Use case: Identify sensitive information sent to an external email address

Details of a secret project called "Project Lighthouse" have appeared in the press. You need to investigate how the leak occurred.

Identify a dataset that covers a broad range of captured items, such as the pre-defined Last Month [built-in] dataset.

In ePO - On-prem, open the DLP Capture feature, and create a new forensic investigation search called Project Lighthouse.
Select the required dataset, then type Project Lighthouse as the search term and run the search immediately.
The search returns the number of results specified in Max Results to Report, and it is unclear whether any of the results are the source of the leak. You need to refine the dataset to get better results.
Create a new dataset called Emails sent externally and exclude email recipients whose email addresses do not end with "mydomain.dom".
Create a duplicate copy of the Project Lighthouse search, and name the new version Project Lighthouse sent externally.
Select the Emails sent externally dataset and save and run the search immediately.
The new search produces a smaller list of results to analyze, so it is easier to identify potential sources of the data leak.