Azure Sentinel and DLP

%3CLINGO-SUB%20id%3D%22lingo-sub-2001907%22%20slang%3D%22en-US%22%3EAzure%20Sentinel%20and%20DLP%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2001907%22%20slang%3D%22en-US%22%3E%3CP%3EI%20already%20configured%20to%20Injest%20logs%20to%20Azure%20Sentinel%20for%20DLP%20incidents%20but%20it%20does%20not%20generate%20incident%20when%20I%20test.%26nbsp%3B%3CBR%20%2F%3E%3CBR%20%2F%3EFollowed%20this%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fazure-sentinel%2Fingest-office-365-dlp-events-into-azure-sentinel%2Fba-p%2F1031820%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fazure-sentinel%2Fingest-office-365-dlp-events-into-azure-sentinel%2Fba-p%2F1031820%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2002025%22%20slang%3D%22en-US%22%3ERe%3A%20Azure%20Sentinel%20and%20DLP%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2002025%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F752993%22%20target%3D%22_blank%22%3E%40ItsMeMichael%3C%2FA%3E%26nbsp%3BNot%20sure%20if%20it%20matters%20but%20I%20noticed%20my%20Operation%20name%20is%20%22DlpRuleMatch%22%20and%20*NOT*%20%22DLPRuleMatch%22%20as%20shown%20in%20the%20article.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

I already configured to Injest logs to Azure Sentinel for DLP incidents but it does not generate incident when I test. 

Followed this: https://techcommunity.microsoft.com/t5/azure-sentinel/ingest-office-365-dlp-events-into-azure-sentin...

1 Reply

@ItsMeMichael Not sure if it matters but I noticed my Operation name is "DlpRuleMatch" and *NOT* "DLPRuleMatch" as shown in the article.