Alerts triggered by the DLP rule depend on the severity of the violation. Set the number of occurrences that should match before a DLP violation is triggered, and then determine which level of severity should trigger an alert.
To set a severity threshold:
- On the Severity Threshold page, select either Record or Aggregate Score.
The Record option uses the count of violations to determine the severity of the violation.
The Aggregate Score option uses the sum of weights for each matched entity to determine the severity of the violation. The default score for most entities is 1. Although, custom dictionaries can be used to assign other values for specific keywords.
To learn more about dictionaries: DLP Entity.
- Count only unique record: When enabled, if there are multiple occurrences of a specific keyword in a DLP violation, then the violation is counted as one. Also, enabling this option will clear the preset severity threshold.
- Enter a number of occurrences for each severity level, or simply keep the defaults.
- Change or keep the severity level that triggers a policy action from the dropdown list. An alert will be sent when the severity level exceeds the number of specified occurrences.
- When finished, click Next.
The current system architecture dictates that when multiple severity tiers (Low, Medium, High, Critical) share an identical threshold value (e.g., “1”), the platform defaults the alert classification to Low. Because the UI does not support a threshold value of 0, it is not possible to “skip” the lower tiers to trigger a Critical alert for a single match using standard count-based thresholds.
Technical Workaround: Aggregated Scoring
To bypass the default “Low” classification for single-record matches, administrators should transition from Object Counts to Aggregated Scoring.
- Assign Weights: Within the DLP Profile, assign a high score (e.g., 100) to the specific predefined or custom data identifiers (Dictionaries/Rules).
- Define Thresholds: In the DLP Policy configuration, set the Aggregated Score thresholds such that a single match immediately meets the “Critical” point requirement.
- Example: Set Critical to 100, while keeping Low/Medium/High at higher or unreachable values.
- Validate Action: Ensure the Policy Action is mapped specifically to the Critical threshold of the aggregate score.