive the Default Label you specify here. *** ** * ** *** ## Data Owner Interaction ### Enabling Notifications in Workflows To notify Data Owners they have pending items to review, two options must be set in the Save List area of a workflow (please note, Data Owner notification is not possible in workflows using a Group Values action). In the Report Details area of the Save List action, two options must be set to Yes: * **Save Report Owne**r -- adds Data Owner information to the database table for the report * **Notify Report Owner** -- triggers the automatic email notification to each Data Owner ![Screenshot 2025-04-09 163950.png](https://docs.gimmal.com/__attachments/a_1f897ebef098fca08f1953ed91f7cd362cec64ab94ad32f700664cd154302c0f/Screenshot%202025-04-09%20163950.png?cb=2c37ef2583e98804cc5de55a927b8155) Configuring Data Owner options in a Workflow ### Data Owners Email When the workflow has been configured to automatically notify Data Owners that they have items to review, they will receive a notification similar to the one shown below. That email will include a link directing them to the Discover User Portal. Clicking that link will open their default web browser, initiate an SSO login, and route them to the User Portal where they can review their content. ![worddav8b7ffd830305bed44623f74d11f20a7a.png](https://docs.gimmal.com/__attachments/a_5c577a62111e1ba0c44f76e98f9207c157ac4edf1bbaf6a6bc2e786c001313dd/worddav8b7ffd830305bed44623f74d11f20a7a.png?cb=8b7ffd830305bed44623f74d11f20a7a) ### User Portal The Discover user portal allows Data Owners to see any open reports requiring their attention, review each item, and apply one of the retention labels defined by the administrator. During the process of review, a Data Owner may use the Save button at the bottom of the screen to preserve any updates in progress, then return at a later time to complete their review. Note: the labels applied by a Data Owner during this step do not immediately take effect on the items marked. The label is attached to that item (for example, a specific file) in the Discover database. To apply the action associated with a label (for example, deleting an item), the administrator must create a workflow that will run against the report, check for the label value, and then apply the appropriate workflow action. When a Data Owner is finished reviewing their items in the portal, they click the Submit button to alert the administrator that their review is complete. ![image-20250409-204614.png](https://docs.gimmal.com/__attachments/a_48459204ad8bdbf77947526826be807ef53aa95fd58cbaac29127a78264fa8ad/image-20250409-204614.png?cb=11fc4831d7edf03b111e4371dfc0a465) Data Owner Portal View *** ** * ** *** ## Administration ### Report Status When administrators view a Discover report, three system-maintained columns are shown to help them monitor the status of the Data Owner process. * Label -- this column shows the value of any label a Data Owner has applied to the item. If the value 'No Action' indicates that the item is in its original state and has not been marked with any disposition action. * Label Status -- "New" indicates the item has not been reviewed, "Set" means the Data Owner has specifically assigned a status * Status Date -- the date an items are updated by the Data Owner ![image-20250409-204948.png](https://docs.gimmal.com/__attachments/a_b06f6b129a1d96a88139f9febc38e27e8e28a2899c12207159d21dd49aa31b03/image-20250409-204948.png?cb=58ac61a1e0749305c930d02ef8519408) ### Managing Report Progress To help administrators monitor report progress, there is a View Owner Activity option available under the More button. ![image-20250409-205353.png](https://docs.gimmal.com/__attachments/a_297fab103b519bfb038f0d3ac4df7045113fb8efdb8dc5a8b6187bf8dcd5ae0d/image-20250409-205353.png?cb=33336f390b598b65ab0779df5b90d54c) Selecting this option will display a status for each data owner with items on the report. For example, have they started reviewing their content yet? How many items have they marked? When does the report expire, etc? ![image-20250409-205506.png](https://docs.gimmal.com/__attachments/a_9c6766140850cb05aa089d0f48653a4c2c67197cfbec093ecd923abecd7e1d1d/image-20250409-205506.png?cb=d232bc77744a3452a740ac57a2e98702) ### Data Owner Interaction While in the 'View Owner Activity' view, administrators have a few tools to help them manage the Data Owner review process. After selecting a Data Owner, three options are available under the Action button: * **Send Notification** -- This option will trigger an email notification to one or more Data Owners, reminding them there is a report to review. It is useful if a Data Owner has accidentally deleted their original email notice. * **Modify Expiration Date**-- Allows administrators to extend the default expiration date, giving Data Owners more time to review their content. * **Set Status** -- Allow administrators to set the report to done, in progress, new, or viewed for an individual Data Owner. For example, if an owner accidentally clicked the submit button before they had completed all their edits, using the 'in progress' option would allow them to continue editing their report. ![image-20250409-205707.png](https://docs.gimmal.com/__attachments/a_c0b776b5ea8ed7edd9313050698a787eaab0fae78999533243d36ab88613fe2f/image-20250409-205707.png?cb=a9ff86993229a03ac117acac457656af) Administrators Can Manually Set a Status A final option in the 'View Owner Activity' view allows administrators to see the notification history for a particular Data Owner. After selecting a Data Owner, hover over the More button and select 'View Notifications' ![image-20250409-205855.png](https://docs.gimmal.com/__attachments/a_316b5e9a37495f8f4f9481f86a9f21dbf16590b4ffa6996ca49617cbab31d2c5/image-20250409-205855.png?cb=37d22fde46a578882159868037d88f7b) A pop-up screen will display each previous notification to that Data Owner. ![image-20250409-205931.png](https://docs.gimmal.com/__attachments/a_b565e5f2d0af44c45abbe88e29b759c6becc0d1fa8f118bae7f4e93a269b9bac/image-20250409-205931.png?cb=b0fc407bfe5593e18e2847f996ac54de) ### Applying Data Owner Actions To apply the actions indicated by a Data Owner, administrators must create a workflow that will test the label value and then apply the appropriate action. The first step in this process is to update the Workflow Editor with any labels that have been defined in the Discover Settings area. From the top menu, select Session, then log in using a valid Discover user ID and password. Next, under the Session link, select the option to 'Update Policy Labels' ![image-20230517-200449.png](https://docs.gimmal.com/__attachments/a_439c8e8254e14891c5017c4cee118985c9bc7b9274c8986ef05bda78e25c6ab1/image-20230517-200449.png?cb=e73f7e4c44d3de9d670a977d80f17f70) After the labels have been added to the Workflow Editor, you will receive this confirmation dialog: ![image-20230517-200846.png](https://docs.gimmal.com/__attachments/a_cd3a3a47b97f78242d889306fd1a0a33d20de00d2750ed4e5d20958014dce67e/image-20230517-200846.png?cb=631a2f5d0d17627bd898191a0a32b735) Once this step is complete, the label values will be available as workflow decisions. Whenever new labels are added in the Discover dashboard, this process should be repeated to keep the Workflow Editor up-to-date. Important: Since these workflows will be applied to items on a Discover report, the root sequence of the workflow must contain a 'process each item in list' step for the type of content being managed. The example below shows a workflow created to process file content that a Data Owner may have labeled, so it uses a 'process each file in list' step. There are corresponding 'process each item in list' steps for all of the content sources that Discover supports. ![Screenshot (163).png](https://docs.gimmal.com/__attachments/a_b75f9b777682af1b7f3103f2b745b053e04f10d3f04c632665ea72f4db1dfe42/Screenshot%20(163).png?cb=7e5508809ea98cd5b0a0ca73e6fd4a9b) To interrogate the label value of each row on the report, this example workflow uses a decision step in the 'Files' sequence ![Screenshot (162).png](https://docs.gimmal.com/__attachments/a_9bd9e0edf0b3bb2c1756a7a015bf8e26dd6b2f31f196025a53fca19c28b72151/Screenshot%20(162).png?cb=ae43669f762c584fe583084c26d23d77) In this workflow, when the value of the label is 'delete item,' the workflow will apply the delete action to remove the item that the Data Owner indicated. Data Owner workflows are executed by adding them to Data Governance policies. When creating the policy, select the check box 'Run Policy on Report'. ![dataownerpolicy.png](https://docs.gimmal.com/__attachments/a_21a51f5d250094c8c30c57091f9a6261b81253734363f9e6af8a1a470bbac109/dataownerpolicy.png?cb=5aee81718928ae1ba947ecad98dd33ee) Checking this box displays two additional options * **Run policy on all reports** - this option will cause the workflow to run on *ANY* Data Owner report of the same type (i.e., email, files, etc.) that is present in the database. This is an ideal way to apply Data Owner labels on bulk content repeatedly * **Selected reports** - click the blue Select button to open a list of all the data owner reports. After selecting a report, you can designate a particular version of that report (based on its creation date) to run the policy on After completing these selections, choose a workflow from the drop-down list. Note: Only workflows containing a 'process each item in list' step will be displayed in the drop-down list. The remainder of the Create Policy screen is the same as any other Data Governance policy. When clicking the Next button at the bottom of the Create Policy screen, you will be taken directly to the Schedule page. There is no need to select data targets since the workflow will be applied to every row of the report you selected on the Create Policy screen. --- language: "en" --- # Data Owners A Data Owner is a person who owns one or more data targets (file paths, mailboxes, etc.). Adding Data Owners is not a required configuration step, but they can be very useful. Data Owners may be used as Data Targets when creating a Data Governance policy, or as custodians in an eDiscovery matter. ## Viewing Data Owners The list of Data Owners configured in Gimmal Discover can be accessed from the Configuration section of the Administration area in the Discover dashboard. Typically, Data Owners are added to Discover by performing a query against a specified Active Directory or Entra Active Directory group. They can, however, also be added manually. The Action button on the Data Owners toolbar includes these options: * Add Owner -- This allows for the addition of a person manually. This option may be used to tie in users no longer in the organization's Active Directory environment. Edit Owner -- Opens the Owner Edit window to change the properties of the person. This option is only available for Owners added manually. Delete Owner- Will prompt you and then remove the person. Please note that if the Owner was added from an Active Directory People Search and the user still exists in the AD search path, the user will be re-added the next time the search is run. The More button on the Data Owners toolbar includes these options: * Show Owners/Show Devices -- These two options toggle between listing the People and the Devices that are configured in Gimmal Discover. Cleanup Devices -- This option is only available when Devices are displayed. It provides a way to remove orphan Devices from the Gimmal Discover configuration. Orphan Devices have no Data Targets assigned to them. ## Adding Owners Data Owners may be added to Gimmal Discover either through Active Directory searches, Azure Active Directory searches, or by manually adding them one at a time. To add Owners through an AD or Azure AD search, create a Data Target Search. If you plan to use Entra/Azure AD please refer to the [Azure AD Certificate Installation](https://docs.gimmal.com/alt/azure-ad-certificate-installation.md) document for information on installing the appropriate certificate. When added through a search, Owner details are updated each time the search is performed. Owners are never automatically removed from Discover if they are no longer found by a search since they may be associated with historical reports, searches, etc. To manually create a new Data Owner click the New Owner toolbar button. You may edit a person by clicking the checkbox next to the person entry and clicking the Edit Person button from the toolbar. The Edit and Create Person popup contains the following fields: * Display Name -- Enter a combined name used when referencing this person. This is the primary method of identifying this person in the selection views. * First Name -- Enter the first name of this owner * Middle Name -- Enter the middle name of this owner * Last Name - Enter the last name of this owner * Email Address - Enter an email address for this owner * Office - Enter an office for this owner * Description - Enter a description for this owner * Manage this person - Check to include this owner for policy processing. When unchecked, this owner will not be processed as part of a policy ## Assigning Data Targets to Owners Whenever possible, Discover will automatically map Data Targets to the corresponding owner. This matching is typically performed using the email address. There are also two other ways to assign data targets to an owner, both of these are available from the Data Targets view: * Administrators may manually select one or more targets and use the Map Owner button on the toolbar to link those targets with a specific owner. AutoMap owner is a feature that allows administrators to define mapping options that Discover will use to attempt to match a target with the correct owner. For example, if your organization has user home drives on a network share where folders named with "first name.last name", that convention could be used to attempt auto mapping. --- language: "en" --- # Data Sources A Data Source in Discover is the high-level data repository that can be accessed and processed by an Discover agent. A Data Source is made up of [Data Targets](https://docs.gimmal.com/alt/data-targets.md) which contain the data that is ultimately managed by Discover. For example, an Exchange Mailbox is a Data Source and each of the mailboxes managed by Discover serve as Data Targets. ![image-20250321-172922.png](https://docs.gimmal.com/__attachments/a_aa09476fc4acfea12a5c7e4f85affcf5c67214c512ab5267a524bf0ffe298a9d/image-20250321-172922.png?cb=3feed9774bd68a9d1410bc4ce66509bf) --- language: "en" --- # Data Target Searches Data Target Searches are automated processes that locate content (file paths, mailboxes, etc.) and then add them to the Discover database. Data Target Searches do not examine content (e.g., open files in a particular folder); rather, they return a list of folders that Discover can access on a particular UNC path and store them in the database. Discover Agents perform searches for [Data Targets](https://docs.gimmal.com/alt/data-targets.md). Agents will periodically perform each search and update the results to your tenant database in the Discover cloud. For example, scan a network share weekly and add any new folders located to the Data Target list. You can review the status of searches performed by an agent in its daily service log. ## Adding A Data Target Search To create and view searches to be performed by agents associated with connectors, browse to Administration → Connectors, hover over the Action button, and select Searches. On the Searches window, click the Action button then select Add. ![image-20250324-164411.png](https://docs.gimmal.com/__attachments/a_79d8914d7d60c3de06f47d05915613e9573bf2859dea29968cb8eb1a7f0a2109/image-20250324-164411.png?cb=c23865831697682fe3fd2f692bd2cc95) The Add Search dialog box will be displayed allowing you to specify the Data Target search options. ## Data Target Search Options Depending on the type of search, the window will change to display the appropriate options. Some options will be common among all types: * **Name**- The name given to this search as it will appear in the list of searches * **Search By** - Determines what connector will run a search. Select all connectors, a specific connector, or a connector category (i.e., all desktops). * **Comment**- A general field for your usage. * Retrieve Store Size - For some search types (i.e. mailboxes or file paths) the size of each Data Target may be returned. Please note that checking this box will take the target search longer to complete. * **Enable Search** - Whether or not to enable the search on this connector * **Perform search every**- How frequently to perform the search * **Must run once** - Forces the Data Target search to run once and never again. Especially useful when running on a large volume of desktops, or other scenarios where you don't expect the data target to change. The Data Target search may have additional tabs or fields specific to the type of content you are searching. For example, a SharePoint data target search has an option for the base URL to start with. The example below shows a Windows file path data target search. Note the second tab which allows you to specify which drives (all drives, all fixed drives, removable, etc.) as part of the criteria. ![image-20250324-165216.png](https://docs.gimmal.com/__attachments/a_a9385c620f4d2d3dab3d93343ff9ddb8eb875f55bf13e603c2ba23189905bb59/image-20250324-165216.png?cb=3a1d3dcbf731a6a53ba7aff78e97e5f2) Data target searches can be performed on a recurring basis by either setting the 'Perform search every' option to a specific number of hours (the default 168 is weekly) or by using the Schedules tab to define exactly when the search should be initiated. --- language: "en" --- # Data Targets A Data Target is a managed item (like a file path, mailbox, PST file, etc.) that is assigned to a Device and possibly owned by a Data Owner (person). These are the primary targets of the policies and workflows you create with Discover. Data Targets contain the actual data on which Discover processes. ## Searching for Data Targets Data targets are not added manually, instead they are searched for by individual agents. Searching for Data Targets ## Viewing Data Targets The Data Targets screen can be accessed through the Administration module under the Configuration section. The list displays the following values for each Target configured in the application: * **Data Source** -- The Data Source for each of the configured targets. * **Data Target**-- A description of the target.The actual path for file paths, the display name of the mailbox or archive for Exchange and Office 365 sources, and the path and name for PST files. * **Status** - Active or Inactive. In the system settings administrators may opt to have targets marked as inactive if they have not been found in recent data target searches. * **Device** -- The assigned device for the target; it is the server or computer where the Data Target was found. * **Owner** -- The Data Owner if one has been associated with the target. * **Connector** -- The machine name of the computer where the Discover Connector is installed that is managing this target. All processes to be performed on the target are initiated by the connector and agents on this computer. * **Date Found** - the date that the data target was originally added to the Discover database. * **Last Updated** -- The last time the details for this target were updated. If [Searches](https://www.sherpaaltitudeig.com/help/Content/Administration/ao_help_app_searches.htm) are configured to locate the Data Targets, these details will be automatically updated. * **Total Size** - If the data target search has the size option enabled, the size of the target will appear in this column. * **On Legal Hold** - Discover supports placing Microsoft 365 data targets on [litigation hold](https://docs.gimmal.com/alt/microsoft-365-litigation-holds.md). This column indicates if a hold has been enabled for this target. ![image-20250321-173740.png](https://docs.gimmal.com/__attachments/a_6604107e5b0935b614724552ede0422f1cf22e9f89a19b3f1db3c575c4ce84fd/image-20250321-173740.png?cb=09b43d3263854e224763c5c09c4be45e) ## Mapping Data Owners Data Owners are employees within your organization who are responsible for a specific data target (i.e. a user mailbox). Data Owners can be entered manually through the Discover dashboard, or added automatically by syncing them from [Entra Active Directory](https://docs.gimmal.com/alt/azure-ad-configuration.md). Assigning a Data Target to an owner allows it to become included in any type of owner/member-based action. For example, you could create a group called "New York Office" within Discover and then assign Data Owners who are part of that office to the group. To apply a mailbox retention policy to every member of that group, you can specify the "New York Office" group as a data target in the policy - the retention rule will then be applied to every Data Owner who is part of the group. Mapping Data Owners to a particular Data Target is an optional operation. To make an owner association manually, follow these steps: 1. Select one or more targets. 2. Hover the Action button and select Map Owner 3. Select an owner. 4. Select Save. ![image-20220307-202910.png](https://docs.gimmal.com/__attachments/a_9a1b9023e7d5b14d92f0889da45ab5bf575551497a377f580bb5cde3a4e0eca9/image-20220307-202910.png?cb=7e19990ee1a9a0ac8408779348440dfc) ## Auto Map Owners While mailbox accounts are automatically mapped to their owner, windows paths are not. Rather than manually map these paths, you can set Discover to automatically map a path. 1. Hover the Action button and select Auto Map Owners for Files. 2. Select if you are mapping general Windows files and/or paths to PST files. 3. Use [Tokens](https://docs.gimmal.com/alt/workflow-tokens.md) as variables to create a formula for mapping folder paths. 4. Select Auto Map. ![image-20220307-202931.png](https://docs.gimmal.com/__attachments/a_f68682d7a1fe7c7129501cf7fa7fa5797f9b34db3321a4ba7a0d6858533cc1aa/image-20220307-202931.png?cb=258de5d798850f63c32c517447af5031) --- language: "en" --- # December 2023 Discover Maintenance Release ## Issues Addressed This release addresses several issues that have been reported in Gimmal Discover, the following table provides a recap of the full list: |-------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Issue Number** | **Description** | | 89827 | Allow multiple users to be selected when setting status on Data Owner report | | 89245 | Database timeout issues were mistakenly reporting 'Customer subscription has expired' added significant retry logic to several database calls | | 89326 | Added additional logging to help identify any missing owner reports | | 88236 | Full text results were not being returned for eDiscovery or Data Gov reports in certain situaitons | | 89193, 89232, 88561,89562, 88563, 88557, 88542, 88225 | Improvements and multiple bug fixes for Data Owner Reports | | 87400 | Updated Gimmal branding on the click through license agreement displayed for new clients | | 85119 | Updated the notification pop-up text that is displayed when clicking on an inactive module | | 84720 | Refined the selection process for non-owned file path targets | | 85688 | In eDiscovery, the search function for non-owned data targets has been updated. A limitation on string size was preventing partial matches of a PST name from returning results | | 85474 | Addressed an issue that was causing the message: "Your process was not completed successfully" to appear when exporting some reports to CSV | | 80220 | Dropbox Agent pre-release work: Add agent entries information to administration | In addition to the items detailed above, several data center components have been updated to improve the performance of the hub services. --- language: "en" --- # Deploying a Connector The core Discover component installed in a client environment is the Connector. A connector deploys agents to discover and analyze data that needs to be managed using Discover. In some cases, as in user desktop and laptops , the Connector (and agents) should be installed on the device containing the data; in other cases (Exchange Server or network file shares, for instance), the Connector and Agent may be installed on an application server which has access to the content area to be managed. ## Installing the Connector Begin by downloading one of the Connector setup utilities from the Discover dashboard. Login to the Discover website then click on the Administration at the top of the screen. Select Download Center in the left-hand navigation pane then Connector. Click on one of the buttons shown: * Connector Setup for Windows will download a .EXE version of the setup utility for a Windows operating system. * Connector Setup for Windows MSI will download an MSI version of the setup utility. This is often the best option for a software deployment product (i.e. SCCM) for installation. * Connector for Mac will download the setup utility for an Apple operating system. * Reset Key will change the registration key value - only select this option at the direction of a Gimmal support team member. ![image-20250320-144538.png](https://docs.gimmal.com/__attachments/a_822a523ab4bd7fe1543719c2e213d88f1998f051c474b25e28dfba424ff36c7e/image-20250320-144538.png?cb=e1d0393a7785e41c51b96e38219857bb) While on the download page make a note of the Registration Key shown in the upper