Microsoft Defender XDR
GeneralInvestigate data loss prevention alerts with Microsoft Sentinel
In brief
The article now includes a clearer introduction, an updated Microsoft Sentinel connector link, revised SOAR terminology, and a KQL query for finding a specific DLP alert by SystemAlertId and correlating it with CloudAppEvents activity.
What Defender admins need to know
Administrators can follow the updated setup guidance and use the query to investigate DLP alerts alongside related user activity in Sentinel.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Investigate data loss prevention alerts with Microsoft Sentinel
- Microsoft Defender
- Microsoft Sentinel
This article explains how to use the Microsoft Defender XDR connector in Microsoft Sentinel to import, correlate, and investigate data loss prevention (DLP) alerts alongside other data sources. You learn how to set up the connector, view DLP incidents in Sentinel, and query user activities related to specific alerts.
Prepare to investigate DLP alerts in Microsoft Sentinel
DLP investigation experience in Microsoft Sentinel
You can use the Microsoft Defender XDR connector in Microsoft Sentinel to import all DLP incidents into Sentinel to extend your correlation, detection, and investigation across other data sources and extend your automated orchestration flows using Sentinel's native SOARsecurity orchestration, automation, and response (SOAR) capabilities.
Follow the instructions
on Connect data from Microsoft Defender XDR to Microsoft Sentinelin Connect data from Microsoft Defender XDR to Microsoft Sentinel to import all incidents including DLP incidents and alerts into Sentinel. Enable theCloudAppEventsevent connector, which imports Office 365 audit log events into Microsoft Sentinel, to pull all Office 365 audit logs into Sentinel.You should be able to see your DLP incidents in Sentinel once the Microsoft Defender XDR connector and the
CloudAppEventsevent connector are set up.You can use AlertType, startTime, and endTime to query the CloudAppEvents table to get all the user activities that contributed to the alert. Use this query to identify the underlying activities. The query retrieves a specific security alert by its
SystemAlertId, then correlates it withCloudAppEventsto return the user activities that occurred within the alert time window. Replace the emptySystemAlertIdvalue with the ID of the alert you want to investigate.Use the following KQL query to locate a specific alert from the last 30 days by its
SystemAlertIdand correlate it with user activities inCloudAppEvents:
let Alert = SecurityAlert
| where TimeGenerated > ago(30d)
@@ -8,9 +8,9 @@ ms.collection: - m365-security - tier2 ms.topic: how-to-ms.date: 06/16/2026+ms.date: 07/02/2026 ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1014+ms.custom: msecd-doc-authoring-1016 --- # Investigate data loss prevention alerts with Microsoft Sentinel@@ -22,6 +22,8 @@ ms.custom: msecd-doc-authoring-1014 - Microsoft Defender - Microsoft Sentinel +This article explains how to use the Microsoft Defender XDR connector in Microsoft Sentinel to import, correlate, and investigate data loss prevention (DLP) alerts alongside other data sources. You learn how to set up the connector, view DLP incidents in Sentinel, and query user activities related to specific alerts.+ <a name="before-you-start"></a> ## Prepare to investigate DLP alerts in Microsoft Sentinel @@ -29,9 +31,9 @@ See, [Investigate data loss prevention alerts with Microsoft Defender](dlp-inves ## DLP investigation experience in Microsoft Sentinel -You can use the Microsoft Defender XDR connector in Microsoft Sentinel to import all DLP incidents into Sentinel to extend your correlation, detection, and investigation across other data sources and extend your automated orchestration flows using Sentinel's native SOAR capabilities.+You can use the Microsoft Defender XDR connector in Microsoft Sentinel to import all DLP incidents into Sentinel to extend your correlation, detection, and investigation across other data sources and extend your automated orchestration flows using Sentinel's native security orchestration, automation, and response (SOAR) capabilities. -1. Follow instructions on Connect data from Microsoft Defender XDR to Microsoft Sentinel to import all incidents including DLP incidents and alerts into Sentinel. Enable the `CloudAppEvents` event connector, which imports Office 365 audit log events into Microsoft Sentinel, to pull all Office 365 audit logs into Sentinel.+1. Follow the instructions in [Connect data from Microsoft Defender XDR to Microsoft Sentinel](/azure/sentinel/connect-microsoft-365-defender) to import all incidents including DLP incidents and alerts into Sentinel. Enable the `CloudAppEvents` event connector, which imports Office 365 audit log events into Microsoft Sentinel, to pull all Office 365 audit logs into Sentinel. You should be able to see your DLP incidents in Sentinel once the Microsoft Defender XDR connector and the `CloudAppEvents` event connector are set up. @@ -39,6 +41,8 @@ You can use the Microsoft Defender XDR connector in Microsoft Sentinel to import 3. You can use **AlertType**, **startTime**, and **endTime** to query the **CloudAppEvents** table to get all the user activities that contributed to the alert. Use this query to identify the underlying activities. The query retrieves a specific security alert by its `SystemAlertId`, then correlates it with `CloudAppEvents` to return the user activities that occurred within the alert time window. Replace the empty `SystemAlertId` value with the ID of the alert you want to investigate. + Use the following KQL query to locate a specific alert from the last 30 days by its `SystemAlertId` and correlate it with user activities in `CloudAppEvents`:+ ```kusto let Alert = SecurityAlert | where TimeGenerated > ago(30d)