Abstract: Systems and techniques to automatically delete emails from an inbox associated with an employee in an enterprise are described. A message lifecycle engine that interfaces with a corporate email system may select an inbox of an email client application. The message lifecycle engine may delete an email in the inbox based at least in part on: (i) one or more sender rules associated with the email; (ii) one or more system rules associated with an email system used by the enterprise; (iii) one or more user rules created based on an analysis of user behavior; and (iv) one or more data loss prevention (DLP) policies.

Abstract: Systems and techniques to automatically delete emails from an inbox associated with an employee in an enterprise are described. A message lifecycle engine that interfaces with a corporate email system may select an inbox of an email client application. The message lifecycle engine may delete an email in the inbox based at least in part on: (i) one or more sender rules associated with the email; (ii) one or more system rules associated with an email system used by the enterprise; (iii) one or more user rules created based on an analysis of user behavior; and (iv) one or more data loss prevention (DLP) policies.

Abstract: Systems and techniques for assessing a risk associated with a data loss prevention (DLP) policy violation are described. Characteristics of data associated with the DLP policy violation and user information associated with a participant associated with the DLP policy violation may be determined. An expertise and a position of the participant may be determined and correlated with the one or more characteristics of the data to determine a risk assessment associated with the DLP policy violation. After determining that the risk assessment satisfies a threshold, a subject matter expert may be determined based on the characteristics of the data, and an alert may be sent to the subject matter expert requesting review of the DLP policy violation.

Abstract: Techniques and systems for prioritizing messages are described. The messages may be associated with multiple message accounts of an individual and the message accounts may be administered by different message account providers. The messages may be prioritized according to priority scores determined based on priority rules. The priority rules may include components that correspond to attributes of the messages. The priority rules may also include weights for each of the respective components of the priority rules. The prioritized messages may be viewed in a user interface. In some cases, a user may modify an order of the messages in the user interface and the system may utilize the feedback from the user to change a priority rule.

Abstract: In one embodiment, a method includes managing and controlling a plurality of data-access credentials. The method further includes accessing data from a plurality of sources in a plurality of data formats. The accessing includes using one or more data-access credentials of the plurality of data-access credentials. The one or more data-access credentials are associated with at least a portion of the plurality of data sources. The method also includes abstracting the data into a standardized format for further analysis. The abstracting includes selecting the standardized format based on a type of the data. In addition, the method includes applying a security policy to the data. The applying includes identifying at least a portion of the data for exclusion from storage based on the security policy. Additionally, the method includes filtering from storage any data identified for exclusion. Further, the method includes storing the data in the standardized format.

Abstract: Systems and techniques are described to display usage data that is collected regarding the employee's use of corporate computing resources and obtain the employee's permission to collect the usage data. The usage data that is collected may be determined. A user interface may display a plurality of categories associated with the usage data, including system usage data, activity data, identity data, content data, raw data that includes personally identifiable data, aggregated data that does not include personally identifiable data, anonymized data that does not include personally identifiable data, a combination of anonymized and aggregated data used to determine personally identifiable data, user access information, and third party application access. For each category of the plurality of categories, the user interface may display one or more additional employees that have access to the usage data. The user interface may receive a user selection to collect one of the plurality of categories of usage data.

Abstract: Systems and techniques are described to display usage data that is collected regarding the employee's use of corporate computing resources and obtain the employee's permission to collect the usage data. A data schema associated with the usage data may be determined. Data elements included in the usage data may be determined based at least in part on the data schema. A permission model associated with the usage data may be determined. Based at least in part on the permission model, one or more additional employees that have access to the usage data may be determined. The employee may use a user interface to display the type of usage data that is being collected and the one or more additional employees that have access to the usage data. The employee may use the user interface to provide permission to collect the type of usage data.

Abstract: Systems and techniques are described to display usage data that is collected regarding the employee's use of corporate computing resources and obtain the employee's permission to collect the usage data. A data schema associated with the usage data may be determined. Data elements included in the usage data may be determined based at least in part on the data schema. A permission model associated with the usage data may be determined. Based at least in part on the permission model, one or more additional employees that have access to the usage data may be determined. The employee may use a user interface to display the type of usage data that is being collected and the one or more additional employees that have access to the usage data. The employee may use the user interface to provide permission to collect the type of usage data.

Abstract: In one embodiment, a method includes activating a cross-platform DLP policy for enforcement against a plurality of users on each of a plurality of heterogeneous communications platforms. The method further includes monitoring communications of the plurality of users on each of the plurality of communications platforms for violations of the cross-platform DLP policy. The method also includes, responsive to a detected violation of the cross-platform DLP policy by at least one user on at least one communications platform, dynamically acquiring context information for the detected violation using information associated with the detected violation. In addition, the method includes publishing violation information to one or more designated users. The violation information includes at least a portion of the information associated with the detected violation and at least a portion of the context information.

Abstract: In one embodiment, a method includes providing an a priori classification engine, an a posteriori classification engine, and a heuristics engine. The a priori classification engine is operable to perform an a priori classification. The a posteriori classification engine is operable to perform an a posteriori classification. The heuristics engine is operable to perform a heuristics classification. In addition, the method includes accessing data from at least one source. The method further includes, responsive to an indication that the a priori classification should be performed, performing the a priori classification on the data. The method also includes, responsive to an indication that the a posteriori classification should be performed, performing the a posteriori classification on the data. Further, the method includes, responsive to an indication that the heuristics classification should be performed, performing the heuristics classification on the data.

Abstract: In one embodiment, a method includes maintaining, by a computer system, a plurality of data and at least one classification for each of the plurality of data. Each data of the plurality of data is aggregated from a plurality data sources and is abstracted into one or more of a plurality of standardized formats based on a type of the data. The computer system has executing thereon a plurality of classification engines. The plurality of classification engines include an a priori classification engine, an a posteriori classification engine, and a heuristics engine. Each at least one classification is generated by one of the plurality of classification engines. In addition, the method includes receiving query input from a user. Further, the method includes querying at least a portion of the plurality of data responsive to the query input.

Abstract: In one embodiment, a method includes maintaining, by a computer system, a plurality of data and at least one classification for each of the plurality of data. Each data of the plurality of data is aggregated from a plurality data sources and is abstracted into one or more of a plurality of standardized formats based on a type of the data. The computer system has executing thereon a plurality of classification engines. The plurality of classification engines include an a priori classification engine, an a posteriori classification engine, and a heuristics engine. Each at least one classification is generated by one of the plurality of classification engines. In addition, the method includes receiving query input from a user. Further, the method includes querying at least a portion of the plurality of data responsive to the query input.

Abstract: In one embodiment, a method includes collecting communications from a plurality of sources. The method further includes selecting a set of topics and a set of users. In addition, the method includes, for each user, identifying, from the collected communications, conversations in which the user has participated. Moreover, the method includes, for each topic, for each user: measuring a proportion of the identified conversations that contain content suggestive of the topic; analyzing timing of the identified conversations; and examining relationships among data attributes of the identified conversations. Further, the method includes generating multidimensional expertise data. The multidimensional expertise data is representative of the user's expertise on the topic. The multidimensional expertise data includes a topical dimension, an expertise-scope dimension, and a timeline dimension. The method also includes, for each topic, ranking the set of users by expertise index.