1,649 questions
Help understanding Confidence Levels for DLP Policies
ComputerHabit
1,036
Reputation points
I am trying really hard to understand confidence levels and what they mean in a DLP policy. Microsofts explanation just leaves me guessing on what is happening.
Can anyone explain WHAT is going on with them?
Classifiers have a confidence level.
DLP Policies have a confidence level for each Classifier you choose.
What is the relationship between these and the Instance Count?
I'm lost what this is good for any why it isn't explained better.
Microsoft Security | Microsoft Purview
{count} votes
-
PRADEEPCHEEKATLA 90,661 Reputation points Moderator2023-08-03T09:32:49.94+00:00 @ComputerHabit - Thanks for the question and using MS Q&A platform.
In the context of DLP policies, confidence levels refer to the level of certainty that a classifier has in identifying sensitive information in a document or data source. Classifiers are algorithms that scan through data sources to identify sensitive information such as credit card numbers, social security numbers, or other personally identifiable information (PII).
The confidence level of a classifier is a measure of how certain the algorithm is that it has correctly identified sensitive information. For example, a classifier may be 90% confident that it has identified a credit card number in a document.
When you create a DLP policy, you can choose which classifiers to use and set a confidence level for each classifier. The confidence level you set determines the threshold at which the DLP policy will take action on identified sensitive information.
For example, if you set a confidence level of 80% for a classifier, the DLP policy will only take action on identified sensitive information if the classifier is at least 80% confident that it has correctly identified the information.
The instance count refers to the number of times that a classifier has identified sensitive information in a document or data source.
In summary, confidence levels are a measure of how certain a classifier is in identifying sensitive information, and DLP policies use confidence levels to determine when to take action on identified sensitive information. The instance count refers to the number of times that a classifier has identified sensitive information.
I hope this helps! Let me know if you have any further questions.
-
ComputerHabit 1,036 Reputation points
2023-08-03T14:25:18.1933333+00:00 Thank you for your comments.
As I work on my understanding maybe a screenshot will help.
Below is a DLP policy I made:
and the results found in
The TW National ID and All Names are built in. I created the TW Birthday. It just looks for Chinese words for Birthday and looks for different date formats.
The test data I send in email is triggered. But I do not understand what would happen if I changed the DLP Policy from Low Confidence to High Confidence.
Also for some reason the test shows TW National ID had no results. I don't understand why. When I test the Sensitive Info Type it works.
Any insights you have would be helpful. I have read now 3 books on this topic and NONE have really explained what is happening. It's just HOW TO setup but not HOW TO USE...
-
PRADEEPCHEEKATLA 90,661 Reputation points Moderator
2023-08-07T06:53:03.2366667+00:00 @ComputerHabit - I agree that this issue looks strange and I wasn't able to reproduce this issue. If you have a support plan could you please file a support ticket for deeper investigation and do share the SR# with us?
Sign in to comment
Sign in to answer