Microsoft Purview: Data Security Investigations – analyze files tied to endpoint DLP alerts

Speed up analysis of exfiltrated content by launching Data Security Investigations (DSI) from endpoint Data Loss Prevention (DLP) alerts. In DSI, define your endpoint DLP query (for example, time range, users, and endpoints). DSI then automatically gathers the related files that triggered the alerts for review (for example, UserA downloaded a file on 3/1/2026).

Affected: Microsoft Purview

Related changes

• Microsoft Purview: Data Security Triage Agent in Data Loss Prevention - Reasoning Trace and Confidence Score for agent-triaged alerts · Data
• Microsoft Purview: Data Loss Prevention - Data Security Triage Agent summaries and categorizations for DLP alerts will be made available in DLP Alerts in Microsoft Defender XDR · Data
• Microsoft Purview compliance portal: Data Lifecycle Management - Retention based on Last Accessed for files in OneDrive and SharePoint · Data
• Microsoft Purview: Data Loss Prevention - User Based Aggregation of DLP Alerts · Data
• Microsoft Purview: Data Security Posture Management-Data Security Posture Agent in DSPM · Data
• Microsoft Purview: Data Loss Prevention - Data Security for non-Microsoft connected apps · Data

View at Microsoft → Copy summary