Skip to main content
Tier One
Low

DLP blocks a resume attachment sent to a personal address

A-1063

00:00time on this alert, target 30 minutes

Back to queue

Alert details

Source
DLP
Detection rule
DLP-PII-EMAIL-012
Affected user
k.mensah
Affected host
WKS-HR-02
Source IP
—
First seen
2026-07-24T17:01:00Z

Why this fired, in plain English

A message containing personal information was sent to an address outside the company, and the system blocked it.

Suggested playbook

Data exfiltration to external storage

  1. 1. Determine whether the destination account is corporate or personal.
  2. 2. Compare volume against the host's own baseline, not an absolute number.
  3. 3. Identify the process: a backup agent and a browser upload mean very different things.
  4. 4. Check the classification and how many files were involved.
Open the full checklist

Raw log evidence

Exactly what the tools recorded — 3 events.

  1. Guided hint: this line matters

    ts=2026-07-24T17:00:22Z src="dlp" event=email_scan user="k.mensah" to="k.mensah@gmail.example" classification="PII-Candidate-Data" match_count=1 attachment="Mensah_Kofi_Resume.pdf" action=blocked

    The recipient is the sender's own personal address, and the attachment is their own resume.

  2. Guided hint: this line matters

    ts=2026-07-24T17:00:22Z src="dlp" event=match_detail pattern="ssn_like" value_redacted=true confidence=low context="phone number in resume header"

    The pattern matched a phone number that looks a bit like a national ID number — a low-confidence match.

  3. ts=2026-07-24T17:01:00Z src="dlp" event=alert_raised severity=low action=blocked user_notified=true

Related events

The order things happened in.

  1. 17:00Z

    Message blocked by DLP

  2. 17:01Z

    Low-severity alert raised

Enrichment lookups

Mock lookups. Run each one yourself — a real analyst never guesses what a lookup would have said. There is no "run everything" button on purpose.

0 of 3 lookups checked

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

techniques

Your verdict

Keyboard shortcuts 1–4, or click. You can always change your mind afterwards.