How to create a search task for Office 365

How to create an Ascema search task for Office 365link

Search tasks are where you begin with the process of managing your sensitive data with the Ascema system. A search task lets you define the sensitive data that you are concerned about and where to look for it on your Office 365 tenant. In order to be able to create a Search Task you must have a user account and be logged in to the Ascema Endpoint manager. See How to manage Ascema user accounts.

Creating an Office 365 Search Tasklink

Creating a search task will usually be one of the first things you do after installing the Ascema system.

  • From the menu bar expand the Tasks option
  • From the task options select Create New
  • A list of available task types to create will be presented
  • Select the option to Create a new O365 Search Task
  • The first stage of the create Search Task wizard will be displayed

Info

Across the top of the wizard is a progress monitor indicating where you are in the process of creating the new Search Task. In this case the the start of the process where you will give the search item a unique name which you can use to manage it in the future.

  • Give your Search Task a unique and meaningful name to help you manage it - this name will also appear on end user reports so a clear and informative name will be best.
  • Set a default task priority for when the search task is run - how this will affect performance will vary according to the operating system the agent is running and may be limited by network connections from the agent to the Office 365 environment.
  • If you wish to send alert emails for this task then select the Automated alerts button.
  • When you have reviewed the details entered on this part of the wizard select Next
  • You will now see the Patterns part of the wizard
  • You can define your search for National Insurance Numbers with a simple pattern
  • Click the Select Pattern button
  • The simple patterns have been organised into categories according to the countries where they originate
  • National Insurance Number originates in the United Kingdom so select that row of the table
  • You choose the pattern you want by selecting the + symbol to add this to your search
  • The wizard will now confirm your selection

  • The menu option for confidence would allow you to report on items where Ascema is less confident that they match the pattern you are looking for
  • Leave the default value as it is for this exercise
  • With the search pattern selected you are ready to proceed to the O365 Apps selection stage of the wizard
  • Select the Next button
  • From the available options choose which areas of the Office 365 tenant the task should apply to
  • By default the search will be made for all users and groups
  • To restrict the search to specific users and groups
  • Select the All Users And Groups slider to unset it
  • The list of users and groups on the Office 365 tenant will be displayed
  • For this example we will leave all users and groups selected
  • When the selections are complete select Next
  • The filter stage of the wizard is where you can define a series of filters to define where Ascema will search for the senstitive data
  1. By file type: from the list of file types seen here or from additional file types you define for yourself
  2. By file created or modified date: to include only files which have been created or modified within defined date ranges

  3. To select a file type simply click the slider button next to the description.

  4. To un-select a file type click the slider button again so that it returns to the unselected position
  5. The Select all option will cause the search to look through all files of all types, searches with this option will take longer to complete
  6. To look for data in regular documents you can select a set of file types as shown here

  7. Next you will review the options for filtering by date range

  • As you can see by default Ascema will search for all files regardless of creation or modified date

Info

The dates on this filter are inclusive - so for example if you set a Modified After date of 2015-01-01 then a file which had been modified on that date would be included in the search and any sensitive data in it would be alerted.

  • The wizard is now complete
  • You may use the Back and Next buttons to review the entries you have made for this Search Task
  • When you have reviewed the entries select Finish