Create datasets to reduce the number of items that get analyzed in forensic investigation searches or rule tuning searches.
From the ePO - On-prem menu, select DLP Capture, and click Datasets.
Select Actions → New Dataset.
Add a name and an optional description, then add the items that the dataset will analyze from the list of available properties.
Click Save.
The dataset appears in the list showing the number of captured events that will be analyzed.
(Optional) If the number of captured items is too large, select the dataset link and further refine the dataset properties, then click Refresh to see an updated number of events.