Manage investigation scopes in Data Security Investigations (preview)

After adding data items from your search queries to the scope of the investigation, you're ready to start working with your data and validate items before preparing for AI analysis. An investigation scope contains all the data items from your search results that you want to analyze and review. This data is now available for AI preparation and further review by analysts in your organization.

Access the investigation scope

Select the Analysis from navigation options at the top of any page within a specific investigation to access the investigation scope. The investigation scope includes a dashboard of scoped items and includes filter and viewer tools to help with item review.

Investigation scope dashboard

The investigation scope dashboard lists all the scoped data items in an investigation. This dashboard allows you to review details about individual data items and displays information about each item.

The investigation scope dashboard contains the following information and controls:

• Subject/Title: The subject/title of the data item.
• Exclude: The exclude status of a data item. Values are Yes or blank.
• Vectorized: The vectorization status of a data item. Values are Yes or blank.
• Date: The date and time the data item was last modified.

To customize the columns display on the investigation scope dashboard, select Customize columns to choose the columns to display or drag and drop the columns in the list to reorder.

To download the list of data items and the column information, select Download list to create a .csv file containing this information.

Grouping data items

When viewing a large list of data items in an investigation, it's often helpful to group the investigation scope by family or conversations and related items. Select Group to group data items by this criteria.

Review data items

To view detailed information about individual data items, select the item in the investigation scope dashboard or use Filters to narrow items based on specific attributes.

Filter items

Filters are automatically created based on the data items add to the scope of the investigation. Typical filter options include attributes such as Author, File class, Location name, Native file extension, Sender, and many more.

Expand a filter area and select one or more filters to refine the data items included in the investigation scope dashboard view. Each filter attribute lists the total number of data items matching the attribute.

For example, to view only email and email attachments, expand the File class filter and select the *Email and Attachment filters. The displayed data items are automatically filtered by the selected attributes.

View item details

Select a data item to display more information about the item. Use the investigation scope viewers to examine source, plain text, metadata, and audit details for the selected item.

Item actions

For each data item, you can choose to exclude an item for AI analysis or add the item to your mitigation plan. Select Actions on the command bar for these options. Review and exclude any redundant items for your investigation, such as system generated emails or meeting invites. Reducing redundant data in your investigation helps reduce data preparation time and improves overall AI insight quality.

All data items in the investigation scope are prepared for AI analysis unless explicitly excluded. You can change the status of any excluded data item later if you want to have the data item processed for AI analysis.

Prepare data for AI analysis

After you filter and review data items in the investigation scope, you're ready to prepare items for AI analysis. Preparing data items for AI analysis automatically vectorizes all items in the investigation scope that aren't marked as Excluded and allows you to use AI-based categorization and examination tools on these items. Preparing data for AI utilizes the latest Azure OpenAI embedding models to help improve the cost and performance of your AI results.

Preparing data for AI analysis doesn't require many SCUs, even for larger amounts of data included in an investigation scope. The following table provides an estimate of the required SCUs for different sized data sets.

From this table, you can see that only about one-tenth of a single SCU is required for significantly different sized data sets included in an investigation scope. Vectorizing large data sets typically doesn't require a significant number of provisioned SCUs.

Select Prepare data to start processing data items for AI analysis. When you prepare data, all unvectorized items are prepared for analysis. Previously vectorized items aren't revectorized. Items that don't contain text aren't vectorized. Some examples include:

• Calendar notifications
• Emails containing only images
• Image files (.jpeg, .png, .gif, etc.)
• Meeting invites

The vectorization processing status of data items is visible at the top of the investigation scope dashboard. Depending on the amount of scoped date, vectorization can take some time to complete.

Next steps

After AI preparation and vectorization is complete, you're ready to review and use AI analytics tools for the data in the investigation scope.