Action 'Get-LabelPolicy' and 'Get-AutoSensitivityLabelPolicy' by User '<SNIP-PII>'

Ian Jeferson Salac 0 Reputation points
2024-10-06T03:08:53.4833333+00:00

We have been receiving detections related to User Access Sensitivity Label Policy with actions stating these commands have been executed 'Get-LabelPolicy' and 'Get-AutoSensitivityLabelPolicy'. The user.id associated with it is named '<SNIP-PII>'

As what I've understand it appears to be that the user's information that initiated this has been redacted. Am I understanding this correctly? I want some insights would be glad to know about it.

Thank you!

Microsoft Intune Compliance
Microsoft Intune Compliance
Microsoft Intune: A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.Compliance: Adhering to rules, standards, policies, and laws.
170 questions
PowerShell
PowerShell
A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
2,627 questions
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.