Create the first policy An administrator creates an Insider Risk Management policy from the Data leaks template: name, all users in scope, sensitivity labels as priority content, an exfiltration activity as triggering event, indicators and sequence detection, and thresholds based on the users' activity. Past activity detection also scores activity up to 90 days before the trigger. Ronny emails the customer list to his private address and notices nothing. W INSIDER RISK MANAGEMENT Create the first policy Ada Admin Eli Employee Ronny Insider THE FIRST POLICY Start with the risk everyone has Start with the recommended settings, and tune as alerts come in. POLICY TIMEFRAMES Before and after the trigger Microsoft Purview Policies User Policies Agent Policies + Create policy ▾ Start scoring activity for users Policy nameStatusUsers in scopeActive alertsConfirmed alerts IRM data leaks Healthy 000 Insider risk management › New policy Choose a policy template Data leaks Data leaks Data leaks Detects data leaks by any user included in this policy.Data leaks can range from accidental oversharing ofinformation outside your organization to data theftwith malicious intent. Prerequisites DLP policyOPTIONAL Devices onboardedOPTIONAL Physical badging connectorOPTIONAL Triggering event User performs selected exfiltration activitiesthat exceed the thresholds Name your policy Name * Description Users and groups Decide whether to prioritize content You can prioritize content based on factors like where it's stored and how it's classified. Risk scoresare increased for any activity that contains priority content. Next step: choose what to prioritize Confidential Strictly Confidential Choose triggering event for this policy Choose one or more triggering events to determine when a policy will begin assigning riskscores to a user's activity. Indicators Select all Sequence detection Specific indicators detect each step in a sequence: download, exfiltrate, obfuscate and delete. Choose threshold type for indicators Each indicator uses thresholds to influence the activity's risk score, which in turn determineswhether an alert's severity is low, medium, or high. RECOMMENDED Review settings and finish The policy will take effect immediately after you create it, but may take up to 24 hours to startgenerating alerts. User productivity won't be impacted in any way. Back Next Cancel THE USER EXPERIENCE Trigger first, then indicators The trigger puts Ronny in scope. What he does next is scored. TRIGGER Emails the customer list to his private address Ronny is in scope INDICATOR Uploads files to the web Risk goes up INDICATOR Copies files to USB High risk, alert Not in scope What Ronny notices Nothing Activity from before the trigger is scored too, thanks to past activity detection. Good to know 1/7 INSIDER RISK MANAGEMENT Create the first policy A policy decides who is scored, what starts the scoring and which activities count. We build a Data leaks policy for all users, and see how far back it looks when Ronny emails the customer list. informasjonsbeskyttelse.no