{ "dlp_policies": [ { "id": 1, "policy_set": "corporate-baseline", "name": "Payment card numbers", "detector": "digit pattern with checksum", "default_action": "block", "severity": "high" }, { "id": 2, "policy_set": "corporate-baseline", "name": "Bank account numbers", "detector": "IBAN pattern with check digits", "default_action": "warn", "severity": "medium" }, { "id": 3, "policy_set": "corporate-baseline", "name": "National ID numbers", "detector": "national ID pattern", "default_action": "block", "severity": "high" }, { "id": 4, "policy_set": "corporate-baseline", "name": "Source code", "detector": "source code classifier", "default_action": "warn", "severity": "medium" }, { "id": 5, "policy_set": "corporate-baseline", "name": "Customer list export", "detector": "record count over 500", "default_action": "warn", "severity": "medium" }, { "id": 6, "policy_set": "corporate-baseline", "name": "Health information", "detector": "medical term dictionary", "default_action": "audit only", "severity": "high" }, { "id": 7, "policy_set": "corporate-baseline", "name": "Credentials and keys", "detector": "secret and key patterns", "default_action": "block", "severity": "high" }, { "id": 8, "policy_set": "corporate-baseline", "name": "Board-confidential label", "detector": "sensitivity label in metadata", "default_action": "warn", "severity": "medium" } ], "employees": [ { "id": 1, "first_name": "Sonny", "last_name": "Anderson", "email": "sonny.anderson@example.org", "department": "Sales", "worker_type": "employee" }, { "id": 2, "first_name": "Ruthie", "last_name": "Barrows-Ernser", "email": "ruthie.barrows-ernser@example.com", "department": "Engineering", "worker_type": "employee" }, { "id": 3, "first_name": "Dagmar", "last_name": "Ward", "email": "dagmar.ward92@example.com", "department": "Engineering", "worker_type": "employee" }, { "id": 4, "first_name": "Theo", "last_name": "Hyatt", "email": "theo_hyatt73@example.org", "department": "Finance", "worker_type": "contractor" }, { "id": 5, "first_name": "Samir", "last_name": "Hintz", "email": "samir.hintz75@example.com", "department": "Customer Success", "worker_type": "employee" }, { "id": 6, "first_name": "Estrella", "last_name": "Moore-Auer", "email": "estrella.moore-auer32@example.org", "department": "Engineering", "worker_type": "employee" }, { "id": 7, "first_name": "Arturo", "last_name": "Wunsch", "email": "arturo.wunsch@example.org", "department": "Sales", "worker_type": "employee" }, { "id": 8, "first_name": "Nancy", "last_name": "Bahringer", "email": "nancy.bahringer55@example.com", "department": "Sales", "worker_type": "employee" }, { "id": 9, "first_name": "Marlen", "last_name": "Haag", "email": "marlen_haag@example.com", "department": "Sales", "worker_type": "employee" }, { "id": 10, "first_name": "Sydnee", "last_name": "Anderson", "email": "sydnee_anderson@example.org", "department": "Engineering", "worker_type": "employee" }, { "id": 11, "first_name": "Chanelle", "last_name": "Jacobson", "email": "chanelle.jacobson14@example.net", "department": "Marketing", "worker_type": "employee" }, { "id": 12, "first_name": "Audra", "last_name": "Hartmann", "email": "audra_hartmann24@example.com", "department": "Marketing", "worker_type": "employee" }, { "id": 13, "first_name": "Hilton", "last_name": "Emmerich", "email": "hilton.emmerich@example.org", "department": "Marketing", "worker_type": "employee" }, { "id": 14, "first_name": "Okey", "last_name": "Senger", "email": "okey.senger58@example.net", "department": "Sales", "worker_type": "contractor" }, { "id": 15, "first_name": "Jenifer", "last_name": "Mertz", "email": "jenifer.mertz@example.org", "department": "Engineering", "worker_type": "employee" }, { "id": 16, "first_name": "Leila", "last_name": "Howell", "email": "leila_howell@example.net", "department": "Finance", "worker_type": "employee" }, { "id": 17, "first_name": "Zora", "last_name": "Hilll", "email": "zora.hilll@example.org", "department": "Marketing", "worker_type": "contractor" }, { "id": 18, "first_name": "Gaetano", "last_name": "Daugherty", "email": "gaetano.daugherty@example.org", "department": "Sales", "worker_type": "contractor" }, { "id": 19, "first_name": "Willard", "last_name": "Jenkins", "email": "willard.jenkins46@example.org", "department": "Customer Success", "worker_type": "employee" }, { "id": 20, "first_name": "Caden", "last_name": "Leuschke", "email": "caden_leuschke@example.org", "department": "Legal", "worker_type": "employee" }, { "id": 21, "first_name": "Cordia", "last_name": "Baumbach", "email": "cordia_baumbach67@example.com", "department": "Marketing", "worker_type": "employee" }, { "id": 22, "first_name": "Gina", "last_name": "Howe", "email": "gina_howe@example.net", "department": "Customer Success", "worker_type": "employee" }, { "id": 23, "first_name": "Alfredo", "last_name": "Waters", "email": "alfredo_waters94@example.org", "department": "Sales", "worker_type": "employee" }, { "id": 24, "first_name": "Cordie", "last_name": "Wintheiser-Koch", "email": "cordie_wintheiser-koch@example.com", "department": "Customer Success", "worker_type": "employee" }, { "id": 25, "first_name": "Angelo", "last_name": "Waters", "email": "angelo.waters24@example.net", "department": "Sales", "worker_type": "employee" }, { "id": 26, "first_name": "Chaim", "last_name": "Morar", "email": "chaim_morar@example.com", "department": "Customer Success", "worker_type": "employee" }, { "id": 27, "first_name": "Ova", "last_name": "Bode", "email": "ova.bode95@example.com", "department": "Customer Success", "worker_type": "employee" }, { "id": 28, "first_name": "Liliana", "last_name": "Weimann", "email": "liliana.weimann96@example.net", "department": "Finance", "worker_type": "employee" }, { "id": 29, "first_name": "Amira", "last_name": "Thiel", "email": "amira.thiel@example.net", "department": "Legal", "worker_type": "employee" }, { "id": 30, "first_name": "Abe", "last_name": "Nolan-Buckridge", "email": "abe_nolan-buckridge@example.net", "department": "Marketing", "worker_type": "contractor" }, { "id": 31, "first_name": "Carmel", "last_name": "McLaughlin", "email": "carmel.mclaughlin@example.net", "department": "Engineering", "worker_type": "employee" }, { "id": 32, "first_name": "Alexandro", "last_name": "Mueller", "email": "alexandro.mueller@example.org", "department": "Engineering", "worker_type": "employee" }, { "id": 33, "first_name": "Shawna", "last_name": "Schumm", "email": "shawna_schumm@example.org", "department": "Sales", "worker_type": "employee" }, { "id": 34, "first_name": "Rahul", "last_name": "Maggio", "email": "rahul.maggio87@example.org", "department": "Marketing", "worker_type": "contractor" }, { "id": 35, "first_name": "Robbie", "last_name": "Stanton", "email": "robbie_stanton39@example.org", "department": "Engineering", "worker_type": "employee" }, { "id": 36, "first_name": "Ilene", "last_name": "Jacobson", "email": "ilene.jacobson@example.net", "department": "Engineering", "worker_type": "employee" }, { "id": 37, "first_name": "Luz", "last_name": "Dicki", "email": "luz_dicki@example.org", "department": "Sales", "worker_type": "employee" }, { "id": 38, "first_name": "Georgia", "last_name": "Macejkovic", "email": "georgia_macejkovic90@example.org", "department": "Customer Success", "worker_type": "employee" }, { "id": 39, "first_name": "Sherwood", "last_name": "Stokes", "email": "sherwood_stokes54@example.org", "department": "Sales", "worker_type": "employee" }, { "id": 40, "first_name": "Dameon", "last_name": "Wehner", "email": "dameon.wehner88@example.com", "department": "Engineering", "worker_type": "employee" }, { "id": 41, "first_name": "Mellie", "last_name": "Halvorson", "email": "mellie_halvorson24@example.com", "department": "Sales", "worker_type": "employee" }, { "id": 42, "first_name": "Madonna", "last_name": "Zulauf", "email": "madonna_zulauf@example.net", "department": "Customer Success", "worker_type": "employee" }, { "id": 43, "first_name": "Amari", "last_name": "Aufderhar", "email": "amari.aufderhar14@example.com", "department": "Sales", "worker_type": "employee" }, { "id": 44, "first_name": "Justyn", "last_name": "McClure", "email": "justyn.mcclure@example.com", "department": "Engineering", "worker_type": "employee" }, { "id": 45, "first_name": "Bud", "last_name": "Hoeger", "email": "bud.hoeger@example.net", "department": "Marketing", "worker_type": "employee" }, { "id": 46, "first_name": "Brice", "last_name": "Pfannerstill", "email": "brice_pfannerstill@example.com", "department": "Engineering", "worker_type": "employee" }, { "id": 47, "first_name": "Lyle", "last_name": "Rolfson", "email": "lyle.rolfson94@example.com", "department": "Engineering", "worker_type": "employee" }, { "id": 48, "first_name": "Jeremy", "last_name": "Gibson", "email": "jeremy.gibson64@example.com", "department": "Customer Success", "worker_type": "employee" }, { "id": 49, "first_name": "Pierre", "last_name": "Waelchi", "email": "pierre.waelchi68@example.org", "department": "Sales", "worker_type": "employee" }, { "id": 50, "first_name": "Loma", "last_name": "Fadel", "email": "loma.fadel@example.com", "department": "Customer Success", "worker_type": "employee" }, { "id": 51, "first_name": "Chauncey", "last_name": "Crona-Cruickshank", "email": "chauncey.crona-cruickshank@example.com", "department": "Engineering", "worker_type": "employee" }, { "id": 52, "first_name": "Eleanor", "last_name": "Borer", "email": "eleanor.borer55@example.org", "department": "Marketing", "worker_type": "employee" }, { "id": 53, "first_name": "Moshe", "last_name": "Runte", "email": "moshe.runte@example.net", "department": "Legal", "worker_type": "employee" }, { "id": 54, "first_name": "Vera", "last_name": "Gislason", "email": "vera.gislason@example.com", "department": "Sales", "worker_type": "employee" }, { "id": 55, "first_name": "Maxime", "last_name": "Torp", "email": "maxime_torp@example.net", "department": "Sales", "worker_type": "employee" }, { "id": 56, "first_name": "Anjali", "last_name": "Von", "email": "anjali_von54@example.net", "department": "Marketing", "worker_type": "employee" }, { "id": 57, "first_name": "Cooper", "last_name": "Kris", "email": "cooper.kris49@example.org", "department": "Customer Success", "worker_type": "employee" }, { "id": 58, "first_name": "Moshe", "last_name": "Johnson", "email": "moshe.johnson@example.com", "department": "Customer Success", "worker_type": "employee" }, { "id": 59, "first_name": "Michael", "last_name": "Botsford", "email": "michael_botsford@example.net", "department": "Engineering", "worker_type": "employee" }, { "id": 60, "first_name": "Selena", "last_name": "Leuschke", "email": "selena.leuschke@example.net", "department": "Customer Success", "worker_type": "contractor" }, { "id": 61, "first_name": "Raoul", "last_name": "Littel", "email": "raoul_littel@example.com", "department": "Sales", "worker_type": "employee" }, { "id": 62, "first_name": "Joesph", "last_name": "Hayes", "email": "joesph_hayes@example.net", "department": "Sales", "worker_type": "contractor" }, { "id": 63, "first_name": "Nikko", "last_name": "Cummerata", "email": "nikko_cummerata17@example.net", "department": "Sales", "worker_type": "employee" }, { "id": 64, "first_name": "Kory", "last_name": "Corwin", "email": "kory_corwin88@example.com", "department": "Finance", "worker_type": "employee" }, { "id": 65, "first_name": "Jessie", "last_name": "Leffler", "email": "jessie_leffler@example.org", "department": "Sales", "worker_type": "contractor" }, { "id": 66, "first_name": "Chasity", "last_name": "Robel", "email": "chasity.robel@example.com", "department": "Finance", "worker_type": "employee" }, { "id": 67, "first_name": "Todd", "last_name": "Legros", "email": "todd_legros5@example.org", "department": "Marketing", "worker_type": "employee" }, { "id": 68, "first_name": "Nikki", "last_name": "Rogahn", "email": "nikki_rogahn@example.org", "department": "Sales", "worker_type": "contractor" }, { "id": 69, "first_name": "Deion", "last_name": "Halvorson-Ferry", "email": "deion_halvorson-ferry@example.net", "department": "Engineering", "worker_type": "employee" }, { "id": 70, "first_name": "Allan", "last_name": "Funk", "email": "allan.funk91@example.com", "department": "Customer Success", "worker_type": "contractor" } ], "incidents": [ { "id": 1, "employee_id": 47, "policy_id": 3, "occurred_at": "2026-08-22 11:08:40", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-6804", "file_type": "txt", "match_count": 63, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-08-31 23:59:54" }, { "id": 2, "employee_id": 8, "policy_id": 7, "occurred_at": "2026-08-27 10:21:06", "channel": "external email", "recipient_domain": "partner876.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 251, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-04 01:24:41" }, { "id": 3, "employee_id": 13, "policy_id": 8, "occurred_at": "2026-09-27 19:45:40", "channel": "external email", "recipient_domain": "partner375.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 366, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "working from my personal laptop tonight", "triage_status": "false positive", "closed_at": "2026-09-30 16:57:04" }, { "id": 4, "employee_id": 69, "policy_id": 1, "occurred_at": "2026-08-11 10:34:07", "channel": "external email", "recipient_domain": "partner732.example.com", "upload_site": null, "device_label": null, "file_type": "py", "match_count": 34, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-08-13 14:00:57" }, { "id": 5, "employee_id": 1, "policy_id": 8, "occurred_at": "2026-08-01 14:09:22", "channel": "external email", "recipient_domain": "partner602.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 301, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "it is test data, not real", "triage_status": "new", "closed_at": null }, { "id": 6, "employee_id": 1, "policy_id": 1, "occurred_at": "2026-08-06 12:19:25", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 452, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-08-07 10:52:34" }, { "id": 7, "employee_id": 33, "policy_id": 6, "occurred_at": "2026-08-18 11:34:20", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 23, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-21 05:00:12" }, { "id": 8, "employee_id": 52, "policy_id": 1, "occurred_at": "2026-09-18 15:55:39", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 38, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-09-21 09:27:03" }, { "id": 9, "employee_id": 63, "policy_id": 8, "occurred_at": "2026-07-07 10:12:18", "channel": "external email", "recipient_domain": "partner091.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 624, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-13 04:44:11" }, { "id": 10, "employee_id": 40, "policy_id": 1, "occurred_at": "2026-09-03 10:44:57", "channel": "external email", "recipient_domain": "partner378.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 316, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-09-10 06:54:53" }, { "id": 11, "employee_id": 30, "policy_id": 5, "occurred_at": "2026-09-30 14:03:51", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "txt", "match_count": 62, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "new", "closed_at": null }, { "id": 12, "employee_id": 50, "policy_id": 5, "occurred_at": "2026-07-31 15:37:46", "channel": "chat message", "recipient_domain": "partner886.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 445, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "false positive", "closed_at": "2026-07-31 22:01:06" }, { "id": 13, "employee_id": 52, "policy_id": 4, "occurred_at": "2026-08-31 15:38:28", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-1215", "file_type": "zip", "match_count": 604, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "closed, business need", "closed_at": "2026-09-08 12:45:42" }, { "id": 14, "employee_id": 3, "policy_id": 2, "occurred_at": "2026-08-27 17:40:07", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-6056", "file_type": "xlsx", "match_count": 333, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "working from my personal laptop tonight", "triage_status": "confirmed, user coached", "closed_at": "2026-09-03 16:20:15" }, { "id": 15, "employee_id": 18, "policy_id": 5, "occurred_at": "2026-09-13 18:58:23", "channel": "web upload", "recipient_domain": null, "upload_site": "convert.example.net", "device_label": null, "file_type": "zip", "match_count": 54, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "closed, business need", "closed_at": "2026-09-19 23:20:54" }, { "id": 16, "employee_id": 44, "policy_id": 4, "occurred_at": "2026-09-13 09:43:56", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-1842", "file_type": "txt", "match_count": 101, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-18 13:20:28" }, { "id": 17, "employee_id": 9, "policy_id": 3, "occurred_at": "2026-07-27 20:52:27", "channel": "chat message", "recipient_domain": "partner044.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 288, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 18, "employee_id": 1, "policy_id": 7, "occurred_at": "2026-09-23 10:46:56", "channel": "external email", "recipient_domain": "partner483.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 151, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 19, "employee_id": 21, "policy_id": 4, "occurred_at": "2026-09-25 12:11:13", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "txt", "match_count": 554, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-10-05 12:01:31" }, { "id": 20, "employee_id": 10, "policy_id": 4, "occurred_at": "2026-07-19 12:25:39", "channel": "external email", "recipient_domain": "partner338.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 128, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-27 01:32:55" }, { "id": 21, "employee_id": 14, "policy_id": 6, "occurred_at": "2026-09-22 09:17:56", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "docx", "match_count": 66, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-10-01 20:20:35" }, { "id": 22, "employee_id": 1, "policy_id": 6, "occurred_at": "2026-09-04 11:58:34", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "docx", "match_count": 242, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-07 13:40:10" }, { "id": 23, "employee_id": 45, "policy_id": 6, "occurred_at": "2026-08-02 13:44:20", "channel": "external email", "recipient_domain": "partner015.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 48, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-08-06 00:09:01" }, { "id": 24, "employee_id": 7, "policy_id": 6, "occurred_at": "2026-08-27 15:01:48", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "py", "match_count": 282, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-08-28 18:21:43" }, { "id": 25, "employee_id": 42, "policy_id": 2, "occurred_at": "2026-07-15 17:57:16", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 416, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-07-21 16:49:51" }, { "id": 26, "employee_id": 23, "policy_id": 1, "occurred_at": "2026-09-14 13:47:02", "channel": "external email", "recipient_domain": "partner312.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 492, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 27, "employee_id": 27, "policy_id": 7, "occurred_at": "2026-09-26 17:08:13", "channel": "web upload", "recipient_domain": null, "upload_site": "paste.example.org", "device_label": null, "file_type": "xlsx", "match_count": 254, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-30 18:23:45" }, { "id": 28, "employee_id": 50, "policy_id": 5, "occurred_at": "2026-09-06 08:02:09", "channel": "external email", "recipient_domain": "partner093.example.com", "upload_site": null, "device_label": null, "file_type": "txt", "match_count": 13, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-13 13:23:44" }, { "id": 29, "employee_id": 56, "policy_id": 8, "occurred_at": "2026-09-14 10:02:09", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 11, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "new", "closed_at": null }, { "id": 30, "employee_id": 22, "policy_id": 3, "occurred_at": "2026-07-16 15:04:52", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "csv", "match_count": 388, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-07-19 06:53:13" }, { "id": 31, "employee_id": 22, "policy_id": 2, "occurred_at": "2026-07-29 13:13:57", "channel": "external email", "recipient_domain": "partner620.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 197, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "sending to our external auditor", "triage_status": "false positive", "closed_at": "2026-07-30 14:56:40" }, { "id": 32, "employee_id": 19, "policy_id": 3, "occurred_at": "2026-09-24 11:43:17", "channel": "external email", "recipient_domain": "partner417.example.com", "upload_site": null, "device_label": null, "file_type": "zip", "match_count": 32, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-09-26 05:01:15" }, { "id": 33, "employee_id": 9, "policy_id": 3, "occurred_at": "2026-07-27 08:19:49", "channel": "chat message", "recipient_domain": "partner296.example.com", "upload_site": null, "device_label": null, "file_type": "py", "match_count": 139, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-08-05 08:25:48" }, { "id": 34, "employee_id": 59, "policy_id": 4, "occurred_at": "2026-09-18 18:59:30", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 289, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "it is test data, not real", "triage_status": "closed, business need", "closed_at": "2026-09-25 16:21:32" }, { "id": 35, "employee_id": 55, "policy_id": 3, "occurred_at": "2026-08-24 09:15:50", "channel": "external email", "recipient_domain": "partner876.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 196, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-09-01 13:22:03" }, { "id": 36, "employee_id": 63, "policy_id": 8, "occurred_at": "2026-08-09 10:52:16", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 238, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "confirmed, user coached", "closed_at": "2026-08-12 23:01:12" }, { "id": 37, "employee_id": 2, "policy_id": 2, "occurred_at": "2026-07-21 13:35:33", "channel": "external email", "recipient_domain": "partner275.