rename module, add intro, kc, and summary

Author: riswinto

learn-pr/wwl-sci/purview-review-analyze-data-classification/analyze-classified-data.yml

@@ -0,0 +1,15 @@
+### YamlMime:ModuleUnit
+uid: learn.wwl.purview-review-analyze-data-classification.analyze-classified-data
+title: Analyze classified data with data and content explorer
+metadata:
+  title: Analyze classified data with data and content explorer
+  description: "Analyze classified data with data and content explorer"
+  ms.date: 03/13/2025
+  author: wwlpublish
+  ms.author: riswinto
+  ms.topic: unit
+azureSandbox: false
+labModal: false
+durationInMinutes: 7
+content: |
+  [!include[](includes/analyze-classified-data.md)]

learn-pr/wwl-sci/purview-review-monitor-data-classification/includes/analyze-classified-data.md renamed to learn-pr/wwl-sci/purview-review-analyze-data-classification/includes/analyze-classified-data.md

@@ -0,0 +1,20 @@
+Organizations store and share sensitive data across cloud services, collaboration platforms, and on-premises environments. As data moves across multiple systems, security teams face challenges in ensuring proper classification, protection, and policy enforcement. To address these challenges, organizations need visibility into where sensitive data resides, how it's labeled, and how it's accessed. Without it, they struggle to enforce security policies, increasing the risk of data leaks, compliance violations, and unauthorized access.
+
+Microsoft Purview provides tools that help security and compliance teams track classified data, enforce protection policies, and detect potential risks. Information Protection Reports, Data Explorer, Content Explorer, and Activity Explorer provide real-time insights into data security, enabling organizations to monitor labeling adoption, investigate policy effectiveness, and analyze user activity trends.
+
+By using these tools, organizations can:
+
+- Track data classification and protection across Microsoft 365, Azure, Amazon Web Services (AWS), and on-premises storage.
+- Analyze label usage and policy compliance to ensure sensitive information is properly secured.
+- Investigate user interactions with classified content to detect unauthorized access or policy violations.
+- Apply AI-driven insights through Microsoft Security Copilot to identify risks and refine security strategies.
+
+## Learning objectives
+
+By the end of this module, you'll be able to:
+
+- Interpret Information Protection Reports to assess classification and protection trends.
+- Investigate labeled content using Data Explorer and Content Explorer to identify classification patterns.
+- Analyze user activity in Activity Explorer to detect policy violations and potential security risks.
+
+Use this knowledge to improve data security, maintain compliance, and respond to risks with confidence.

learn-pr/wwl-sci/purview-review-monitor-data-classification/includes/information-protection-reports.md renamed to learn-pr/wwl-sci/purview-review-analyze-data-classification/includes/information-protection-reports.md

@@ -0,0 +1,19 @@
+Without clear visibility into how sensitive data is classified, accessed, and protected, organizations struggle to enforce security policies and prevent unauthorized data exposure. Data security threats, such as accidental data leaks, insider risks, and compliance violations, can lead to financial loss, regulatory penalties, and operational disruptions.
+
+This module covered how Microsoft Purview helps organizations overcome these challenges by providing tools to monitor classification trends, track policy compliance, and investigate security risks.
+
+Using Information Protection Reports, Data explorer, Content explorer, and Activity explorer, organizations can:
+
+- Interpret classification and protection trends to assess labeling adoption.
+- Investigate labeled content to ensure sensitive data is classified appropriately.
+- Analyze user activity to detect policy violations and security risks.
+
+Maintaining data security requires continuous monitoring and policy adjustments. Microsoft Purview gives security teams the tools to track classification trends, analyze risks, and respond to potential threats, ensuring sensitive data remains protected while enabling safe collaboration.
+
+## References
+
+- [Learn about data classification](/purview/data-classification-overview?azure-portal=true)
+- [Get started with data explorer](/purview/data-classification-data-explorer?azure-portal=true)
+- [Get started with content explorer](/purview/data-classification-content-explorer?azure-portal=true)
+- [Get started with activity explorer](/purview/data-classification-activity-explorer?azure-portal=true)
+- [Labeling activities that are available in Activity explorer](/purview/data-classification-activity-explorer-available-events?azure-portal=true)

learn-pr/wwl-sci/purview-review-analyze-data-classification/includes/introduction.md

