Cyera DLP Investigation Agent

An AI-powered Security Copilot agent that helps security teams investigate and triage Data Loss Prevention incidents across email, endpoints, messaging, cloud, and GenAI platforms. Run on-demand from the Agent Management view to analyze incidents with organizational context, identify patterns, and prioritize incidents requiring immediate attention.

- Investigate DLP incidents across multiple channels (email, endpoint, messaging, cloud, GenAI)

- Analyze user behavior with organizational context (manager, department, risk status)

- Identify data leakage patterns and policy violations across channels

- Prioritize incidents by severity and business impact

- Review business justifications to distinguish legitimate use from actual data loss risks

- Generate department and user risk reports with actionable insights

- Provide direct links to provider incident URLs (Purview) for deeper investigation

1. Navigate to Agent Management view in Security Copilot

2. Select "Cyera Omni DLP Investigation Agent"

3. Click "Run one time"

4. Provide investigation parameters:

- **UserRequest** (required): Describe your investigation (e.g., "Show high severity DLP incidents from the last 7 days")

- **IngestLookbackDays** (optional): Maximum days to look back for ingested data (default: 30)

5. Review results with executive summary, incident details, and recommendations

- Data Tables: CyeraOmniDlpIncidents_CL from Microsoft Sentinel/Log Analytics

- UserRequest: Natural language investigation request parameter

- IngestLookbackDays: Time range for data ingestion filter (default: 30 days)

- Supports filtering across channels: Email, Endpoint, Messaging, Cloud, GenAI

- Analyzes user, department, severity, and policy dimensions

- Executive summary with key statistics (total incidents, high-severity count, channel breakdown)

- Incident tables with severity, channel, user, policy, and business justification

- User activity analysis with manager hierarchy and department context

- High-risk incident alerts with provider incident URLs for Purview investigation

- Pattern analysis showing common data leakage scenarios by channel and policy

- Policy violation reports with affected users and channels

- Department risk distribution showing incident concentration

- Email-specific details (subject lines, recipients) and endpoint details (device, file paths)

- Risky user identification based on identity system flags

- Microsoft Security Copilot with active SCU capacity

- Microsoft Sentinel workspace with Log Analytics

- Cyera Omni DLP data ingested into CyeraOmniDlpIncidents_CL table

- Microsoft Purview DLP (recommended for incident URLs)

- Agent installed and configured with workspace connection

- **Execution-Based**: Run on-demand from Agent Management view with specific investigation parameters

- **Cross-Channel Visibility**: Single view across email, endpoint, messaging, cloud, and GenAI channels

- **Organizational Context**: Enriches incidents with manager, department, and office location data

- **Pattern Detection**: Identifies common data leakage scenarios and policy violations

- **Risk Prioritization**: Automatically highlights high-severity incidents and risky users

- **Business Context**: Reviews justification fields to reduce false positives

- **Purview Integration**: Provides direct links to Purview incident URLs for detailed investigation

- **Flexible Investigations**: Parameterized requests for different analysis types (user, channel, severity, department)

Approximately 0.5-1.5 SCU per agent execution, depending on investigation complexity and data volume.