right-hand side of the screen, this information will be required later in the installation process. Clicking the appropriate download button will place a copy of the file connectorsetup.exe (or MSI) on your local machine. For a Microsoft Windows install, continue with this guide. For an Apple Mac installation, please refer to guide "[Installing the Discover Mac File Agent](https://docs.gimmal.com/alt/installing-the-discover-mac-file-agent.md)" located in the Technical Guides section of this site. Open and execute the downloaded setup file as an administrator. When asked where to install the file, it is recommended to use the default location. The setup will extract the program files to the location you specified (this process takes a few minutes). It will then check for the presence of the Microsoft Visual C++ runtime files. If these are not present, it will install them automatically. Once this step is complete, the setup will launch the installation wizard. ### Web Service Move through the installation wizard until you get to the screen asking for the URI for the Discover Web Services. Please validate that the URI value is set to: https://discover.gimmal.cloud/saigws ### Credentials On the following screen, you will be asked to enter the credentials to be used for the Connector Service. The Connector is a Windows Service installed on the local machine which initiates HTTPS communication back to the Gimmal cloud. Typically, the credentials entered on this screen would be a domain account that has sufficient permissions to install and update software (i.e. Connector updates, new Agents, etc.) on the application server where installation is taking place. The account used will also become the default account for any Agents that are installed (although Agent credentials can overridden after installation), so you may want to ensure that the account selected will have rights to access any content that it will manage. If this Connector is being deployed to a desktop Computer, please select the checkbox for 'Use Local System Account' rather than entering a named account. ### Register the Service The Connector will need to be registered back to the cloud service with the key provided when you downloaded the Connector setup utility. * **Customer ID** - Same as the one used for logging onto the Discover administration site. * **Connector Registration Key**: Obtained from the Download Center section of the Discover Administration module. ### Connector Settings The web service connection timeout setting determines how often the Connector component will check in with the Gimmal cloud. The default setting (expressed in seconds) is 3600 (once per hour). For a more frequent check-in, this setting may be changed a minimum of 900 seconds (15 minutes). ### Select Content Sources The content sources available will be limited to the sources that are provided with your subscription. One each machine, you may select one or more sources, which will deploy the specific agent required. If you selected Microsoft EWS Email as one of the sources, you will be prompted to install the Microsoft Exchange Web Services Managed API. ### Operation Mode * **Service Mode** - This mode is recommended when installing on a server that will primarily be used for the Discover Connector and large volumes of data will need to be processed. * **Desktop Mode**- This mode is recommended when installing on workstation that is being shared by multiple users. ### Agent Specific Settings Depending on the content sources selected, different options will be shown throughout the rest of the installation. Please contact support if you need help with any of the options or refer to the [Technical Guide](https://docs.gimmal.com/alt/technical-guides.md)s section of this site for more detailed information on specific Agents. --- language: "en" --- # Discover Overview ## Getting started First of all, thank you for being a client. We appreciate that you trusted Gimmal for your purchase. This topic will help you get started using Discover for the first time. There are detailed guides throughout the rest of the site. However, we recommend you start with these steps the first time you use the software. ### 1. First-time setup If this is the first time you or your organization is using Discover, you're in the right place. This topic will guide you through the basic steps of either using Discover or preparing your organization to use Discover. Some of the topics are for everyone, while some will be for administrators only. [Read the first-time setup topic here.](https://docs.gimmal.com/alt/first-time-setup.md) ### 2. Connecting to data sources In order to start discovering data, sources will need to be configured and targets defined. Here you will be guided through downloading the connector, configuring agents, and searching for data targets. [Deploying a Connector](https://docs.gimmal.com/alt/deploying-a-connector.md) [Searching for Data Targets](https://docs.gimmal.com/alt/data-target-searches.md) ### 3. Building workflows Workflows are the instructions that execute against data sources. Using workflows you can perform many different functions such as: * Create a report on what has been discovered * Sensitive data * Files that have exceeded a certain age * Take action based on a set of criteria to move, copy, or delete data. The Workflow Builder is the Discover component for constructing workflows and the following topics on how to use it will help you get started. ​[Introduction to the Workflow Builder](https://docs.gimmal.com/alt/introduction-to-the-workflow-builder.md) ​[Getting Started with Workflow Builder](https://docs.gimmal.com/alt/getting-started-with-workflow-builder.md) ### 4. Creating policies Policies are used to assign workflows to data owners or devices and execute them on a schedule. While workflows contain the actual instructions that act on the data Discover is configured to manage, policies direct workflows where and when to execute. [++Creating a Policy++](https://docs.gimmal.com/alt/policy.md) ### 5. Running Reports While some workflows and policies are built to move or delete data, oftentimes you want to analyze the data that is found within your organization. This is done with reports. Policy reports are generated by workflows and display the information that was processed. [View Policy Reports](https://docs.gimmal.com/alt/policy-reports.md) Summary reports are either created manually from policy reports or automatically by the workflow. [View Summary Reports](https://docs.gimmal.com/alt/summary-reports.md) There are also default reports in Discover Analytics. These reports show summaries of all the data processed by Discover and can be used to create a personal dashboard on the home screen. [View Analytics](https://docs.gimmal.com/alt/analytics.md) ### 6. Classification Classifying is a tool to help organize content so it can be effectively managed throughout its life cycle. This process starts by creating labels (or categories) for content, then mapping out rules which determine what label should be applied to a file, email, etc. These rules are executed by policies that add the category label as a piece of extended metadata that can be interrogated by Data Governance or eDiscovery. [Learn more about Classification](https://docs.gimmal.com/alt/classification.md) ### 7. eDiscovery Whether your need is to search content for litigation, comply with a public records request, or fulfill a data subject access request, eDiscovery can help. It allows you to search the various content types that Discover supports using sophisticated key word terms, phrases, or patterns. Once search results are returned, they may reviewed and marked for collection. [Learn more about eDiscovery](https://docs.gimmal.com/alt/ediscovery.md) ### 8. Integrating with Gimmal Records Management In addition to analyzing data, Discover can send files to Gimmal Records Management for long-term retention. Currently, this integration with Gimmal Records Management only applies to files stored on network file-share servers. [Gimmal Records Integration](https://docs.gimmal.com/alt/integrations.md) --- language: "en" --- # Discover KeyWord Search Syntax ## Discover Keyword Search Expression Options Gimmal Discover includes a very robust and powerful keyword search engine to help identify documents and emails as part of either a Data Governance workflow or an eDiscovery search. The search engine supports the use of simple pattern matching and Boolean capabilities as well as more extensive features such as Regular Expression (Regex) matching and proximity processing. This document describes the many keyword search options supported in Gimmal Discover and provides some examples of how to properly format a search expression using these options. ## Keyword Criteria Options * Word List Any - Acts as a Boolean OR, add item to the search results If any of the listed keywords are found, (i.e. Huck OR Tom OR Becky) * Word List All - Acts as a Boolean AND, requires that all the listed words or phrases must be found in order for an item to be included in the search results (i.e. Huck AND Tom AND Becky) * Search Expression - Allows the administrator to enter a logical expression for keyword AND/OR logic) usage. See Search Term Clarification for more detail. When using search expressions with the "Fast/Quick Search" option to create a search, there is a limitation of 62 'OR' operators supported in a keyword expression. Exceeding this limit will trigger an error in the search execution. ## Word List Rules When using a Word list (Any or All), keep in mind the following rules are used for evaluating the entries: * Keywords or Phrases should be entered one word or phrase per line. * Quotes are not needed for multi-word phrases. Each item is delineated by the line breaks. * Wildcards may be used in words or phrases. Gimmal Discover will automatically recognize wildcards as a Like Pattern. If you wish to search for a literal word, one that has a wildcard as a character you wish to search, put the word or expression in quotes. * Regular Expressions may be used as part of the keyword list. Make sure to use the proper syntax (i.e. RegEx ("expression"). * Proximity operators (e.g. raft NEAR(3) Mississippi) maybe used in a Word List . ### Search Expression Rules A search expression uses Boolean logic to enter a more complex set of keyword criteria. When a search expression is used, follow these guidelines: * Valid Boolean operators are: AND, OR, AND NOT * Long search expressions will word-wrap around the text box, do not press enter to manually move to the next line while typing long search expressions as this could cause an error in logic translation. * Multi-word phrases need to be surrounded by double quotes, e.g. "Statue of Liberty" * Double quotes (") should surround words or phrases with punctuation including spaces, hyphens, parenthesis or commas, e.g. "100-234". * Be sure to use parenthesis to group search expressions, e.g. ((blue OR green) AND (red or yellow)) OR (lions AND tigers AND bears) * Proximity operators can be used in search expressions, e.g. (bank\* NEAR asset\* AND loan NEAR payment) * Gimmal Discover will automatically consider items with wildcards to be valid Like Patterns, unless that word or phrase is in double quotes. Therefore, **day\*** will find matches on both the terms today and days, while "**day**" will find only the exact phrase **day** and would not match on the term today or days plural. ## Boolean Operators The logical operators AND, OR, AND NOT and NEAR are used to further clarify keyword criteria when simple lists are not precise enough. **Reserved Word: AND** Narrows your criteria by only returning hits which match all the keywords, phrases or conditions **Reserved Word: OR** Expands your criteria by returning hits which match any of the keywords, phrases or conditions. See the examples below for how these operators are used: **Scenario** **fence AND paint fence OR paint** |-------------------------------------------------|---------|---------| | Fence and paint both appear in the document | **Yes** | **Yes** | | Only fence appears in the document | **No** | **Yes** | | Only paint appears in the document | **No** | **Yes** | | Neither fence nor paint appears in the document | **No** | **No** | Please note: Boolean operators may also be used with Negative Criteria (e.g. AND NOT). ## Proximity Searching (NEAR) Gimmal Discover provides a keyword option that allows a choice where two or more words must all be present in a document, but cannot be more than a set distance apart. This is referred to as Proximity Searching. For example, a search expression of Romeo NEAR(5) Juliet must find Juliet within 5 words of Romeo to be