@@ -1,15 +1,15 @@
 ### YamlMime:Module
-uid: learn.wwl.purview-review-monitor-data-classification
+uid: learn.wwl.purview-review-analyze-data-classification
 metadata:
-  title: Protect sensitive data in a digital world
-  description: "Protect sensitive data in a digital world."
-  ms.date: 03/10/2025
+  title: Review and analyze data classification and protection
+  description: "Review and analyze data classification and protection."
+  ms.date: 03/13/2025
   author: wwlpublish
   ms.author: riswinto
   ms.topic: module
   ms.service: purview
   hidden: false
-title: Protect sensitive data in a digital world
+title: Review and analyze data classification and protection
 summary: Discover how Microsoft Purview helps organizations classify, protect, and monitor sensitive data across cloud, endpoint, and AI environments. This module explores strategies for securing data through classification, labeling, encryption, and proactive risk management.
 abstract: |
   After completing this module, you'll be able to:
@@ -36,12 +36,12 @@ subjects:
 - information-protection-governance
 - security
 units:
-- learn.wwl.purview-review-monitor-data-classification.introduction
-- learn.wwl.purview-review-monitor-data-classification.information-protection-reports
-- learn.wwl.purview-review-monitor-data-classification.analyze-classified-data
-- learn.wwl.purview-review-monitor-data-classification.monitor-review-actions
-- learn.wwl.purview-review-monitor-data-classification.knowledge-check
-- learn.wwl.purview-review-monitor-data-classification.summary
+- learn.wwl.purview-review-analyze-data-classification.introduction
+- learn.wwl.purview-review-analyze-data-classification.information-protection-reports
+- learn.wwl.purview-review-analyze-data-classification.analyze-classified-data
+- learn.wwl.purview-review-analyze-data-classification.monitor-review-actions
+- learn.wwl.purview-review-analyze-data-classification.knowledge-check
+- learn.wwl.purview-review-analyze-data-classification.summary
 
 badge:
-  uid: learn.wwl.purview-review-monitor-data-classification.badge
+  uid: learn.wwl.purview-review-analyze-data-classification.badge

learn-pr/wwl-sci/purview-review-monitor-data-classification/includes/monitor-review-actions.md renamed to learn-pr/wwl-sci/purview-review-analyze-data-classification/includes/monitor-review-actions.md

@@ -0,0 +1,15 @@
+### YamlMime:ModuleUnit
+uid: learn.wwl.purview-review-analyze-data-classification.information-protection-reports
+title: Review classification and protection insights
+metadata:
+  title: Review classification and protection insights
+  description: "Review classification and protection insights."
+  ms.date: 03/13/2025
+  author: wwlpublish
+  ms.author: riswinto
+  ms.topic: unit
+azureSandbox: false
+labModal: false
+durationInMinutes: 7
+content: |
+  [!include[](includes/information-protection-reports.md)]

learn-pr/wwl-sci/purview-review-analyze-data-classification/includes/summary.md

@@ -0,0 +1,15 @@
+### YamlMime:ModuleUnit
+uid: learn.wwl.purview-review-analyze-data-classification.introduction
+title: Introduction
+metadata:
+  title: Introduction
+  description: "Introduction."
+  ms.date: 03/13/2025
+  author: wwlpublish
+  ms.author: riswinto
+  ms.topic: unit
+azureSandbox: false
+labModal: false
+durationInMinutes: 1
+content: |
+  [!include[](includes/introduction.md)]

learn-pr/wwl-sci/purview-review-monitor-data-classification/index.yml renamed to learn-pr/wwl-sci/purview-review-analyze-data-classification/index.yml