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 8, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "sending to our external auditor", "triage_status": "closed, business need", "closed_at": "2026-07-26 00:17:11" }, { "id": 38, "employee_id": 3, "policy_id": 4, "occurred_at": "2026-09-09 06:57:19", "channel": "web upload", "recipient_domain": null, "upload_site": "paste.example.org", "device_label": null, "file_type": "xlsx", "match_count": 130, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "working from my personal laptop tonight", "triage_status": "new", "closed_at": null }, { "id": 39, "employee_id": 63, "policy_id": 4, "occurred_at": "2026-07-13 11:01:28", "channel": "external email", "recipient_domain": "partner925.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 466, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "closed, business need", "closed_at": "2026-07-18 23:01:08" }, { "id": 40, "employee_id": 6, "policy_id": 1, "occurred_at": "2026-09-30 15:10:02", "channel": "chat message", "recipient_domain": "partner126.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 223, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-10-05 17:08:42" }, { "id": 41, "employee_id": 10, "policy_id": 2, "occurred_at": "2026-07-12 16:41:48", "channel": "web upload", "recipient_domain": null, "upload_site": "paste.example.org", "device_label": null, "file_type": "xlsx", "match_count": 157, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-15 16:56:37" }, { "id": 42, "employee_id": 70, "policy_id": 5, "occurred_at": "2026-07-25 14:50:50", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-9947", "file_type": "zip", "match_count": 23, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "it is test data, not real", "triage_status": "new", "closed_at": null }, { "id": 43, "employee_id": 1, "policy_id": 5, "occurred_at": "2026-09-27 17:02:47", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "zip", "match_count": 668, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "sending to our external auditor", "triage_status": "closed, business need", "closed_at": "2026-10-02 11:01:07" }, { "id": 44, "employee_id": 27, "policy_id": 5, "occurred_at": "2026-08-09 14:50:38", "channel": "chat message", "recipient_domain": "partner358.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 88, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-14 21:34:48" }, { "id": 45, "employee_id": 55, "policy_id": 4, "occurred_at": "2026-07-01 10:13:54", "channel": "external email", "recipient_domain": "partner743.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 78, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "confirmed, user coached", "closed_at": "2026-07-03 23:38:55" }, { "id": 46, "employee_id": 25, "policy_id": 1, "occurred_at": "2026-08-25 16:02:54", "channel": "external email", "recipient_domain": "partner210.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 662, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-25 23:33:45" }, { "id": 47, "employee_id": 9, "policy_id": 4, "occurred_at": "2026-08-24 08:53:05", "channel": "external email", "recipient_domain": "partner322.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 285, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "it is test data, not real", "triage_status": "new", "closed_at": null }, { "id": 48, "employee_id": 1, "policy_id": 6, "occurred_at": "2026-08-20 13:08:05", "channel": "external email", "recipient_domain": "partner178.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 205, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-08-23 13:36:29" }, { "id": 49, "employee_id": 53, "policy_id": 6, "occurred_at": "2026-09-10 16:43:39", "channel": "chat message", "recipient_domain": "partner481.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 99, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-09-18 15:32:49" }, { "id": 50, "employee_id": 65, "policy_id": 4, "occurred_at": "2026-07-12 11:13:27", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "xlsx", "match_count": 176, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "confirmed, escalated", "closed_at": "2026-07-12 20:22:26" }, { "id": 51, "employee_id": 45, "policy_id": 8, "occurred_at": "2026-08-21 14:30:37", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "csv", "match_count": 84, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-08-30 20:21:23" }, { "id": 52, "employee_id": 9, "policy_id": 5, "occurred_at": "2026-09-13 08:01:10", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 14, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-14 23:51:33" }, { "id": 53, "employee_id": 14, "policy_id": 4, "occurred_at": "2026-08-08 16:35:48", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 152, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-08 17:57:55" }, { "id": 54, "employee_id": 1, "policy_id": 8, "occurred_at": "2026-07-12 16:29:09", "channel": "external email", "recipient_domain": "partner056.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 168, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-22 09:40:02" }, { "id": 55, "employee_id": 2, "policy_id": 8, "occurred_at": "2026-08-27 14:35:26", "channel": "external email", "recipient_domain": "partner578.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 53, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "new", "closed_at": null }, { "id": 56, "employee_id": 1, "policy_id": 3, "occurred_at": "2026-08-29 14:08:28", "channel": "external email", "recipient_domain": "partner335.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 2, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-09-03 13:44:01" }, { "id": 57, "employee_id": 8, "policy_id": 6, "occurred_at": "2026-07-05 09:42:15", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 219, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-07-06 13:45:48" }, { "id": 58, "employee_id": 16, "policy_id": 6, "occurred_at": "2026-09-27 07:48:19", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "zip", "match_count": 408, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 59, "employee_id": 18, "policy_id": 6, "occurred_at": "2026-09-08 17:15:37", "channel": "external email", "recipient_domain": "partner984.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 164, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 60, "employee_id": 6, "policy_id": 2, "occurred_at": "2026-08-03 12:44:55", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "pdf", "match_count": 142, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "closed, business need", "closed_at": "2026-08-10 13:35:19" }, { "id": 61, "employee_id": 2, "policy_id": 6, "occurred_at": "2026-08-06 09:18:58", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "zip", "match_count": 597, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-08-09 18:53:35" }, { "id": 62, "employee_id": 1, "policy_id": 7, "occurred_at": "2026-09-13 15:43:08", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-8780", "file_type": "zip", "match_count": 509, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-09-22 06:27:00" }, { "id": 63, "employee_id": 21, "policy_id": 1, "occurred_at": "2026-08-02 15:43:14", "channel": "external email", "recipient_domain": "partner427.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 108, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-08-12 14:02:51" }, { "id": 64, "employee_id": 49, "policy_id": 1, "occurred_at": "2026-08-30 14:59:42", "channel": "external email", "recipient_domain": "partner012.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 489, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-09-04 04:59:13" }, { "id": 65, "employee_id": 24, "policy_id": 2, "occurred_at": "2026-07-06 07:24:33", "channel": "web upload", "recipient_domain": null, "upload_site": "paste.example.org", "device_label": null, "file_type": "docx", "match_count": 792, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "closed, business need", "closed_at": "2026-07-06 07:41:33" }, { "id": 66, "employee_id": 52, "policy_id": 2, "occurred_at": "2026-08-05 18:44:11", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-3889", "file_type": "docx", "match_count": 622, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-15 11:54:31" }, { "id": 67, "employee_id": 58, "policy_id": 8, "occurred_at": "2026-07-12 08:13:35", "channel": "external email", "recipient_domain": "partner245.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 665, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-07-14 16:50:46" }, { "id": 68, "employee_id": 39, "policy_id": 6, "occurred_at": "2026-08-01 16:11:20", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-5060", "file_type": "txt", "match_count": 49, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-08-05 06:34:21" }, { "id": 69, "employee_id": 43, "policy_id": 4, "occurred_at": "2026-09-22 17:54:42", "channel": "chat message", "recipient_domain": "partner764.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 209, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "false positive", "closed_at": "2026-09-30 04:21:44" }, { "id": 70, "employee_id": 52, "policy_id": 4, "occurred_at": "2026-07-13 16:54:10", "channel": "web upload", "recipient_domain": null, "upload_site": "paste.example.org", "device_label": null, "file_type": "txt", "match_count": 377, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "new", "closed_at": null }, { "id": 71, "employee_id": 12, "policy_id": 1, "occurred_at": "2026-08-29 09:18:03", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 689, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-02 03:04:29" }, { "id": 72, "employee_id": 48, "policy_id": 7, "occurred_at": "2026-08-30 10:54:53", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 6, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-09-05 10:07:05" }, { "id": 73, "employee_id": 13, "policy_id": 5, "occurred_at": "2026-08-23 15:06:41", "channel": "chat message", "recipient_domain": "partner377.example.com", "upload_site": null, "device_label": null, "file_type": "txt", "match_count": 265, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-29 09:05:00" }, { "id": 74, "employee_id": 64, "policy_id": 2, "occurred_at": "2026-09-06 16:57:29", "channel": "external email", "recipient_domain": "partner063.example.com", "upload_site": null, "device_label": null, "file_type": "py", "match_count": 113, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "new", "closed_at": null }, { "id": 75, "employee_id": 55, "policy_id": 5, "occurred_at": "2026-09-08 09:40:06", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-9557", "file_type": "txt", "match_count": 41, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "working from my personal laptop tonight", "triage_status": "confirmed, user coached", "closed_at": "2026-09-11 11:49:10" }, { "id": 76, "employee_id": 26, "policy_id": 2, "occurred_at": "2026-07-08 14:19:02", "channel": "external email", "recipient_domain": "partner082.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 116, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "sending to our external auditor", "triage_status": "new", "closed_at": null }, { "id": 77, "employee_id": 14, "policy_id": 4, "occurred_at": "2026-08-30 14:27:24", "channel": "web upload", "recipient_domain": null, "upload_site": "paste.example.org", "device_label": null, "file_type": "pdf", "match_count": 227, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-07 05:07:07" }, { "id": 78, "employee_id": 32, "policy_id": 8, "occurred_at": "2026-08-24 16:49:16", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "pdf", "match_count": 365, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "new", "closed_at": null }, { "id": 79, "employee_id": 8, "policy_id": 3, "occurred_at": "2026-08-24 10:11:43", "channel": "external email", "recipient_domain": "partner561.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 700, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-08-30 13:12:08" }, { "id": 80, "employee_id": 1, "policy_id": 5, "occurred_at": "2026-08-24 19:20:41", "channel": "chat message", "recipient_domain": "partner511.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 695, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "false positive", "closed_at": "2026-08-31 14:54:45" }, { "id": 81, "employee_id": 1, "policy_id": 6, "occurred_at": "2026-09-06 06:42:34", "channel": "external email", "recipient_domain": "partner581.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 55, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-15 09:26:49" }, { "id": 82, "employee_id": 7, "policy_id": 4, "occurred_at": "2026-08-04 20:45:24", "channel": "external email", "recipient_domain": "partner657.example.com", "upload_site": null, "device_label": null, "file_type": "txt", "match_count": 66, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "confirmed, user coached", "closed_at": "2026-08-06 04:21:05" }, { "id": 83, "employee_id": 37, "policy_id": 5, "occurred_at": "2026-09-11 16:46:40", "channel": "chat message", "recipient_domain": "partner351.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 230, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-09-13 22:41:43" }, { "id": 84, "employee_id": 52, "policy_id": 2, "occurred_at": "2026-08-05 14:46:10", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "zip", "match_count": 163, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "closed, business need", "closed_at": "2026-08-06 22:18:45" }, { "id": 85, "employee_id": 29, "policy_id": 1, "occurred_at": "2026-07-08 12:11:43", "channel": "external email", "recipient_domain": "partner500.example.com", "upload_site": null, "device_label": null, "file_type": "txt", "match_count": 115, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 86, "employee_id": 48, "policy_id": 7, "occurred_at": "2026-09-06 10:34:30", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "pdf", "match_count": 19, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-09-09 00:49:56" }, { "id": 87, "employee_id": 16, "policy_id": 6, "occurred_at": "2026-07-23 18:25:01", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "pdf", "match_count": 719, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-07-29 09:36:08" }, { "id": 88, "employee_id": 2, "policy_id": 7, "occurred_at": "2026-07-20 16:43:40", "channel": "chat message", "recipient_domain": "partner568.example.com", "upload_site": null, "device_label": null, "file_type": "py", "match_count": 366, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-23 00:33:15" }, { "id": 89, "employee_id": 24, "policy_id": 7, "occurred_at": "2026-08-01 16:41:43", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-9972", "file_type": "txt", "match_count": 599, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 90, "employee_id": 61, "policy_id": 1, "occurred_at": "2026-08-30 12:12:18", "channel": "external email", "recipient_domain": "partner705.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 13, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-08 00:57:35" }, { "id": 91, "employee_id": 55, "policy_id": 7, "occurred_at": "2026-09-02 16:09:24", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-1282", "file_type": "csv", "match_count": 81, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-09-12 02:31:26" }, { "id": 92, "employee_id": 56, "policy_id": 7, "occurred_at": "2026-09-09 11:19:46", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-1593", "file_type": "csv", "match_count": 193, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-14 19:31:36" }, { "id": 93, "employee_id": 5, "policy_id": 8, "occurred_at": "2026-08-09 13:44:33", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "txt", "match_count": 507, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "confirmed, user coached", "closed_at": "2026-08-15 22:33:41" }, { "id": 94, "employee_id": 68, "policy_id": 3, "occurred_at": "2026-09-01 11:36:58", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 182, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-05 04:10:44" }, { "id": 95, "employee_id": 50, "policy_id": 4, "occurred_at": "2026-09-24 15:01:15", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "xlsx", "match_count": 25, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "closed, business need", "closed_at": "2026-10-02 06:33:38" }, { "id": 96, "employee_id": 1, "policy_id": 7, "occurred_at": "2026-09-20 17:40:52", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-9286", "file_type": "docx", "match_count": 619, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 97, "employee_id": 11, "policy_id": 5, "occurred_at": "2026-09-29 12:50:14", "channel": "external email", "recipient_domain": "partner077.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 12, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-10-06 05:47:15" }, { "id": 98, "employee_id": 30, "policy_id": 4, "occurred_at": "2026-07-10 12:42:22", "channel": "web upload", "recipient_domain": null, "upload_site": "paste.example.org", "device_label": null, "file_type": "docx", "match_count": 735, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "closed, business need", "closed_at": "2026-07-18 20:44:55" }, { "id": 99, "employee_id": 7, "policy_id": 5, "occurred_at": "2026-09-10 16:00:23", "channel": "chat message", "recipient_domain": "partner687.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 248, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "false positive", "closed_at": "2026-09-10 18:24:40" }, { "id": 100, "employee_id": 32, "policy_id": 6, "occurred_at": "2026-07-16 11:32:00", "channel": "external email", "recipient_domain": "partner154.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 175, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-07-22 11:27:26" }, { "id": 101, "employee_id": 35, "policy_id": 3, "occurred_at": "2026-08-13 09:08:33", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "docx", "match_count": 437, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-08-17 15:56:25" }, { "id": 102, "employee_id": 4, "policy_id": 1, "occurred_at": "2026-07-24 08:47:23", "channel": "chat message", "recipient_domain": "partner190.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 188, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-07-25 07:55:14" }, { "id": 103, "employee_id": 62, "policy_id": 7, "occurred_at": "2026-08-11 17:45:46", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-7623", "file_type": "csv", "match_count": 720, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-08-20 20:26:06" }, { "id": 104, "employee_id": 13, "policy_id": 1, "occurred_at": "2026-09-11 20:25:58", "channel": "web upload", "recipient_domain": null, "upload_site": "paste.example.org", "device_label": null, "file_type": "pdf", "match_count": 177, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-12 16:51:17" }, { "id": 105, "employee_id": 60, "policy_id": 6, "occurred_at": "2026-09-07 15:15:33", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-9460", "file_type": "xlsx", "match_count": 790, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-17 02:47:52" }, { "id": 106, "employee_id": 5, "policy_id": 2, "occurred_at": "2026-08-03 17:31:32", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-4578", "file_type": "csv", "match_count": 177, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-08-05 15:04:26" }, { "id": 107, "employee_id": 1, "policy_id": 3, "occurred_at": "2026-09-02 16:21:45", "channel": "web upload", "recipient_domain": null, "upload_site": "convert.example.net", "device_label": null, "file_type": "xlsx", "match_count": 69, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-11 17:39:15" }, { "id": 108, "employee_id": 45, "policy_id": 6, "occurred_at": "2026-09-15 16:33:13", "channel": "external email", "recipient_domain": "partner993.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 748, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-09-21 22:23:53" }, { "id": 109, "employee_id": 10, "policy_id": 8, "occurred_at": "2026-09-21 17:50:30", "channel": "chat message", "recipient_domain": "partner401.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 6, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "confirmed, user coached", "closed_at": "2026-09-24 11:37:03" }, { "id": 110, "employee_id": 4, "policy_id": 4, "occurred_at": "2026-07-01 15:39:28", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 710, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-07-02 13:17:24" }, { "id": 111, "employee_id": 14, "policy_id": 8, "occurred_at": "2026-08-21 15:32:11", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "docx", "match_count": 529, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "new", "closed_at": null }, { "id": 112, "employee_id": 26, "policy_id": 1, "occurred_at": "2026-09-08 14:14:01", "channel": "external email", "recipient_domain": "partner701.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 14, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 113, "employee_id": 1, "policy_id": 8, "occurred_at": "2026-08-19 14:36:00", "channel": "external email", "recipient_domain": "partner455.example.com", "upload_site": null, "device_label": null, "file_type": "zip", "match_count": 17, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-19 20:56:32" }, { "id": 114, "employee_id": 29, "policy_id": 5, "occurred_at": "2026-07-24 13:50:34", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-4337", "file_type": "csv", "match_count": 121, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "closed, business need", "closed_at": "2026-07-28 00:44:40" }, { "id": 115, "employee_id": 22, "policy_id": 8, "occurred_at": "2026-08-13 04:40:35", "channel": "web upload", "recipient_domain": null, "upload_site": "convert.example.net", "device_label": null, "file_type": "py", "match_count": 17, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-08-18 15:42:10" }, { "id": 116, "employee_id": 22, "policy_id": 6, "occurred_at": "2026-07-15 13:59:01", "channel": "external email", "recipient_domain": "partner027.