Veritas Data Insight Administrator's Guide

The Collector node is configured on Windows Server 2012 R2 or Windows Server 2016.

Ensure that you are aware of the SharePoint Online Account Administration Center Site URL that you want Data Insight to monitor.

The Global administrator and the SharePoint administrator accounts are configured in the Office 365 admin center. This account should have administrative privileges on the target site collections and should be an owner for team site collections.

See Configuring an administrator account for Data Insight.

The DataInsightSPOnline service is configured and running on the Collector node. This service is responsible for discovering the site collections and scanning the Online account hierarchy for metadata and to gather the audit events.

See Configuring Data Insight services. for information about the Data Insight services.

Create a role with View-only audit log privilege. This user credentials are used by Data Insight to collect SharePoint Online audit logs.

Do the following:

Ensure that you use the same user credentials with role as SharePoint administrator.

For more information, see

https://support.office.com/en-us/article/Turn-off-audit-log-search-in-Office-365

Note that Data Insight fetches audit data using PowerShell PS Remoting.

On the Windows Server, ensure that the execution policy is set to RemoteSigned. This permits running of PowerShell scripts for device discovery and audit data collection. To configure the policy, start Windows PowerShell as administrator, and run the following commands:

To view the configured execution policy:

Get-ExecutionPolicy

To configure the execution policy to RemoteSigned:

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope LocalMachine

Enable auditing in Office 365 Admin Center.

To enable auditing, in Office 365 Admin Center navigate to Security and Compliance > Search and investigation > Audit log search. Click Start recording user and admin activities.

Note that it takes 24 hours for the audit logs to start appearing on the Audit log search page.

If your organization requires internet connections to pass through a proxy server, edit the proxy_server.properties file to update the proxy settings.

Do the following: