| 主权项 |
1. A method, implemented by a computing system programmed to perform the following, comprising:
monitoring, by a data loss prevention (DLP) agent hosted on the computing system, outbound activities performed by the computing system; capturing, by the DLP agent, an external identifier from each of the outbound activities; sending the external identifier to a server computing system having an identity-correlation data store, wherein the identity-correlation data store maps external identifiers to unique internal identifiers assigned to users by an entity, and wherein the external identifiers are not assigned by the entity; detecting a violation of a DLP policy by the DLP agent; creating, by the DLP agent, an incident record of the violation of the DLP policy, the incident record comprising one of the external identifiers being used by a particular user when the violation occurred; and sending the incident record to the server computing system, wherein the server computing system updates the incident record to include the unique internal identifier corresponding to the particular user associated with the external identifier using the identify-correlation data store. |
