The Report tab in Office Protect contains a list of events flagged by Microsoft 365. Office Protect displays these events in three views: Unignored, Ignored, and All. We also offer further insight into each event by explaining why it was flagged.
Report Navigation
When logged in Office Protect, select Report in the left-hand menu
How to consult information?
On the Report's page, you have different actions you can take to review the events and information you are looking to investigate. You can also manage ignored events.
By default, the Start Date will be set to the start of the current week and the End Date will be today's date. To change the period simply click on the date box and select the desired date. You can look for events for specific periods large or small depending on your needs. For example, you can look at the last 3 months, or set it to focus on a specific day by selecting the Start Date and End Date as the same date.
Once your dates selection is set, click the Refresh button to update the report and see the events for the period selected.
By default, the report will display Unignored events only. You can toggle between the different views using the View button.
What information can be found?
In the report, you will be able to consult the information from Microsoft Events.
- The first column will display the exact date and time the event was reported on.
- In the second column, you will see the familiar Office Protect event name to identify quickly what this event is about.
- The third column will display the user responsible for this alert or action if relevant to the event. Some events may not be triggered by a user thus this field may be blank.
- In the fourth column, the details of the event are provided. You will see all the relevant information needed to investigate the event further.
- Finally, the last column Source informs you where in Microsoft 365 this event originates from.
What can I do here?
Under the Report page, you can manage which events occurrences you wish to ignore if it is deemed an expected behavior or non-threatening. For more information on managing the Ignore and Unignore feature look at the articles on the subject: Ignoring and unignoring events in Office Protect.
To make event investigation easy, you have multiple options to drill down or organize the report to better suit your needs.
Column Headers
Use the columns headers to reorder events based on that element. Simply click on a column title to order the list of events by that information type. This is helpful to regroup events by similar categories to compare events or to regroup events by users to review events by users. By default, events are listed by Date time with the most recent event from the selected period on top of the list.
Export CSV
Another way to get more out of the report is to use the Export CSV option, to manipulate the data outside of Office Protect to analyze it further.
Send By Email
An investigation may require someone else's involvement or some information may be requested by someone who does not have access to Office Protect.
To facilitate that, use the Send By Email button to automatically create an email of the information displayed by your research. An email similar to the format of the Digest will be sent to you containing all the events from your search and you can forward this email to anyone who needs it.
Note: The email is sent to the user who is making the request (clicks the button) only.
Search
You may be looking at drilling down on specific information to investigate further. That is where the Search option is helpful. This will open search boxes per column to look for specific content. Simply type in the search box needed and click enter to search for the matching information.
