Can someone sort out my issue with respect to Duplicate DLP incidents. When i checked DLP incident count of Email protection in DLP incident manager, it shows around 400 for past 24 hours. But when i exporting the DLP incident dump for email protection for past 24 hours, it gives around 30000 incidents.
After checking the incident dump, i got to know that Incident ID's are duplicate but evidence file different. I know its little confusing right, checked one incident ID in which user has sent around 20 attachment beacuse of this i'm getting huge number of duplicate incidents for one incident.
i would be more helpful if someone will solve my issue.
Not sure if you have the answer by now. However I am not seeing it as an issue rather per design. If you can please attach some screenshots, it will help me to answer it in a better way. Also is it a default query or custom query?
It is custom query & created for email protection incidents details in table format. In DLP incident manager, i could see around 230 incidents are generated for email protection incident type in the time frame of past 24 hours.
Below criteria used for query creation:
DLP(drop down) --> Data in motion DLP incidents/History
Report type : table
Columns : included required fields
Filter : 1. Incident type : Email protection & 2. Occurred endpoint(custom) - is with in last 24 hours
While running the query, i am getting around 4500 incidents. Which contains duplicate incident IDs & different evidence files.
I hope you got my reported issue. Kindly help me to eliminate the duplicate....