Data Loss Prevention Incident Response with Microsoft
The Data Loss Prevention Incident Response with Microsoft provides a core framework to import Data Loss Prevention (DLP) incidents from multiple sources, such as Microsoft Purview apps, Microsoft Teams, Exchange Online, SharePoint Online, OneDrive for Business, and other event types.
Request apps on the Store
Visit the ServiceNow Store to view all the available apps, and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.
Overview and key features
The Data Loss Prevention Incident Response integration with Microsoft enables organizations to gain a unified view of incidents across email, network, endpoint, and cloud sources. Endpoint devices enable remediation workflow involving end users, managers, and DLP operations team with automated incident assignment and escalations.
Use the key features of this integration to do the following actions:
- Create multiple profiles for different accounts.
- Automate the creation of DLP IR incidents.
- Map the Microsoft DLP IR event fields to DLP IR incident fields.
- Filter Microsoft DLP IR events.
- Schedule the ingestion of DLP IR events that create DLP IR incidents periodically.
- Store the matching content of each Microsoft DLP event in external cloud storage.
- Delete matching content at external cloud storage on the deletion of the DLP IR incident in ServiceNow.
- Download files for DLP IR incidents of type Exchange, OneDrive, and SharePoint.
Learn about this integration
| Document identifier | Document title |
|---|---|
| Microsoft product documentation website | Microsoft Product Documentation website |
| ServiceNow product documentation website | ServiceNow Product Documentation website |
- Getting started with Microsoft DLP IR integration for data loss prevention
Review the following information before you start setting up your Microsoft DLP IR integration for data loss prevention. - Install and configure the Microsoft DLP integration
Install and configure the DLP Incident Response integration with Microsoft DLP from the ServiceNow® Store on your ServiceNow AI Platform instance. Start investigating DLP incidents using the Microsoft DLP event data. - Create a new incident profile for Microsoft DLP integration
Create an incident profile in your ServiceNow AI Platform instance to retrieve the data from the Microsoft Purview and add the data into the ServiceNow DLP IR incident table. - Configure Microsoft DLP IR integration settings
Modify the Microsoft DLP IR integration default system properties. - Request release email from quarantine
Use this feature to release the email that is quarantined from the Microsoft Purview compliance portal. - Download files for DLP incidents of type Exchange Online, OneDrive, and SharePoint
Download files or email that violates the DLP policy on Microsoft Purview. Download this file or email on to your local machine from the DLP IR Incident view. You can download the files for DLP IR incidents of type Scan source Exchange Online, OneDrive, and SharePoint. - Preview Evidence files for DLP incidents of type Exchange Online, OneDrive, and SharePoint
Preview Data Loss Prevention Incident Response evidence files in the DLP IR Analyst workspace. - Domain separation in Microsoft DLP integration
Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can then control several aspects of this separation, including which users can see and access data.
Parent Topic:DLP integrations
Related topics
Symantec Integration for Data Loss Prevention Incident Response
Data Loss Prevention Incident Response Integration with Proofpoint
Data Loss Prevention Incident Response Integration with Netskope
Internet Content Adaption Protocol (ICAP) integration for DLP IR