@@ -0,0 +1,75 @@
+### YamlMime:ModuleUnit
+uid: learn.wwl.purview-review-monitor-data-classification.knowledge-check
+title: Knowledge check
+metadata:
+  title: Knowledge check
+  description: "Knowledge check"
+  ms.date: 03/13/2025
+  author: wwlpublish
+  ms.author: riswinto
+  ms.topic: unit
+azureSandbox: false
+labModal: false
+durationInMinutes: 5
+quiz: 
+  title: "Check your knowledge"
+  questions:
+  - content: "A security analyst in your organization needs to track how sensitive data is being accessed and shared across Microsoft 365 services. They want to filter activities based on users, sensitivity labels, and policy violations. Which Microsoft Purview tool should they use?"
+    choices:
+    - content: "Activity Explorer"
+      isCorrect: true
+      explanation: "Correct: Activity Explorer helps track user activity, data access, and policy violations within Microsoft 365."
+    - content: "Data Explorer"
+      isCorrect: false
+      explanation: "Incorrect: Data Explorer provides visibility into classified data but doesn't track user activity."
+    - content: "Microsoft Purview Audit"
+      isCorrect: false
+      explanation: "Incorrect: Microsoft Purview Audit provides forensic activity logs but isn't designed for interactive data movement analysis."
+
+  - content: "Your compliance team needs a way to review where sensitive data is stored and how it's classified across Microsoft 365. They want to see applied sensitivity labels and retention labels in a centralized view. Which tool should they use?"
+    choices:
+    - content: "Activity Explorer"
+      isCorrect: false
+      explanation: "Incorrect: Activity Explorer focuses on tracking user actions and policy violations, not reviewing stored data."
+    - content: "Microsoft Purview Data Loss Prevention (DLP)"
+      isCorrect: false
+      explanation: "Incorrect: DLP prevents data sharing violations but doesn't provide a view of labeled data."
+    - content: "Content Explorer"
+      isCorrect: true
+      explanation: "Correct: Content Explorer helps review labeled data across Microsoft 365, displaying classification details for files."
+
+  - content: "Your organization wants to track trends in sensitivity label adoption, encryption usage, and policy enforcement across Microsoft 365 and external storage locations. Which Microsoft Purview feature provides this high-level overview?"
+    choices:
+    - content: "Data Explorer"
+      isCorrect: false
+      explanation: "Incorrect: Data Explorer focuses on reviewing labeled data, but it doesn't provide a broad summary of protection trends."
+    - content: "Information Protection Reports"
+      isCorrect: true
+      explanation: "Correct: Information Protection Reports provide insights into classification, encryption, and policy effectiveness across multiple environments."
+    - content: "Microsoft Purview Audit"
+      isCorrect: false
+      explanation: "Incorrect: Microsoft Purview Audit provides detailed event logs but isn't designed for monitoring classification trends."
+
+  - content: "A security administrator wants to analyze how users are applying sensitivity labels and whether labeled data is being downgraded or removed. They need to drill down into specific files and locations. Which Microsoft Purview tool should they use?"
+    choices:
+    - content: "Activity Explorer"
+      isCorrect: false
+      explanation: "Incorrect: Activity Explorer tracks user actions but doesn't provide a detailed view of labeled files."
+    - content: "Data Explorer"
+      isCorrect: true
+      explanation: "Correct: Data Explorer allows security teams to investigate labeled content, track label changes, and analyze classification patterns."
+    - content: "Microsoft Purview Insider Risk Management"
+      isCorrect: false
+      explanation: "Incorrect: Insider Risk Management identifies risky user behavior but doesn't focus on tracking label usage."
+
+  - content: "Your organization's security team wants to proactively detect unusual data activity, such as large-scale downloads of sensitive files. They want an AI-powered tool that can analyze patterns and surface potential risks. Which feature should they use?"
+    choices:
+    - content: "Microsoft Security Copilot in Activity Explorer"
+      isCorrect: true
+      explanation: "Correct: Security Copilot in Activity Explorer helps detect anomalies and investigate unusual data access patterns."
+    - content: "Information Protection Reports"
+      isCorrect: false
+      explanation: "Incorrect: Information Protection Reports provide insights into classification trends but don't analyze real-time security risks."
+    - content: "Microsoft Purview Data Loss Prevention (DLP)"
+      isCorrect: false
+      explanation: "Incorrect: DLP helps prevent policy violations but doesn't use AI to detect unusual activity."