Handle an alert An analyst triages an Insider Risk Management alert. The alert list shows a pseudonymized user with status Needs review. The alert details show all risk factors and the user activity timeline around the triggering event. The analyst can dismiss the alert with a reason, assign it, or confirm it and create a case. Here the alert is confirmed and a case is created. Ronny notices nothing. W INSIDER RISK MANAGEMENT Handle an alert Ada Admin Eli Employee Ronny Insider TRIAGE An alert is a question, not an answer Is it real? Is it serious? Does it need a closer look? Triage answers those questions before anyone is contacted. IRM scores activity. People decide what happened. TRIAGE OPTIONS Three ways out of Needs review Microsoft Purview Alerts USERPOLICYSEVERITYSTATUSTIME DETECTED (UTC) ‹ Alerts AnonyRB-311 High Needs review Confirmed Actions ▾ All risk factorsActivity explorerUser activity Triggering event: exfiltration activity above the threshold History of recent user activity Confirm alerts & create caseDismiss alertsAssign Confirm alert and create insider risk case Case name Users to add as contributors Comments Create case with content download on (preview) Create case THE USER EXPERIENCE What does Ronny notice? His alert is now a case. Good to know 1/7 INSIDER RISK MANAGEMENT Handle an alert About a day later, the first alert arrives. We follow the analyst from Needs review to a confirmed alert: what the alert says, what the timeline shows, and when it becomes a case. informasjonsbeskyttelse.no