Forum Discussion

mikerowlandlondon's avatar
mikerowlandlondon
Brass Contributor
Jun 11, 2018
Solved

Overrides and false positives in DLP policy end user experience

Ok so a user gets a policy applied to his/her document for let's say PCI compliance. On the policy tip we give the user the option to override with a business justification or to report as a false p...
data loss prevention
security
  • Simon Backwell's avatar
    Simon Backwell
    Jun 19, 2018
    No I'm not able to; I don't think you can.

    If someone does put down it's a false positive and it's not, I usually go and speak to the individual or email them. There's no way that I know of to reclassify it.

    I also have alerts turned on to me when people do it so when I get the email, it shows the override reason and false positive answers. If anyone puts anything that we don't agree with as being an acceptable answer, then we raise this with them/their line manager.
mikerowlandlondon's avatar
mikerowlandlondon
Brass Contributor
Jun 12, 2018

 

Found it ( I think) - im missing DLP Insights.  I have the DLP report but I'm not seeing the warning triangles / insight icon. 

VasilMichev's avatar
VasilMichev
MVP
Jun 12, 2018

The insights are fairly new addition, I don't have them in my tenant either.

  • Dean_Gross's avatar
    Dean_Gross
    Silver Contributor
    Jun 18, 2018

    VasilMichevdo you know if there was an announcement about this new feature? I don't remember seeing one.

    • mikerowlandlondon's avatar
      mikerowlandlondon
      Brass Contributor
      Jun 18, 2018

      Maybe I'm looking at the wrong thing? This isn't a new feature.

       

      I get a policy tip for a DLP rule

      I have the option to "report" my content as a false positive

      where the dickens does that report button end up? 

      I am expecting if there's a report button that somewhere I can go as a sec admin, view that report and either dismiss it and reply to the data owner or opt to reclassify and allow sharing.

      There seems no information anywhere about this and no one at Microsoft seems to have a clue about it from what I can see.

      If you have a report button then it must go somewhere or why have the button?

      • Simon Backwell's avatar
        Simon Backwell
        Copper Contributor
        Jun 19, 2018
        I've had this issue too; you don't actually get report as far I am aware. However, if you go to the DLP page and click the graph called DLP false positives and overrides, you can then see a graph of both results and change it to the actual details. You can also request a report of this information which will appear in the reports area.

        One thing to note is if you're not a domain admin and just compliance, you cannot schedule reports to come out automatically. Only a domain admin can do it and they only are visible to them (we tried this and my colleague only got the reports, not me; I have to get them manually).

        Hope this helps

Resources