I'm trying to create an alert for an email DLP Event where I want to
alert when a rule is matched and then the email is allowed vs blocked.
The issue I'm facing is I don't know how to alert when the events that I
want to alert (is rule matched and wa...
I'm trying to create an ESA Alert that will create an alert for any
events that match a certain criteria within a 30 second window. I'm not
entirely sure how to achieve this with ESA.
Thanks @JohnKisner for the reply. It does answer my question. Obvsiouly
I want to use as least amount of disk space as possible to get the most
amount of retention, but if it means I can't respond effectively because
the system is taking too much tim...
