We have switched on a DLP-rule that blocks external sharing of files containing swedish personal numbers.
Sometimes when we receive an alert about user action taken that violates the rule, we don´t see who´s the triggering user. Moste often we do, but sometimes it says "Triggering user (none).
I want to know in what specific cases that is suppose to happen.