Forum Discussion
Defender 365 - SmartAlerts: User exfiltrating sensitive information via Removable Media
Hi, In the past few days we have started seeing incidents/alerts for "SmartAlerts: User exfiltrating sensitive information via Removable Media". We do not believe we have enabled any features or ...
I have started seeing these with a customer too but I am unable to track them down. Issue is they are raising as a high causing too much noise for the SOC.
I am assuming no one has been able to track them down yet?
I am assuming no one has been able to track them down yet?
- I have a new case open with them as we've started to get new alerts. So far nothing but I'll update if we get some direction. So far, I've been unable to figure out how to turn off the out of box sensitive info types in Purview or tune the Smart Alert directly. Needless to say, we don't have any slovenian tax ID numbers in our environment.