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 183, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 117, "employee_id": 22, "policy_id": 2, "occurred_at": "2026-08-30 10:05:47", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 80, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "false positive", "closed_at": "2026-09-06 23:41:16" }, { "id": 118, "employee_id": 8, "policy_id": 5, "occurred_at": "2026-08-07 12:53:55", "channel": "chat message", "recipient_domain": "partner299.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 13, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-08-08 18:17:53" }, { "id": 119, "employee_id": 30, "policy_id": 6, "occurred_at": "2026-07-29 16:45:38", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "csv", "match_count": 667, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 120, "employee_id": 1, "policy_id": 1, "occurred_at": "2026-07-02 13:29:12", "channel": "external email", "recipient_domain": "partner543.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 355, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-07-11 12:25:16" }, { "id": 121, "employee_id": 19, "policy_id": 5, "occurred_at": "2026-08-26 11:55:10", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 86, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "false positive", "closed_at": "2026-08-31 22:14:37" }, { "id": 122, "employee_id": 69, "policy_id": 4, "occurred_at": "2026-07-05 15:53:59", "channel": "chat message", "recipient_domain": "partner023.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 422, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "working from my personal laptop tonight", "triage_status": "false positive", "closed_at": "2026-07-14 18:45:40" }, { "id": 123, "employee_id": 68, "policy_id": 8, "occurred_at": "2026-08-26 13:06:10", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-5211", "file_type": "xlsx", "match_count": 29, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "closed, business need", "closed_at": "2026-08-28 08:31:29" }, { "id": 124, "employee_id": 5, "policy_id": 7, "occurred_at": "2026-09-01 12:45:10", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 352, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-09-06 16:13:30" }, { "id": 125, "employee_id": 16, "policy_id": 6, "occurred_at": "2026-08-20 11:49:54", "channel": "chat message", "recipient_domain": "partner670.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 560, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-08-21 06:02:55" }, { "id": 126, "employee_id": 7, "policy_id": 4, "occurred_at": "2026-08-01 14:49:00", "channel": "external email", "recipient_domain": "partner816.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 649, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-09 20:22:32" }, { "id": 127, "employee_id": 1, "policy_id": 3, "occurred_at": "2026-07-19 17:09:04", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "csv", "match_count": 782, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-07-21 13:33:25" }, { "id": 128, "employee_id": 32, "policy_id": 5, "occurred_at": "2026-08-11 11:31:35", "channel": "external email", "recipient_domain": "partner365.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 479, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-16 10:25:23" }, { "id": 129, "employee_id": 3, "policy_id": 7, "occurred_at": "2026-09-19 21:08:38", "channel": "chat message", "recipient_domain": "partner800.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 165, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-29 04:18:38" }, { "id": 130, "employee_id": 4, "policy_id": 1, "occurred_at": "2026-08-11 12:18:13", "channel": "external email", "recipient_domain": "partner975.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 54, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-08-19 14:27:55" }, { "id": 131, "employee_id": 48, "policy_id": 7, "occurred_at": "2026-09-26 15:28:22", "channel": "chat message", "recipient_domain": "partner798.example.com", "upload_site": null, "device_label": null, "file_type": "txt", "match_count": 70, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-09-26 18:34:55" }, { "id": 132, "employee_id": 51, "policy_id": 7, "occurred_at": "2026-07-14 14:20:52", "channel": "external email", "recipient_domain": "partner136.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 18, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 133, "employee_id": 9, "policy_id": 2, "occurred_at": "2026-07-10 15:31:50", "channel": "external email", "recipient_domain": "partner827.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 2, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "new", "closed_at": null }, { "id": 134, "employee_id": 33, "policy_id": 5, "occurred_at": "2026-08-31 16:54:19", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 41, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-05 03:33:53" }, { "id": 135, "employee_id": 60, "policy_id": 2, "occurred_at": "2026-07-11 17:18:13", "channel": "external email", "recipient_domain": "partner250.example.com", "upload_site": null, "device_label": null, "file_type": "zip", "match_count": 263, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "new", "closed_at": null }, { "id": 136, "employee_id": 55, "policy_id": 7, "occurred_at": "2026-09-21 14:12:08", "channel": "external email", "recipient_domain": "partner717.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 558, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 137, "employee_id": 10, "policy_id": 1, "occurred_at": "2026-09-07 10:50:24", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "txt", "match_count": 133, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-09-17 01:52:38" }, { "id": 138, "employee_id": 23, "policy_id": 3, "occurred_at": "2026-08-19 12:28:02", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-4056", "file_type": "docx", "match_count": 21, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 139, "employee_id": 65, "policy_id": 4, "occurred_at": "2026-08-16 14:28:27", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 425, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-22 10:50:44" }, { "id": 140, "employee_id": 10, "policy_id": 2, "occurred_at": "2026-08-18 12:48:29", "channel": "chat message", "recipient_domain": "partner820.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 474, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "new", "closed_at": null }, { "id": 141, "employee_id": 69, "policy_id": 7, "occurred_at": "2026-09-24 11:41:01", "channel": "external email", "recipient_domain": "partner913.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 339, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-09-30 00:55:42" }, { "id": 142, "employee_id": 19, "policy_id": 3, "occurred_at": "2026-08-21 10:15:37", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-2151", "file_type": "zip", "match_count": 153, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-08-27 13:43:54" }, { "id": 143, "employee_id": 38, "policy_id": 5, "occurred_at": "2026-08-29 15:04:58", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "py", "match_count": 47, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "closed, business need", "closed_at": "2026-09-05 19:43:28" }, { "id": 144, "employee_id": 1, "policy_id": 2, "occurred_at": "2026-07-18 15:23:33", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "csv", "match_count": 214, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "working from my personal laptop tonight", "triage_status": "closed, business need", "closed_at": "2026-07-23 11:34:30" }, { "id": 145, "employee_id": 44, "policy_id": 2, "occurred_at": "2026-09-23 11:07:21", "channel": "external email", "recipient_domain": "partner793.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 751, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "false positive", "closed_at": "2026-09-29 02:03:47" }, { "id": 146, "employee_id": 31, "policy_id": 4, "occurred_at": "2026-08-06 19:25:02", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "docx", "match_count": 4, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-08-06 21:09:22" }, { "id": 147, "employee_id": 11, "policy_id": 2, "occurred_at": "2026-07-25 08:00:10", "channel": "web upload", "recipient_domain": null, "upload_site": "paste.example.org", "device_label": null, "file_type": "xlsx", "match_count": 296, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "closed, business need", "closed_at": "2026-07-30 16:27:47" }, { "id": 148, "employee_id": 1, "policy_id": 4, "occurred_at": "2026-07-18 12:54:05", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "pdf", "match_count": 96, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "new", "closed_at": null }, { "id": 149, "employee_id": 55, "policy_id": 4, "occurred_at": "2026-07-14 17:22:11", "channel": "external email", "recipient_domain": "partner242.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 62, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-19 21:02:16" }, { "id": 150, "employee_id": 13, "policy_id": 8, "occurred_at": "2026-07-29 16:38:10", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-3681", "file_type": "xlsx", "match_count": 232, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-30 07:26:35" }, { "id": 151, "employee_id": 33, "policy_id": 5, "occurred_at": "2026-09-20 18:24:03", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-4636", "file_type": "csv", "match_count": 16, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "working from my personal laptop tonight", "triage_status": "false positive", "closed_at": "2026-09-26 12:24:46" }, { "id": 152, "employee_id": 8, "policy_id": 3, "occurred_at": "2026-09-05 10:46:36", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 373, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-09-08 20:34:19" }, { "id": 153, "employee_id": 1, "policy_id": 5, "occurred_at": "2026-07-19 10:30:49", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 372, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "false positive", "closed_at": "2026-07-28 15:59:43" }, { "id": 154, "employee_id": 8, "policy_id": 4, "occurred_at": "2026-09-04 13:58:50", "channel": "chat message", "recipient_domain": "partner001.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 71, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "working from my personal laptop tonight", "triage_status": "new", "closed_at": null }, { "id": 155, "employee_id": 12, "policy_id": 3, "occurred_at": "2026-07-16 09:47:30", "channel": "external email", "recipient_domain": "partner500.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 162, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 156, "employee_id": 52, "policy_id": 7, "occurred_at": "2026-09-05 17:21:49", "channel": "external email", "recipient_domain": "partner782.example.com", "upload_site": null, "device_label": null, "file_type": "py", "match_count": 46, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-08 22:24:02" }, { "id": 157, "employee_id": 3, "policy_id": 6, "occurred_at": "2026-09-26 16:56:23", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-6429", "file_type": "py", "match_count": 616, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-10-03 16:22:16" }, { "id": 158, "employee_id": 3, "policy_id": 3, "occurred_at": "2026-08-01 15:46:12", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "xlsx", "match_count": 81, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 159, "employee_id": 48, "policy_id": 7, "occurred_at": "2026-07-13 14:19:10", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "docx", "match_count": 477, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-07-23 07:55:44" }, { "id": 160, "employee_id": 22, "policy_id": 5, "occurred_at": "2026-08-02 09:00:58", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "pdf", "match_count": 2, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-02 21:59:39" }, { "id": 161, "employee_id": 1, "policy_id": 7, "occurred_at": "2026-07-10 09:44:41", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 8, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-19 03:00:30" }, { "id": 162, "employee_id": 7, "policy_id": 7, "occurred_at": "2026-07-13 20:38:02", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-6608", "file_type": "pdf", "match_count": 145, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-15 08:18:27" }, { "id": 163, "employee_id": 62, "policy_id": 1, "occurred_at": "2026-09-14 09:48:11", "channel": "external email", "recipient_domain": "partner964.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 592, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-09-17 13:07:36" }, { "id": 164, "employee_id": 29, "policy_id": 5, "occurred_at": "2026-08-12 09:56:46", "channel": "chat message", "recipient_domain": "partner675.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 292, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-08-18 04:21:29" }, { "id": 165, "employee_id": 44, "policy_id": 8, "occurred_at": "2026-07-03 12:21:40", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 437, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "sending to our external auditor", "triage_status": "new", "closed_at": null }, { "id": 166, "employee_id": 54, "policy_id": 8, "occurred_at": "2026-07-28 15:34:14", "channel": "external email", "recipient_domain": "partner106.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 378, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "sending to our external auditor", "triage_status": "new", "closed_at": null }, { "id": 167, "employee_id": 22, "policy_id": 2, "occurred_at": "2026-08-26 18:57:35", "channel": "web upload", "recipient_domain": null, "upload_site": "paste.example.org", "device_label": null, "file_type": "zip", "match_count": 747, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "closed, business need", "closed_at": "2026-09-01 05:15:23" }, { "id": 168, "employee_id": 24, "policy_id": 8, "occurred_at": "2026-08-05 16:31:18", "channel": "chat message", "recipient_domain": "partner291.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 447, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-08-07 18:19:27" }, { "id": 169, "employee_id": 7, "policy_id": 7, "occurred_at": "2026-09-07 13:54:32", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "csv", "match_count": 89, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-09-14 06:02:31" }, { "id": 170, "employee_id": 2, "policy_id": 3, "occurred_at": "2026-09-01 14:30:10", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-5510", "file_type": "zip", "match_count": 31, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-05 14:59:11" }, { "id": 171, "employee_id": 1, "policy_id": 3, "occurred_at": "2026-07-03 16:20:47", "channel": "chat message", "recipient_domain": "partner459.example.com", "upload_site": null, "device_label": null, "file_type": "zip", "match_count": 268, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 172, "employee_id": 3, "policy_id": 3, "occurred_at": "2026-07-09 10:52:56", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "txt", "match_count": 25, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-11 16:36:06" }, { "id": 173, "employee_id": 66, "policy_id": 1, "occurred_at": "2026-09-08 11:09:32", "channel": "external email", "recipient_domain": "partner386.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 167, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 174, "employee_id": 1, "policy_id": 2, "occurred_at": "2026-07-19 11:06:04", "channel": "external email", "recipient_domain": "partner396.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 80, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "new", "closed_at": null }, { "id": 175, "employee_id": 13, "policy_id": 6, "occurred_at": "2026-08-09 07:23:57", "channel": "web upload", "recipient_domain": null, "upload_site": "paste.example.org", "device_label": null, "file_type": "txt", "match_count": 486, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-08-09 15:21:57" }, { "id": 176, "employee_id": 1, "policy_id": 8, "occurred_at": "2026-08-16 15:29:53", "channel": "external email", "recipient_domain": "partner095.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 665, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "new", "closed_at": null }, { "id": 177, "employee_id": 49, "policy_id": 8, "occurred_at": "2026-09-30 13:20:29", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "xlsx", "match_count": 12, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-10-10 11:54:05" }, { "id": 178, "employee_id": 20, "policy_id": 6, "occurred_at": "2026-09-02 17:24:01", "channel": "external email", "recipient_domain": "partner583.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 508, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-11 10:16:20" }, { "id": 179, "employee_id": 38, "policy_id": 1, "occurred_at": "2026-09-05 17:39:14", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "zip", "match_count": 9, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-09-11 22:37:41" }, { "id": 180, "employee_id": 1, "policy_id": 6, "occurred_at": "2026-09-28 14:43:25", "channel": "external email", "recipient_domain": "partner184.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 9, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-09-29 19:40:29" }, { "id": 181, "employee_id": 56, "policy_id": 3, "occurred_at": "2026-08-07 14:54:12", "channel": "chat message", "recipient_domain": "partner024.example.com", "upload_site": null, "device_label": null, "file_type": "py", "match_count": 649, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-08-10 10:29:48" }, { "id": 182, "employee_id": 44, "policy_id": 2, "occurred_at": "2026-09-11 11:15:53", "channel": "chat message", "recipient_domain": "partner945.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 167, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-20 08:17:56" }, { "id": 183, "employee_id": 8, "policy_id": 6, "occurred_at": "2026-08-24 20:57:53", "channel": "web upload", "recipient_domain": null, "upload_site": "convert.example.net", "device_label": null, "file_type": "docx", "match_count": 2, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 184, "employee_id": 50, "policy_id": 8, "occurred_at": "2026-09-17 13:03:06", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-4909", "file_type": "pdf", "match_count": 221, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "it is test data, not real", "triage_status": "new", "closed_at": null }, { "id": 185, "employee_id": 61, "policy_id": 5, "occurred_at": "2026-09-26 10:41:55", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "py", "match_count": 207, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "it is test data, not real", "triage_status": "confirmed, escalated", "closed_at": "2026-09-30 15:09:23" }, { "id": 186, "employee_id": 8, "policy_id": 8, "occurred_at": "2026-08-28 15:12:52", "channel": "external email", "recipient_domain": "partner683.example.com", "upload_site": null, "device_label": null, "file_type": "zip", "match_count": 29, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-07 11:19:25" }, { "id": 187, "employee_id": 41, "policy_id": 8, "occurred_at": "2026-09-11 11:22:18", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "csv", "match_count": 671, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-20 06:09:52" }, { "id": 188, "employee_id": 3, "policy_id": 5, "occurred_at": "2026-09-13 12:50:42", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-6701", "file_type": "csv", "match_count": 22, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-09-15 04:07:16" }, { "id": 189, "employee_id": 50, "policy_id": 1, "occurred_at": "2026-08-07 08:59:10", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-7760", "file_type": "zip", "match_count": 1, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-08-10 10:50:10" }, { "id": 190, "employee_id": 23, "policy_id": 2, "occurred_at": "2026-07-31 14:29:48", "channel": "chat message", "recipient_domain": "partner089.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 20, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "confirmed, user coached", "closed_at": "2026-08-06 15:26:30" }, { "id": 191, "employee_id": 37, "policy_id": 4, "occurred_at": "2026-09-07 09:40:29", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "csv", "match_count": 37, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "false positive", "closed_at": "2026-09-08 08:21:49" }, { "id": 192, "employee_id": 35, "policy_id": 6, "occurred_at": "2026-07-03 16:33:31", "channel": "chat message", "recipient_domain": "partner816.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 22, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 193, "employee_id": 1, "policy_id": 8, "occurred_at": "2026-09-21 16:19:46", "channel": "chat message", "recipient_domain": "partner224.example.com", "upload_site": null, "device_label": null, "file_type": "zip", "match_count": 148, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-27 23:29:45" }, { "id": 194, "employee_id": 67, "policy_id": 6, "occurred_at": "2026-07-22 17:12:32", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 65, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-26 21:01:04" }, { "id": 195, "employee_id": 64, "policy_id": 6, "occurred_at": "2026-08-24 17:50:00", "channel": "web upload", "recipient_domain": null, "upload_site": "paste.example.org", "device_label": null, "file_type": "xlsx", "match_count": 168, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-31 14:21:52" }, { "id": 196, "employee_id": 1, "policy_id": 1, "occurred_at": "2026-08-08 11:30:15", "channel": "chat message", "recipient_domain": "partner747.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 356, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-17 21:16:33" }, { "id": 197, "employee_id": 49, "policy_id": 8, "occurred_at": "2026-07-13 08:28:03", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "txt", "match_count": 632, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "new", "closed_at": null }, { "id": 198, "employee_id": 21, "policy_id": 6, "occurred_at": "2026-09-11 06:32:36", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-2660", "file_type": "csv", "match_count": 624, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 199, "employee_id": 1, "policy_id": 5, "occurred_at": "2026-07-16 15:06:01", "channel": "chat message", "recipient_domain": "partner208.