409967 – Microsoft Purview compliance portal: Insider Risk Management- Alert Spotlighting

Product:

Purview Communication Compliance, Purview Insider Risk Management

Platform:

US Instances, Web, World tenant

Status:

In development

Change type:

Links:

Details:

On the alert list page, high priority alerts will be spotlighted to help analysts prioritize the most important alerts first. Alerts are spotlighted based on predefined rules which are common across all tenants across all industries. Alert Spotlighting feature was developed to assist admins in prioritizing alerts to be triaged. Every generated alert has a risk score, a list of activities performed, tags, and triggers. The Alert Spotlighting feature uses this information to decide whether an alert can be spotlighted. Based on a detailed study of alert triage patterns across tenants, we have developed a rule-based algorithm to spotlight alerts that would be of importance to admins, based on historical volume analysis. Microsoft Purview Insider Risk Management correlates various signals to identify potential malicious or inadvertent insider risks, such as IP theft, data leakage, and security violations. Insider Risk Management enables customers to create policies based on their own internal policies, governance, and organizational requirements. Built with privacy by design, users are pseudonymized by default, and role-based access controls and audit logs are in place to help ensure user-level privacy.

Change Category:
XXXXXXX ... free basic plan only

Scope:
XXXXXXX ... free basic plan only

Release Phase:
Preview, General Availability

Created:
2024-08-13

updated:
2024-09-13

Public Preview Start Date

XXXXXXX ... free basic plan only

Docu to Check

XXXXXXX ... free basic plan only

MS workload name

XXXXXXX ... free basic plan only

Direct effects for Operations**

- Direct Impact on IT Operations
- Increased Alert Management Complexity
- Admins will need to adapt to the new spotlighting feature, which may require additional training and adjustments to existing workflows.
- Potential for increased workload as admins prioritize and triage a higher volume of alerts, impacting operational efficiency.
- Roles impacted: IT Administrators, Security Analysts

- Direct Impact on IT Services
- Changes in Alert Response Protocols
- The introduction of spotlighted alerts may necessitate updates to incident response protocols, requiring coordination with other IT services such as incident management and security operations.
- Dependencies on other services (e.g., data loss prevention tools) may be affected if alerts lead to escalated incidents, requiring cross-team collaboration.
- Roles impacted: IT Service Managers, Compliance Officers

References:
- Microsoft Purview Insider Risk Management documentation: [Microsoft Docs](https://docs.microsoft.com/en-us/microsoft-365/compliance/insider-risk-management?view=o365-worldwide)
- Overview of Microsoft Purview compliance portal: [Microsoft Purview](https://www.microsoft.com/en-us/microsoft-365/compliance/microsoft-purview)