Recent DiscussionsMost RecentNewest TopicsMost LikesSolutionsTagged:TagRe: What is Enforcement mode in Activity Explorer This exists because Endpoint DLP has specific enforcement actions at the device level, unlike cloud-based workloads. Example: Copying a file with sensitive data to USB - WarnAndBypass (Endpoint DLP) Sending sensitive data via Exchange with override - DLP rule undo (Exchange DLP) Hope this clears it up! Re: Issue with Advanced Hunting in Security Portal Support team is currently looking at it: Re: Access Level Changed in Teams siastolf Maybe you should consider trying a custom query in Advanced Hunting with a detection rule? Where you check for newValue/public and oldValue/private? Re: Is it possible to scan specific BOX accounts from Microsoft defender for Cloud Apps? Santhmon I don't think this is possible Re: Advanced Hunting I keep getting this error on all cloudappevent queries: I noticed it 3 days ago: Semantic error Error message - between(): argument #1 - invalid data type: string How to resolve - Fix semantic errors in your query Issue with Advanced Hunting in Security Portal Hi all, Do you also have issue with Advanced Hunting? See attachment: Keep getting this error: Semantic error Error message: between(): argument #1 - invalid data type: string How to resolve: Fix semantic errors in your query SolvedRe: Purview integration - Where does the file content get scanned? Hi Charles1575 The scanning is typically done "in-place", meaning it scans the data where it resides without moving the actual content. The metadata might be sent to Purview's catalog though. If I understand you right your actual content of a file remains in its original location (e.g., Canada) during the scanning process. Mathias Re: Files Policy - Filter if the file is shared to a user that is a member of a specific group? HI Charles1575 I agree with Keith. But if you need to determine whether an external user is a "member of or not", consider the following approach: File Policy: Create a file policy. Within this policy, whitelist specific domains. Based on the domains and the applied sensitivity labels, you can then remove external users. This ensures that only users from trusted domains have access to files with specific sensitivity labels. Session Policy: Next, create a session policy using the type "Control file download (with inspection)". This policy allows you to set filters based on specific sensitivity labels. Under "Actions", you have the option to either "Block" or "Protect". If the goal is to prevent the download of sensitive files, opt for "Block". With these steps, you can ensure that your sensitive files are only accessible to specific users, and any unauthorized attempts to download these files are blocked. Mathias Re: New Survey | Microsoft Defender for Cloud Apps Feature Survey for CY24H1Feedback submitted!Re: Microsoft Defender for Endpoint integrationDid you find a solution? Otherwise let me know.