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 254, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "working from my personal laptop tonight", "triage_status": "confirmed, user coached", "closed_at": "2026-07-18 11:11:11" }, { "id": 200, "employee_id": 17, "policy_id": 7, "occurred_at": "2026-07-24 11:58:44", "channel": "external email", "recipient_domain": "partner278.example.com", "upload_site": null, "device_label": null, "file_type": "txt", "match_count": 516, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 201, "employee_id": 5, "policy_id": 5, "occurred_at": "2026-09-02 12:00:26", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "pdf", "match_count": 184, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "new", "closed_at": null }, { "id": 202, "employee_id": 50, "policy_id": 2, "occurred_at": "2026-07-24 13:01:21", "channel": "chat message", "recipient_domain": "partner675.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 794, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "closed, business need", "closed_at": "2026-08-02 15:42:43" }, { "id": 203, "employee_id": 14, "policy_id": 3, "occurred_at": "2026-07-03 20:01:59", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-8359", "file_type": "pdf", "match_count": 304, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-06 05:55:54" }, { "id": 204, "employee_id": 5, "policy_id": 5, "occurred_at": "2026-08-18 17:14:20", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "docx", "match_count": 478, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-08-28 04:38:01" }, { "id": 205, "employee_id": 20, "policy_id": 4, "occurred_at": "2026-07-06 14:58:19", "channel": "chat message", "recipient_domain": "partner452.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 1, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "closed, business need", "closed_at": "2026-07-14 02:53:53" }, { "id": 206, "employee_id": 22, "policy_id": 2, "occurred_at": "2026-09-06 17:01:24", "channel": "chat message", "recipient_domain": "partner741.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 734, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-16 16:18:54" }, { "id": 207, "employee_id": 1, "policy_id": 6, "occurred_at": "2026-08-10 13:40:02", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 430, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 208, "employee_id": 69, "policy_id": 4, "occurred_at": "2026-08-24 16:14:47", "channel": "external email", "recipient_domain": "partner676.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 676, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "new", "closed_at": null }, { "id": 209, "employee_id": 1, "policy_id": 2, "occurred_at": "2026-09-28 17:12:40", "channel": "external email", "recipient_domain": "partner408.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 63, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "sending to our external auditor", "triage_status": "new", "closed_at": null }, { "id": 210, "employee_id": 11, "policy_id": 7, "occurred_at": "2026-08-01 14:58:56", "channel": "external email", "recipient_domain": "partner564.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 48, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 211, "employee_id": 12, "policy_id": 4, "occurred_at": "2026-09-09 21:10:40", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "py", "match_count": 13, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "new", "closed_at": null }, { "id": 212, "employee_id": 1, "policy_id": 6, "occurred_at": "2026-08-17 16:32:20", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 182, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-08-21 08:23:12" }, { "id": 213, "employee_id": 9, "policy_id": 8, "occurred_at": "2026-07-15 17:35:27", "channel": "external email", "recipient_domain": "partner999.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 354, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "new", "closed_at": null }, { "id": 214, "employee_id": 34, "policy_id": 2, "occurred_at": "2026-09-18 11:16:03", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "zip", "match_count": 114, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "working from my personal laptop tonight", "triage_status": "new", "closed_at": null }, { "id": 215, "employee_id": 33, "policy_id": 2, "occurred_at": "2026-08-03 09:45:43", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-6701", "file_type": "csv", "match_count": 299, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "new", "closed_at": null }, { "id": 216, "employee_id": 45, "policy_id": 2, "occurred_at": "2026-07-02 19:50:23", "channel": "external email", "recipient_domain": "partner355.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 478, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "new", "closed_at": null }, { "id": 217, "employee_id": 42, "policy_id": 4, "occurred_at": "2026-07-26 15:19:07", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-6882", "file_type": "txt", "match_count": 93, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "sending to our external auditor", "triage_status": "closed, business need", "closed_at": "2026-07-27 19:34:02" }, { "id": 218, "employee_id": 29, "policy_id": 8, "occurred_at": "2026-09-26 11:12:44", "channel": "chat message", "recipient_domain": "partner813.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 100, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-27 17:33:52" }, { "id": 219, "employee_id": 1, "policy_id": 6, "occurred_at": "2026-09-15 10:33:23", "channel": "external email", "recipient_domain": "partner721.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 91, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 220, "employee_id": 42, "policy_id": 6, "occurred_at": "2026-07-31 11:04:37", "channel": "external email", "recipient_domain": "partner863.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 97, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-08-08 01:16:18" }, { "id": 221, "employee_id": 3, "policy_id": 3, "occurred_at": "2026-08-17 09:09:19", "channel": "chat message", "recipient_domain": "partner756.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 583, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-08-20 02:20:32" }, { "id": 222, "employee_id": 1, "policy_id": 6, "occurred_at": "2026-08-13 12:33:17", "channel": "external email", "recipient_domain": "partner255.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 16, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 223, "employee_id": 10, "policy_id": 8, "occurred_at": "2026-09-27 11:08:53", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 173, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-09-29 21:23:58" }, { "id": 224, "employee_id": 3, "policy_id": 1, "occurred_at": "2026-07-02 09:16:06", "channel": "chat message", "recipient_domain": "partner462.example.com", "upload_site": null, "device_label": null, "file_type": "txt", "match_count": 42, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-07-04 05:45:43" }, { "id": 225, "employee_id": 1, "policy_id": 2, "occurred_at": "2026-07-07 14:46:41", "channel": "chat message", "recipient_domain": "partner873.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 38, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "new", "closed_at": null }, { "id": 226, "employee_id": 1, "policy_id": 7, "occurred_at": "2026-08-28 17:53:26", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 600, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-09-04 14:16:15" }, { "id": 227, "employee_id": 17, "policy_id": 8, "occurred_at": "2026-07-14 14:26:17", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-9273", "file_type": "txt", "match_count": 14, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "new", "closed_at": null }, { "id": 228, "employee_id": 49, "policy_id": 2, "occurred_at": "2026-08-29 18:59:43", "channel": "external email", "recipient_domain": "partner343.example.com", "upload_site": null, "device_label": null, "file_type": "py", "match_count": 105, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "new", "closed_at": null }, { "id": 229, "employee_id": 17, "policy_id": 4, "occurred_at": "2026-09-25 09:05:02", "channel": "external email", "recipient_domain": "partner378.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 13, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-27 11:21:24" }, { "id": 230, "employee_id": 68, "policy_id": 7, "occurred_at": "2026-09-11 15:26:18", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "xlsx", "match_count": 208, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-15 04:43:47" }, { "id": 231, "employee_id": 19, "policy_id": 5, "occurred_at": "2026-07-25 08:00:09", "channel": "external email", "recipient_domain": "partner270.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 21, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-07-25 15:05:15" }, { "id": 232, "employee_id": 19, "policy_id": 3, "occurred_at": "2026-07-23 15:03:43", "channel": "chat message", "recipient_domain": "partner639.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 2, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-07-25 04:59:48" }, { "id": 233, "employee_id": 1, "policy_id": 3, "occurred_at": "2026-09-30 11:34:00", "channel": "chat message", "recipient_domain": "partner267.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 349, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-10-02 00:01:40" }, { "id": 234, "employee_id": 1, "policy_id": 8, "occurred_at": "2026-08-18 01:30:08", "channel": "chat message", "recipient_domain": "partner059.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 768, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-25 07:16:59" }, { "id": 235, "employee_id": 41, "policy_id": 6, "occurred_at": "2026-09-13 13:19:31", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 765, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-17 14:33:19" }, { "id": 236, "employee_id": 62, "policy_id": 5, "occurred_at": "2026-07-18 13:55:31", "channel": "chat message", "recipient_domain": "partner927.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 19, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-07-27 01:24:17" }, { "id": 237, "employee_id": 63, "policy_id": 5, "occurred_at": "2026-08-01 10:43:23", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "xlsx", "match_count": 19, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-08-10 22:17:15" }, { "id": 238, "employee_id": 1, "policy_id": 7, "occurred_at": "2026-09-13 11:14:58", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "docx", "match_count": 774, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-09-13 17:31:55" }, { "id": 239, "employee_id": 19, "policy_id": 7, "occurred_at": "2026-07-21 15:43:36", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-5277", "file_type": "xlsx", "match_count": 300, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-07-28 00:09:11" }, { "id": 240, "employee_id": 62, "policy_id": 3, "occurred_at": "2026-08-24 13:15:31", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "csv", "match_count": 121, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-28 06:58:43" }, { "id": 241, "employee_id": 44, "policy_id": 1, "occurred_at": "2026-09-09 13:25:14", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "zip", "match_count": 108, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 242, "employee_id": 3, "policy_id": 1, "occurred_at": "2026-07-20 10:45:12", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "docx", "match_count": 155, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 243, "employee_id": 2, "policy_id": 8, "occurred_at": "2026-09-22 17:24:42", "channel": "external email", "recipient_domain": "partner591.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 141, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "new", "closed_at": null }, { "id": 244, "employee_id": 1, "policy_id": 5, "occurred_at": "2026-09-11 17:48:46", "channel": "external email", "recipient_domain": "partner027.example.com", "upload_site": null, "device_label": null, "file_type": "txt", "match_count": 1, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "sending to our external auditor", "triage_status": "closed, business need", "closed_at": "2026-09-18 23:11:05" }, { "id": 245, "employee_id": 59, "policy_id": 8, "occurred_at": "2026-07-05 15:11:43", "channel": "external email", "recipient_domain": "partner936.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 361, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "sending to our external auditor", "triage_status": "confirmed, escalated", "closed_at": "2026-07-05 17:43:30" }, { "id": 246, "employee_id": 2, "policy_id": 3, "occurred_at": "2026-07-28 11:26:48", "channel": "web upload", "recipient_domain": null, "upload_site": "paste.example.org", "device_label": null, "file_type": "csv", "match_count": 15, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-07-31 17:32:44" }, { "id": 247, "employee_id": 32, "policy_id": 7, "occurred_at": "2026-07-12 09:18:47", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-3652", "file_type": "csv", "match_count": 345, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-18 14:09:54" }, { "id": 248, "employee_id": 20, "policy_id": 5, "occurred_at": "2026-07-23 10:52:11", "channel": "external email", "recipient_domain": "partner971.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 103, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-30 03:55:05" }, { "id": 249, "employee_id": 4, "policy_id": 4, "occurred_at": "2026-09-06 08:58:57", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-6177", "file_type": "csv", "match_count": 317, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "closed, business need", "closed_at": "2026-09-06 12:14:20" }, { "id": 250, "employee_id": 6, "policy_id": 3, "occurred_at": "2026-07-21 16:50:01", "channel": "external email", "recipient_domain": "partner953.example.com", "upload_site": null, "device_label": null, "file_type": "txt", "match_count": 9, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 251, "employee_id": 16, "policy_id": 3, "occurred_at": "2026-08-29 14:51:32", "channel": "chat message", "recipient_domain": "partner566.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 702, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-09-03 11:37:50" }, { "id": 252, "employee_id": 34, "policy_id": 4, "occurred_at": "2026-09-18 08:57:07", "channel": "chat message", "recipient_domain": "partner020.example.com", "upload_site": null, "device_label": null, "file_type": "py", "match_count": 117, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-09-22 15:41:59" }, { "id": 253, "employee_id": 23, "policy_id": 2, "occurred_at": "2026-09-04 15:01:50", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 31, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "new", "closed_at": null }, { "id": 254, "employee_id": 40, "policy_id": 2, "occurred_at": "2026-07-20 13:56:08", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 547, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "false positive", "closed_at": "2026-07-21 07:28:39" }, { "id": 255, "employee_id": 1, "policy_id": 5, "occurred_at": "2026-07-05 19:58:06", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 703, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "new", "closed_at": null }, { "id": 256, "employee_id": 41, "policy_id": 5, "occurred_at": "2026-09-17 15:42:42", "channel": "chat message", "recipient_domain": "partner427.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 691, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "new", "closed_at": null }, { "id": 257, "employee_id": 19, "policy_id": 2, "occurred_at": "2026-09-06 09:18:18", "channel": "external email", "recipient_domain": "partner114.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 712, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "closed, business need", "closed_at": "2026-09-06 10:50:03" }, { "id": 258, "employee_id": 60, "policy_id": 8, "occurred_at": "2026-08-16 15:24:57", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-2284", "file_type": "csv", "match_count": 794, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "closed, business need", "closed_at": "2026-08-25 07:05:45" }, { "id": 259, "employee_id": 70, "policy_id": 5, "occurred_at": "2026-09-04 02:28:55", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-4018", "file_type": "csv", "match_count": 754, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-07 08:13:00" }, { "id": 260, "employee_id": 61, "policy_id": 3, "occurred_at": "2026-08-28 12:28:10", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 228, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-03 11:15:24" }, { "id": 261, "employee_id": 45, "policy_id": 8, "occurred_at": "2026-09-24 19:25:38", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "csv", "match_count": 5, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "new", "closed_at": null }, { "id": 262, "employee_id": 10, "policy_id": 4, "occurred_at": "2026-08-04 10:05:02", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "txt", "match_count": 95, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-09 02:35:16" }, { "id": 263, "employee_id": 1, "policy_id": 1, "occurred_at": "2026-07-14 12:30:11", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "pdf", "match_count": 722, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-07-16 20:58:45" }, { "id": 264, "employee_id": 37, "policy_id": 2, "occurred_at": "2026-08-17 17:31:09", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 183, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-08-27 11:33:15" }, { "id": 265, "employee_id": 31, "policy_id": 7, "occurred_at": "2026-07-23 14:33:58", "channel": "external email", "recipient_domain": "partner646.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 200, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-07-27 10:08:26" }, { "id": 266, "employee_id": 69, "policy_id": 1, "occurred_at": "2026-08-12 17:25:46", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-1244", "file_type": "pdf", "match_count": 497, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-15 23:19:28" }, { "id": 267, "employee_id": 4, "policy_id": 8, "occurred_at": "2026-09-26 14:50:43", "channel": "web upload", "recipient_domain": null, "upload_site": "paste.example.org", "device_label": null, "file_type": "docx", "match_count": 30, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "working from my personal laptop tonight", "triage_status": "confirmed, user coached", "closed_at": "2026-10-04 21:55:15" }, { "id": 268, "employee_id": 38, "policy_id": 1, "occurred_at": "2026-09-11 13:22:27", "channel": "external email", "recipient_domain": "partner317.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 379, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-09-19 05:05:58" }, { "id": 269, "employee_id": 6, "policy_id": 3, "occurred_at": "2026-07-22 12:22:21", "channel": "external email", "recipient_domain": "partner410.example.com", "upload_site": null, "device_label": null, "file_type": "py", "match_count": 260, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-07-30 08:29:00" }, { "id": 270, "employee_id": 6, "policy_id": 1, "occurred_at": "2026-09-25 12:02:48", "channel": "external email", "recipient_domain": "partner329.example.com", "upload_site": null, "device_label": null, "file_type": "zip", "match_count": 113, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-10-03 07:33:35" }, { "id": 271, "employee_id": 1, "policy_id": 5, "occurred_at": "2026-09-22 15:26:37", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "pdf", "match_count": 656, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "false positive", "closed_at": "2026-09-22 22:27:49" }, { "id": 272, "employee_id": 5, "policy_id": 7, "occurred_at": "2026-08-14 16:15:11", "channel": "external email", "recipient_domain": "partner358.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 1, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-08-20 05:02:35" }, { "id": 273, "employee_id": 67, "policy_id": 8, "occurred_at": "2026-07-25 12:38:38", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 168, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "closed, business need", "closed_at": "2026-07-27 04:59:20" }, { "id": 274, "employee_id": 12, "policy_id": 2, "occurred_at": "2026-08-22 09:29:24", "channel": "external email", "recipient_domain": "partner808.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 76, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "working from my personal laptop tonight", "triage_status": "new", "closed_at": null }, { "id": 275, "employee_id": 24, "policy_id": 2, "occurred_at": "2026-07-02 13:20:30", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 147, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "sending to our external auditor", "triage_status": "false positive", "closed_at": "2026-07-12 10:09:18" }, { "id": 276, "employee_id": 1, "policy_id": 6, "occurred_at": "2026-09-29 14:50:22", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "pdf", "match_count": 4, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-10-08 16:07:04" }, { "id": 277, "employee_id": 41, "policy_id": 1, "occurred_at": "2026-09-05 15:15:18", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-7661", "file_type": "csv", "match_count": 482, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-08 03:03:34" }, { "id": 278, "employee_id": 35, "policy_id": 1, "occurred_at": "2026-07-31 16:41:38", "channel": "external email", "recipient_domain": "partner936.example.com", "upload_site": null, "device_label": null, "file_type": "txt", "match_count": 12, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-08-05 22:24:09" }, { "id": 279, "employee_id": 6, "policy_id": 2, "occurred_at": "2026-09-26 14:34:40", "channel": "external email", "recipient_domain": "partner801.