Detect a pdf signed by DocuSign in the DLP based on metadata.
Is there a way to detect a file signed by DocuSign in Purview DLP's?
Sample Sudo code below, (assuming DocuSign signed pdf file has some property which Purview can detect, which I can use in ContentPropertyContainsWords condition. )
# script to create 'HK Test Delete after Aug07'
New-DlpCompliancePolicy `
-Name 'HK Test Delete after Aug07' `
-Comment 'HK Test Delete after Aug07' `
-Mode 'TestWithoutNotifications' `
-ExchangeLocation All `
;
New-DlpComplianceRule `
-Name 'TST - HK Test Delete after Aug07' `
-Policy 'HK Test Delete after Aug07' `
-AdvancedRule '{
"Version": "1.0",
"Condition": {
"Operator": "And",
"SubConditions": s
{
"ConditionName": "AccessScope",
"Value": "NotInOrganization"
},
{
"ConditionName": "ContentPropertyContainsWords",
"Value": e
"SignedBy:DocuSign",
"SignedAtIPLocation:142.250.73.78"
]
}
]
}
}' `
-AlertProperties '{
"AggregationType": "None"
}' `
-AttachmentIsNotLabeled $false `
-BlockAccess $true `
-BlockAccessScope 'PerUser' `
-Comment 'HK Test Delete after Aug07' `
-ContentIsNotLabeled $false `
-ContentIsShared $false `
-Disabled $false `
-DocumentIsPasswordProtected $false `
-DocumentIsUnsupported $false `
-EnforcePortalAccess $true `
-EvaluateRulePerComponent $false `
-ExceptIfContentIsShared $false `
-ExceptIfDocumentIsPasswordProtected $false `
-ExceptIfDocumentIsUnsupported $false `
-ExceptIfHasSenderOverride $false `
-ExceptIfProcessingLimitExceeded $false `
-GenerateAlert 'true' `
-HasSenderOverride $false `
-MessageIsNotLabeled $false `
-NotifyEmailExchangeIncludeAttachment $true `
-NotifyEmailOnedriveRemediationActions 'NotSet' `
-NotifyOverrideRequirements 'None' `
-NotifyPolicyTipDisplayOption 'Tip' `
-NotifyUserType 'Email, PolicyTip' `
-ProcessingLimitExceeded $false `
-Quarantine $false `
-RemoveRMSTemplate $false `
-ReportSeverityLevel 'Low' `
-RestrictBrowserAccess $false `
-StopPolicyProcessing $true `
-NotifyUser 'LastModifier' `
-NotifyPolicyTipCustomText 'Document Signed by DocuSign eSignature Platform from IP 142.250.73.78 can not be sent outside the organization.' `
;