API to retrieve DLP alerts along with relevant details

Question

Hello, Is there a way to programmatically retrieve DLP alerts and associated details from Microsoft Purview? We want to export the alerts and forensic data into our own dashboard (rather than using Defender or Sentinel).

Answer 1

There's no specific direct way to programmatically retrieve DLP (Data Loss Prevention) alerts and associated details from Microsoft Purview. Microsoft Purview primarily focuses on data governance, including cataloging, classification, and protection of data, but it doesn't directly manage or provide APIs for DLP alerts. If you're looking to integrate DLP alerts into another dashboard or system, you might need to look into options provided by Microsoft 365 Compliance Center, which manages DLP policies and alerts. You may be able to use Microsoft Graph API's alert methods to list, create, get, update, and delete alerts from the security and compliance alert collection. However, please note that these APIs might not provide all forensic details related to DLP policy matches, so you will need to check their documentation thoroughly to ensure they meet your requirements.