considered a hit. The standard syntax for proximity searching is: KeywordA NEAR(#) KeywordB. The NEAR reserved word delineates which word or phase will be tied by a certain distance to the other. Customize the distance by entering the number of word distance after the reserved word in parenthesis, e.g. John NEAR(6) Smith will find John if it is within six words of Smith, regardless of direction. By default, the distance is three, so John NEAR(3) Smith can be written as John NEAR Smith. The proximity feature is particularly helpful for returning hits where specific keywords can be found close to one another, regardless of order. For example, if you wanted to locate a name such as "Jane Beth Doe", instead of having "Jane Doe", "Jane B. Doe", "Jane Beth Doe", "Doe, Jane" etc. you can used proximity searching to limit your keyword to one phrase: Jane NEAR Doe. ### Grouped Proximity Expression This type of proximity search allows the user to find multiple words near the base words. When using multiple words, they must be delineated using curly brackets, i.e. { and }. Here are some examples of possible syntax options for multi-word proximity: * *KeywordA* *NEAR(#) {KeywordB OR KeywordC OR KeywordD} --* ***Any*** of the words B, C or D can be found within the # of KeywordA to match. * *KeywordA* *NEAR(#) {KeywordB AND KeywordC AND KeywordD}* -- ***All*** of the words B, C or D must be found within the # of KeywordA to be a match. * *{KeywordA OR KeywordB OR KeywordC} NEAR(#) {KeywordX OR KeywordY OR KeywordZ}* -***Any*** words on the right side are found near any of the words on the left side of the proximity expression. * *{KeywordA AND KeywordB AND KeywordC} NEAR(#) {KeywordX AND KeywordY AND KeywordZ}* -- ***Any*** words on the right side are found near any of the words on the left side of the proximity expression. Please note: When using Boolean operators as part of a grouped proximity expression in a keyword list, they must match the type of list. You can only use 'OR' when in an 'ANY' list. 'AND' can only be used in a "ALL' list. ### Multiple Proximity Expressions NEARS can be combined together to form a set of conditional nears. Gimmal Discover supports a variety of syntax for multiple nears including grouped, directional and with additional AND/OR operators: * KeywordA NEAR(#) KeywordB NEAR(#) KeywordC * {KeywordA OR KeywordB} NEAR(#) {KeywordC} NEAR(#) {KeywordX OR KeywordY} * {KeywordA AND KeywordB} NEAR(#, BEFORE) {KeywordC OR KeywordD} NEAR(#) {Key-wordX AND KeywordY} ### Directional Proximity Searches (BEFORE, AFTER) Gimmal Discover supports using directional indicators in proximity. The syntax is *KeywordA* *NEAR(#, BEFORE) KeywordB, or KeywordA NEAR(#, AFTER) KeywordB* .The syntax can also be shortened using just the first letter, e.g. *KeywordA NEAR(#, B) KeywordB or KeywordA NEAR(#, A) KeywordB* ### Proximity Hints and Tips * Unlike the Boolean operators (AND, OR, NOT), the NEAR reserved word can be used in either a Keyword List or in a Search Expression. * Multi-Word phrases are valid in Proximity expressions, but quotes must be used: "A Connecticut Yankee in King Arthur's Court" NEAR "To Be or Not to Be" * Pattern matching (including standard wildcards) can be used in proximity expressions: Adventure\* NEAR Sawyer * Be sure to use the "curly" brackets { and } for any types of grouping within a proximity expression. Standard parenthesis (and) are used for grouping within a search expression and syntax error will occur if they are interchanged. You can, however, group proximity expressions within a search expression, for example: *(market NEAR(3) {stock OR bond} AND {bank OR CD} NEAR(4) {loan* *OR borrow}) OR finance NEAR {job OR position} OR (discount\* NEAR invest\* NEAR loan\* AND (Acme OR Widget))* ## Complex Search Expressions The Boolean operators can be combined to form more complex expressions, with each expression separated by an OR. For example, you could enter the following: *(fence AND paint) OR (river AND boat)* Use regular parenthesis (i.e. "( "and ")") to delineate an expression. Expressions can be nested, and each nesting must have its own grouping with parenthesis. In the example below, notice how the parenthesis match the various groupings: *(fence AND paint) OR (river AND boat) OR (cave AND (hideout OR "hide out" OR "hide-out" OR "hideaway"))* The Proximity Operator can also be used as part of a complex expression: *(fence AND paint) OR (river AND boat) OR Yankee NEAR(5) court* ### Using Quotes with Keywords The rules for using single and double quotes with keywords depend on the type of keyword search being performed. #### Keyword List (Any or All) The search engine will see the entry of a single line of a word list as a phrase to search, regardless of spaces or any internal punctuation. Quotes surrounding the expression are not required. However, if included, double quotes will be ignored if surrounding the entire phrase. Thus, in a word list, the following are equivalent: *"To be or not to be"* *To be or not to be* #### Keyword Search Expression Quotes should be used for all multi-word phrases or items with delineating characters including spaces, parenthesis or commas. When in doubt surround the phrase with double quotes, or a syntax error could occur. For example, the following search expression: *Profit OR (1,234,567 AND 7654321)* will throw a syntax error. To get this expression to resolve correctly use the following: *Profit OR ("1,234,567" AND 7654321)* #### Items with Double Quotes If you **are** searching for a keyword that contains double quotes, keep in mind the following (for both the keyword list and search expression). For one double quote (e.g. *4" to identify inches* ), no further formatting is required. However, if you are searching for something that is wrapped in double quotes, (e.g.*"Wow"* ), then you must wrap the phrase in single quotes, i.e. ' *"Wow" '*. #### Items with Single Quotes If you are searching for items with a single quote, no further formatting in required for a word list. For example, the following will all resolve correctly: * *O'Connor* * *partners' AND accounts* * *"partners' accounts"* However, when using single quotes in a search expression, they must be contained in double quotes: * *"O'Connor"* * *"partners'" AND accounts* * *"partners' accounts"* However, in the example above, it would be a better idea to use a Like Pattern, e.g. *Like* *("partner\* account\*")* to find all possible permutations of the criteria rather than relying on quotes. **Please note:** * If you are using a search expression with one of the reserved words as a keyword, be sure to place it within quotes or use a Like Pattern. * Smart Quotes, also known as 'Curly' quotes, are directional quotes often inserted by Microsoft Word. To prevent confusion, Discover will automatically convert Smart Quotes to straight quotes when they are found in keyword criteria. ## Negative Criteria Sometimes with keyword criteria it can be as important to avoid certain words as is it to find others. Gimmal Discover has a number of options for the so called negative criteria. ### AND NOT Narrows your criteria by only returning hits where one search term is in a document while the other is NOT in the document. For example, a search expression of *fence AND NOT paint* must find fence but cannot find paint for the document to be considered a hit. This syntax is very tricky, especially when used with parenthesis. See Examples below: a) *fence AND NOT paint* |-------------------------------------------------|-----------|-------------------------| | **Scenario** | **Match** | **Logic** | | Fence and paint both appear in the document | No | True AND False = False | | Only fence appears in the document | Yes | True AND True = True | | Only paint appears in the document | No | False AND False = False | | Neither fence nor paint appears in the document | No | False AND True = False | b) *NOT (fence AND paint) i.e. NOT fence OR NOT paint* |-------------------------------------------------|-----------|------------------------| | **Scenario** | **Match** | **Logic** | | Fence and paint both appear in the document | No | False OR False = False | | Only fence appears in the document | Yes | False OR True = True | | Only paint appears in the document | Yes | True OR False = True | | Neither fence nor paint appears in the document | Yes | True OR True = True | c) *NOT (fence OR paint) i.e. NOT fence AND NOT paint* |-------------------------------------------------|-----------|-------------------------| | **Scenario** | **Match** | **Logic** | | Fence and paint both appear in the document | No | False AND False = False | | Only fence appears in the document | No | False AND True = False | | Only paint appears in the document | No | True AND False = False | | Neither fence nor paint appears in the document | Yes | True AND True = True | ### NOT NEAR This criteria is an inverse of the Proximity Operator used to find a word or phrase as long as it is not located in proximity to another word or phrase. Like the NEAR, this expression can also take a numeric value indicating the number of words within the second word or phrase should not appear. The syntax is *KeywordA* *NOT NEAR(#) KeywordB* . For Example, *"income tax" NOT NEAR(2) "personal"* will find all instances of "income tax" where it is not within two words of "personal". The NOT NEAR is very useful as it can also contain directional indicators *KeywordA NOT NEAR(#, BEFORE/AFTER) KeywordB*. ### EXCLUDE This operator refines searches by locating keywords that match as long as it does not match a specified full excluded expression. It helps to find specific words that are needed without bringing back false positives based on specific usage of the word or phrase. EXCLUDE can be used when a 'BUT NOT' is needed. The syntax is *KeywordA EXCLUDE KeywordA* *\[Rest* *of* *Expression\].* For example, the following expression *Confiden\*\* EXCLUDE "Confidential Statement"* would match all instances of Confiden\* (including Confidence, Confidential etc.) as long as it was not part of the phrase Confidential Statement. **Please note:** * For the EXCLUDE to be valid, the first keyword or phrase (KeywordA), must be part of the second portion of the expression. * Similar to the proximity statement, EXCLUDE can accept an integer to describe the range that this comparison should be made within. The default is5. For example, if you want to search for *"United States"* but you did not want to find *"United States of America Presidential Election of 1994"*, you would need to explicitly input a value of 6 for the range. Since the phrase being excluded is larger than the default range, it is impossible to match the entire expression within 5 words of the original keyword phrase. To be valid, the following should be used: * *"United States" EXCLUDE (6) "United States of America Presidential Election of 1994"* **Comparing Negative Operators** |--------------|-------------------------|----------------------------------------------------------------------------------------------| | **Operator** | **Scope** | **Usage** | | AND NOT | Entire Document | Should be avoided due to lack of precision and validation | | NOT NEAR | Within NEAR(#) range | Very flexible, can be used in a variety of instances | | EXCLUDE | Within EXCLUDE(#) range | Wherever a 'BUT NOT" is required, i.e. this word, BUT NOT if is a specific usage of the word | ## List of Reserved Words The following is a list of reserved words in Gimmal Discover. If any of these words are used as part of keyword criteria, they must be enclosed in double quotes. These words are not case sensitive. |----------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------| | **Word** | **Description** | **Example** | | LIKE | Used to define a pattern in keyword criteria. Often hidden from the user, but always used by the engine when a wildcard is used. | *LIKE ("comp\*")* | | AND | Boolean operator indicating that all keyword or expressions on either side of the operator must be found | *blue AND green* | | OR | Boolean operator indicating that any keyword used with this operator could be found | *blue OR green* | | NOT | Boolean operator used to negate an expression. Can be used with AND or NEAR | *blue AND NOT green* *blue NOT NEAR green* | | NEAR | Used to define proximity of first word or phrase near a second word or phrase | *bank NEAR loan* | | EXCLUDE | Used to find keywords that match the first partial expression so long as it does not match the full excluded expression | *Confidential* *EXCLUDE* *"confidential statement"* | | BEFORE | Used with the NEAR operator to define proximity only for items for items found in one direction (left side of expression must come