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 162, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-09-27 17:44:23" }, { "id": 280, "employee_id": 7, "policy_id": 3, "occurred_at": "2026-08-27 10:36:55", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 8, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-30 22:42:19" }, { "id": 281, "employee_id": 34, "policy_id": 7, "occurred_at": "2026-09-17 10:06:17", "channel": "external email", "recipient_domain": "partner903.example.com", "upload_site": null, "device_label": null, "file_type": "zip", "match_count": 308, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-09-17 23:33:37" }, { "id": 282, "employee_id": 2, "policy_id": 8, "occurred_at": "2026-07-22 15:56:57", "channel": "external email", "recipient_domain": "partner789.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 14, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-07-30 21:15:21" }, { "id": 283, "employee_id": 15, "policy_id": 7, "occurred_at": "2026-09-20 10:42:43", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "xlsx", "match_count": 214, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 284, "employee_id": 4, "policy_id": 3, "occurred_at": "2026-08-10 14:36:19", "channel": "chat message", "recipient_domain": "partner240.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 227, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-08-11 06:19:23" }, { "id": 285, "employee_id": 40, "policy_id": 4, "occurred_at": "2026-07-01 12:48:56", "channel": "chat message", "recipient_domain": "partner127.example.com", "upload_site": null, "device_label": null, "file_type": "py", "match_count": 365, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-07-03 00:46:16" }, { "id": 286, "employee_id": 2, "policy_id": 7, "occurred_at": "2026-09-02 12:54:27", "channel": "external email", "recipient_domain": "partner261.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 330, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-04 06:14:41" }, { "id": 287, "employee_id": 2, "policy_id": 5, "occurred_at": "2026-08-09 12:32:39", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "pdf", "match_count": 183, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "confirmed, user coached", "closed_at": "2026-08-15 10:18:28" }, { "id": 288, "employee_id": 4, "policy_id": 2, "occurred_at": "2026-08-20 11:56:17", "channel": "external email", "recipient_domain": "partner068.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 599, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-26 13:13:26" }, { "id": 289, "employee_id": 1, "policy_id": 7, "occurred_at": "2026-08-01 08:45:06", "channel": "external email", "recipient_domain": "partner366.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 15, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-08-02 04:45:04" }, { "id": 290, "employee_id": 64, "policy_id": 5, "occurred_at": "2026-08-07 09:06:52", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 371, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "new", "closed_at": null }, { "id": 291, "employee_id": 1, "policy_id": 8, "occurred_at": "2026-08-22 09:54:02", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-3413", "file_type": "zip", "match_count": 338, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "working from my personal laptop tonight", "triage_status": "false positive", "closed_at": "2026-09-01 08:36:37" }, { "id": 292, "employee_id": 50, "policy_id": 2, "occurred_at": "2026-09-12 16:14:47", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-1795", "file_type": "xlsx", "match_count": 334, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "false positive", "closed_at": "2026-09-16 17:05:04" }, { "id": 293, "employee_id": 3, "policy_id": 3, "occurred_at": "2026-09-06 16:55:10", "channel": "web upload", "recipient_domain": null, "upload_site": "paste.example.org", "device_label": null, "file_type": "pdf", "match_count": 10, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-09-11 04:21:23" }, { "id": 294, "employee_id": 9, "policy_id": 8, "occurred_at": "2026-07-10 14:18:55", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 1, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "working from my personal laptop tonight", "triage_status": "new", "closed_at": null }, { "id": 295, "employee_id": 33, "policy_id": 5, "occurred_at": "2026-07-14 17:14:13", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 49, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "sending to our external auditor", "triage_status": "confirmed, user coached", "closed_at": "2026-07-23 09:17:54" }, { "id": 296, "employee_id": 48, "policy_id": 2, "occurred_at": "2026-07-01 11:59:48", "channel": "chat message", "recipient_domain": "partner160.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 331, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-05 06:02:37" }, { "id": 297, "employee_id": 10, "policy_id": 1, "occurred_at": "2026-09-17 10:54:10", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-2955", "file_type": "xlsx", "match_count": 309, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-22 04:04:11" }, { "id": 298, "employee_id": 2, "policy_id": 8, "occurred_at": "2026-08-01 14:54:19", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "xlsx", "match_count": 274, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "new", "closed_at": null }, { "id": 299, "employee_id": 23, "policy_id": 7, "occurred_at": "2026-07-09 08:43:14", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-6395", "file_type": "xlsx", "match_count": 277, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-07-12 07:55:36" }, { "id": 300, "employee_id": 48, "policy_id": 3, "occurred_at": "2026-08-22 19:49:59", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "docx", "match_count": 448, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-09-01 19:47:47" }, { "id": 301, "employee_id": 47, "policy_id": 8, "occurred_at": "2026-07-11 08:08:44", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 605, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "closed, business need", "closed_at": "2026-07-11 16:39:45" }, { "id": 302, "employee_id": 55, "policy_id": 4, "occurred_at": "2026-08-29 08:25:03", "channel": "chat message", "recipient_domain": "partner789.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 71, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "working from my personal laptop tonight", "triage_status": "confirmed, escalated", "closed_at": "2026-09-07 08:13:52" }, { "id": 303, "employee_id": 1, "policy_id": 4, "occurred_at": "2026-07-07 19:41:38", "channel": "external email", "recipient_domain": "partner498.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 28, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "confirmed, user coached", "closed_at": "2026-07-08 10:35:55" }, { "id": 304, "employee_id": 1, "policy_id": 1, "occurred_at": "2026-08-13 09:38:07", "channel": "external email", "recipient_domain": "partner954.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 12, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-08-22 13:30:44" }, { "id": 305, "employee_id": 41, "policy_id": 7, "occurred_at": "2026-07-01 14:27:07", "channel": "web upload", "recipient_domain": null, "upload_site": "paste.example.org", "device_label": null, "file_type": "xlsx", "match_count": 424, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-02 08:25:53" }, { "id": 306, "employee_id": 9, "policy_id": 8, "occurred_at": "2026-09-25 17:18:52", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "csv", "match_count": 333, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "it is test data, not real", "triage_status": "confirmed, user coached", "closed_at": "2026-09-25 18:06:58" }, { "id": 307, "employee_id": 22, "policy_id": 4, "occurred_at": "2026-08-29 15:37:01", "channel": "chat message", "recipient_domain": "partner906.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 225, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-04 20:59:48" }, { "id": 308, "employee_id": 34, "policy_id": 2, "occurred_at": "2026-07-20 13:11:39", "channel": "web upload", "recipient_domain": null, "upload_site": "paste.example.org", "device_label": null, "file_type": "xlsx", "match_count": 3, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "sending to our external auditor", "triage_status": "new", "closed_at": null }, { "id": 309, "employee_id": 3, "policy_id": 7, "occurred_at": "2026-07-29 15:48:19", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "py", "match_count": 144, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-08-04 14:25:18" }, { "id": 310, "employee_id": 9, "policy_id": 1, "occurred_at": "2026-09-21 10:26:18", "channel": "chat message", "recipient_domain": "partner324.example.com", "upload_site": null, "device_label": null, "file_type": "zip", "match_count": 211, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-09-22 11:23:51" }, { "id": 311, "employee_id": 1, "policy_id": 8, "occurred_at": "2026-07-16 14:23:27", "channel": "external email", "recipient_domain": "partner840.example.com", "upload_site": null, "device_label": null, "file_type": "py", "match_count": 1, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "sending to our external auditor", "triage_status": "confirmed, user coached", "closed_at": "2026-07-26 00:06:58" }, { "id": 312, "employee_id": 10, "policy_id": 6, "occurred_at": "2026-07-31 09:08:10", "channel": "chat message", "recipient_domain": "partner189.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 4, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-08-10 06:41:12" }, { "id": 313, "employee_id": 1, "policy_id": 3, "occurred_at": "2026-08-25 08:43:14", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "pdf", "match_count": 191, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-09-03 13:13:08" }, { "id": 314, "employee_id": 35, "policy_id": 8, "occurred_at": "2026-09-07 12:05:27", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-6817", "file_type": "pdf", "match_count": 53, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-09-15 10:08:10" }, { "id": 315, "employee_id": 52, "policy_id": 5, "occurred_at": "2026-09-18 10:08:28", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 66, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "closed, business need", "closed_at": "2026-09-24 04:06:07" }, { "id": 316, "employee_id": 5, "policy_id": 4, "occurred_at": "2026-07-01 19:28:01", "channel": "external email", "recipient_domain": "partner791.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 573, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "sending to our external auditor", "triage_status": "new", "closed_at": null }, { "id": 317, "employee_id": 5, "policy_id": 1, "occurred_at": "2026-07-13 18:41:35", "channel": "external email", "recipient_domain": "partner706.example.com", "upload_site": null, "device_label": null, "file_type": "zip", "match_count": 30, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-07-16 15:04:14" }, { "id": 318, "employee_id": 17, "policy_id": 2, "occurred_at": "2026-07-26 10:45:39", "channel": "external email", "recipient_domain": "partner657.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 359, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "working from my personal laptop tonight", "triage_status": "closed, business need", "closed_at": "2026-08-03 23:22:13" }, { "id": 319, "employee_id": 1, "policy_id": 1, "occurred_at": "2026-08-15 10:35:03", "channel": "external email", "recipient_domain": "partner663.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 303, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-08-21 15:22:29" }, { "id": 320, "employee_id": 67, "policy_id": 4, "occurred_at": "2026-07-21 11:13:28", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-2816", "file_type": "pdf", "match_count": 22, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "new", "closed_at": null }, { "id": 321, "employee_id": 9, "policy_id": 3, "occurred_at": "2026-08-24 09:15:04", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 235, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-08-31 22:28:25" }, { "id": 322, "employee_id": 21, "policy_id": 8, "occurred_at": "2026-08-10 16:48:23", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-8753", "file_type": "docx", "match_count": 310, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-16 16:26:35" }, { "id": 323, "employee_id": 47, "policy_id": 3, "occurred_at": "2026-08-09 10:07:01", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-7613", "file_type": "xlsx", "match_count": 57, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-08-18 07:02:42" }, { "id": 324, "employee_id": 1, "policy_id": 6, "occurred_at": "2026-08-14 06:56:38", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "py", "match_count": 685, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-19 04:16:54" }, { "id": 325, "employee_id": 24, "policy_id": 6, "occurred_at": "2026-09-23 09:12:45", "channel": "external email", "recipient_domain": "partner410.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 508, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-24 20:38:40" }, { "id": 326, "employee_id": 30, "policy_id": 5, "occurred_at": "2026-09-02 14:16:32", "channel": "external email", "recipient_domain": "partner017.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 67, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "new", "closed_at": null }, { "id": 327, "employee_id": 9, "policy_id": 8, "occurred_at": "2026-07-07 10:33:00", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 335, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "confirmed, escalated", "closed_at": "2026-07-10 07:30:03" }, { "id": 328, "employee_id": 10, "policy_id": 4, "occurred_at": "2026-09-04 20:40:16", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-7253", "file_type": "xlsx", "match_count": 780, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "sending to our external auditor", "triage_status": "new", "closed_at": null }, { "id": 329, "employee_id": 4, "policy_id": 3, "occurred_at": "2026-09-07 10:00:14", "channel": "external email", "recipient_domain": "partner986.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 460, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-09-13 18:40:22" }, { "id": 330, "employee_id": 38, "policy_id": 2, "occurred_at": "2026-09-08 13:45:12", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "docx", "match_count": 6, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-09-10 22:17:33" }, { "id": 331, "employee_id": 12, "policy_id": 5, "occurred_at": "2026-07-15 09:14:22", "channel": "external email", "recipient_domain": "partner085.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 1, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "new", "closed_at": null }, { "id": 332, "employee_id": 3, "policy_id": 7, "occurred_at": "2026-08-09 11:59:25", "channel": "chat message", "recipient_domain": "partner932.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 782, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-08-11 22:19:41" }, { "id": 333, "employee_id": 13, "policy_id": 3, "occurred_at": "2026-08-28 17:42:46", "channel": "chat message", "recipient_domain": "partner204.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 19, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-09-04 18:10:19" }, { "id": 334, "employee_id": 12, "policy_id": 3, "occurred_at": "2026-07-19 11:49:04", "channel": "chat message", "recipient_domain": "partner217.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 706, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-27 17:44:14" }, { "id": 335, "employee_id": 37, "policy_id": 4, "occurred_at": "2026-08-23 12:01:14", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "xlsx", "match_count": 613, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-29 06:47:16" }, { "id": 336, "employee_id": 47, "policy_id": 5, "occurred_at": "2026-07-17 10:30:56", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 126, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-23 21:06:08" }, { "id": 337, "employee_id": 11, "policy_id": 6, "occurred_at": "2026-09-21 16:18:33", "channel": "external email", "recipient_domain": "partner719.example.com", "upload_site": null, "device_label": null, "file_type": "txt", "match_count": 7, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-09-26 20:36:31" }, { "id": 338, "employee_id": 8, "policy_id": 7, "occurred_at": "2026-08-20 08:45:21", "channel": "external email", "recipient_domain": "partner003.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 119, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-08-25 08:36:27" }, { "id": 339, "employee_id": 34, "policy_id": 1, "occurred_at": "2026-08-23 16:48:15", "channel": "external email", "recipient_domain": "partner779.example.com", "upload_site": null, "device_label": null, "file_type": "txt", "match_count": 201, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-08-27 03:23:13" }, { "id": 340, "employee_id": 3, "policy_id": 2, "occurred_at": "2026-09-21 14:27:57", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 4, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "closed, business need", "closed_at": "2026-09-28 07:18:22" }, { "id": 341, "employee_id": 32, "policy_id": 6, "occurred_at": "2026-09-29 15:13:25", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 440, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-30 14:42:21" }, { "id": 342, "employee_id": 2, "policy_id": 3, "occurred_at": "2026-08-26 11:20:52", "channel": "external email", "recipient_domain": "partner300.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 677, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-08-28 05:35:09" }, { "id": 343, "employee_id": 55, "policy_id": 2, "occurred_at": "2026-08-17 16:04:10", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "zip", "match_count": 94, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "new", "closed_at": null }, { "id": 344, "employee_id": 30, "policy_id": 5, "occurred_at": "2026-08-02 14:58:12", "channel": "external email", "recipient_domain": "partner754.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 299, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-08-04 23:56:25" }, { "id": 345, "employee_id": 36, "policy_id": 4, "occurred_at": "2026-07-31 13:00:36", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-0526", "file_type": "csv", "match_count": 7, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "sending to our external auditor", "triage_status": "new", "closed_at": null }, { "id": 346, "employee_id": 27, "policy_id": 6, "occurred_at": "2026-08-13 11:32:26", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 559, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-08-23 02:31:52" }, { "id": 347, "employee_id": 31, "policy_id": 5, "occurred_at": "2026-09-08 13:30:29", "channel": "external email", "recipient_domain": "partner919.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 82, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "working from my personal laptop tonight", "triage_status": "false positive", "closed_at": "2026-09-13 00:10:33" }, { "id": 348, "employee_id": 33, "policy_id": 4, "occurred_at": "2026-08-15 16:09:12", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 710, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "closed, business need", "closed_at": "2026-08-19 06:59:49" }, { "id": 349, "employee_id": 1, "policy_id": 5, "occurred_at": "2026-08-18 15:33:19", "channel": "chat message", "recipient_domain": "partner055.example.com", "upload_site": null, "device_label": null, "file_type": "txt", "match_count": 7, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "sending to our external auditor", "triage_status": "closed, business need", "closed_at": "2026-08-21 21:52:58" }, { "id": 350, "employee_id": 66, "policy_id": 5, "occurred_at": "2026-08-27 12:36:35", "channel": "external email", "recipient_domain": "partner931.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 1, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "confirmed, user coached", "closed_at": "2026-09-04 10:18:21" }, { "id": 351, "employee_id": 10, "policy_id": 1, "occurred_at": "2026-08-20 13:43:27", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "py", "match_count": 665, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-08-21 05:06:32" }, { "id": 352, "employee_id": 51, "policy_id": 1, "occurred_at": "2026-07-03 15:54:23", "channel": "chat message", "recipient_domain": "partner702.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 3, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-04 15:14:57" }, { "id": 353, "employee_id": 4, "policy_id": 4, "occurred_at": "2026-09-06 15:20:02", "channel": "chat message", "recipient_domain": "partner250.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 411, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "closed, business need", "closed_at": "2026-09-07 14:03:03" }, { "id": 354, "employee_id": 44, "policy_id": 7, "occurred_at": "2026-09-27 16:55:19", "channel": "external email", "recipient_domain": "partner825.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 93, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-10-06 22:11:55" }, { "id": 355, "employee_id": 13, "policy_id": 7, "occurred_at": "2026-07-02 13:27:27", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "docx", "match_count": 114, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-07-09 14:09:26" }, { "id": 356, "employee_id": 19, "policy_id": 5, "occurred_at": "2026-07-11 09:21:25", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "xlsx", "match_count": 41, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "it is test data, not real", "triage_status": "new", "closed_at": null }, { "id": 357, "employee_id": 62, "policy_id": 7, "occurred_at": "2026-07-09 12:35:45", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "txt", "match_count": 337, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-07-14 02:30:11" }, { "id": 358, "employee_id": 6, "policy_id": 6, "occurred_at": "2026-07-20 08:41:12", "channel": "web upload", "recipient_domain": null, "upload_site": "convert.example.net", "device_label": null, "file_type": "zip", "match_count": 612, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-07-28 20:34:10" }, { "id": 359, "employee_id": 31, "policy_id": 6, "occurred_at": "2026-09-12 10:43:30", "channel": "chat message", "recipient_domain": "partner115.