Forum Discussion

AElmo15's avatar
AElmo15
Copper Contributor
Jan 08, 2021

Deleted and Unmached files

Hello community,

 

We are working with MCAS DLP Feature and want to know if there is any way to identify the alerts with deleted files or where files dont match the policy anymore ? For example, I would like to know for a set of alerts if the user has deleted the file or changed the content.. Thanks in advance.

 

Regards,

Elmo

Cloud App Security

2 Replies

  • AnuragSrivastava's avatar
    AnuragSrivastava
    Iron Contributor
    Jan 14, 2021

    AElmo15 Yes you can create a custom policy in MCAS for user deleting multiple files within a certain time period. In the policy, the activity type should be selected as 'FileDeleted'.

  • mmancina's avatar
    mmancina
    Brass Contributor
    Jan 14, 2021
    Hi, I would check the Graph API for MCAS: https://docs.microsoft.com/en-us/cloud-app-security/api-introduction.

    Maybe you find something there.

    BR