NewMicrosoft Purview · Microsoft Defender · Graph API
Microsoft Purview: Data Loss Prevention – Enrich Defender alerts Graph API with DLP event data
DLP event data will be added to Defender alerts in Graph API, enabling admins to correlate DLP rule matches with alerts and simplify SIEM integration, automated workflows, and custom reporting without requiring separate Management API calls.
Key dates
- 2024 — rollout (Rolling out to Worldwide Standard Multi-Tenant environments)
Microsoft's description
Enhance current API infrastructure to provide easy and simple way for customers to export data to integrate with SIEM tools, create automated workflows and generate customizable reports. Today alert data is present in Graph API and DLP rule match event details are present in Management API. This work enriches the graph API with DLP event data to make correlation and integration easy for customers.