Dynamically populating an identity-correlation data store

A system, comprising:

• a server computing system, comprising:
• a memory;
• and
• a processor coupled with the memory, wherein the processor is configured to execute a data loss prevention (DLP) system communicatively coupled to one or more DLP agents, wherein the DLP system is to:
• receive from one or more DLP agents hosted by one or more client computing systems a plurality of external identifiers captured by the one or more agents while monitoring outbound activities performed by the one or more client computing systems;
• map each of the plurality of external identifiers to a corresponding one of a plurality of unique internal identifiers in an identity-correlation data store, wherein the plurality of unique internal identifiers are assigned to a plurality of users by an entity, and wherein the plurality of external identifiers are not assigned by the entity;
• subsequently receive an incident record of a violation of a DLP policy from one of the DLP agents, the incident record comprising one of the plurality of external identifiers;
• identify a corresponding one of the plurality of unique internal identifiers correlated to the one external identifier in the incident record using the identity-correlation data store to identify one of the plurality of users associated with the one external identifier;
• and
• update the incident record to include the identified unique internal identifier.

A non-transitory computer readable storage medium storing instructions that when executed by a server computing system cause the server computing system to perform operations comprising:

• receiving, at the server computing system from one or more data loss prevention (DLP) agents hosted by one or more client computing systems, a plurality of external identifiers captured by the one or more agents while monitoring outbound activities performed by the one or more client computing systems;
• mapping each of the plurality of external identifiers to a corresponding one of a plurality of unique internal identifiers in an identity-correlation data store of the server computing system, wherein the plurality of unique internal identifiers are assigned to a plurality of users by an entity, and wherein the plurality of external identifiers are not assigned by the entity;
• subsequently receiving an incident record of a violation of a DLP policy from one of the DLP agents, the incident record comprising one of the plurality of external identifiers;
• identifying a corresponding one of the plurality of unique internal identifiers correlated to the one external identifier in the incident record using the identity-correlation data store to identify one of the plurality of users associated with the one external identifier;
• and
• updating the incident record to include the identified unique internal identifier.