You are a Microsoft Purview, Microsoft Defender XDR, Microsoft Sentinel, Power BI, Logic Apps, and Power Automate engineering team building enterprise-class, audit-defensible reporting for data protection controls.

Objective:
Create a Microsoft-native reporting and workflow architecture for Purview DLP, sensitivity labels, retention/control health, and investigation operations.

Required Microsoft products:
- Microsoft Purview
- Microsoft Defender XDR
- Microsoft Sentinel
- Log Analytics
- KQL
- Sentinel Workbooks
- Power BI
- Logic Apps
- Power Automate
- SharePoint Online for evidence registers
- Teams for notifications
- Optional Planner or ServiceNow connector if approved

Design principle:
Purview is the control and policy plane. Defender XDR is the alert, evidence, and investigation plane. Sentinel/Log Analytics is the central security telemetry and correlation plane. Power BI is the executive and audit reporting plane. Logic Apps and Power Automate provide workflow, escalation, notifications, and evidence packaging.

Data sources to connect:
1. Microsoft Defender XDR connector into Microsoft Sentinel
   - incidents, alerts, advanced hunting events where required

2. Microsoft 365 audit activity / Unified Audit Log
   - Exchange, SharePoint, OneDrive, Teams activity where available
   - DLP events where available

3. Purview-related data
   - DLP alerts, DLP policy/rule metadata
   - sensitivity label activity, auto-labeling activity
   - retention policy/label deployment status
   - Insider Risk / Data Security Investigation events where available

4. Workflow data
   - Sentinel incident status, Logic Apps run history
   - Power Automate flow status, Power BI refresh status
   - SharePoint evidence register status

Create Sentinel Watchlists:
1. DLPPolicyMap
   PolicyName | PolicyOwner | ControlObjective | WorkloadScope | ExpectedAction | DeploymentStatus | ExecutiveCategory

2. DLPRuleMap
   PolicyName | RuleName | RuleOwner | ExpectedAction | SeverityTier | EnforcementMode | TuningStatus

3. SITFamilyMap
   SITName | SITFamily | RegulatedDataType | ExecutiveCategory | SeverityModifier

4. SensitivityLabelMap
   LabelId | LabelName | LabelFamily | ProtectionLevel | EncryptionExpected | ExternalSharingAllowed

5. KPIMaturityMap
   KPIName | DataSource | MaturityStatus | Owner | KnownGap | RemediationPlan

6. ControlOwnerMap
   ControlName | Owner | BackupOwner | BusinessUnit | EscalationPath

Create normalized KQL functions:
- Purview_DLP_Events()
- Purview_DLP_Alerts()
- Purview_Label_Activity()
- Purview_Incident_Facts()
- Purview_Control_Facts()
- Purview_KPI_Health_Daily()
- Purview_KPI_Effectiveness_Daily()
- Purview_KPI_Investigation_Daily()
- Purview_KPI_Executive_Monthly()
- Purview_Audit_Evidence_Status()

Normalize the following fields in Purview_Control_Facts():
- EventTime, SourcePlane, Workload, Operation
- PolicyName, RuleName, RuleAction, EnforcementMode
- UserPrincipalName, UserDepartment, UserTitle
- Recipient, RecipientDomain, ExternalInternalFlag
- FileName, FileExtension, FilePath, SiteUrl
- DeviceName, DeviceId, IPAddress
- SensitivityLabel, SensitivityLabelId
- SITNames, SITFamily, SITCount, ConfidenceLevel
- AlertId, IncidentId, Severity, Status, Classification, Determination, AssignedTo
- TicketId, MaturityStatus

Build Sentinel Workbooks:
1. Purview Pipeline Health (Audience: Engineering)
   - ingestion freshness by source, connector health
   - Defender alert and incident ingestion rates
   - parse success rate, missing policy/rule/action %
   - zero-event days, failed automation runs

2. DLP Control Effectiveness (Audience: Engineering / Security / Compliance)
   - DLP events by workload, policy, rule
   - rule action distribution, block/warn/allow/override trend
   - SIT family and confidence distribution
   - label + SIT mismatch, top external domains, top risky users/files

3. Investigation Operations (Audience: SOC / Investigations)
   - incidents by severity/status, queue depth, aging
   - MTTA, MTTR, FP/TP rates
   - unassigned and reopened incidents
   - top policies producing FPs, top entities across multiple incidents

4. Audit Evidence Register (Audience: Audit / Compliance)
   - control objective, evidence source, maturity state
   - last successful event, refresh status, owner
   - known gap, remediation plan, evidence package link

Build Power BI reports:
1. Executive Data Protection Scorecard
2. DLP Effectiveness Trend
3. Sensitive Data Exposure Dashboard
4. Control Health Dashboard
5. Audit Defensibility Dashboard
6. KPI Maturity Dashboard

Power BI design rules:
- Use Sentinel/Log Analytics KQL function outputs as the curated source.
- Do not parse raw Defender/Purview JSON directly in Power BI unless unavoidable.
- Use imported or DirectQuery-compatible datasets per performance/governance needs.
- Publish to Power BI Service with workspace permissions and sensitivity labels.
- Create scheduled refresh. Add monthly PDF/PowerPoint export if approved.
- Publish executive views to Teams.

Automation requirements:

Logic Apps — Sentinel-centered:
- New high-severity DLP incident → Teams alert + email control owner
- Incident aging past SLA → escalate to manager/control owner
- Incident closed as FP → create tuning backlog item
- Override event above threshold → notify compliance reviewer
- Monthly reporting date → generate evidence snapshot + store in SharePoint
- Failed ingestion or Power BI refresh → notify engineering

Power Automate — compliance/business:
- Update SharePoint evidence register
- Create Planner tasks for KPI gaps
- Notify executives when monthly report publishes
- Route control-owner attestations
- Track remediation for Blank/Partial KPIs
- DLP high-FP-rate → route to engineering backlog

KPI maturity states:
- Blank: dashboard/control exists, no source data connected or available.
- Partial: data exists but parsing, coverage, source completeness, or workflow incomplete.
- Live: source data connected, normalized, refreshed, validated, report-ready.

Control Health Score:
  20% ingestion freshness
+ 20% alert pipeline health
+ 15% policy/rule parse quality
+ 15% incident lifecycle completeness
+ 10% watchlist/taxonomy completeness
+ 10% dashboard refresh health
+ 10% KPI maturity

Control Effectiveness Score:
  25% sensitive events protected
+ 20% high-risk events reduced over 90 days
+ 20% false-positive rate reduced
+ 15% MTTA/MTTR improvement
+ 10% override rate controlled
+ 10% repeat-offender reduction

Acceptance criteria:
- Defender XDR incidents and alerts are visible in Sentinel.
- DLP-related events are queryable in Sentinel or Defender Advanced Hunting.
- Sentinel Workbooks exist for Engineering, Investigation Operations, and Audit Evidence.
- Power BI executive dashboards are connected to curated Sentinel/Log Analytics KQL outputs.
- Every KPI is tagged Blank, Partial, or Live.
- Every KPI has a source, owner, refresh cadence, known limitation, and remediation path.
- Logic Apps or Power Automate flows exist for escalation, evidence packaging, and monthly report distribution.
- Executives can understand risk posture in under five minutes.
- Auditors can trace KPI evidence back to source telemetry and control objective.