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 86, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 360, "employee_id": 1, "policy_id": 6, "occurred_at": "2026-09-02 13:46:04", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-3568", "file_type": "docx", "match_count": 206, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-08 21:22:02" }, { "id": 361, "employee_id": 66, "policy_id": 6, "occurred_at": "2026-07-07 16:42:31", "channel": "web upload", "recipient_domain": null, "upload_site": "convert.example.net", "device_label": null, "file_type": "pdf", "match_count": 796, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 362, "employee_id": 1, "policy_id": 1, "occurred_at": "2026-09-23 15:26:42", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-8654", "file_type": "docx", "match_count": 653, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 363, "employee_id": 60, "policy_id": 1, "occurred_at": "2026-08-14 20:47:00", "channel": "external email", "recipient_domain": "partner290.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 506, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-20 04:58:00" }, { "id": 364, "employee_id": 23, "policy_id": 2, "occurred_at": "2026-07-16 13:30:44", "channel": "web upload", "recipient_domain": null, "upload_site": "paste.example.org", "device_label": null, "file_type": "xlsx", "match_count": 2, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "sending to our external auditor", "triage_status": "closed, business need", "closed_at": "2026-07-24 20:38:31" }, { "id": 365, "employee_id": 11, "policy_id": 6, "occurred_at": "2026-07-08 17:05:52", "channel": "external email", "recipient_domain": "partner023.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 2, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-07-14 03:11:18" }, { "id": 366, "employee_id": 11, "policy_id": 8, "occurred_at": "2026-09-01 11:09:33", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 65, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "closed, business need", "closed_at": "2026-09-02 00:38:35" }, { "id": 367, "employee_id": 55, "policy_id": 8, "occurred_at": "2026-09-10 10:00:12", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 221, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "confirmed, user coached", "closed_at": "2026-09-12 12:53:46" }, { "id": 368, "employee_id": 28, "policy_id": 8, "occurred_at": "2026-09-16 14:05:36", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "py", "match_count": 562, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "new", "closed_at": null }, { "id": 369, "employee_id": 5, "policy_id": 5, "occurred_at": "2026-07-01 10:19:08", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "csv", "match_count": 85, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "closed, business need", "closed_at": "2026-07-11 02:22:42" }, { "id": 370, "employee_id": 11, "policy_id": 8, "occurred_at": "2026-08-30 13:46:00", "channel": "external email", "recipient_domain": "partner623.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 2, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "sending to our external auditor", "triage_status": "new", "closed_at": null }, { "id": 371, "employee_id": 15, "policy_id": 7, "occurred_at": "2026-08-28 11:27:01", "channel": "chat message", "recipient_domain": "partner294.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 144, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-08-30 21:05:57" }, { "id": 372, "employee_id": 44, "policy_id": 7, "occurred_at": "2026-09-20 18:50:39", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-4687", "file_type": "xlsx", "match_count": 10, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-09-26 22:36:16" }, { "id": 373, "employee_id": 7, "policy_id": 5, "occurred_at": "2026-07-16 12:01:03", "channel": "external email", "recipient_domain": "partner659.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 1, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-07-18 05:10:01" }, { "id": 374, "employee_id": 2, "policy_id": 3, "occurred_at": "2026-09-07 15:42:14", "channel": "external email", "recipient_domain": "partner204.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 1, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-09-14 16:13:49" }, { "id": 375, "employee_id": 1, "policy_id": 4, "occurred_at": "2026-09-22 07:46:06", "channel": "external email", "recipient_domain": "partner455.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 441, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-27 11:18:49" }, { "id": 376, "employee_id": 23, "policy_id": 7, "occurred_at": "2026-07-21 12:00:43", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "txt", "match_count": 128, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-07-24 22:06:41" }, { "id": 377, "employee_id": 2, "policy_id": 5, "occurred_at": "2026-07-10 13:57:54", "channel": "external email", "recipient_domain": "partner006.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 326, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "working from my personal laptop tonight", "triage_status": "closed, business need", "closed_at": "2026-07-16 21:25:21" }, { "id": 378, "employee_id": 32, "policy_id": 3, "occurred_at": "2026-09-04 17:50:11", "channel": "web upload", "recipient_domain": null, "upload_site": "paste.example.org", "device_label": null, "file_type": "zip", "match_count": 1, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-09-10 16:13:34" }, { "id": 379, "employee_id": 4, "policy_id": 5, "occurred_at": "2026-08-16 09:05:01", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "zip", "match_count": 96, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "new", "closed_at": null }, { "id": 380, "employee_id": 4, "policy_id": 1, "occurred_at": "2026-09-22 15:02:58", "channel": "chat message", "recipient_domain": "partner571.example.com", "upload_site": null, "device_label": null, "file_type": "zip", "match_count": 7, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 381, "employee_id": 12, "policy_id": 6, "occurred_at": "2026-07-14 18:36:10", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-8800", "file_type": "xlsx", "match_count": 156, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-20 21:12:04" }, { "id": 382, "employee_id": 1, "policy_id": 5, "occurred_at": "2026-08-09 09:25:23", "channel": "external email", "recipient_domain": "partner340.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 160, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "sending to our external auditor", "triage_status": "false positive", "closed_at": "2026-08-16 00:33:59" }, { "id": 383, "employee_id": 27, "policy_id": 3, "occurred_at": "2026-08-27 09:10:26", "channel": "web upload", "recipient_domain": null, "upload_site": "convert.example.net", "device_label": null, "file_type": "csv", "match_count": 531, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-09-05 23:10:49" }, { "id": 384, "employee_id": 51, "policy_id": 6, "occurred_at": "2026-08-17 11:41:12", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 576, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 385, "employee_id": 31, "policy_id": 2, "occurred_at": "2026-09-07 11:17:55", "channel": "external email", "recipient_domain": "partner846.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 505, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "working from my personal laptop tonight", "triage_status": "new", "closed_at": null }, { "id": 386, "employee_id": 2, "policy_id": 8, "occurred_at": "2026-08-29 10:59:44", "channel": "external email", "recipient_domain": "partner144.example.com", "upload_site": null, "device_label": null, "file_type": "zip", "match_count": 42, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "working from my personal laptop tonight", "triage_status": "confirmed, escalated", "closed_at": "2026-08-30 15:15:33" }, { "id": 387, "employee_id": 3, "policy_id": 4, "occurred_at": "2026-07-03 12:18:33", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "pdf", "match_count": 664, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-07-06 02:26:19" }, { "id": 388, "employee_id": 63, "policy_id": 7, "occurred_at": "2026-09-24 09:54:06", "channel": "web upload", "recipient_domain": null, "upload_site": "paste.example.org", "device_label": null, "file_type": "xlsx", "match_count": 479, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-10-02 16:25:36" }, { "id": 389, "employee_id": 41, "policy_id": 7, "occurred_at": "2026-08-03 12:00:39", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 320, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-03 21:28:45" }, { "id": 390, "employee_id": 33, "policy_id": 3, "occurred_at": "2026-09-05 11:08:55", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 2, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-09-10 14:21:31" }, { "id": 391, "employee_id": 17, "policy_id": 6, "occurred_at": "2026-08-07 12:19:23", "channel": "web upload", "recipient_domain": null, "upload_site": "paste.example.org", "device_label": null, "file_type": "zip", "match_count": 181, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-08-15 19:29:01" }, { "id": 392, "employee_id": 11, "policy_id": 2, "occurred_at": "2026-09-10 13:15:10", "channel": "external email", "recipient_domain": "partner181.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 580, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-16 11:30:24" }, { "id": 393, "employee_id": 18, "policy_id": 7, "occurred_at": "2026-07-10 09:06:49", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-3633", "file_type": "xlsx", "match_count": 658, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-07-14 02:30:43" }, { "id": 394, "employee_id": 6, "policy_id": 2, "occurred_at": "2026-09-13 13:44:16", "channel": "external email", "recipient_domain": "partner353.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 321, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "closed, business need", "closed_at": "2026-09-15 01:31:43" }, { "id": 395, "employee_id": 4, "policy_id": 3, "occurred_at": "2026-08-08 15:58:41", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-5483", "file_type": "xlsx", "match_count": 58, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-09 19:30:50" }, { "id": 396, "employee_id": 1, "policy_id": 5, "occurred_at": "2026-09-24 12:52:30", "channel": "external email", "recipient_domain": "partner981.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 203, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "working from my personal laptop tonight", "triage_status": "new", "closed_at": null }, { "id": 397, "employee_id": 5, "policy_id": 3, "occurred_at": "2026-09-20 14:38:44", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "xlsx", "match_count": 771, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-23 15:32:05" }, { "id": 398, "employee_id": 1, "policy_id": 6, "occurred_at": "2026-08-20 19:51:13", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "pdf", "match_count": 99, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-29 02:24:31" }, { "id": 399, "employee_id": 10, "policy_id": 5, "occurred_at": "2026-08-16 09:34:42", "channel": "external email", "recipient_domain": "partner570.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 68, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "sending to our external auditor", "triage_status": "confirmed, user coached", "closed_at": "2026-08-23 10:48:32" }, { "id": 400, "employee_id": 45, "policy_id": 1, "occurred_at": "2026-07-24 12:12:10", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "zip", "match_count": 109, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-03 07:09:13" }, { "id": 401, "employee_id": 6, "policy_id": 1, "occurred_at": "2026-08-21 21:59:41", "channel": "external email", "recipient_domain": "partner886.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 58, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-08-28 02:02:55" }, { "id": 402, "employee_id": 28, "policy_id": 7, "occurred_at": "2026-09-15 09:49:01", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "xlsx", "match_count": 376, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-09-15 11:25:44" }, { "id": 403, "employee_id": 56, "policy_id": 3, "occurred_at": "2026-07-29 09:35:52", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 39, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-05 11:00:00" }, { "id": 404, "employee_id": 34, "policy_id": 5, "occurred_at": "2026-08-23 17:48:24", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 102, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "new", "closed_at": null }, { "id": 405, "employee_id": 69, "policy_id": 7, "occurred_at": "2026-09-01 13:10:19", "channel": "external email", "recipient_domain": "partner150.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 461, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-09-07 10:27:56" }, { "id": 406, "employee_id": 2, "policy_id": 8, "occurred_at": "2026-07-13 10:47:11", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 1, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-22 15:13:58" }, { "id": 407, "employee_id": 5, "policy_id": 5, "occurred_at": "2026-09-16 12:44:41", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-8847", "file_type": "xlsx", "match_count": 103, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "new", "closed_at": null }, { "id": 408, "employee_id": 4, "policy_id": 2, "occurred_at": "2026-07-05 15:43:57", "channel": "external email", "recipient_domain": "partner686.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 56, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-07-14 01:59:25" }, { "id": 409, "employee_id": 21, "policy_id": 4, "occurred_at": "2026-08-13 10:40:08", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 243, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-08-22 02:33:36" }, { "id": 410, "employee_id": 2, "policy_id": 4, "occurred_at": "2026-07-14 11:13:49", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "txt", "match_count": 77, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "closed, business need", "closed_at": "2026-07-14 21:44:42" }, { "id": 411, "employee_id": 1, "policy_id": 5, "occurred_at": "2026-08-13 09:11:04", "channel": "chat message", "recipient_domain": "partner798.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 468, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "confirmed, user coached", "closed_at": "2026-08-20 14:53:09" }, { "id": 412, "employee_id": 4, "policy_id": 3, "occurred_at": "2026-09-16 15:18:34", "channel": "external email", "recipient_domain": "partner522.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 51, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-19 22:40:46" }, { "id": 413, "employee_id": 3, "policy_id": 2, "occurred_at": "2026-08-11 20:20:22", "channel": "external email", "recipient_domain": "partner468.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 58, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "sending to our external auditor", "triage_status": "closed, business need", "closed_at": "2026-08-21 19:00:14" }, { "id": 414, "employee_id": 11, "policy_id": 7, "occurred_at": "2026-09-27 11:35:07", "channel": "chat message", "recipient_domain": "partner695.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 56, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-09-27 17:28:07" }, { "id": 415, "employee_id": 17, "policy_id": 7, "occurred_at": "2026-08-04 08:51:22", "channel": "external email", "recipient_domain": "partner895.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 513, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-12 17:49:35" }, { "id": 416, "employee_id": 37, "policy_id": 6, "occurred_at": "2026-08-31 16:51:51", "channel": "external email", "recipient_domain": "partner507.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 603, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-09-02 10:17:20" }, { "id": 417, "employee_id": 50, "policy_id": 7, "occurred_at": "2026-08-22 12:57:55", "channel": "external email", "recipient_domain": "partner863.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 640, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-08-28 13:36:03" }, { "id": 418, "employee_id": 61, "policy_id": 8, "occurred_at": "2026-07-27 10:30:33", "channel": "web upload", "recipient_domain": null, "upload_site": "convert.example.net", "device_label": null, "file_type": "xlsx", "match_count": 67, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "sending to our external auditor", "triage_status": "closed, business need", "closed_at": "2026-07-28 16:46:55" }, { "id": 419, "employee_id": 15, "policy_id": 4, "occurred_at": "2026-09-18 15:44:25", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-1468", "file_type": "xlsx", "match_count": 468, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "it is test data, not real", "triage_status": "confirmed, user coached", "closed_at": "2026-09-23 22:32:41" }, { "id": 420, "employee_id": 43, "policy_id": 5, "occurred_at": "2026-08-02 09:41:45", "channel": "external email", "recipient_domain": "partner287.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 274, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "closed, business need", "closed_at": "2026-08-11 21:57:13" }, { "id": 421, "employee_id": 40, "policy_id": 2, "occurred_at": "2026-08-10 17:41:11", "channel": "external email", "recipient_domain": "partner016.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 534, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "sending to our external auditor", "triage_status": "confirmed, user coached", "closed_at": "2026-08-20 08:28:58" }, { "id": 422, "employee_id": 1, "policy_id": 7, "occurred_at": "2026-08-08 10:24:04", "channel": "external email", "recipient_domain": "partner171.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 27, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-08-13 13:26:59" }, { "id": 423, "employee_id": 11, "policy_id": 7, "occurred_at": "2026-09-13 13:37:45", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "zip", "match_count": 4, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-09-21 23:41:14" }, { "id": 424, "employee_id": 44, "policy_id": 6, "occurred_at": "2026-07-03 12:41:04", "channel": "external email", "recipient_domain": "partner849.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 5, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 425, "employee_id": 3, "policy_id": 4, "occurred_at": "2026-07-19 13:23:29", "channel": "external email", "recipient_domain": "partner007.example.com", "upload_site": null, "device_label": null, "file_type": "zip", "match_count": 5, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "sending to our external auditor", "triage_status": "new", "closed_at": null }, { "id": 426, "employee_id": 6, "policy_id": 2, "occurred_at": "2026-07-21 19:29:37", "channel": "external email", "recipient_domain": "partner808.example.com", "upload_site": null, "device_label": null, "file_type": "zip", "match_count": 1, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-07-28 04:05:37" }, { "id": 427, "employee_id": 1, "policy_id": 1, "occurred_at": "2026-07-29 13:33:44", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-2230", "file_type": "docx", "match_count": 46, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-08-03 04:28:41" }, { "id": 428, "employee_id": 6, "policy_id": 1, "occurred_at": "2026-08-30 11:54:32", "channel": "external email", "recipient_domain": "partner096.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 180, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-07 10:50:21" }, { "id": 429, "employee_id": 1, "policy_id": 4, "occurred_at": "2026-08-17 14:21:45", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "xlsx", "match_count": 506, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "working from my personal laptop tonight", "triage_status": "false positive", "closed_at": "2026-08-18 15:53:09" }, { "id": 430, "employee_id": 70, "policy_id": 7, "occurred_at": "2026-07-04 10:52:36", "channel": "external email", "recipient_domain": "partner478.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 651, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-07-06 01:49:29" }, { "id": 431, "employee_id": 2, "policy_id": 1, "occurred_at": "2026-08-27 10:37:22", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "py", "match_count": 27, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 432, "employee_id": 22, "policy_id": 8, "occurred_at": "2026-09-01 15:06:24", "channel": "external email", "recipient_domain": "partner165.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 751, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "working from my personal laptop tonight", "triage_status": "false positive", "closed_at": "2026-09-06 01:19:14" }, { "id": 433, "employee_id": 13, "policy_id": 1, "occurred_at": "2026-07-26 17:29:03", "channel": "external email", "recipient_domain": "partner646.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 92, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-07-26 17:30:37" }, { "id": 434, "employee_id": 30, "policy_id": 5, "occurred_at": "2026-08-21 15:27:15", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "zip", "match_count": 15, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-31 13:45:58" }, { "id": 435, "employee_id": 17, "policy_id": 3, "occurred_at": "2026-07-07 17:16:17", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "pdf", "match_count": 672, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 436, "employee_id": 1, "policy_id": 6, "occurred_at": "2026-09-02 14:25:58", "channel": "external email", "recipient_domain": "partner150.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 178, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 437, "employee_id": 33, "policy_id": 4, "occurred_at": "2026-08-21 11:32:57", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-8423", "file_type": "zip", "match_count": 286, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-08-26 09:47:29" }, { "id": 438, "employee_id": 4, "policy_id": 5, "occurred_at": "2026-09-06 13:54:18", "channel": "external email", "recipient_domain": "partner853.