Hi all,
When I run this query it is not giving any alerts from the policies marked in red color what changes do we need so that it can raise an alerts when any one violates these policies.
index=dlp sourcetype=netskope ((policy="[DLP] - All Apps - Internal" OR policy="[SMTP] - Gmail - Internal " OR policy="[DLP] - GDrive - Internal ") AND ((policy="All DLP Policies" ) OR (policy="[SMTP] - All Apps - Pwd Protected Files - Alert") OR (alert_type=uba alert_name=" Potential suspicious activity: uploads" )
Thanks
