DLP Alert Received, but no report.

[HDpete]

Hi,

I have received the following alert, but I am unable to locate the report in Compliance Centre.  Can anyone give me guidance on where to look specifically?  I only have default policies applied, but would like to look into this alert in more detail to understand what is happening and check it's legitimate.

Many thanks, Pete

A match of one or more of your organization’s policy rules has been detected.

Report Id: xxxxxxx-0906-4c2e-887b-85cd0e68e117
Person who last modified document:
Severity: High
False positive: No
Override: No

Condition matched: External recipients
Condition matched: Contains sensitive information

[#2]

I had to run message message trace between that period and found postmaster@domain.com sending alert to user who send the emails . Its the same postmaster email which send report. Its lame way to find.

Other methods are audit logs search and ediscovery - didnt try though.