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 25, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "new", "closed_at": null }, { "id": 439, "employee_id": 62, "policy_id": 1, "occurred_at": "2026-07-11 15:44:12", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 13, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 440, "employee_id": 8, "policy_id": 1, "occurred_at": "2026-08-02 09:10:59", "channel": "external email", "recipient_domain": "partner718.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 160, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-08-11 02:24:32" }, { "id": 441, "employee_id": 59, "policy_id": 4, "occurred_at": "2026-07-25 09:35:58", "channel": "external email", "recipient_domain": "partner579.example.com", "upload_site": null, "device_label": null, "file_type": "py", "match_count": 6, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "it is test data, not real", "triage_status": "confirmed, user coached", "closed_at": "2026-07-31 06:51:37" }, { "id": 442, "employee_id": 16, "policy_id": 2, "occurred_at": "2026-08-22 09:08:35", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 95, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-08-22 19:06:56" }, { "id": 443, "employee_id": 35, "policy_id": 1, "occurred_at": "2026-08-07 14:44:16", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-7460", "file_type": "pdf", "match_count": 466, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-08-10 15:41:01" }, { "id": 444, "employee_id": 1, "policy_id": 3, "occurred_at": "2026-09-29 15:07:12", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-0233", "file_type": "pdf", "match_count": 550, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-09-30 20:20:53" }, { "id": 445, "employee_id": 2, "policy_id": 1, "occurred_at": "2026-07-19 03:07:23", "channel": "external email", "recipient_domain": "partner487.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 400, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-25 04:58:48" }, { "id": 446, "employee_id": 31, "policy_id": 5, "occurred_at": "2026-08-20 09:33:19", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 436, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "new", "closed_at": null }, { "id": 447, "employee_id": 20, "policy_id": 7, "occurred_at": "2026-08-03 14:23:53", "channel": "chat message", "recipient_domain": "partner839.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 26, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 448, "employee_id": 1, "policy_id": 1, "occurred_at": "2026-09-13 16:22:57", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "zip", "match_count": 278, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 449, "employee_id": 2, "policy_id": 5, "occurred_at": "2026-07-12 09:22:39", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "docx", "match_count": 637, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "new", "closed_at": null }, { "id": 450, "employee_id": 61, "policy_id": 5, "occurred_at": "2026-09-06 13:43:04", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "csv", "match_count": 289, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "working from my personal laptop tonight", "triage_status": "confirmed, escalated", "closed_at": "2026-09-09 05:18:49" }, { "id": 451, "employee_id": 60, "policy_id": 8, "occurred_at": "2026-08-11 12:25:31", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-0805", "file_type": "docx", "match_count": 782, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-21 00:16:25" }, { "id": 452, "employee_id": 40, "policy_id": 7, "occurred_at": "2026-09-19 14:40:04", "channel": "external email", "recipient_domain": "partner358.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 444, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-19 23:08:20" }, { "id": 453, "employee_id": 66, "policy_id": 8, "occurred_at": "2026-09-28 10:56:20", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "pdf", "match_count": 349, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "closed, business need", "closed_at": "2026-10-03 20:03:48" }, { "id": 454, "employee_id": 13, "policy_id": 5, "occurred_at": "2026-08-17 13:39:30", "channel": "chat message", "recipient_domain": "partner112.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 756, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "new", "closed_at": null }, { "id": 455, "employee_id": 36, "policy_id": 7, "occurred_at": "2026-09-25 11:35:05", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "zip", "match_count": 150, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-10-04 13:42:40" }, { "id": 456, "employee_id": 2, "policy_id": 6, "occurred_at": "2026-08-15 16:54:12", "channel": "web upload", "recipient_domain": null, "upload_site": "convert.example.net", "device_label": null, "file_type": "pdf", "match_count": 565, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-08-23 01:28:51" }, { "id": 457, "employee_id": 53, "policy_id": 6, "occurred_at": "2026-09-15 15:06:50", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 681, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 458, "employee_id": 6, "policy_id": 3, "occurred_at": "2026-08-22 11:49:54", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-1374", "file_type": "csv", "match_count": 583, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-01 04:12:04" }, { "id": 459, "employee_id": 53, "policy_id": 3, "occurred_at": "2026-08-07 14:11:01", "channel": "external email", "recipient_domain": "partner635.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 625, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-08 05:51:43" }, { "id": 460, "employee_id": 56, "policy_id": 3, "occurred_at": "2026-09-28 12:31:44", "channel": "external email", "recipient_domain": "partner060.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 303, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-10-06 15:31:07" }, { "id": 461, "employee_id": 7, "policy_id": 2, "occurred_at": "2026-07-15 11:30:58", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-9779", "file_type": "xlsx", "match_count": 110, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "false positive", "closed_at": "2026-07-20 13:27:22" }, { "id": 462, "employee_id": 10, "policy_id": 1, "occurred_at": "2026-07-26 17:54:06", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "csv", "match_count": 538, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 463, "employee_id": 63, "policy_id": 8, "occurred_at": "2026-09-29 17:34:26", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 340, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "it is test data, not real", "triage_status": "new", "closed_at": null }, { "id": 464, "employee_id": 37, "policy_id": 2, "occurred_at": "2026-09-14 14:09:24", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "zip", "match_count": 33, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "closed, business need", "closed_at": "2026-09-20 00:46:44" }, { "id": 465, "employee_id": 9, "policy_id": 2, "occurred_at": "2026-09-13 18:42:40", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-6498", "file_type": "docx", "match_count": 216, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-09-23 02:41:59" }, { "id": 466, "employee_id": 1, "policy_id": 6, "occurred_at": "2026-09-03 10:24:16", "channel": "external email", "recipient_domain": "partner790.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 136, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 467, "employee_id": 45, "policy_id": 4, "occurred_at": "2026-07-09 15:56:25", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 31, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "closed, business need", "closed_at": "2026-07-15 03:03:25" }, { "id": 468, "employee_id": 7, "policy_id": 7, "occurred_at": "2026-08-01 14:40:32", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-7623", "file_type": "xlsx", "match_count": 124, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-09 03:53:53" }, { "id": 469, "employee_id": 1, "policy_id": 8, "occurred_at": "2026-07-25 15:20:33", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 14, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "false positive", "closed_at": "2026-08-04 07:25:38" }, { "id": 470, "employee_id": 1, "policy_id": 4, "occurred_at": "2026-08-12 14:08:05", "channel": "external email", "recipient_domain": "partner028.example.com", "upload_site": null, "device_label": null, "file_type": "py", "match_count": 559, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-17 03:33:48" }, { "id": 471, "employee_id": 59, "policy_id": 1, "occurred_at": "2026-08-24 13:14:35", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 65, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-28 13:48:23" }, { "id": 472, "employee_id": 1, "policy_id": 7, "occurred_at": "2026-08-16 10:34:00", "channel": "external email", "recipient_domain": "partner975.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 558, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-08-23 11:04:13" }, { "id": 473, "employee_id": 37, "policy_id": 8, "occurred_at": "2026-09-13 13:41:19", "channel": "external email", "recipient_domain": "partner397.example.com", "upload_site": null, "device_label": null, "file_type": "zip", "match_count": 475, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-16 17:04:25" }, { "id": 474, "employee_id": 12, "policy_id": 1, "occurred_at": "2026-09-07 14:42:19", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-7959", "file_type": "csv", "match_count": 690, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-09-12 09:29:22" }, { "id": 475, "employee_id": 1, "policy_id": 2, "occurred_at": "2026-07-13 15:43:28", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "py", "match_count": 717, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "new", "closed_at": null }, { "id": 476, "employee_id": 36, "policy_id": 4, "occurred_at": "2026-09-14 10:19:19", "channel": "chat message", "recipient_domain": "partner041.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 379, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "confirmed, escalated", "closed_at": "2026-09-20 15:05:54" }, { "id": 477, "employee_id": 45, "policy_id": 3, "occurred_at": "2026-07-16 14:37:27", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "csv", "match_count": 13, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-07-22 00:12:28" }, { "id": 478, "employee_id": 15, "policy_id": 6, "occurred_at": "2026-07-20 22:28:32", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 774, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-07-21 07:21:51" }, { "id": 479, "employee_id": 2, "policy_id": 2, "occurred_at": "2026-09-27 22:01:57", "channel": "chat message", "recipient_domain": "partner916.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 552, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "it is test data, not real", "triage_status": "closed, business need", "closed_at": "2026-09-28 12:21:07" }, { "id": 480, "employee_id": 23, "policy_id": 1, "occurred_at": "2026-08-24 07:33:57", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "xlsx", "match_count": 667, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-25 11:24:34" }, { "id": 481, "employee_id": 26, "policy_id": 7, "occurred_at": "2026-08-18 13:17:40", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-9839", "file_type": "txt", "match_count": 1, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-08-27 21:04:26" }, { "id": 482, "employee_id": 9, "policy_id": 7, "occurred_at": "2026-07-11 16:38:57", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-9137", "file_type": "py", "match_count": 95, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-20 07:55:56" }, { "id": 483, "employee_id": 1, "policy_id": 4, "occurred_at": "2026-08-16 12:35:53", "channel": "external email", "recipient_domain": "partner703.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 326, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-17 10:27:46" }, { "id": 484, "employee_id": 12, "policy_id": 5, "occurred_at": "2026-08-10 15:07:16", "channel": "external email", "recipient_domain": "partner648.example.com", "upload_site": null, "device_label": null, "file_type": "zip", "match_count": 70, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-12 00:39:01" }, { "id": 485, "employee_id": 51, "policy_id": 8, "occurred_at": "2026-07-07 12:29:50", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "docx", "match_count": 289, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-09 01:50:10" }, { "id": 486, "employee_id": 18, "policy_id": 1, "occurred_at": "2026-07-19 14:06:59", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "zip", "match_count": 329, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 487, "employee_id": 43, "policy_id": 1, "occurred_at": "2026-09-17 15:42:10", "channel": "external email", "recipient_domain": "partner119.example.com", "upload_site": null, "device_label": null, "file_type": "zip", "match_count": 412, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-09-18 16:53:22" }, { "id": 488, "employee_id": 44, "policy_id": 7, "occurred_at": "2026-07-03 17:59:19", "channel": "external email", "recipient_domain": "partner268.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 2, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-07-05 18:28:32" }, { "id": 489, "employee_id": 32, "policy_id": 3, "occurred_at": "2026-07-30 14:04:20", "channel": "web upload", "recipient_domain": null, "upload_site": "convert.example.net", "device_label": null, "file_type": "csv", "match_count": 670, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-08-02 16:30:28" }, { "id": 490, "employee_id": 21, "policy_id": 4, "occurred_at": "2026-08-24 11:56:51", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 67, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-27 04:14:48" }, { "id": 491, "employee_id": 41, "policy_id": 6, "occurred_at": "2026-07-07 15:06:59", "channel": "external email", "recipient_domain": "partner610.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 159, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 492, "employee_id": 1, "policy_id": 8, "occurred_at": "2026-07-19 07:29:52", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-6040", "file_type": "xlsx", "match_count": 301, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "confirmed, user coached", "closed_at": "2026-07-23 00:40:13" }, { "id": 493, "employee_id": 11, "policy_id": 1, "occurred_at": "2026-07-21 13:03:24", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "docx", "match_count": 46, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 494, "employee_id": 1, "policy_id": 5, "occurred_at": "2026-09-21 12:43:23", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "csv", "match_count": 4, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "closed, business need", "closed_at": "2026-10-01 03:05:25" }, { "id": 495, "employee_id": 52, "policy_id": 5, "occurred_at": "2026-07-11 07:07:52", "channel": "external email", "recipient_domain": "partner386.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 124, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "working from my personal laptop tonight", "triage_status": "false positive", "closed_at": "2026-07-12 22:14:31" }, { "id": 496, "employee_id": 17, "policy_id": 8, "occurred_at": "2026-09-12 10:30:31", "channel": "external email", "recipient_domain": "partner798.example.com", "upload_site": null, "device_label": null, "file_type": "txt", "match_count": 446, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "false positive", "closed_at": "2026-09-17 12:23:00" }, { "id": 497, "employee_id": 3, "policy_id": 6, "occurred_at": "2026-07-02 12:33:21", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "zip", "match_count": 18, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 498, "employee_id": 54, "policy_id": 3, "occurred_at": "2026-08-18 12:22:17", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-4114", "file_type": "zip", "match_count": 22, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-08-27 10:07:28" }, { "id": 499, "employee_id": 1, "policy_id": 8, "occurred_at": "2026-07-21 10:30:24", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "zip", "match_count": 614, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "new", "closed_at": null }, { "id": 500, "employee_id": 28, "policy_id": 2, "occurred_at": "2026-09-20 09:05:03", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "xlsx", "match_count": 610, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-20 20:27:20" }, { "id": 501, "employee_id": 10, "policy_id": 7, "occurred_at": "2026-09-15 10:26:02", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-1045", "file_type": "xlsx", "match_count": 36, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-09-23 02:56:05" }, { "id": 502, "employee_id": 3, "policy_id": 5, "occurred_at": "2026-07-09 10:27:30", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "zip", "match_count": 286, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-07-19 08:14:05" }, { "id": 503, "employee_id": 6, "policy_id": 8, "occurred_at": "2026-09-13 16:49:14", "channel": "external email", "recipient_domain": "partner450.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 20, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-21 23:36:27" }, { "id": 504, "employee_id": 4, "policy_id": 3, "occurred_at": "2026-07-06 13:33:38", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "xlsx", "match_count": 28, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-09 17:36:06" }, { "id": 505, "employee_id": 3, "policy_id": 5, "occurred_at": "2026-07-17 09:37:57", "channel": "external email", "recipient_domain": "partner371.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 165, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "confirmed, escalated", "closed_at": "2026-07-23 21:14:34" }, { "id": 506, "employee_id": 2, "policy_id": 4, "occurred_at": "2026-08-20 14:11:07", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-7917", "file_type": "zip", "match_count": 19, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "closed, business need", "closed_at": "2026-08-27 13:17:21" }, { "id": 507, "employee_id": 3, "policy_id": 4, "occurred_at": "2026-09-09 17:22:47", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 1, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "new", "closed_at": null }, { "id": 508, "employee_id": 65, "policy_id": 3, "occurred_at": "2026-07-21 11:31:30", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-4529", "file_type": "txt", "match_count": 215, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-07-28 12:59:13" }, { "id": 509, "employee_id": 47, "policy_id": 1, "occurred_at": "2026-07-14 13:55:40", "channel": "external email", "recipient_domain": "partner077.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 458, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 510, "employee_id": 31, "policy_id": 1, "occurred_at": "2026-07-13 16:42:07", "channel": "web upload", "recipient_domain": null, "upload_site": "paste.example.org", "device_label": null, "file_type": "csv", "match_count": 328, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-16 02:32:35" }, { "id": 511, "employee_id": 45, "policy_id": 7, "occurred_at": "2026-09-01 11:57:54", "channel": "external email", "recipient_domain": "partner677.example.com", "upload_site": null, "device_label": null, "file_type": "py", "match_count": 106, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-09-09 08:08:16" }, { "id": 512, "employee_id": 7, "policy_id": 5, "occurred_at": "2026-07-12 15:31:50", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 83, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "closed, business need", "closed_at": "2026-07-22 07:26:18" }, { "id": 513, "employee_id": 38, "policy_id": 6, "occurred_at": "2026-07-16 17:06:48", "channel": "external email", "recipient_domain": "partner162.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 26, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-07-20 17:36:29" }, { "id": 514, "employee_id": 45, "policy_id": 8, "occurred_at": "2026-08-22 15:20:52", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 160, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-08-30 17:51:08" }, { "id": 515, "employee_id": 9, "policy_id": 1, "occurred_at": "2026-07-20 10:02:36", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "txt", "match_count": 188, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-07-29 05:09:26" }, { "id": 516, "employee_id": 1, "policy_id": 4, "occurred_at": "2026-09-17 14:31:43", "channel": "external email", "recipient_domain": "partner022.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 65, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "new", "closed_at": null }, { "id": 517, "employee_id": 5, "policy_id": 8, "occurred_at": "2026-07-07 16:31:50", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 1, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "new", "closed_at": null }, { "id": 518, "employee_id": 57, "policy_id": 1, "occurred_at": "2026-09-14 10:24:47", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "pdf", "match_count": 7, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 519, "employee_id": 17, "policy_id": 1, "occurred_at": "2026-08-26 16:54:30", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "csv", "match_count": 780, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-31 17:44:01" }, { "id": 520, "employee_id": 14, "policy_id": 3, "occurred_at": "2026-09-02 16:15:51", "channel": "chat message", "recipient_domain": "partner290.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 98, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-06 05:03:39" }, { "id": 521, "employee_id": 33, "policy_id": 6, "occurred_at": "2026-09-21 13:03:43", "channel": "external email", "recipient_domain": "partner582.