DLP collection fields
Describes the fields available in the Cloud DLP collections, DLPIncidents and DLPIncidentsAll.
This topic describes each field in the Cloud DLP collections as displayed in Insights. The descriptions apply to the records you see in Insights, not to the full alert. Use them when you create reports or export data.
DLPIncidentsAll- Contains a record for each Incident and each subsequent update to that Incident. Recommended for SIEM export use cases.DLPIncidents- Contains a single consolidated record for each Incident, updated with any subsequent update. Recommended for reporting purposes.
| Field Name | Description |
|---|---|
| Action | Policy Action Applied |
| Alert Event ID | Associated Event ID |
| Alert ID | Incident ID |
| Analysed By | Endpoint Version |
| Assignee | Admin Assigned for follow up |
| Channel | Data Channel where the incident occurred |
| Created Timestamp | When the record was created |
| Data Channels | Data Channel where the incident occurred |
| Destination | Incident Destination – specific to channel |
| Detected By | Neo | DPS – Neo for Endpoint, DPS for Cloud |
| File Names | Filenames detected in Incident |
| Ignored Incident | Future use – marks an Incident that should be ignored |
| Incident Status | Incident Status |
| Justification Choice | Choice selected by the user during a confirm |
| Justification Text | Text provided by the user during a confirm |
| Reason | Reason for state change |
| Released Incident | Future use – marks an Incident as released |
| Reporting Products | Alert Source: DLP (Endpoint DLP), Neo (Device Control or UAM) & DPS (Cloud Channels DLP) |
| Rules | List of rules violated in the policy |
| Severity | Incident Severity |
| State | Current Incident State |
| State Transition | State transition recorded in this update |
| Tags | Future Use |
| Incident Timestamp | When this Incident occurred |
| Update Time | When the Incident was updated |
| User | Source User associated with Incident |
| User Risk Level | User risk level at the time of Incident |
| Violated Policies | List of policies violated by this Incident |
| Violated Triggers | List of classifiers detected in this Incident |
| Maximum Matches | Maximum number of matches |
| Risk Impact | Risk impact of this Incident |
| Time To Resolve | Time in seconds to resolve (close) Incident |
| Transaction Size | Content size in bytes |