Jan 08 2021 01:49 AM
Hello community,
We are working with MCAS DLP Feature and want to know if there is any way to identify the alerts with deleted files or where files dont match the policy anymore ? For example, I would like to know for a set of alerts if the user has deleted the file or changed the content.. Thanks in advance.
Regards,
Elmo
Jan 14 2021 12:31 AM
Jan 14 2021 02:13 AM
@AElmo15 Yes you can create a custom policy in MCAS for user deleting multiple files within a certain time period. In the policy, the activity type should be selected as 'FileDeleted'.