Creating an Advanced ECA search
You can create an advanced ECA search in the following ways:
-
Create a new search and save it as an Advanced ECA search, as explained in this section.
-
Update the existing standard search under the Managed Accounts node. See Updating an on-going or a standard search from Managed Accounts.
To create an Advanced ECA search
-
On the Investigationstab, selectManaged Accounts>New Search.
-
Perform advanced search or query search to get the expected items. See Performing Advanced Search and Query Search.
-
Click Save Search.
-
In the Save Search dialog box, enter a unique name for the search.
-
Select the Advanced ECA check box.Note: After you select the Advanced ECA check box, the application disables theTag namefield, theOn-goingcheck box, and theLegal Holdcheck box.
-
To send this search to a particular case, select the Send to Case check box, and select a valid case from the drop-down list.Note: TheKeep copy in Investigationsremains selected by default. When you send the Advanced ECA search from theInvestigationstab to a Case in theeDiscoverytab, it gets saved underResearch Sets. After sending this Advanced ECA search to Case, it may show different result (email count) depending on the custodians selected in theCase Setupoption.
-
Click Save.
The search appears under the Advanced ECA node in the left navigation pane.
After the search is created, you can select the appropriate filter options to refine the search results. For example, under Filters, expandFormatTypeand selectMS Teams to view only MS teams related search results.
In a single Advanced ECA search, the application can save maximum 250000 records each for emails, collaboration messages, and files. The total records the application can save is maximum 750000 in a single Advanced ECA search.
Note: If the Advanced ECA search processing fails, you need to clickPlease try againto retry processing. If this search fails consecutively, you need to delete the search and create a new search again.
Related information