first) | *cat NEAR(3, BEFORE) hat* | | AFTER | Used with the NEAR operator to define proximity only for items for Items found in one direction (left side of expression must come second) | *cat NEAR(3, AFTER) hat* | | REGEX | Used to define a regular expression in keyword criteria | *RegEx("\\d\\d\\d\[- \]\\d\\d\[- \]\\d\\d\\d\\d")* | | PATTERN | Used to find specific information that is found well defined formats. It is used in conjunction with CC (for finding credit cards) and SSN (for finding social security numbers) | *PATTERN(CC)* *PATTERN(SSN)* | ## Pattern Matching Gimmal Discover provides options for users to enter expressions which are more complex than a standard exact search match. Patterns can be used to help evaluate keyword, address, file name and folder criteria. Two types of Pattern Matching: Like Patterns and Regular Expressions (RegEx) are supported by the search engine. ### Like Patterns (Wildcards) Whenever you use a wildcard to expand a keyword search term, you are actually using a Like Pattern. Gimmal Discover automatically evaluates any word or phrase containing wildcards as a Like Pattern for use in the engine. However, the user does not need to enter exact syntax (i.e. the Like ("") portion) into the wizard. For example, use of ***day*** is valid as is the equivalent syntax *Like* *("* ***day*** *")* . The syntax for a Like Pattern is *Like* *("expression")* where the expression is the word or phrase, containing wildcards, you wish to evaluate. #### Supported Wildcards \*Matches none, one or more characters. ?Matches any single character #Matches any digit \[,\]Matches a range or set of characters or numbers All the wildcards are reserved and will be translated as a pattern. If you wish to use one of the wildcards as a literal match, be sure to put it in double quotes, e.g. *"# sign"* will find a hit in the phrase *Press the # sign for more options* . **Examples** |----------------|---------------------------------------------------| | **Expression** | **Matches** | | bicycl\* | bicycle, bicycles, bicycling | | river?boat\* | river boat, riverboat, river boats, river boating | | Version 3.# | Version 3.0, Version 3.1, Version 3.101 | ### Regular Expressions (RegEx) In addition to the standard wildcard support with Like Patterns, Gimmal Discover also supports the complex structured pattern language of Regular Expressions (also referred to as RegEx, or GREP). Regular Expressions are very helpful when trying to match patterns that cannot be done with Boolean operators such as account numbers, credit card numbers, social security or national insurance numbers. This help document is not intended to teach you how to use Regular Expressions, a certain amount of knowledge is assumed before you can use them in a search. There are entire books written on the subject and innumerable sources to be found on the Internet to help you create the ideal Regular Expression. Gimmal Discover uses the .Net implementation of RegEx. The syntax is: *RegEx("expression")* where RegEx("") tells the search engine to analyze and return items that match the expression within the quotes. #### Examples |--------------------------------------------------|---------------------------------------------------------------------------------|--------------------------------------------------------|-------------------------------------------------------------------| | **Expression** | **Finds** | | | | RegEx("\\b(?!000)(\[0-6\]\\d{2} | 7(\[0-6\]\\d | 7\[012\]))(\[ -\]?)(?!00)\\d\\d\\3(?!0000)\\d{4}\\b") | Social Security numbers (just the numbers using allocated limits) | | RegEx("\\d\\d\\d\[- \]\\d\\d\[- \]\\d\\d\\d\\d") | Social Security numbers (with ### ## #### or ######### pattern) | | | | RegEx("(cc | credit(\\s{0,3}card)?)\[\\D\]{0,60}(\\d{4}(\[\\D\]?\\d{4}){3} (\[\\D\]?\\d{3})? | \\d{4}\[\\D\]?\\d{6}\[\\D\]?\\d{5}(\[\\D\]?\\d{4})?)") | Credit Card patterns with several allocated numbers. | ### PATTERN Reserved Words Gimmal Discover has a method for finding certain predefined formats such as credit card and social security numbers in text using the PATTERN reserved word. When used as a keyword, the *PATTERN(CC)* or *PATTERN(SSN)* uses a regular expression combined with programmatic testing (including the Luhn algorithm in the case of credit cards) to find matching hits while reducing (but not necessarily eliminating) false positives. |----------------|-------------------------------------------------------------------| | **Expression** | **Finds** | | PATTERN(SSN) | Social Security Numbers (just the numbers using allocated limits) | | PATTERN(CC) | Credit Card numbers | --- language: "en" --- # Download Center The Download Center found in the Administration area provides access to the Discover Connector setup utility and the Workflow Builder application. * [Connector](https://docs.gimmal.com/alt/connectors.md) * [Workflow Builder](https://docs.gimmal.com/alt/workflow-builder.md) *** ** * ** *** ## Connector Connectors are installed inside your firewall, for example on application servers or workstations. They communicate periodically with the Discover Cloud via HTTPS to allow Discover agents to send and receive instructions, status updates, and log files. The Connector supports agents for all data sources, which can be configured upon installation. To download the installation program for a Connector, click on the Connector option under Download Center in the Administration section of the Discover console. Click the Download button. Once downloaded, [install and configure the connector](https://docs.gimmal.com/alt/deploying-a-connector.md) on the application server(s) that will be used to search or manage content within your organization. The connector may also be installed on a Windows or Mac workstation to manage local content. If you plan to manage large numbers of workstations, there is a [silent install](https://docs.gimmal.com/alt/silently-installing-discover-components.md) option that creates a package that may be distributed using a system management tool (i.e. SCCM or Jamf). ![image-20250320-135023.png](https://docs.gimmal.com/__attachments/a_4e9457ae63b6f34e9c01ad49ed7c490ffc6939a5fcdded922cde5848bad7e3d7/image-20250320-135023.png?cb=e1d0393a7785e41c51b96e38219857bb) Please note the Registration Key value in the top-right corner of the screen; this key will be required to complete the setup of a Connector in your environment. *** ** * ** *** ## Workflow Builder From the Download Center link on the left, you can also select the Workflow Builder. This link will lead you to the download page for Gimmal's workflow builder desktop application. This tool may be used to create a new workflow or edit one of the sample workflows available in Discover. Workflows are an element of Data Governance that allows you to orchestrate a business process by specifying the decisions and actions to be taken on a specific content source. For more information, refer to the [Workflow Builder](https://docs.gimmal.com/alt/introduction-to-the-workflow-builder.md) section of the documentation. ![image-20250320-135119.png](https://docs.gimmal.com/__attachments/a_061fdaef7cb6d62c794d4880e9afb686908117c27a68d76ce3690782d1c31bb6/image-20250320-135119.png?cb=40fe926e1fe0fdcf56926d0cd39e1d77) --- language: "en" --- # eDiscovery ## Introduction eDiscovery in Gimmal Discover can be used to complete a comprehensive search, review, and collection of electronically stored information (ESI) found in a variety of content areas. The process is carried out in two distinct steps: * The first step is performing a search of content to build a responsive dataset. These responsive items may then be reviewed for relevancy and labeled for subsequent processing. * The second step is creating a forensically sound collection of content that was labeled as relevant during the review process. The data search is conducted within a corporation's network and in places where the data resides -- in email stores such as Microsoft Exchange mailboxes and archives, in PST files, in Office 365 mailboxes and archives, on Windows File Shares, on users' desktops, laptops, and more. The discovery across all the repositories will be performed as a federated search using a consistent, unified syntax across all data types. Metadata about the results of the search can be viewed on the Discover website with filtering options to help identify responsive items to be collected. Collected items are exported to a configured shared location within the corporate network along with inventory and exception logs. Additionally, all search activity is logged, and the information is reviewable through the Discover dashboard. For more information about the eDiscovery components, refer to one of the following topics: * [eDiscovery Summary](https://docs.gimmal.com/alt/ediscovery-summary.md) * [Matters](https://docs.gimmal.com/alt/matters.md) * [Holds](https://docs.gimmal.com/alt/holds.md) * [eDiscovery Searches](https://docs.gimmal.com/alt/ediscovery-searches.md) * [eDiscovery Collections](https://docs.gimmal.com/alt/ediscovery-collections.md) * [Custodians](https://docs.gimmal.com/alt/custodians.md) --- language: "en" --- # eDiscovery Collections Collection, in Gimmal Discover, is the process of exporting items by copying them from the original location where they were found during a search into a separate storage area. Typically, these items are then imported into a legal review platform for further processing (i.e., Bates stamping, redaction, etc.). To initiate a collection in Discover, you will have to create a matter, process one or more searches for the matter, review the search results, and label items that you wish to collect. The Discover collection process allows for the collection of items from different data sources in a single collection. In other words, unlike when creating a search, where each search is restricted to processing a single data source, when creating a collection, you may choose to collect search result items returned by multiple searches with different data source targets. For example, file results and email results may both be included in the same collection. File-based results that are exported from repositories like Windows file shares, OneDrive, Box, etc. will be collected in native format -- as Word documents, PDF files, etc. All email message results regardless of their source (Microsoft Exchange mailboxes, Office 365 mailboxes, or PST files) will be collected in PST files, one PST per type of email store -- so, Discover will create a PST for search results exported from Exchange mailboxes, a PST for search results exported from Office 365 mailboxes and a PST for results exported from PST files. There is also a limit on the size of the PST that the exported results are saved in; the limit is 1.8 GB. Once that size is exceeded, a new PST with the same name with an incremental counter appended to the end of it is created for the additional results. The collected data will be accumulated in a location selected during the collection configuration; this will typically be a network path within your organization's environment. The folder path where the data will be housed within additional sub-folders under the path defined in the configuration. For example, let's assume the collection location you choose in the configuration is \\\\server\\share\\collections. Within this path, Discover will generate a sub-folder with the internal ID (a system-generated GUID) of the matter for which this collection is being processed and a sub-folder within that folder named with the unique internal ID (another system-generated GUID) of the specific execution of the collection. So the path for a given collection execution would be: \\\\server\\share\\collections\\\[Matter ID\]\\\[Collection ID\]. Here, the results are then broken down further by the target machine from which the data was exported. For file collections, the original folder path of the file is maintained within the collection location. So, if a file was collected from the c:\\Documents\\Projects\\Gimmal folder on a user's desktop, that folder path is recreated in the collection location. For emails, the original folder path within the source email store is recreated within the collection PST file. ## Viewing Collections You can access Discover's collections either by selecting a matter from the Matter screen, then clicking the Collections option found under the More button in the toolbar, or clicking the Collections link found in the left-hand navigation pane of eDiscovery. ![image-20250328-200856.png](https://docs.gimmal.com/__attachments/a_c0853011a968075626009d4ea44b8c2432c76cdb4f63f6ee6cd9da5292a2da35/image-20250328-200856.png?cb=59c3b248e915dce6a85de19dd4352608) The