Forum Discussion
Defender 365 - SmartAlerts: User exfiltrating sensitive information via Removable Media
Hi, In the past few days we have started seeing incidents/alerts for "SmartAlerts: User exfiltrating sensitive information via Removable Media". We do not believe we have enabled any features or ...
Hi Mike,
We too have started getting these. I have been searching pretty hard to find information about them. I just found this today and I also found a page that does talk about SmartAlerts, a bit and wanted to share it with the community.
https://techcommunity.microsoft.com/t5/security-compliance-and-identity/learn-how-microsoft-purview-information-protection-discovers-and/ba-p/3777181
You can find them talking about SmartAlerts in line item #3.
Hopefully this helps out. I know for me it did and I understand the system a bit more. However, you cannot tune these from my understanding... Nor have I found anywhere else that has talked about them.
We too have started getting these. I have been searching pretty hard to find information about them. I just found this today and I also found a page that does talk about SmartAlerts, a bit and wanted to share it with the community.
https://techcommunity.microsoft.com/t5/security-compliance-and-identity/learn-how-microsoft-purview-information-protection-discovers-and/ba-p/3777181
You can find them talking about SmartAlerts in line item #3.
Hopefully this helps out. I know for me it did and I understand the system a bit more. However, you cannot tune these from my understanding... Nor have I found anywhere else that has talked about them.
Has anyone found a way to tune these "smart" alerts or disable them?
- No, I raised a ticket with MS, and they wasted 2 months assigning it to the wrong teams, that all misquoted old or out of date guides, they didn't understand the product.
I eventually gave up and created an automation rule to close them.
