Data Loss Prevention
Handling a DLP incident
When a policy triggers, an incident is raised. Learn how to review the details, confirm whether it is a real risk, and follow up.
Every policy match becomes an incident you can review, so nothing slips by unseen.
What an incident contains
- The user, device, and time.
- The policy and rule that matched, and the channel involved.
- Supporting detail — and a screenshot when the policy captures one.
Triaging it
Confirm whether it was genuine data movement or a false positive. Genuine incidents can be escalated or documented for compliance; repeated false positives are a sign to tune the rule. Keeping policies in Monitor mode first makes this tuning low-risk.