Patent ID: 8510446

Claim:
A method, implemented by a server computing system programmed to perform the following, comprising: receiving, at the server computing system from one or more data loss prevention (DLP) agents hosted by one or more client computing systems, a plurality of external identifiers captured by the one or more agents while monitoring outbound activities performed by the one or more client computing systems; mapping each of the plurality of external identifiers to a corresponding one of a plurality of unique internal identifiers in an identity-correlation data store of the server computing system, wherein the plurality of unique internal identifiers are assigned to a plurality of users by an entity, and wherein the plurality of external identifiers are not assigned by the entity; subsequently receiving an incident record of a violation of a DLP policy from one of the DLP agents, the incident record comprising one of the plurality of external identifiers; identifying a corresponding one of the plurality of unique internal identifiers correlated to the one external identifier in the incident record using the identity-correlation data store to identify one of the plurality of users associated with the one external identifier; and updating the incident record to include the identified unique internal identifier.