Cognni admins that would like to run a forensic search on a specific entity.

This article will help you learn how to navigate and use Cognni's forensics tool.

i. Navigate to Overview > Microsoft M365 In-Motion.

ii. Navigate to Forensics. (Top right of the screen)

i. Choose your "entity type":

ii. Search and select your entity:

iii. After selecting your entity click on the arrow to search:

i. Click on the current time on the top left of the screen:

ii. Select the relevant time period:

Review the following parameters:

i. Risk Types

ii. Sensitive Information Overview

iii. Activities Summary

iiii. Information Trust

i. Click on "Add Subject".

i. Click on "Add subject to watchlist".

ii. Review the users you added in the watchlist (forensics tab)

Contact [email protected] for more information.