Aggregate alerts not showing up for Email DLP
Hi, I’m unable to see the “Aggregate alerts” option while configuring an Email DLP policy, although the same option is visible for Endpoint DLP. The available license is Microsoft 365 E5 Information Protection and DLP (add-on). If this is a licensing limitation, why am I still able to see the option for Endpoint DLP but not for Email DLP? Screen short showing option for Endpoint DLP alertsIssue with the Canadian Drivers License SIT
Did any face an issue with the Canadian Driver's License SIT in the DLP policy? We see a lot of false positives especially around BC province number, NB, PrinceEdward Island and Saskatchewan. These provinces has just digits which can flag any kind of digits. Even if we use some custom RegEx and reduced keyword list, it still flags a lot of false positives. We see this as more and more customers are not happy with it. Has anyone found a breakthrough or best solution for deploying the Canadian Driver's License DLP?
Unknown DLP Policies Triggering IRM Alerts
Two unknown DLP policies are triggering high severity IRM alerts, and these policies are not showing in our DLP policy list. The policies names are: FileCopiedToRemovableMedia (Preview) FileUploadedToCloud (Preview) Additionally, there are no associated events in Activity Explorer. These alerts are causing confusion with our Security operations because they result in Sentinel incidents.
Onboarding Devices: "No authenticated user found"
Hi, I am looking to onboard a device in Purview for the purpose of testing some Endpoint DLP policies. I have ran the onboarding script locally and the device successfully appears on the 'Devices' screen. 'Real time protection/RTP' and 'Behavior monitoring/BM' both show as 'enabled' with a green tick, however under 'Valid User' it has a red cross and states: "Invalid: No authenticated user found. Without proper authentication, data classification is impeded. To ensure precise validation, we recommend re-onboarding to Active Directory". The device is in active directory. I have signed into the device with an account that is also in Active Directory. Is there anything additional that I need to do? Any help would be really appreciated - thank you!!!Real Time Monitoring and Behavior Monitoring
Good afternoon, I am running into an issue with DLP protecting endpoints, the following are the findings: In purview: - Real-Time Monitoring Enabled - Behavior Monitoring Enabled The devices are using CrowdStrike as the active AV client and the Defender AV client is in EDR Block Mode however when testing Policies that should restrict USB, Printing, and Copy and Paste of Sensitive Data the policies are not being enforced. The test device is not generating any alerts or notifications in the Purview portal or Toast Notifications. Policies are enforced via GPO: - Real Time Monitoring - Behavior Monitoring Endpoints have Windows Defender FW and Crowdstrike enabled, but have been disabled on the test device. Any insights on why the devices are showing in the MDE Portal that RTM and BM are disabled
Upload to a restricted cloud service domain or access from an unallowed browser
-The action in DLP rules "Upload to a restricted cloud service domain or access from an unallowed browser" does not seem to be working as expected. -Currently a number of policies are meant to detect certain sensitivity labels as well as certain information types and among the actions taken to restrict data/files being shared, Is the action named above. -The activity explorer shows the policy match but the enforcement action is always audit instead of block(which is specified in the policy) -Service domains and domain groups are added with an action of block in DLP settings. -Unallowed browser also specified. What could be the issue here? Any Ideas?exclude network share
i have enabled network share coverage and exclusions within the dlp settings and i have added a network share path in the exclusion list with the following format \\10.10.10.10\ i'm still getting alerts for file copied to network share activity, am i doing it right? do i need to be more specific? the file server has multiple directories and folders, i want to exclude all
