I want to create an alert to catch large amounts of data leaving the network

Question

I want the SEM to monitor the average data leaving our network and alert when it goes above this average by a percentage we determine could be DLP. 
 Is this possible and how can this be done? 
 
 Thank you, 
 Lou

mak3 · Answer

Connect your corporate firewall to SEM, ensuring you are sending your traffic logs to SEM. Once being collected by SEM, take a look at the ExtraneousInfo field being generated in these logs. There is a lot of info/data in that field, but the exact field/data to use in a query and/or rule will be based on how your firewall logs are sent to SEM and what firewall is used.