Forum Discussion

VAloine

Copper Contributor

Nov 28, 2024

Solved

DLP rule to monitor bulk export or downloads

Is there a way to create a dlp rule in purview to trigger when bulk documents are being downloaded or exported

insider risk management

Joseph-Berbary
Dec 05, 2024
I believe your requirements can be addressed using Insider Risk Management, specifically through the Data Leaks policy. You can configure triggering events, such as "downloading files from a SharePoint Online site" exceeding a certain threshold or uploading files to the web. This setup will generate an Insider Risk Management alert, enabling the system to monitor the flagged user's activity over a defined past and future period for the specific indicators you select.

Joseph-Berbary

Brass Contributor

Dec 05, 2024

I believe your requirements can be addressed using Insider Risk Management, specifically through the Data Leaks policy. You can configure triggering events, such as "downloading files from a SharePoint Online site" exceeding a certain threshold or uploading files to the web. This setup will generate an Insider Risk Management alert, enabling the system to monitor the flagged user's activity over a defined past and future period for the specific indicators you select.