I have received the following alert, but I am unable to locate the report in Compliance Centre. Can anyone give me guidance on where to look specifically? I only have default policies applied, but would like to look into this alert in more detail to understand what is happening and check it's legitimate.
Many thanks, Pete
A match of one or more of your organization’s policy rules has been detected.
Report Id: xxxxxxx-0906-4c2e-887b-85cd0e68e117 Person who last modified document: Severity: High False positive: No Override: No
Condition matched: External recipients Condition matched: Contains sensitive information
I had to run message message trace between that period and found email@example.com sending alert to user who send the emails . Its the same postmaster email which send report. Its lame way to find.
Other methods are audit logs search and ediscovery - didnt try though.