asked on

DLP Reporting Exchange 2016

Hello Team,

Can someone please help me with DLP reporting in Exchange 2016?

I have some transport rules inplace which is blocking the Credit Card, Driver's License and SSN.

I would like to get the report for the same to list Recipient, Sender, Rule Name and Time Stamp for last 7 Days.

Thanks
Krish

timgreen7077

DLP reporting in Exchange 2016 is not an easy task because its integrated with the message tracking logs, unless you know exactly what your are looking for it's difficult to actually get a report. The best way I can suggest going about this is adding an incident report to the DLP transport rule and send it to a mailbox. That way each time that rule is engaged it will send and email to the mailbox you choose and you can select which information you want it to send, including a copy of the email. Your requirements Recipient, Sender, Rule Name and Time Stamp can all be selected in the incident report. That is probably the best way because using the message tracking logs to find the rule is difficult if you can't be specific about the email you are after. Below is some info on the reporting:

https://docs.microsoft.com/en-us/exchange/view-dlp-policy-detection-reports-exchange-2013-help

ASKER CERTIFIED SOLUTION

krish5music

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

timgreen7077

nice

krish5music

ASKER

Hi Timgreen,

I got a question for you. Even though if we enable incident report for DLP, how can we get the count based on the category?

Is it possible?

Thanks
Krish