details available in this list view are: * Collection Name - A user-assigned name for the collection * Matter Name - The name of the matter that the collection is associated with. Click the name to view details of the matter * Status - The current running or last completed status of the collection * Matter # - The unique case identifier assigned to the matter * Searches - The number of searches whose results are configured to be collected * Last Update - The last time the collection configuration was modified The options found under the Action button of the toolbar are: * Add Collection -- Click to add a new collection * Edit Collection -- Select a collection and click this button to modify the collection configuration * Delete Collection - Deleting a collection will delete not only the configuration but also the details of all the times the collection was executed * Start Collection -- Select one or more collections and click this button to initiate the collection(s). This button will be disabled if the selected collection is currently running * Stop Collection -- This button is enabled only when the selected collection is in progress. Click it to initiate the cancellation of the execution. Because of the distributed nature of the search process, it may take a few minutes before the process is completely canceled at the client(s) where the collection is running. * Collect Logs -- retrieves current copies of the log files for collections that are in progress The options found under the More button of the toolbar are: * Collection History - Select a collection and click this button to view a list of each time the collection has been executed * Collection Summary Details - Select a collection and click to view the summary details of the collection. It lists the configuration details, including the searches that were included in the collection; for collections that have been processed, count, and size details of the collected items are also listed * Collection Details -- a non-modifiable view displaying all of the Collection options ### Creating a Collection To create a new collection, click the Add link found under the green Action button in the toolbar. Until a new Collection is saved, it will appear in the Matter List view with the caption (PENDING SAVE). In this case, to release a collection from that status, use either of these options: * Edit Collection - Return to the collection in Edit mode * Delete Collection - Discards the unsaved collection. For a previously saved collection in partial edit mode, you will be offered the option of deleting the collection or just discarding the unsaved changes Collection options are divided into two tabs (General and Details) when adding or editing a collection. ![image-20250328-200954.png](https://docs.gimmal.com/__attachments/a_524e6df979c632de5dba183a50bbeef7eb989d45ebeae76194716d85c1f328ab/image-20250328-200954.png?cb=2ddc48ef4abb544f0d56a23dc2911059) ++General tab of the collection:++ * Collection Name - A user-assigned name for the collection. The value defaults to "New Collection", so you'll want to give it a more descriptive name. * Description - A freehand text box where you can fill in other relevant details about the collection. * Matter - You must select a matter from the list to save the collection. * Select Search - Once you select a matter, the Add Search button will be enabled. Click it to see a dialog with a list of all the searches that have been created for the selected matter * Selecting a search will display a list of all the specific executions of the selected search. Select a specific execution and click the Add button to add to the search selection list. Please note that you can include only one execution of a specific search for a given collection. * If you would like to include additional searches in the collection, select a different search from the Search dropdown list and pick the desired execution of that search. * Click OK when you are done selecting all the searches you would like to include in the collection. ++Details tab of the collection:++ ![image-20250328-201035.png](https://docs.gimmal.com/__attachments/a_a6499a2ff6eabf493589478d952f13c1306d0eda52b4c462b890836c0511bb13/image-20250328-201035.png?cb=ababcaeb68030164a802c960bf3c0134) * Collect Location -- Select a Collection path from the list of locations provided; this will be the root path where data exported from the source targets will be saved. Note: additional collection locations may be added by administrators in the Settings area (pink gear icon) at the top of the Discover dashboard. * Email Collections - If your collection will include email-related results, select what format those results should be stored in: PST, MSG, or EML. If you selected PST, the option "Generate PST per Custodian" will cause Discovery to create separate PST files in the collection for each custodian. * Enable Collect Locally First -- if your search was performed on workstations, this option causes Discover to create local collection folders on each workstation, then upload those collections to the central location. This is important if the workstations do not have consistent access to the network collection location (i.e., a VPN is required) * Dedup Options - The options are None and Global. The default choice of no will cause all items from all the searched targets will be exported to the collection location. If you choose the Global option, once all the exported data is accumulated to the collection location, a deduplication process is run to exclude duplicate files and duplicate emails (regardless of where they came from -- Exchange mailboxes, PST files, Office 365 Archives, etc.) retaining only a single copy of every collected item. * Label Options -- Designate whether labels indicate items to include or exclude from the collection Labels - Select the labels that indicate to Discover which specific items from the list of search results will be collected. Based on your selection, Discover will export only the items from the source data store, the items that were tagged with the selected label in the Discover search results. * Process Timeout -- If the collection is being performed on workstations, should a timeout be used to determine how long to wait for the workstation to respond before it is bypassed Click Save to save the collection configuration. **Note**, like searches -- collections do not start automatically. You must select the collection, then choose the Start option under the green Action button on the toolbar --- language: "en" --- # eDiscovery Searches The most powerful capability in Gimmal eDiscovery is the ability to search a wide variety of electronically stored information. Searches may be created and managed through the Search screen in eDiscovery. Each search is associated with a matter, so prior to creating a search, you will need to create a matter. ## Viewing Searches You can access the Search screen in one of two ways: selecting a matter in the [Matter](https://docs.gimmal.com/alt/matters.md) screen and clicking the Searches button found in the More toolbar to view a list of the searches defined for the selected matter, or by clicking the Search option in the left-hand pane of the eDiscovery. Notice there is a drop-down box for matter. To see searches related to a specific matter, select it from the list, or choose 'all matters' to see a list of all searches that you have access to. The details displayed for each of the searches are: * Name -- The user-assigned name for the search * Matter -- The name of the matter that the search is associated with. Click the matter name to view a few matter details * Status -- information on the last time the search was performed * Collections - The number of [collections](https://docs.gimmal.com/alt/ediscovery-collections.md) that the search has been used in * Search Results - The number of results returned the last time the search was executed. Clicking this number opens the view to review the search results * Data Source - The targeted data source that this search is configured to run against * Last Update - The date that the search criteria were last updated The Action toolbar menu has the following actions: * Add Search -- Click to add a new search * Add Quick Search -- for a content area that supports indexing, perform a search using that index * Copy Search -- copy the parameters of an existing search to create a new version * Edit Search -- Select a search and click this button to modify the search configuration. The search configuration can no longer be changed if it has been used in a [collection](https://docs.gimmal.com/alt/ediscovery-collections.md); the Edit button will be disabled in this case. * Schedule Search - Select a search and click this button to automate the execution of the search on a schedule. There are three types of scheduling options available: a one-time schedule, a periodic schedule configuration that executes the search every x minutes, and a weekly schedule configuration that allows for the execution of the search on certain days/weeks of the month * Delete Search - Deleting a search will delete the search configuration, the details of all the times the search was executed, and all the stored result details * Start Search -- Select one or more searches and click this button to initiate the search(es). This button will be disabled if the selected search is currently running * Stop Search -- This button is enabled only when the selected search is in progress. Click it to initiate the cancellation of the execution. Because of the distributed nature of the search process, it may take a few minutes before the process is completely canceled at the client(s) where the search is running. * Pause Search -- temporarily place an in-process search on hold * Request Logs -- Obtain a copy of the logs for a search that is currently processing The More toolbar menu has the following actions: * Search History - Select a search and click this button to view a list of each time the search has been executed * Search Results - Click to review the results returned for the last time the search was executed * Search Summary Details - Select a search and click to view the details of the search. Details include the criteria entered when the search was created, the status of targets that were searched, and if the search has executed, it includes the count and size of results for each of the targets that were searched Viewing Search History Selecting a search and clicking the Search History option found under the More category opens a screen listing the details of each previous execution of the search. The details displayed on the screen are: * Name -- The user-assigned name for the search * Started -- The date/time of when the execution of the search was initiated * Elapsed - The duration of the search process; for a currently running search, the real-time duration will be displayed * Status - The status of the search, either one that is running or the completed status of a search that has completed * Search Results - For a completed search, this number indicates the count of results that were identified as matching the search criteria for the execution of the search. The count is a hyperlink that will display results from that previous run in a review window The Action toolbar menu has the following options: * Restart Search for All Failed Targets -- This option will attempt to retry the search for any data target that failed during the selected search execution * Cancel Search -- For currently running searches, click to cancel the search. It may take a few minutes before the cancellation is recorded and the console is updated * Delete Search - Delete the details of a search execution, along with all the logs and search result details * Delete Search Cache -- If the cache option was selected when performing the search, this option will remove any of the cached content that had been stored * Download the Exception Log -- generates a report of any exceptions that were noted when the search was performed * Download the Search Results -- Generates a CSV file of the search results The More toolbar menu has the following options: * Search Execution -- Select an execution in the list and click this button to view the individual details for each of the data targets/custodians that were searched. For completed searches, you can view the log details for the search. For currently running searches, you can cancel the searches being performed on individual targets * Search Results - For a completed search, click to review the results that matched the search criteria for the selected search execution * Search Summary Details - Click to view the search configuration