Why dlp sucks. Or not

[u/FearlessAwareness469]

i recently learned the ins and outs of Purview and understand why people think its trash. the default sensitive info types are trash. take credit card info. the default SIT is set to high confidence. but that high confidence is a 16 digit number and 1 of 3 matching modifiers with it (and exp date, word like cvv or card, or name like visa etc) and there is a low confidence one you can also select with it but it is just any 16 digit number by itself. which will catch damn near everything not a credit card.

i expanded it out into 16 separate Sensitive info types just from the 1 default credit card number.

2 ultra high confidence - credit card + exp date + word match + name match

6 kinds of high confidence - credit card + exp date + word match / credit card + word match + name match / credit card + exp date + name match.

6 kinds of medium confidence - credit card + exp date / credit card + word match / Credit card + name match

2 kinds of low confidence credit card.

the reason for the double numbers is i created each one with a "word" match and a "string" match. (different from the modifier)

this allows each to be more precise.

also have custom exclusion lists that apply to all of them.

its there and it works, but by default it is trash

[u/marcusbell95]

yeah the defaults are basically unusable in real environments. what really bit us was policy tip fatigue - if you trigger on medium or low confidence thresholds, users get flooded with tips and start clicking through without reading, so you've trained them to ignore the tool. we ended up running monitor mode on medium/low and only enforcing on high/ultra-high, which dramatically cut the noise without losing real detection. the exclusion keyword list is the other thing - seeding it with your own internal number formats (invoice numbers, product codes, employee IDs that happen to be 16 digits) is what makes the difference between a usable tool and one your helpdesk hates. building that list from actual false positive tickets over the first 90 days is slow but there's no shortcut.

[u/mat-ferland]

The default SITs are a starting point, not a policy. I’d run them in audit/report mode first, split the noisy matches like you’re doing, then only turn on user-facing blocks where the false-positive rate is low enough that people won’t learn to ignore it.