DLP Rule Issue

Sunil Kumar 0

Hi Team,

We want to create a rule in Keywords base DLP. We want allow emails alerts for external domains, such as gmail.com, yahoo.com, live.com, msn.com, rediffmail.com but we want to apply condition base rule like If there are two email id of our domain in the CC along with an external domain, an alert should not be triggered as this is a false positive.

Please help anyone on this.

PRADEEPCHEEKATLA-MSFT 89,296 Reputation points Microsoft Employee

2024-07-22T07:38:03.13+00:00
@Sunil Kumar - Thanks for the question and using MS Q&A platform.

To create a rule in Keywords base DLP, you can follow the steps mentioned in the document you shared. However, for your specific requirement, you can create a condition-based rule to avoid false positives.

To allow email alerts for external domains such as gmail.com, yahoo.com, live.com, msn.com, rediffmail.com, you can add these domains to the allowed list in the policy.

To apply a condition-based rule, you can create a custom condition that checks if there are two email IDs of your domain in the CC along with an external domain. If this condition is met, the alert will not be triggered.

To create a custom condition with an expression field, you can follow these steps:

In the policy editor, go to the "Conditions" tab and click on "Add condition".

Select "Custom condition" and give it a name.

In the "Expression" field, enter the expression that checks if there are two email IDs from your domain in the CC and at least one email ID from an external domain in the CC. The expression should be in the following format:

(countOfEmailsInCc(domain=="yourdomain.com")=2) && (countOfEmailsInCc(domain!="yourdomain.com")=1)

Save the custom condition.

Once you have created the custom condition, you can use it in your policy rule. When the condition is met, the alert will not be triggered, avoiding false positives.

For more details, refer to Create and Deploy data loss prevention policies.

I hope this helps! Let me know if you have any further questions.
PRADEEPCHEEKATLA-MSFT 89,296 Reputation points Microsoft Employee

2024-07-25T05:17:54.16+00:00

@Sunil Kumar - We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Sunil Kumar 0 Reputation points

2024-07-25T06:31:12.7633333+00:00

Hi,

We checked as per your suggestion but we did not found the custom condition option on compliance portal during creating the rule and more issue we are facing, on compliance portal we did not get all alert related Email dlp. Please help ASAP
PRADEEPCHEEKATLA-MSFT 89,296 Reputation points Microsoft Employee

2024-07-26T10:21:10.68+00:00

@Sunil Kumar - I agree that this issue looks strange and I wasn't able to reproduce this issue. If you have a support plan could you please file a support ticket for deeper investigation and do share the SR# with us?
Sunil Kumar 0 Reputation points

2024-07-26T10:36:17.7766667+00:00

I have created a support request for custom condition based rule. please contact me.

(#‎2407250030004110‎)
PRADEEPCHEEKATLA-MSFT 89,296 Reputation points Microsoft Employee

2024-07-29T06:46:04.86+00:00

@Sunil Kumar Thanks for sharing the support request number.

Once the issue has been resolved, please do consider sharing the solution, which might be beneficial to other community members reading this thread.
PRADEEPCHEEKATLA-MSFT 89,296 Reputation points Microsoft Employee

2024-08-08T10:03:12.8266667+00:00

@Sunil Kumar - Did your issue resolved?

Once the issue has been resolved, please do consider sharing the solution, which might be beneficial to other community members reading this thread.
Sunil Kumar 0 Reputation points

2024-08-08T10:33:36.19+00:00

Still Not resolve.

Share via

DLP Rule Issue

Your answer