DPL incident mgmt

[Deleted]

Regarding Data Loss Prevention (DLP) in Office 365, what are the ramifications of the incident status options (Active, Investigating, Resolved, Dismissed)?

Insight Dashboard (https://protection.office.com/#/insightdashboard) > Unusual volume of DLP policy matches detected. > Edit status

The reference material doesn't seem to go that far yet. 

https://support.office.com/en-us/article/overview-of-data-loss-prevention-policies-1966b2a7-d1e2-4d9...

[#2 · Accepted solution]

That is simply for your own organizations internal tracking status. It's designed to help you track the status of your "investigation" of the incident(s).