details as well as search result details for each of the data targets that were searched ### Creating a Search Click the Create Search button to launch the wizard; the General Information page is opened. ![image-20250328-194555.png](https://docs.gimmal.com/__attachments/a_20464e77b8b969296ec393cdf33f01b58410e66a879ca869e4eac995492179ee/image-20250328-194555.png?cb=236592ba591dbc97175d277697e56506) General Search Options Fill in a name and a description, if necessary. From the Matter list, select the matter that this search is associated with. A matter is required to save the search. Specify any of the result options listed below, then click Next. ++Result Options++ * **Recurring Search** -- this is a search that will be performed multiple times; selecting this option will generate a cumulative result set of those multiple searches * **Cache Results** -- make a local copy of any item returned as a search result. Checking this box will open another dialog where the cache location may be specified * **Collect Results** -- makes an immediate collection of the search results; this option is used when no review of the results will be performed. Checking this box will open another dialog where the collection location may be specified * **Retrieve Full Text** -- store an extracted copy of the text for each search result. Selecting this option will open another dialog where you may choose to return results for a sample (i.e., retrieve full text for 100 results) or all items * **DeNist** -- automatically excludes items deemed non-discoverable by the National Institute of Standards and Technology * **Process Timeout** -- specify a timeout period for the search. Helpful when searching desktop computers that may not be connected for an extended period On the Data Source page, choose the source(s) you would like to target. The criteria and action options that appear in subsequent pages depend on your data source choice. ![image-20250328-194829.png](https://docs.gimmal.com/__attachments/a_f6d2afe68dfa32efaad95706b43501ceae792720100834eb7acd6653973199c8/image-20250328-194829.png?cb=4654d82174b12c069860a845dcfe85c6) Content Areas to Search Discover permits the creation of an unlimited number of searches for a single matter to accommodate the searching of multiple data sources. Click Next. On the Custodian page, click the Add Custodian button to select one or more custodians, whose data you would like to search, from the list of custodians assigned to the matter you selected on the previous screen. Click Next. The Non-custodial Targets screen is displayed. This page displays a list of target types supported by Discover for your environment. Non-custodial targets are typically items not associated with a specific data owner (aka custodian). For example, a network file share that an entire department has access to. Select any targets in this list that you would like to include in the search. Then click Next. ![image-20250328-195033.png](https://docs.gimmal.com/__attachments/a_a3dbf9ec5a649809a11f8cab788e8820cda141de33f2a36bd291b89fa3e224ea/image-20250328-195033.png?cb=a0181fe270eb643d8329dbc0ef1c5bed) Selecting a Non-Custodial Area to Search The Criteria page is displayed. The criteria available for messages in email-based data sources include: * Size of the Messages * Message Type * Message Class * Message Category * Age of the Messages * Date of the Messages * Address Criteria (senders or recipients) * Address Criteria (domains) * Classification (Discover Classification label) The criteria for files include: * Size of the files * Age of files * File Dates * Names of files * File Type * Classification (Discover Classification label) To configure a criterion, click the checkbox next to the criteria; this will expand the accordion panel so you can supply the specific parameters. ![image-20250328-195151.png](https://docs.gimmal.com/__attachments/a_88a000c2cd5696220eba631e92100553220323e37a2c0a28a4876f49933b8711/image-20250328-195151.png?cb=f8372b4018bddb23c0a0039565f0f6f2) Search Criteria Options You may configure multiple criteria options. Please note that if you do, all the selected criteria parameters will have to be met for an item to be included as a search result. Click Next after you have configured the necessary criteria. The Keyword wizard page is displayed. ![image-20250328-195250.png](https://docs.gimmal.com/__attachments/a_1d39f33106ea857ad86edbd34880c46369bbc11da0731d35004123b777ed27fa/image-20250328-195250.png?cb=019939ff3f0f31dc59eecddbdc67fa3a) Keyword Search Options If you wish to search on keywords, check the Use Keyword option. Select the appropriate type of keyword search you would like to perform: * **Word List (Any)** - Fill in a list of keywords, one per line. If an item being searched contains any of the listed keywords, the item will be considered a hit. * **Word List (All)** - Fill in a list of keywords, again one per line. All the listed keywords must be found in the items being searched for the item to be considered a hit. * **Search Expression** - Discover keyword searching supports a wide variety of keyword expressions, including Boolean, regular expressions, proximity, etc. For more information on the search syntax options supported in Discover, please refer to the [Keyword Search Syntax](#) document. When using search expressions with the "Fast/Quick Search" option to create a search, there is a limitation of 62 'OR' operators supported in a keyword expression. Exceeding this limit will trigger an error in the search execution. Search Continuity * **Simple** -- the search stops after finding the first matching keyword **Complete** -- all keyword criteria will be recorded in the search results (note, this will extend the time required to perform the search) **Exhaustive** -- used in conjunction with proximity search (i.e. find Term_a NEAR(5) Term_b) to apply all keyword criteria either before or after the proximity specified Snippet Keyword Length -- determines how much text around the matching search term will be returned as part of the snippet shown in the search results grid. Mask Patterns -- if the search expression uses one of the built-in Pattern(CC) or Pattern(SSN) options, mask this sensitive text in the search result to protect personally identifiable information. Luhn Verification -- when using a regular expression to identify credit card numbers, the Luhn algorithm check may be helpful in eliminating false positives. Evaluate Image File Content with OCR - if your Gimmal Discover tenant supports it, OCR checking this box will instruct the File Agent to attempt extracting text from common image file types (JPG, BMP, GIF, etc.) and apply the search criteria. If the OCR option is selected, a Minimum OCR Confidence Percentage may also be specified. When the OCR component parses the image file, it will return a minimum confidence level value for each file. Gimmal recommends specifying a value of 60% or higher for the processing OCR supplied content. After entering your search terms or expression, there is a Test button located on the right-hand side of the page. This button will open a logic test panel. The logic tester will validate the accuracy of your search expression and allow you to enter some sample text to help determine if the search terms are being evaluated properly. Click Save to store the search configuration. **Please note,** searches do not start automatically. They must be selected and initiated using the 'Start' option found in the Action menu or attached to a schedule for unattended initiation. ### Viewing Search Results There are several ways to view the results of an executed search. In the Search screen, you either click on the value in the Results column or select the search, then click the Search Results option shown under the More button in the toolbar. To view the results of a prior execution of the search, select the search, click the Search History button in the toolbar, and click on the results of the execution you would like to view. The columns of information displayed in the Search Results screen vary depending on the data type of the target information that was searched. Filters on the left of the screen allow you to drill down on the results; click on one or more filters and click the Apply button to refresh the results list with results that match the selected filters. Click the Clear Filters button to clear all selected filters and reload the full list of search results. ![image-20250328-195427.png](https://docs.gimmal.com/__attachments/a_05dde98607dacc5eead25046145fc95e0310ef10beb4ddb46bc96e709eb5610e/image-20250328-195427.png?cb=7e2e59ae2fd7df95664bba59e95d13d0) eDiscovery Search Results Clicking the checkbox on the header line of the results table selects/deselects all the results displayed on the current page. Clicking the Select All/Clear All buttons on the toolbar will select/deselect all the results across all the pages of the results. ### Labeling Results Discover offers a mechanism to tag results for further processing by applying text labels. For example, items may be marked with a 'responsive' label if they are to be included in a collection, or perhaps as privileged if you want to exclude them from additional processing. Labels are defined for each customer and are normally specific to the review process used with their organization. ![Screenshot (50).png](https://docs.gimmal.com/__attachments/a_0def618ecaef7b79ad1810b806f2a3275d27250e8b3f9c8c485814ebea7ee0f5/Screenshot%20(50).png?cb=973ab040ad4286057cecad38579533ca) Label Responsive Search Results To tag results, select the results, then select the Assign Label option found under the Action button on the toolbar. The dialog that is opened displays a list of pre-defined labels; you could also add a label if you don't see one that meets your tagging needs. A result item can be assigned multiple tags. In addition to categorizing your search results, labels are used to target the result items that will be collected for more advanced review. See the section on Collections for more details on setting up a collection. To clear the labels from a tagged result, select the result item(s) and click the Clear Label button from the toolbar. --- language: "en" --- # eDiscovery Summary ## Summary The eDiscovery Summary Page is displayed when clicking on the eDiscovery link found at the top of the Discover dashboard. The summary provides a quick recap of current activity in the module, including how many matters and hold notices are in use, and whether any searches or collections are currently in progress. ![image-20250326-184942.png](https://docs.gimmal.com/__attachments/a_16fed7e92ab27c288726cf71becaa8430677a6bb4b3d131595041eab2460a379/image-20250326-184942.png?cb=50a40e67d9603feb572d3ada13279ef3) There are hyperlinks in the blocks for Matters, Holds, and Searches that will direct you to each of these areas within eDiscovery. --- language: "en" --- # EWS Agent Configuration This document describes what settings and permissions the Discover EWS Agent requires to successfully communicate with and manage mailboxes and archives in Exchange Online or On-Premises. If you are connecting to Microsoft 365 using Modern Authentication (OAuth), please refer to the configuration steps outlined in the guide: [OAuth Configuration Guide](https://docs.gimmal.com/alt/oauth_configuration_guide.md) Before getting started, you will need to obtain the following information: * The URL to the PowerShell interface on the Exchange Service it should look something like one of the examples below: **For Exchange Online:** **For Exchange 2016/2019 On-Premises**: https://\[Exchange Server\]/powershell\| (where \[Exchange Server\] is the fully qualified domain name of the Exchange Server machine) * The Entra Client \& Tenant ID * An Entra certificate file and the associated password Supply these settings when you install the Discover EWS Agent. Note: Please use the steps outlined below if you would like to verify the Agent configuration before entering it into the Discover EWS Agent or if you run into any errors with the Agent accessing mailboxes. ## Section 1: PowerShell Setup/Access The steps in this section are optional, but can be useful in determining if the Agent server is able to communicate with Microsoft Exchange successfully. Begin by logging into the machine where the Discover Connector and EWS Agent are installed. We recommend logging in using the same account credentials that the EWS Agent service is registered with. After logging in, launch a Windows PowerShell session (note that this process may need to be performed with both 32 and 64-bit versions of PowerShell). Then enter the command that permits this server to issue remote PowerShell calls: Set-ExecutionPolicy