identify and generate alerts for specific policies

[AL3Z]

Hi all,

When I run this query it is not giving any alerts from the policies marked in red color what changes do we need so that it can raise an alerts when any one violates these policies.

index=dlp sourcetype=netskope ((policy="[DLP] - All Apps - Internal" OR policy="[SMTP] - Gmail - Internal " OR policy="[DLP] - GDrive - Internal ") AND ((policy="All DLP Policies" ) OR (policy="[SMTP] - All Apps - Pwd Protected Files - Alert") OR (alert_type=uba alert_name=" Potential suspicious activity: uploads" )

Thanks

[richgalloway]

Please share sample events for each policy.