none
DLP incident report is not functioning properly for exchange server 2013

    Question

  • Hello,

    I have applied DLP policy for passport and swiftcode, both rules are working but facing problem with incident report.

    According to DLP, when any rule will be detected then a incident report will be generated and moderator will receive one rule detected email against that rule. But in my organization, my moderator is receiving multiple email against one rule. As example, if a user sends an email (DLP policy matched email) to 5 users the moderator gets 5 incident reports instead of one .

    Thanks,

    Aparna

    • Edited by Apu2016 Wednesday, June 22, 2016 7:23 AM
    Wednesday, June 22, 2016 6:39 AM

Answers

  • Hi,

    Please post the result of the following command for troubleshooting.

    Get-DlpPolicy "PolicyName" | fl

    Best Regards.


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com

    Lynn-Li
    TechNet Community Support

    Friday, June 24, 2016 6:39 AM
    Moderator

All replies

  • We can't help much when you don't share the details of what you've configured.

    Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."
    Celebrating 20 years of providing Exchange peer support!

    Wednesday, June 22, 2016 2:48 PM
    Moderator
  • Hi,

    Please post the result of the following command for troubleshooting.

    Get-DlpPolicy "PolicyName" | fl

    Best Regards.


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com

    Lynn-Li
    TechNet Community Support

    Friday, June 24, 2016 6:39 AM
    Moderator