Forum Discussion

mikerowlandlondon's avatar
mikerowlandlondon
Brass Contributor
Jun 11, 2018
Solved

Overrides and false positives in DLP policy end user experience

Ok so a user gets a policy applied to his/her document for let's say PCI compliance. On the policy tip we give the user the option to override with a business justification or to report as a false p...
data loss prevention
security
  • Simon Backwell's avatar
    Simon Backwell
    Jun 19, 2018
    No I'm not able to; I don't think you can.

    If someone does put down it's a false positive and it's not, I usually go and speak to the individual or email them. There's no way that I know of to reclassify it.

    I also have alerts turned on to me when people do it so when I get the email, it shows the override reason and false positive answers. If anyone puts anything that we don't agree with as being an acceptable answer, then we raise this with them/their line manager.
mikerowlandlondon's avatar
mikerowlandlondon
Brass Contributor
Jun 18, 2018

Maybe I'm looking at the wrong thing? This isn't a new feature.

 

I get a policy tip for a DLP rule

I have the option to "report" my content as a false positive

where the dickens does that report button end up? 

I am expecting if there's a report button that somewhere I can go as a sec admin, view that report and either dismiss it and reply to the data owner or opt to reclassify and allow sharing.

There seems no information anywhere about this and no one at Microsoft seems to have a clue about it from what I can see.

If you have a report button then it must go somewhere or why have the button?

Simon Backwell's avatar
Simon Backwell
Copper Contributor
Jun 19, 2018
I've had this issue too; you don't actually get report as far I am aware. However, if you go to the DLP page and click the graph called DLP false positives and overrides, you can then see a graph of both results and change it to the actual details. You can also request a report of this information which will appear in the reports area.

One thing to note is if you're not a domain admin and just compliance, you cannot schedule reports to come out automatically. Only a domain admin can do it and they only are visible to them (we tried this and my colleague only got the reports, not me; I have to get them manually).

Hope this helps
  • mikerowlandlondon's avatar
    mikerowlandlondon
    Brass Contributor
    Jun 19, 2018
    "you can then see a graph of both results and change it to the actual details" - could you attach a screenshot of what you mean? My graph (and report) are both decidedly non interactive!!
    • Simon Backwell's avatar
      Simon Backwell
      Copper Contributor
      Jun 19, 2018

      Hi Mike

       

      Hopefully these help; if you click on Show details table, it will show the details of any overrides and false positives. Just to note that my screenshot currently doesn't as we have a ticket open with MS about policy tips not working on Outlook but okay on OWA (don't know if anyone else is experiencing this). 

       

      Simon

      • mikerowlandlondon's avatar
        mikerowlandlondon
        Brass Contributor
        Jun 19, 2018

        Thanks Simon!

         

        I get that report but I can't interact with it? Are you able to?

        As my point above I can see someone has reported something as a false positive but there seems to no way for an admin to say "ah ok, that's fine, I'll reclassify it and away you go"

        Thanks for your help!

Resources