eDiscovery

Overview

eDiscovery works on top of legal holds (Govern → Records → Legal holds). A legal hold keeps everything Shield360 holds about named people and computers, whatever its normal retention. An eDiscovery case gathers the holds for one matter. In a case you can:

• Search the held records by keyword, phrase or boolean query, person or computer, period, source and sensitive data type. You see hit counts before anything is added.
• Review hits in review sets: tag each item as responsive, not responsive, privileged or with the case’s own tags, and add notes. Progress counts show how far review has got.
• Export a review set as a ZIP with the items as JSON Lines and CSV, and a manifest with SHA-256 hashes and the chain of custody.

Every search, case view, review-set view, tag and export is recorded in the audit log (Govern → Records → Audit log).

Note

A review set points at the records a legal hold keeps. Nothing is copied. When a hold is released its copies are removed, and the items that pointed at them are shown and exported as missing.

Prerequisites

• At least one legal hold in the environment (Govern → Records → Legal holds). Holds copy collector records, AI session spans and AI agent actions (activity provenance) about their people and computers every hour.
• One of the eDiscovery permissions. Owners, administrators and the Compliance officer role have all four:

Permission	Key	What it allows
Open eDiscovery cases	ediscovery.view	Open the cases you are a member of, search them and read their review sets.
Review eDiscovery items	ediscovery.review	Tag items and add notes.
Manage eDiscovery cases	ediscovery.manage	Open and close cases, give them holds and members, and build review sets. Sees every case in the environment.
Export eDiscovery review sets	ediscovery.export	Download a review set with its manifest.

eDiscovery is part of the Compliance module.

Open a case

Open Compliance → eDiscovery

Choose the environment in the header. A case belongs to one environment, like its legal holds.

Select New case

Give the case a name, and optionally a matter or docket number, notes and tags of its own (for example hot or follow-up).

Choose its legal holds

Tick the holds the case owns. A hold belongs to one case at most. You can add or remove holds later on the Case tab.

You become the case’s manager. Add reviewers on the Case tab by the e-mail address of a member of your organisation. People with ediscovery.view but not ediscovery.manage see only the cases they are members of.

Search a case

On the Search tab, combine any of these. A search must narrow by at least a query, a person or computer, a period or a sensitive data type.

Filter	How it works
Keywords	Words match anywhere in a record, ignoring case: contract also finds contractor. Use "quotes" for a phrase, AND, OR, NOT (or -word) and brackets. Words next to each other mean AND. At most 32 words or phrases.
People and computers	A person matches the user name a record was filed under, ignoring case; a computer matches its host name.
From and To	The time the record describes, not when it was preserved.
Sources	Collector events, data protection events, AI sessions and traces (coding-agent sessions and SDK spans), AI agent actions (activity provenance), and the other held sources.
Mentions sensitive data	Records with a masked value of that kind (for example [email:fp_…]) or a data protection event that found it.

acme AND ("price list" OR contract) NOT draft

The result shows how many records match, by source and by person or computer, and the 50 most recent hits with an excerpt. Then choose a review set (or name a new one) and select Add. The server runs the recorded search again and adds every hit, up to 50,000 items per review set. A record already in the set is not added twice.

Note

Prompts and responses are searchable only where your organisation chose to store content (data retention). Elsewhere a search finds what was kept: people, computers, tools, sites, actions and masked tokens.

Review

On the Review sets tab, open a set to see its items, oldest first, 25 to a page. For each item you can show the record as it was preserved, and save a note.

• Select items (or Select this page), then choose a tag under Tag as. Responsive and Not responsive replace each other.
• Use Remove tag to take a tag off the selected items.
• Filter by tag or by Not reviewed.

An item counts as reviewed once someone has tagged it or saved a note. The set shows how many items are reviewed and how many carry each tag.

Export a review set

Select Export on an open review set. To export part of it, tick tags under Only items tagged: an item is included when it carries any of them.

The ZIP contains:

File	Contents
items.ndjson	One line per item: its reference (hold, source, record key), the time, the person and computer, tags, note, reviewer, the SHA-256 of the record, and the record as preserved.
items.csv	The same without the record. Cells that would start a formula are prefixed with '.
manifest.json	The case, review set and holds; the searches that built the set; who exported it and when; the item counts by tag; the SHA-256 and size of both files; and chainOfCustody, every earlier export of the set with its manifest’s SHA-256.

Each export is recorded with the SHA-256 of its manifest and of the manifest before it, so the exports of a set form a chain. The response also carries the manifest’s hash in the X-Manifest-SHA256 header.

To check an export, compare each file’s SHA-256 with the manifest:

unzip shield360-ediscovery_<set>_<export>.zip -d export
cd export
shasum -a 256 items.ndjson items.csv
jq '.files' manifest.json
shasum -a 256 manifest.json   # matches the hash recorded for the export

Close a case

On the Case tab, give a reason and select Close case. A closed case can still be searched, read and exported, but nothing in it changes until a manager reopens it. A case is never deleted except with its organisation.

Data and privacy

• Review sets hold references to held records, never copies. The records stay in the legal-hold store and follow their hold.
• Searches are recorded with the case (criteria, hit counts, who and when) so you can show how a review set was built. The audit log records each search’s id, hit count and the shape of its criteria, not the words searched for.
• All search values are sent to ClickHouse as query parameters. No part of a query is written into SQL.

API

Method and path	Permission
GET /api/compliance/ediscovery	ediscovery.view
POST /api/compliance/ediscovery	ediscovery.manage
GET, PATCH /api/compliance/ediscovery/cases/{id}	ediscovery.view, ediscovery.manage
POST /api/compliance/ediscovery/cases/{id}/holds	ediscovery.manage
POST /api/compliance/ediscovery/cases/{id}/members	ediscovery.manage
POST /api/compliance/ediscovery/cases/{id}/search	ediscovery.view
POST /api/compliance/ediscovery/cases/{id}/review-sets	ediscovery.manage
GET /api/compliance/ediscovery/cases/{id}/review-sets/{setId}	ediscovery.view
POST /api/compliance/ediscovery/cases/{id}/review-sets/{setId}/items	ediscovery.manage (add a search’s hits)
PATCH /api/compliance/ediscovery/cases/{id}/review-sets/{setId}/items	ediscovery.review (tag and note)
POST /api/compliance/ediscovery/cases/{id}/review-sets/{setId}/export	ediscovery.export

These routes need a signed-in user; API keys cannot use them. Malformed JSON gets 400; a case outside your environment, or one you are not a member of, gets 404.

Next steps

• Data retention
• Evidence package
• Activity provenance