Instant Message Metadata

Metadata is collected on Instant Messages. This includes the properties of the Instant Message—the sender, recipient, (creation) date and time, subject, attachments, size, and so on.

Advanced metadata is collected for MS Teams and Slack Enterprise. For a detailed overview, see the table below.

Advanced IM Metadata collection is not supported for SlackPlus.
To ensure all IM Metadata is collected, indexing must be performed—see Configuring Teams Indexing and Configuring Slack Indexing.

With the metadata collected, System Messages can be included in your audit. A System Message will indicate when, for instance, a person of interest has joined a chat. The System Messages can be viewed, searched, and exported.