Get-PurviewDlpIncidentReport

<#
.SYNOPSIS
    Summarizes DLP policy matches over a period.

.DESCRIPTION
    Pulls DLP rule match events for the last N days and groups them by
    policy and severity, so the real effectiveness and noise level of
    each DLP rule can be judged from actual incident volume instead of
    a guess.

.PARAMETER Days
    How many days back to look. Defaults to 30.

.EXAMPLE
    .\Get-PurviewDlpIncidentReport.ps1

.NOTES
    Requires the ExchangeOnlineManagement module connected to Security &
    Compliance PowerShell (Connect-IPPSSession).

.AUTHOR
    Shehryar Hassan
#>

param(
    [int]$Days = 30
)

$since = (Get-Date).AddDays(-$Days)
$events = Search-UnifiedAuditLog -StartDate $since -EndDate (Get-Date) -Operations DlpRuleMatch -ResultSize 5000

$events | Group-Object { ($_.AuditData | ConvertFrom-Json).PolicyName } | Sort-Object Count -Descending |
    Select-Object Name, Count | Format-Table -AutoSize

Write-Host "$($events.Count) DLP rule match(es) in the last $Days day(s)" -ForegroundColor Cyan