Handle a case An investigator works an Insider Risk Management case. The case has tabs for overview, alerts, user activity, Content explorer and case notes. Content explorer shows copies of the files and emails, and only investigators can see it. The investigator adds a case note, sends an email notice based on a notice template, and resolves the case as a confirmed policy violation with the action taken. Escalate for investigation would create an eDiscovery (Premium) case. Ronny receives the notice in his inbox. W INSIDER RISK MANAGEMENT Handle a case Ada Admin Eli Employee Ronny Insider INSIDE THE CASE Everything about the case, in one place TAKING ACTION Three ways to act Microsoft Purview Cases CASE IDCASE NAMESTATUSUSERTOTAL POLICY ALERTS 12Customer list to private emailActiveAnonyRB-3111 ‹ Cases Customer list to private email Active Closed Send email notice Escalate for investigation Resolve case Case overviewAlertsUser activityContent explorerCase notes NAMETYPESENSITIVITY LABEL Risk analyst · Oct 14Download and downgrade before the email. Investigator · Oct 15 Add note Send email notice Notice template Send from Subject Message body Send Resolve case Resolve as▾ Action taken BenignConfirmed policy violation Resolve THE USER EXPERIENCE What does Ronny notice? The case is handled before his last day. Outlook Inbox Compliance team Before you leave: company data Hi Ronny, as part of your offboarding… Before you leave: company data Compliance team · To: Ronny Insider Hi Ronny, As part of your offboarding, we'd like to remind you that customer data belongs to the company and stays here. Please delete any copies outside our systems, and talk to your manager if you have questions. Kind regards, Compliance team Good to know 1/7 INSIDER RISK MANAGEMENT Handle a case The case is open. Investigators look at the content, the notes and the timeline, and decide what to do: a notice, an escalation, or a resolution. informasjonsbeskyttelse.no