How can DLP alerts be filtered before reaching into Alerts and Incidents table in Sentinel?

Question

Goal - how to stop dlp alerts before reaching to the tables. Not interested in using any automation or playbooks.

There is a single data connector which has defender suite alerts. Even If, no dlp alerts and incidents are enabled, it reaches to alert and incidents. No analytics rules are enabled.

We have separate team for SOC and DLP under different organization, and every team needs to see their own alerts. How do we stop them reaching to the tables in Sentinel?

clive_watson · Answer

wonder_wolf&nbsp;&nbsp;From your description it sounds like you are getting these alerts from the Microsoft 365 Defender connector.&nbsp;&nbsp;The only way I know is to use an Automation Rule to action these.&nbsp; You could take an Action of "Change Status" to "Closed" as an example, adding a comments or even a Tag.&nbsp;&nbsp;&nbsp;&nbsp;

clive_watson · Answer

wonder_wolf&nbsp;if its from M365 it's not the same as Purview.&nbsp; Personally I'd look at some of them and assess if you want to drop them in Sentinel.&nbsp; They will still be in the source system.

wonder_wolf · Answer

Will it impact any ML in the Purview? DLP is owned by separate team not SOC. Is there a work around for this limitation?

wonder_wolf · Answer

Thank you indeed for your response. Is it the same for MDCA alerts since it also creates alerts info protection alerts that is also related to other teams?

clive_watson · Answer

Its the same for the ~12 products listed in my second screen shot. If you are confident your other teams are looking at those portals then you can supress these in Sentinel/SOC. Even if the other teams own those solutions the SOC might want to look for spikes or trends even if you are not acting on them. e.g. There are usually 50 DLP alerts per week, but today you saw 50 which you believe is an anomaly that you can alert the other team on. Or maybe you see a high closure rate from a person not seen before (is that an attacker, hiding the alerts) etc...

Forum Discussion

How can DLP alerts be filtered before reaching into Alerts and Incidents table in Sentinel?

8 Replies