---
title: M365 Purview DLP Signal
description: Identifies Microsoft 365 Data Loss Prevention (DLP) and Data Lifecycle Management (DLM) signals from Microsoft Purview across Exchange, SharePoint, OneDrive,...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules_building_block/collection_microsoft_purview_dlp_signal
products:
  - Elastic Security
---

# M365 Purview DLP Signal
Identifies Microsoft 365 Data Loss Prevention (DLP) and Data Lifecycle Management (DLM) signals from Microsoft Purview
across Exchange, SharePoint, OneDrive, and endpoint devices. These events indicate potential data exfiltration attempts,
policy violations involving sensitive data, or unauthorized sharing of classified information. This building block rule
generates security events for correlation, threat hunting, and telemetry collection to support detection of collection
and exfiltration activities.
**Rule type**: query
**Rule indices**:
- logs-o365.audit-*
- filebeat-*

**Rule Severity**: low
**Risk Score**: 21
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
- [[https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp](https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp)](https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp)
- [[https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#enum-auditlogrecordtype---type-edmint32](https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#enum-auditlogrecordtype---type-edmint32)](https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#enum-auditlogrecordtype---type-edmint32)

**Tags**:
- Domain: Cloud
- Domain: SaaS
- Data Source: Microsoft 365
- Data Source: Microsoft 365 Audit Logs
- Data Source: Microsoft Purview
- Data Source: Microsoft Purview DLP
- Use Case: Threat Detection
- Use Case: Data Protection
- Tactic: Collection
- Tactic: Exfiltration
- Rule Type: BBR
- Rule Type: Custom Query (KQL)
- Platform: Microsoft 365
- Domain: Email
- Service: Microsoft Purview

**Version**: 3
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

### Additional notes

For information on troubleshooting the maximum alerts warning please refer to this [guide](https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts).

## Rule Query

```kuery
event.dataset:o365.audit and
    event.code:(ComplianceDLPSharePoint or ComplianceDLPExchange or ComplianceDLPSharePointClassification or DLPEndpoint or ComplianceDLPExchangeClassification or ComplianceDLMExchange or ComplianceDLMSharePoint)
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Collection
  - Id: TA0009
  - Reference URL: [[https://attack.mitre.org/tactics/TA0009/](https://attack.mitre.org/tactics/TA0009/)](https://attack.mitre.org/tactics/TA0009/)
- Technique:
  - Name: Data from Local System
  - Id: T1005
  - Reference URL: [[https://attack.mitre.org/techniques/T1005/](https://attack.mitre.org/techniques/T1005/)](https://attack.mitre.org/techniques/T1005/)
- Technique:
  - Name: Email Collection
  - Id: T1114
  - Reference URL: [[https://attack.mitre.org/techniques/T1114/](https://attack.mitre.org/techniques/T1114/)](https://attack.mitre.org/techniques/T1114/)
- Technique:
  - Name: Data from Cloud Storage
  - Id: T1530
  - Reference URL: [[https://attack.mitre.org/techniques/T1530/](https://attack.mitre.org/techniques/T1530/)](https://attack.mitre.org/techniques/T1530/)

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Exfiltration
  - Id: TA0010
  - Reference URL: [[https://attack.mitre.org/tactics/TA0010/](https://attack.mitre.org/tactics/TA0010/)](https://attack.mitre.org/tactics/TA0010/)
- Technique:
  - Name: Exfiltration Over Web Service
  - Id: T1567
  - Reference URL: [[https://attack.mitre.org/techniques/T1567/](https://attack.mitre.org/techniques/T1567/)](https://attack.mitre.org/techniques/T1567/)
- Sub Technique:
  - Name: Exfiltration to Cloud Storage
  - Id: T1567.002
  - Reference URL: [[https://attack.mitre.org/techniques/T1567/002/](https://attack.mitre.org/techniques/T1567/002/)](https://attack.mitre.org/techniques/T1567/002/)