Action 'Get-LabelPolicy' and 'Get-AutoSensitivityLabelPolicy' by User '<SNIP-PII>'
Ian Jeferson Salac
0
Reputation points
We have been receiving detections related to User Access Sensitivity Label Policy with actions stating these commands have been executed 'Get-LabelPolicy' and 'Get-AutoSensitivityLabelPolicy'. The user.id associated with it is named '<SNIP-PII>'
As what I've understand it appears to be that the user's information that initiated this has been redacted. Am I understanding this correctly? I want some insights would be glad to know about it.
Thank you!
Sign in to answer