Question

You are an Insider Risk Management analyst at Contoso. A data theft policy has generated several alerts for a departing employee. After reviewing one alert, you determine the activity warrants a deeper, formal investigation that can track notes, be assigned to reviewers, and store investigation history. What should you do next in the Insider Risk Management workflow?

Accepted Answer

Confirm the alert, which creates a case for the associated user

Answer

Dismiss the alert so it no longer counts toward the user's risk score

Answer

Edit the policy to add the user to a priority user group

Answer

Escalate the activity directly to eDiscovery for legal hold