Reviewing and analyzing DLP reports

With both the DLP Policy Matches report and the DLP Incidents report page, there is a chart and a table you will be able to view that display information based on their corresponding events.

When analyzing both these reports, you have the ability to break down the charts and separate them by either of the following:

• Affected service
• Enforced action
• Applied policy

You will need to familiarize yourself with the existing filters of DLP that will aid you in fine-tuning the policies and limit the false positives and overrides.

Reviewing DLP policy matches

When you are utilizing DLP policy match reports, it is recommended to use filters to reduce the report to particular policies. This will aid in lowering the number of matches that are viewable and concentrate on the effect of the specific policies in your tenant.

Imagine a scenario in which you created a new policy to protect financial content a week ago and it is...