O365 DLP Rule Triggered

This analytic detects when Microsoft Office 365 Data Loss Prevention (DLP) rules have been triggered. DLP rules are configured for security, regulatory, or business compliance reasons. Detections from this analytic should be thoroughly evaluated to determine the security relevance of the underlying DLP events. The accuracy of this analytic depends on the upstream DLP configuration.