Once you have policies in place, you can customize your alerts. Alerts can be viewed in the CAS portal (portal.cloudappsecurity.com) | Alerts (the lowest icon on the left):
As can be seen in the preceding screenshot, you can filter your alerts according to those that are open, dismissed, or resolved. You can resolve alerts from this page as well. Other filters include the following:
- Resolution status
- Category (DLP and access control)
- Severity
- App (O365 or even more specific, such as just SharePoint-related alerts)
- Username
- Policy
Note that you can also choose to view these alerts in your O365 Security & Compliance center, but, at the time of writing, you're only able to view, and unable to resolve, alerts from Security & Compliance.
You can resolve alerts in a few different ways. In the case of those that are authorized violations or anomalies...