We are creating policies based on thresholds of internal users that are collaborators of a document. In doing that, we’ve ran into the following issues:

1.) We’ve seen in the alerts section that a lot of our alerts associated have a collaborator count that is different from what we see in the incidents section. For example, here you can see 135 collaborators. However if you look at the actual incident, this is only shared with 4 individual users, and a group of 64 users. That doesn’t add up to 135. We are seeing this for lots of alerts/incidents.

2.) In our DLP profiles, we have a a configuration for various exposure definitions. We are wondering if the following is an AND or OR in terms of the internal/external and # of internal users. The reason we ask is that it seemed that we were triggering on internal documents that are shared with less than 100 users. Let us know if there is any further clarification needed here.