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 48, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-25 02:33:17" }, { "id": 522, "employee_id": 3, "policy_id": 5, "occurred_at": "2026-09-02 16:25:40", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "zip", "match_count": 699, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "confirmed, escalated", "closed_at": "2026-09-07 20:05:25" }, { "id": 523, "employee_id": 9, "policy_id": 6, "occurred_at": "2026-09-19 08:33:42", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 609, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-26 14:49:12" }, { "id": 524, "employee_id": 1, "policy_id": 8, "occurred_at": "2026-07-08 12:52:30", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 496, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "confirmed, escalated", "closed_at": "2026-07-15 11:20:13" }, { "id": 525, "employee_id": 55, "policy_id": 6, "occurred_at": "2026-08-16 10:01:57", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 683, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-17 02:29:39" }, { "id": 526, "employee_id": 38, "policy_id": 7, "occurred_at": "2026-09-11 10:40:21", "channel": "external email", "recipient_domain": "partner784.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 449, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 527, "employee_id": 2, "policy_id": 3, "occurred_at": "2026-07-10 11:47:09", "channel": "external email", "recipient_domain": "partner238.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 721, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-07-14 16:28:21" }, { "id": 528, "employee_id": 1, "policy_id": 2, "occurred_at": "2026-07-26 11:07:38", "channel": "external email", "recipient_domain": "partner433.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 372, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "false positive", "closed_at": "2026-07-31 01:26:43" }, { "id": 529, "employee_id": 50, "policy_id": 5, "occurred_at": "2026-07-04 18:28:00", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "py", "match_count": 56, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "new", "closed_at": null }, { "id": 530, "employee_id": 1, "policy_id": 2, "occurred_at": "2026-09-19 11:29:48", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "txt", "match_count": 2, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-22 09:03:46" }, { "id": 531, "employee_id": 64, "policy_id": 4, "occurred_at": "2026-08-05 15:51:04", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "txt", "match_count": 69, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "confirmed, user coached", "closed_at": "2026-08-14 12:16:25" }, { "id": 532, "employee_id": 11, "policy_id": 2, "occurred_at": "2026-07-18 13:13:09", "channel": "external email", "recipient_domain": "partner124.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 289, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "closed, business need", "closed_at": "2026-07-22 05:41:22" }, { "id": 533, "employee_id": 7, "policy_id": 5, "occurred_at": "2026-09-29 16:10:02", "channel": "chat message", "recipient_domain": "partner069.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 779, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "closed, business need", "closed_at": "2026-10-08 13:01:24" }, { "id": 534, "employee_id": 11, "policy_id": 5, "occurred_at": "2026-08-10 15:49:14", "channel": "external email", "recipient_domain": "partner202.example.com", "upload_site": null, "device_label": null, "file_type": "py", "match_count": 64, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-08-14 22:50:28" }, { "id": 535, "employee_id": 4, "policy_id": 4, "occurred_at": "2026-09-02 14:11:15", "channel": "chat message", "recipient_domain": "partner640.example.com", "upload_site": null, "device_label": null, "file_type": "txt", "match_count": 117, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "working from my personal laptop tonight", "triage_status": "false positive", "closed_at": "2026-09-06 20:29:43" }, { "id": 536, "employee_id": 48, "policy_id": 1, "occurred_at": "2026-07-30 16:44:14", "channel": "web upload", "recipient_domain": null, "upload_site": "paste.example.org", "device_label": null, "file_type": "docx", "match_count": 379, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-08-01 21:54:09" }, { "id": 537, "employee_id": 11, "policy_id": 1, "occurred_at": "2026-07-19 16:05:07", "channel": "external email", "recipient_domain": "partner299.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 245, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-07-22 18:12:41" }, { "id": 538, "employee_id": 63, "policy_id": 1, "occurred_at": "2026-09-19 12:50:31", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "docx", "match_count": 12, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-09-28 05:22:20" }, { "id": 539, "employee_id": 3, "policy_id": 6, "occurred_at": "2026-09-22 08:33:46", "channel": "external email", "recipient_domain": "partner057.example.com", "upload_site": null, "device_label": null, "file_type": "zip", "match_count": 606, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-10-02 08:09:28" }, { "id": 540, "employee_id": 1, "policy_id": 2, "occurred_at": "2026-07-12 10:43:23", "channel": "external email", "recipient_domain": "partner942.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 223, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-13 18:27:36" }, { "id": 541, "employee_id": 18, "policy_id": 2, "occurred_at": "2026-09-06 16:07:31", "channel": "external email", "recipient_domain": "partner094.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 719, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "new", "closed_at": null }, { "id": 542, "employee_id": 1, "policy_id": 3, "occurred_at": "2026-09-25 18:33:58", "channel": "external email", "recipient_domain": "partner659.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 789, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-09-25 23:51:45" }, { "id": 543, "employee_id": 50, "policy_id": 6, "occurred_at": "2026-07-14 08:54:59", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 256, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-17 10:13:48" }, { "id": 544, "employee_id": 1, "policy_id": 1, "occurred_at": "2026-08-05 13:02:17", "channel": "chat message", "recipient_domain": "partner106.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 77, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-08-11 06:48:04" }, { "id": 545, "employee_id": 11, "policy_id": 6, "occurred_at": "2026-09-04 10:25:18", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 201, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-09-05 04:59:09" }, { "id": 546, "employee_id": 16, "policy_id": 7, "occurred_at": "2026-08-15 08:11:15", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 708, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-19 21:09:48" }, { "id": 547, "employee_id": 4, "policy_id": 1, "occurred_at": "2026-07-22 15:29:52", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "csv", "match_count": 1, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-23 10:04:23" }, { "id": 548, "employee_id": 17, "policy_id": 5, "occurred_at": "2026-08-17 14:31:50", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-3344", "file_type": "xlsx", "match_count": 57, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-08-21 12:22:00" }, { "id": 549, "employee_id": 1, "policy_id": 7, "occurred_at": "2026-08-02 11:25:59", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 672, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-08-05 18:40:29" }, { "id": 550, "employee_id": 3, "policy_id": 2, "occurred_at": "2026-07-25 18:41:12", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-0477", "file_type": "docx", "match_count": 60, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "new", "closed_at": null }, { "id": 551, "employee_id": 15, "policy_id": 6, "occurred_at": "2026-09-24 09:17:21", "channel": "external email", "recipient_domain": "partner581.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 34, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-09-28 21:03:35" }, { "id": 552, "employee_id": 4, "policy_id": 8, "occurred_at": "2026-09-11 09:09:06", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 1, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "it is test data, not real", "triage_status": "new", "closed_at": null }, { "id": 553, "employee_id": 64, "policy_id": 6, "occurred_at": "2026-09-11 09:32:29", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-5254", "file_type": "csv", "match_count": 3, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-09-15 19:40:26" }, { "id": 554, "employee_id": 6, "policy_id": 2, "occurred_at": "2026-08-11 14:34:24", "channel": "external email", "recipient_domain": "partner125.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 99, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "working from my personal laptop tonight", "triage_status": "confirmed, user coached", "closed_at": "2026-08-17 03:05:44" }, { "id": 555, "employee_id": 35, "policy_id": 3, "occurred_at": "2026-07-20 13:29:38", "channel": "external email", "recipient_domain": "partner930.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 6, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-23 16:31:20" }, { "id": 556, "employee_id": 4, "policy_id": 3, "occurred_at": "2026-07-31 13:36:09", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 345, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-08-10 12:20:14" }, { "id": 557, "employee_id": 11, "policy_id": 3, "occurred_at": "2026-08-23 11:47:15", "channel": "web upload", "recipient_domain": null, "upload_site": "convert.example.net", "device_label": null, "file_type": "xlsx", "match_count": 360, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 558, "employee_id": 56, "policy_id": 8, "occurred_at": "2026-07-24 10:39:04", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "csv", "match_count": 607, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "confirmed, user coached", "closed_at": "2026-07-28 08:50:40" }, { "id": 559, "employee_id": 1, "policy_id": 5, "occurred_at": "2026-09-29 10:43:10", "channel": "web upload", "recipient_domain": null, "upload_site": "paste.example.org", "device_label": null, "file_type": "txt", "match_count": 168, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "confirmed, user coached", "closed_at": "2026-10-04 10:29:29" }, { "id": 560, "employee_id": 20, "policy_id": 2, "occurred_at": "2026-08-01 10:33:43", "channel": "external email", "recipient_domain": "partner449.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 93, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-08-04 22:53:19" }, { "id": 561, "employee_id": 38, "policy_id": 1, "occurred_at": "2026-09-05 12:42:04", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "docx", "match_count": 335, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-09-09 22:03:06" }, { "id": 562, "employee_id": 34, "policy_id": 5, "occurred_at": "2026-07-29 21:21:08", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 26, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "new", "closed_at": null }, { "id": 563, "employee_id": 51, "policy_id": 4, "occurred_at": "2026-09-19 14:56:04", "channel": "external email", "recipient_domain": "partner473.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 323, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "confirmed, user coached", "closed_at": "2026-09-24 02:52:37" }, { "id": 564, "employee_id": 59, "policy_id": 1, "occurred_at": "2026-08-07 10:43:43", "channel": "chat message", "recipient_domain": "partner701.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 48, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-08-14 13:18:24" }, { "id": 565, "employee_id": 17, "policy_id": 7, "occurred_at": "2026-07-27 05:27:31", "channel": "chat message", "recipient_domain": "partner551.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 520, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-29 09:05:28" }, { "id": 566, "employee_id": 41, "policy_id": 6, "occurred_at": "2026-08-18 16:57:23", "channel": "external email", "recipient_domain": "partner624.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 726, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-23 01:54:43" }, { "id": 567, "employee_id": 30, "policy_id": 7, "occurred_at": "2026-09-15 14:34:51", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "pdf", "match_count": 163, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-09-20 04:00:22" }, { "id": 568, "employee_id": 16, "policy_id": 6, "occurred_at": "2026-09-27 08:14:34", "channel": "chat message", "recipient_domain": "partner353.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 447, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-10-05 06:05:08" }, { "id": 569, "employee_id": 10, "policy_id": 1, "occurred_at": "2026-09-01 17:04:39", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-5084", "file_type": "csv", "match_count": 482, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-09-05 04:41:29" }, { "id": 570, "employee_id": 5, "policy_id": 1, "occurred_at": "2026-08-30 13:00:19", "channel": "chat message", "recipient_domain": "partner523.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 726, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-08-31 07:58:59" }, { "id": 571, "employee_id": 33, "policy_id": 4, "occurred_at": "2026-08-19 18:41:54", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-3398", "file_type": "pdf", "match_count": 342, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "closed, business need", "closed_at": "2026-08-25 09:15:05" }, { "id": 572, "employee_id": 21, "policy_id": 2, "occurred_at": "2026-08-31 14:49:59", "channel": "printer", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 56, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "closed, business need", "closed_at": "2026-09-05 03:13:10" }, { "id": 573, "employee_id": 55, "policy_id": 4, "occurred_at": "2026-09-20 11:38:28", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 523, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "closed, business need", "closed_at": "2026-09-28 08:59:03" }, { "id": 574, "employee_id": 57, "policy_id": 1, "occurred_at": "2026-07-07 14:24:09", "channel": "external email", "recipient_domain": "partner171.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 535, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-13 17:38:30" }, { "id": 575, "employee_id": 6, "policy_id": 1, "occurred_at": "2026-07-03 10:12:10", "channel": "external email", "recipient_domain": "partner825.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 490, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 576, "employee_id": 16, "policy_id": 7, "occurred_at": "2026-09-23 15:11:42", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 69, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-09-25 20:15:03" }, { "id": 577, "employee_id": 45, "policy_id": 5, "occurred_at": "2026-08-30 10:04:49", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 65, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "confirmed, escalated", "closed_at": "2026-09-02 13:19:22" }, { "id": 578, "employee_id": 24, "policy_id": 6, "occurred_at": "2026-08-06 13:43:22", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 395, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "confirmed, escalated", "closed_at": "2026-08-10 13:33:43" }, { "id": 579, "employee_id": 3, "policy_id": 1, "occurred_at": "2026-08-19 16:35:00", "channel": "external email", "recipient_domain": "partner447.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 716, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "closed, business need", "closed_at": "2026-08-26 20:46:45" }, { "id": 580, "employee_id": 2, "policy_id": 4, "occurred_at": "2026-08-18 14:11:20", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-5377", "file_type": "csv", "match_count": 54, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "false positive", "closed_at": "2026-08-18 16:19:37" }, { "id": 581, "employee_id": 1, "policy_id": 1, "occurred_at": "2026-09-14 11:43:15", "channel": "external email", "recipient_domain": "partner630.example.com", "upload_site": null, "device_label": null, "file_type": "zip", "match_count": 253, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-09-18 21:11:28" }, { "id": 582, "employee_id": 52, "policy_id": 3, "occurred_at": "2026-08-20 15:14:06", "channel": "external email", "recipient_domain": "partner143.example.com", "upload_site": null, "device_label": null, "file_type": "py", "match_count": 183, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-25 17:05:00" }, { "id": 583, "employee_id": 30, "policy_id": 8, "occurred_at": "2026-07-30 08:52:20", "channel": "external email", "recipient_domain": "partner579.example.com", "upload_site": null, "device_label": null, "file_type": "py", "match_count": 15, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-07 09:07:41" }, { "id": 584, "employee_id": 1, "policy_id": 8, "occurred_at": "2026-08-31 14:37:41", "channel": "external email", "recipient_domain": "partner159.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 1, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "customer asked for a copy of their own data", "triage_status": "closed, business need", "closed_at": "2026-09-08 00:18:50" }, { "id": 585, "employee_id": 47, "policy_id": 5, "occurred_at": "2026-07-20 17:40:56", "channel": "cloud sync client", "recipient_domain": null, "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 450, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "closed, business need", "closed_at": "2026-07-27 17:50:30" }, { "id": 586, "employee_id": 1, "policy_id": 8, "occurred_at": "2026-09-22 15:23:40", "channel": "external email", "recipient_domain": "partner144.example.com", "upload_site": null, "device_label": null, "file_type": "pdf", "match_count": 429, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "closed, business need", "closed_at": "2026-09-28 04:45:02" }, { "id": 587, "employee_id": 13, "policy_id": 6, "occurred_at": "2026-07-11 15:25:44", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "docx", "match_count": 441, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 588, "employee_id": 1, "policy_id": 2, "occurred_at": "2026-09-24 08:34:02", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "pdf", "match_count": 49, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "false positive", "closed_at": "2026-09-26 00:56:49" }, { "id": 589, "employee_id": 3, "policy_id": 8, "occurred_at": "2026-08-31 10:24:11", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-3876", "file_type": "csv", "match_count": 292, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "it is test data, not real", "triage_status": "new", "closed_at": null }, { "id": 590, "employee_id": 3, "policy_id": 1, "occurred_at": "2026-08-06 11:39:51", "channel": "chat message", "recipient_domain": "partner647.example.com", "upload_site": null, "device_label": null, "file_type": "xlsx", "match_count": 704, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-08-07 22:35:45" }, { "id": 591, "employee_id": 68, "policy_id": 6, "occurred_at": "2026-08-03 13:41:39", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-1631", "file_type": "xlsx", "match_count": 52, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-08-05 14:46:07" }, { "id": 592, "employee_id": 53, "policy_id": 6, "occurred_at": "2026-07-18 10:33:56", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "xlsx", "match_count": 759, "enforced_action": "audit only", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-07-22 07:03:47" }, { "id": 593, "employee_id": 1, "policy_id": 4, "occurred_at": "2026-07-20 12:06:21", "channel": "web upload", "recipient_domain": null, "upload_site": "share.example.com", "device_label": null, "file_type": "txt", "match_count": 185, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "new", "closed_at": null }, { "id": 594, "employee_id": 65, "policy_id": 8, "occurred_at": "2026-08-01 11:09:38", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "xlsx", "match_count": 95, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "sending to our external auditor", "triage_status": "new", "closed_at": null }, { "id": 595, "employee_id": 11, "policy_id": 4, "occurred_at": "2026-07-15 15:56:32", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-2620", "file_type": "xlsx", "match_count": 73, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "working from my personal laptop tonight", "triage_status": "new", "closed_at": null }, { "id": 596, "employee_id": 41, "policy_id": 1, "occurred_at": "2026-07-15 11:43:00", "channel": "USB storage", "recipient_domain": null, "upload_site": null, "device_label": "USB-3052", "file_type": "xlsx", "match_count": 513, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "confirmed, user coached", "closed_at": "2026-07-24 07:53:14" }, { "id": 597, "employee_id": 54, "policy_id": 2, "occurred_at": "2026-07-06 15:42:52", "channel": "external email", "recipient_domain": "partner091.example.com", "upload_site": null, "device_label": null, "file_type": "csv", "match_count": 258, "enforced_action": "warn", "user_response": "proceeded with justification", "justification": "approved by my manager", "triage_status": "confirmed, user coached", "closed_at": "2026-07-10 19:05:27" }, { "id": 598, "employee_id": 56, "policy_id": 1, "occurred_at": "2026-07-01 11:45:05", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "xlsx", "match_count": 135, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "false positive", "closed_at": "2026-07-09 05:25:51" }, { "id": 599, "employee_id": 27, "policy_id": 1, "occurred_at": "2026-08-19 23:12:15", "channel": "web upload", "recipient_domain": null, "upload_site": "files.example.net", "device_label": null, "file_type": "xlsx", "match_count": 117, "enforced_action": "block", "user_response": null, "justification": null, "triage_status": "new", "closed_at": null }, { "id": 600, "employee_id": 28, "policy_id": 2, "occurred_at": "2026-08-23 13:25:49", "channel": "external email", "recipient_domain": "partner556.example.com", "upload_site": null, "device_label": null, "file_type": "docx", "match_count": 39, "enforced_action": "warn", "user_response": "cancelled the action", "justification": null, "triage_status": "new", "closed_at": null } ] }