# Control 1.12: Insider Risk Detection and Response

## Expected Screenshots

| Filename | Portal | Navigation Path | What to Capture |
|----------|--------|-----------------|-----------------|
| `01-purview-insider-risk-dashboard.png` | Purview | Insider risk management | Main dashboard |
| `02-purview-insider-risk-policies.png` | Purview | Insider risk → Policies | Policy list |
| `03-purview-insider-risk-create-policy.png` | Purview | Policies → Create | Policy creation wizard |
| `04-purview-insider-risk-indicators.png` | Purview | Policy → Indicators | Risk indicators selection |
| `05-purview-insider-risk-settings.png` | Purview | Insider risk → Settings | Global settings configuration |
| `06-purview-insider-risk-connectors.png` | Purview | Settings → Connectors | HR and other data connectors |
| `07-purview-insider-risk-alerts.png` | Purview | Alerts | Alert queue and triage |
| `08-purview-insider-risk-cases.png` | Purview | Cases | Case management view |

## Verification Focus

- Policies include AI/agent usage patterns
- Indicators cover data exfiltration via agents
- HR connector configured for departure scenarios
- Alert workflow routes to appropriate teams
- Capture from pre-production environment when possible
- Include timestamps to demonstrate currency
- Verify UI matches documentation after Microsoft portal updates

---

## Screenshot Organization

Organize screenshots in this directory as:
- `1.12-01-purview-insider-risk-dashboard.png` — Main dashboard
- `1.12-02-purview-insider-risk-policies.png` — Policy list
- `1.12-03-purview-insider-risk-create-policy.png` — Policy creation wizard
- `1.12-04-purview-insider-risk-indicators.png` — Risk indicators selection
- `1.12-05-purview-insider-risk-settings.png` — Global settings configuration
- `1.12-06-purview-insider-risk-connectors.png` — HR and other data connectors
- `1.12-07-purview-insider-risk-alerts.png` — Alert queue and triage
- `1.12-08-purview-insider-risk-cases.png` — Case management view
