You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
**Note:** This parameter is functional only in on-premises Exchange.
2195
+
2194
2196
This parameter specifies an exception or part of an exception for the rule. The name of the corresponding condition parameter doesn't include the ExceptIf prefix.
2195
2197
2196
2198
In on-premises Exchange, this exception is available only on Mailbox servers.
**Note:** This parameter is functional only in on-premises Exchange.
2362
+
2359
2363
This parameter specifies an exception or part of an exception for the rule. The name of the corresponding condition parameter doesn't include the ExceptIf prefix.
2360
2364
2361
2365
In on-premises Exchange, this exception is available only on Mailbox servers.
@@ -3219,8 +3223,6 @@ The GenerateIncidentReport parameter specifies where to send the incident report
3219
3223
- Email address
3220
3224
- GUID
3221
3225
3222
-
An incident report is generated for messages that violate a DLP policy in your organization.
3223
-
3224
3226
**Note**: An incident report isn't generated for notifications or other incident reports that are generated by DLP or mail flow rules.
**Note:** This parameter is functional only in on-premises Exchange.
3323
+
3320
3324
This parameter specifies a condition or part of a condition for the rule. The name of the corresponding exception parameter starts with ExceptIf.
3321
3325
3322
3326
In on-premises Exchange, this condition is available only on Mailbox servers.
@@ -3430,18 +3434,16 @@ This parameter specifies an action or part of an action for the rule.
3430
3434
3431
3435
In on-premises Exchange, this action is available only on Mailbox servers.
3432
3436
3433
-
The IncidentReportContent parameter specifies the message properties that are included in the incident report that's generated when a message violates a DLP policy. Valid values are:
3437
+
The IncidentReportContent parameter specifies the message properties that are included in the incident report. Valid values are:
3434
3438
3435
3439
- Sender: The sender of the message.
3436
3440
- Recipients: The recipients in the To field of the message. Only the first 10 recipients are displayed in the incident report. If there are more than 10 recipients, the remaining number of recipients will be displayed.
3437
3441
- Subject: The Subject field of the message.
3438
3442
- CC: The recipients in the Cc field of the message. Only the first 10 recipients are displayed in the incident report. If there are more than 10 recipients, the remaining number of recipients will be displayed.
3439
3443
- BCC: The recipients in the Bcc field of the message. Only the first 10 recipients are displayed in the incident report. If there are more than 10 recipients, the remaining number of recipients will be displayed.
3440
3444
- Severity: The audit severity of the rule that was triggered. If the message was processed by more than one rule, the highest severity is displayed.
3441
-
- Override: The override if the sender chose to override a PolicyTip. If the sender provided a justification, the first 100 characters of the justification is also included.
3442
3445
- RuleDetections: The list of rules that the message triggered.
3443
3446
- FalsePositive: The false positive if the sender marked the message as a false positive for a PolicyTip.
3444
-
- DataClassifications: The list of sensitive information types that were detected in the message.
3445
3447
- IdMatch: The sensitive information type that was detected, the exact matched content from the message, and the 150 characters before and after the matched sensitive information.
3446
3448
- AttachOriginalMail: The entire original message as an attachment.
0 commit comments