OneDrive \ SharePoint incident has unknown recipients in DLP

Products

• CASB Securlet SAAS

Issue/Introduction

DLP incidents from o365 OneDrive or SharePoint securlet have unknown user for the recipient.

Resolution

Recipient field is required for these types of incidents.  Unknown is expected when the file is uploaded and not shared as CASB \ DLP would not know at that time if it was shared.

When the file is shared the new incident will include the recipient of the shared user.