Investigate data loss prevention alerts in Microsoft Purview
To view DLP Alerts from DLP Policies created in Microsoft Purview use the following steps:
In the Microsoft Purview compliance portal, https://compliance.microsoft.com on the left menu pane under Solutions, select Data loss prevention.
Select the Alerts tab to view the DLP alerts dashboard.
Choose filters to refine the list of alerts. Choose Customize columns to list the properties you want to see. You can also choose to sort the alerts in ascending or descending order in any column.
Select an alert to see details.
Select the Events tab to view all of the events associated with the alert. You can choose a particular event to view its details.
Select the Sensitive Info Types tab to view details about the sensitive information types detected in the content. Details include confidence and count.
After you investigate the alert, choose Manage alert to change the status (Active, Investigating, Dismissed, or Resolved). You can also add comments and assign the alert to someone in your organization.
To see the history of workflow management, choose Management log.
After you take the required action for the alert, set the status of the alert to Resolved.