Forum Discussion
Threshold based dlp block in Purview DLP
Hi All, Just wanted to know if there is a way to add threshold based email block for sensitive info types. Example: If there are 3 unique Social security numbers keywords matched only then block....
Yes you can. When you create a rule in a policy, and you add your SIT (where you have your keywords), you can then specify an incident count. In the action you set that to block.
If you want to do slightly different actions based on the numbers, you can add a second rule right higher numbers. Just be careful to put the rules in the order you want them processed since that matters.
Hi dominicirrcher ,
Thank you for the feedback. Do you mean this field? If yes, then if I put 3 in the instance count field, then it would block only if 3 keywords from the SIT dictionary?
Thanks,
yes, that field, and it would block if there are 3 (or more) detections by the sit details.