Unrestricted ![image-20220317-201451.png](https://docs.gimmal.com/__attachments/a_c80c8114a912ff8e6636360858096b2ba901b7c7381e9fa95fbfbd74031f6e74/image-20220317-201451.png?cb=020eac30f56526105987c160e2d1cc63) After entering the command, PowerShell prompts you to confirm the setting. Type the letter Y to complete the command. This server now has permission to issue PowerShell commands to a remote server -- in this case, either the Exchange 2016/2019 on-premise or Office 365. ### Manually Validating A PowerShell Connection The Discover EWS Agent is designed to query Exchange via PowerShell in order to obtain a list of valid mailbox Data Targets. For troubleshooting purposes, it is sometimes helpful to issue the appropriate PowerShell commands manually in order to identify any permissions-related issues. The steps for performing a manual query are listed below for the oAuth (Modern) authentication method. Note: The PowerShell commands listed below have been tested with the native 64 Bit PowerShell version included with Microsoft Windows. Downloading a newer standalone PowerShell version may not provide the same results. #### Using oAuth (Modern) Authentication The three PowerShell commands shown below are issued by the EWS Agent when it attempts to obtain a list of Microsoft 365 mailboxes using oAuth (Modern) authentication. To manually run these commands in a PowerShell session, replace the values in { } with the appropriate values for your environment: When entering the environment specific information shown with { } below, be sure to use single quotes as shown. $Secure_String_Pwd = ConvertTo-SecureString '{CERTIFICATE PASSWORD}' -AsPlainText -Force Connect-ExchangeOnline -CertificateFilePath '{FULL PATH TO APP REGISTRATION CERTIFICATE}' -CertificatePassword $Secure_String_Pwd -AppID '{Entra APPLICATION (CLIENT) ID}' -Organization '{Entra TENANT ID}' get-mailbox -ResultSize unlimited \| fl UserPrincipalName,PrimarySmtpAddress,ServerName,Database ## Section 2: Exchange Online and Entra AD Permissions: ### Credential Configuration To access and enable the Agent authentication fields, perform the following steps on the server where the EWS Agent Service is running: * Double-click on the Connector Status Tool application shortcut on the desktop. If the shortcut does not exist, this utility may be found here: C:\\Program Files (x86)\\Sherpa Software\\Sherpa Connector\\ SherpaConnectorStatus.exe ![image-20220317-201857.png](https://docs.gimmal.com/__attachments/a_fadca3cb58dea0fc8f2ed3a860d6dfd7433c1c97c6a307f1f73be180eded9534/image-20220317-201857.png?cb=83ffc0bc2ef7b71e44220cf2fb1e210f) Once the application is open, click on the 'Credentials' link in the status tool window: ![image-20220317-201922.png](https://docs.gimmal.com/__attachments/a_47c0ba19fbd7a6b80652b3fda425535745f129987317e966832cb8f749c6970b/image-20220317-201922.png?cb=e844ea86ef145108c2558373d7def4bd) ### Configure the EWS tab for oAuth: * Check the 'Use Azure Registration Credentials' box, this will disable the Basic Authentication fields and enable OAuth Authentication. The fields listed in the screenshots below will need to be filled out with the IDs obtained during the App Registration process. * For the tenant ID you will need to input the company domain from Entra (e.g. [gimmal.onmicrosoft.com](http://sherpasoftware.onmicrosoft.com/)), then copy/paste the client ID into their respective fields. * Click on the browse button to navigate to the folder path where the certificate file is stored. Please note that this cert file has an extension of (.pfx), NOT (.cer). * Lastly please enter the password which was assigned to the certificate at the time of creation and click SAVE to exit the window. ![image-20220317-201946.png](https://docs.gimmal.com/__attachments/a_15a6839a30ba0d6989e377b5c75399104bf17e376873c4d3184e1e39f8511b89/image-20220317-201946.png?cb=8c38c8d765624c7708061e61b1089200) The EWS agent may also be used to obtain a list of Data Owners from Entra AD. If you plan to use this feature, please complete the additional configuration steps described in [Entra AD Certificate Installation](https://docs.gimmal.com/alt/azure-ad-certificate-installation.md) ### Verify that the Required PowerShell Modules are Installed The remote PowerShell commands issued by Discover require these modules to be installed on the Agent server: * Microsoft.Entra * PowerShellGet * ExchangeOnlineManagement (*version 3.4.0 or above required*) * PackageManagement You can determine what modules are installed by launching a PowerShell session and issuing the command get-installedmodule as shown below: ![image-20250801-174806.png](https://docs.gimmal.com/__attachments/a_1efc15d13958323758239e2592b6632e4e9563c995f7ffebfcf912f26aa03e35/image-20250801-174806.png?cb=a2b436f2dce9e6116d6a4e73fa0a5223) If you do not have all of the required modules, they can be installed by issuing the commands listed below in a PowerShell session. If you encounter an error, please verify the version of TLS as described in Appendix A. * Install-Module -Name Microsoft.Entra -AllowClobber * Install-Module -Name PowerShellGet -allowclobber * Install-Module -Name ExchangeOnlineManagement * Install-Module -Name PackageManagement **(note: this module may be installed automatically)** ### Appendix A: TLS Configuration If the connector server is running an older version of Microsoft Windows (2010 R2 or lower) it may not have the required support for TLS1.2. This Microsoft link provides more details on TLS dependencies and adding TLS support to older versions of Microsoft Windows: The versions of TLS currently installed on the server can be verified using this PowerShell command: **\[Net.ServicePointManager\]::SecurityProtocol** ![image-20220317-202201.png](https://docs.gimmal.com/__attachments/a_ce51b76046271ed4519f4ae2c94c7e1c674106e7dfd3bb57bcb95f16d1e24a60/image-20220317-202201.png?cb=c8e695fde2cd585aec22958c4bd7c4a6) If TLs12 is not shown in the list, it will need to be installed on this server using one of these Microsoft methods. Option 2 (below) is the preferred method since it adds Tls12 to the whole system, where option 1 only persists for the current PS session. 1. Modify the script in question to include the following: \[System.Net.ServicePointManager\]::SecurityProtocol = \[System.Net.SecurityProtocolType\]::Tls12; 2. Add a system-wide registry key (e.g. via group policy) to any machine that needs to make TLS 1.2 connections from a .NET app. This will cause .NET to use the "System Default" TLS versions which adds TLS 1.2 as an available protocol AND it will allow the scripts to use future TLS Versions when the OS supports them. (e.g. TLS 1.3). Registry keys are shown for both 64 and 32 bit systems: reg add HKLM\\SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319 /v SystemDefaultTlsVersions /t REG_DWORD /d 1 /f /reg:64 reg add HKLM\\SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319 /v SystemDefaultTlsVersions /t REG_DWORD /d 1 /f /reg:32 --- language: "en" --- # Exceptions his page will display information about any item that was not able to successfully classify. The options on these items are the same as the option on [Classification Results](https://confluence.gimmal.com/display/ALT/.Results+v2021-04). --- language: "en" --- # February 2025 Release The February 2025 release of Gimmal Discover is a maintenance release that includes an update to the SharePoint agent as detailed below: | **Issue Number** | **Description** | |------------------|-----------------------------------------------------------------------| | **97385** | Correct errors encountered when processing large SharePoint libraries | --- language: "en" --- # File Formats Supported by Gimmal Discover Adobe Framemaker MIF (\*.mif) Adobe Photoshop images (metadata only) (\*.psd) Ami Pro (\*.sam) Ansi Text (\*.txt) Apple iWork KeyNote 2009 (\*.key) Apple iWork Numbers 2009 (\*.numbers) Apple iWork Pages 2009 (\*.pages) ASCII Text ASF media files (metadata only) (\*.asf) CSV (Comma-separated values) (\*.csv) DBF (\*.dbf) EBCDIC EML (emails saved by Outlook Express) (\*.eml) Enhanced Metafile Format (\*.emf) EMF Spool (\*.spl) Eudora MBX message files (\*.mbx) Flash (\*.swf) GZIP (\*.gz) Hancom Hanword (\*.hwp) Hancom Hanword 97(\*.hwp) HTML (\*.htm, \*.html) iCalendar (\*.ics) Ichitaro (versions 5 and later) (\*.jtd, \*.jbw) JPEG (\*.jpg) Lotus 1-2-3 (\*.123, \*.wk?) MBOX email archives such as Thunderbird, including attachments (see note 3) (\*.mbx) MHT archives (web pages saved by Internet Explorer in the "Web archive, single file" format) (\*.mht) MIME messages, including attachments (see note 3) MSG (emails saved by Outlook), including attachments (see note 3) (\*.msg) Microsoft Access 95, 97, 2000, 2003, 2007, 2010, 2013, and 2016 MDB (see note 1) (\*.mdb, \*.accdb) Microsoft Document Imaging (\*.mdi) Microsoft Excel for Mac 2.2, 3, 4, 5, 98, 2001, X, 2004, 2008, 2011 Microsoft Excel for Windows 2, 3, 4, 5 Microsoft Excel 95, 97, 2000, XP, 2003, 2007, 2010, 2013, 2016 (\*.xls) Microsoft Excel 2003 XML (\*.xml) Microsoft Excel Office Open XML 2007, 2010, 2013, and 2016 (\*.xlsx) Microsoft OneNote 2007, 2010, 2013, and 2016 (\*.one) Microsoft Outlook 97, 2000, 2003, 2007, 2010, 2013, and 2016 data files, including attachments (see note 3) (\*.PST, \*.OST) Microsoft Outlook/Exchange Messages, Notes, Contacts, Appointments, and Tasks (see note 2) Microsoft Outlook Express 5 and 6 (\*.dbx) message stores Microsoft PowerPoint 3, 4, 95, 97, 98, 2000, 2001, 2002, 2003, 2004, 2007, 2008, 2010, 2011, 2013, 2016 (\*.ppt) Microsoft PowerPoint Office Open XML 2007, 2010, 2013, and 2016 (\*.pptx) Microsoft Rich Text Format (\*.rtf) Microsoft Searchable Tiff (\*.tiff) Microsoft Word for DOS 1, 2, 3, 4, 5, 6 (\*.doc) Microsoft Word for Mac 1, 3, 4, 5, 6, 98, 2001, X, 2004, 2008, 2011 Microsoft Word for Windows 1, 2, 6 (\*.doc) Microsoft Word 95, 97, 98, 2000, 2002, 2003, 2007, 2010, 2013, 2016 (\*.doc) Microsoft Word 2003 XML (\*.xml) Microsoft Word Office Open XML 2007, 2010, 2013, 2016 (\*.docx) Microsoft Works WP (\*.wks) MP3 (metadata only) (\*.mp3) Multimate Advantage II (\*.dox) Multimate version 4 (\*.doc) OpenOffice/LibreOffice versions 1, 2, 3, 4, and 5 documents, spreadsheets, and presentations (**.sxc,.sxd, \*.sxi, \*.sxw, \*.sxg, \*.stc, \*.sti, \*.stw, \*.stm, \*.odt, \*.ott, \*.odg, \*.otg, \*.odp, \*.otp, \*.ods,** .ots, \*.odf) (includes OASIS Open Document Format for Office Applications) PDF 1.x files (\*.pdf) (see note 4) PDF Portfolio files (\*.pdf), including embedded non-PDF documents. Quattro Pro (\*.wb1, \*.wb2, \*.wb3, \*.qpw) QuickTime (\*.mov, \*.m4a, \*.m4v) RAR (\*.rar) (see note 4) TAR (\*.tar) TIFF (metadata only) (\*.tif) TNEF (winmail.dat) Treepad HJT files (\*.hjt) Unicode (UCS16, Mac or Windows byte order, or UTF-8) Visio XML files (\*.vdx) Windows Metafile Format (\*.wmf) WMA media files (metadata only) (\*.wma) WMV video files (metadata only) (\*.wmv) WordPerfect 4.2 (\*.wpd, \*.wpf) WordPerfect (5.0 and later) (\*.wpd, \*.wpf) WordStar version 1, 2, 3 (\*.ws) WordStar versions 4, 5, 6 (\*.ws) WordStar 2000 Write (\*.wri) XBase (including FoxPro, dBase, and other XBase-compatible formats) (\*.dbf) XML (\*.xml) XML Paper Specification (\*.xps) XSL XyWrite ZIP (\*.zip) (PKZIP 2.0-compatible) **Notes** \[1\] Databases. The Gimmal Discover File Agent does not use ODBC or any Microsoft database drivers for Microsoft Access files. Each record of a database is treated as a separate document. Gimmal highly recommends using the OLEDB Agent for database content. \[2\] Outlook and Exchange. Outlook and Exchange message stores are indexed using MAPI. Outlook PST and OST files can be searched directly, without using Outlook or MAPI. \[3\] Attachments. In all supported email formats, attachments, including nested attachments (for example, a .doc instead a ZIP attached to an email) are treated as part of the main document by default. \[4\] PDF Support. Encrypted PDF files cannot be indexed, unless the PDF file can be opened without a password and the PDF file permissions allow for text extraction. --- language: "en" --- # Getting Started with Discover This is where you should start if you are setting up Gimmal Discover for the first time. You'll be guided through setting up users, basic tenant configuration, and security considerations. * [Discover Overview](https://docs.gimmal.com/alt/discover-overview.md) * [Terminology](https://docs.gimmal.com/alt/terminology.md) * [Logging in the first time with a Master Account](https://docs.gimmal.com/alt/logging-in-the-first-time-with-a-master-account.md) * [Navigating the User Interface](https://docs.gimmal.com/alt/navigating-the-user-interface.md) [Next Page](https://docs.gimmal.com/llms-full.txt/1)