Forum Discussion
Search for Credit Card Numbers within tenant
You are in the right path:
Using eDiscovery, you can use the Content search function. Once content search finishes searching for information > you can export a report that contains details (there is a limit of 2TB for the exported file)
Exporting data from Content Search: https://learn.microsoft.com/en-us/purview/ediscovery-export-search-results
Additionally, you can create a DLP policy that points inwards. You're DLP policy would have the following in the rules:
Policy is for SharePoint and OneDrive
Rule: IF data contains Sensitive Information Type (1) PAN or (2) CCN then trigger. Recommended to change the confidence level to High. No action taken
Run policy: Simulation/ Audit mode. So that it doesn't change or affect anything in your org.
Another option:
In Content explorer, there is an SIT section, you'll get ALL (and I do mean ALL) data that matches PAN and CCN. You can export this list too in excel. Then you can use excel to count.
Thank you both - really appreciate the advice. I keep playing with Purview eDiscovery, custom SIT that match exactly what I need, also playing with Content Explorer and Data Explorer, created DLP (this was super helpful) based on your recommendations... and getting some useful data now. Just need to tune it up a little to get the most accurate info.
MicrosoftIf you create a new custom SIT, only content created/modified after that SIT was created would be evaluated and will show up in content explorer/ eDiscovery search. For historical content not being used, you will need to run a scan using the on-demand classification capability - https://learn.microsoft.com/en-us/purview/on-demand-classification