You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
**Note:** This parameter is functional only in on-premises Exchange.
2218
+
2217
2219
This parameter specifies an exception or part of an exception for the rule. The name of the corresponding condition parameter doesn't include the ExceptIf prefix.
2218
2220
2219
2221
In on-premises Exchange, this exception is available only on Mailbox servers.
**Note:** This parameter is functional only in on-premises Exchange.
2385
+
2382
2386
This parameter specifies an exception or part of an exception for the rule. The name of the corresponding condition parameter doesn't include the ExceptIf prefix.
2383
2387
2384
2388
In on-premises Exchange, this exception is available only on Mailbox servers.
@@ -3242,8 +3246,6 @@ The GenerateIncidentReport parameter specifies where to send the incident report
3242
3246
- Email address
3243
3247
- GUID
3244
3248
3245
-
An incident report is generated for messages that violate a DLP policy in your organization.
3246
-
3247
3249
**Note**: An incident report isn't generated for notifications or other incident reports that are generated by DLP or mail flow rules.
**Note:** This parameter is functional only in on-premises Exchange.
3346
+
3343
3347
This parameter specifies a condition or part of a condition for the rule. The name of the corresponding exception parameter starts with ExceptIf.
3344
3348
3345
3349
In on-premises Exchange, this condition is available only on Mailbox servers.
@@ -3453,18 +3457,16 @@ This parameter specifies an action or part of an action for the rule.
3453
3457
3454
3458
In on-premises Exchange, this action is available only on Mailbox servers.
3455
3459
3456
-
The IncidentReportContent parameter specifies the message properties that are included in the incident report that's generated when a message violates a DLP policy. Valid values are:
3460
+
The IncidentReportContent parameter specifies the message properties that are included in the incident report. Valid values are:
3457
3461
3458
3462
- Sender: The sender of the message.
3459
3463
- Recipients: The recipients in the To field of the message. Only the first 10 recipients are displayed in the incident report. If there are more than 10 recipients, the remaining number of recipients will be displayed.
3460
3464
- Subject: The Subject field of the message.
3461
3465
- CC: The recipients in the Cc field of the message. Only the first 10 recipients are displayed in the incident report. If there are more than 10 recipients, the remaining number of recipients will be displayed.
3462
3466
- BCC: The recipients in the Bcc field of the message. Only the first 10 recipients are displayed in the incident report. If there are more than 10 recipients, the remaining number of recipients will be displayed.
3463
3467
- Severity: The audit severity of the rule that was triggered. If the message was processed by more than one rule, the highest severity is displayed.
3464
-
- Override: The override if the sender chose to override a PolicyTip. If the sender provided a justification, the first 100 characters of the justification is also included.
3465
3468
- RuleDetections: The list of rules that the message triggered.
3466
3469
- FalsePositive: The false positive if the sender marked the message as a false positive for a PolicyTip.
3467
-
- DataClassifications: The list of sensitive information types that were detected in the message.
3468
3470
- IdMatch: The sensitive information type that was detected, the exact matched content from the message, and the 150 characters before and after the matched sensitive information.
3469
3471
- AttachOriginalMail: The entire original message as an attachment.
0 commit comments