detection.wiki

DLP policy matches in Exchange M365-ComplianceDLPExchange

1 operation, identified by Operation in the audit log.

OperationDescription
_catch_allCatch-all for M365-ComplianceDLPExchange rules matching the RecordType but no specific Operation.

_catch_all: DLP policy matches in Exchange (catch-all)

#
RecordType
M365-ComplianceDLPExchange

Description

Catch-all for M365-ComplianceDLPExchange rules matching the RecordType but no specific Operation.

Fields #

NameDescription
RecordTypeAuditLogRecordType enum value (named string in Sentinel OfficeActivity; integer in the raw Management Activity API JSON).
OperationThe name of the user or admin activity. For Exchange admin activity this is the cmdlet name; for DLP it is DlpRuleMatch/DlpRuleUndo/DlpInfo. The per-event discriminator (event.action in Elastic ECS).
WorkloadThe Microsoft 365 service where the activity occurred (Exchange, SharePoint, AzureActiveDirectory, MicrosoftTeams, ...). Surfaces as event.provider in Elastic ECS.
ResultStatusWhether the action succeeded: Succeeded, PartiallySucceeded, or Failed (True/False for Exchange admin). For STS-logon events this reflects only the HTTP operation, not logon success: check LogonError.
UserIdUPN of the user who performed the action; system-account and app@sharepoint values also appear.
UserTypeType of actor: Regular, Admin, System, DcAdmin, Application, ServicePrincipal.
UserKeyAlternative ID for the user (the PUID for SharePoint / OneDrive / Exchange events).
ClientIPIPv4/IPv6 address of the device used; may be a trusted-app IP, and is null for Microsoft Entra ID events.
ObjectIdFor SharePoint/OneDrive, the full path of the file/folder; for Exchange admin, the object modified by the cmdlet; shape is operation-specific.
OrganizationIdGUID of the tenant's Office 365 organization (constant per tenant).
IdUnique identifier (GUID) for the audit record.
CreationTimeUTC date/time when the audit record was generated.
ScopeSource of the event: online (a Microsoft 365 service) or onprem (an on-premises service; currently SharePoint only).
AppAccessContextApplication context for the user or service principal that performed the action.
PolicyDetailsInformation about the one or more DLP policies that triggered the event.
SharePointMetaDataMetadata about the SharePoint/OneDrive document that contained the sensitive information.
ExchangeMetaDataMetadata about the email message that contained the sensitive information.
ExceptionInfoWhy a policy no longer applies, plus false-positive / end-user override information.
SensitiveInfoDetectionIsIncludedWhether the event includes the sensitive-data values and surrounding context (gated by a Purview permission).

Detection Rules #

View all rules referencing this event →

Elastic #

  • M365 Purview DLP Signal source low: Identifies Microsoft 365 Data Loss Prevention (DLP) and Data Lifecycle Management (DLM) signals from Microsoft Purview across Exchange, SharePoint, OneDrive, and endpoint devices. These events indicate potential data exfiltration attempts, policy violations involving sensitive data, or unauthorized sharing of classified information. This building block rule generates security events for correlation, threat hunting, and telemetry collection to support detection of collection and exfiltration activities.

References #