There is a DLP violation on a file in your sanctioned Google Drive instance. The file is in a deleted state. You need to locate information…

The Netskope platform logs all policy violations as incidents. The central location for viewing, triaging, and managing these violations is the Incidents dashboard. A DLP incident is a historical record of a policy match that occurred at a specific point in time. The subsequent deletion of the file in the source application (Google Drive) does not remove the corresponding incident log from the Netskope platform. Therefore, the information pertaining to the violation remains accessible for investigation within the Incidents > DLP page.

A. Forensic profiles are configurations that define what evidence (e.g., the violating file) to capture when an incident occurs; they are not the location where incidents are viewed.

B. The incident record is created in Netskope at the time of the violation and is independent of the file's lifecycle. Deleting the file does not delete the incident log.

D. A DLP incident is created when a DLP policy is violated. A forensic profile is an optional feature used to capture additional data and is not required for incident creation.

1. Netskope Official Documentation

"About DLP Incidents": The Incidents > DLP page is the primary interface for viewing details about all DLP incidents detected by Netskope. It provides a comprehensive list of violations

including user

application

policy

and violation type. This confirms that incidents are found on this dashboard. (Reference: Netskope Tenant UI and associated help documentation under the Incidents section).

2. Netskope Official Documentation

"Create a Forensic Profile": "You can associate a forensic profile with a DLP policy to store violating files or content in a forensic folder in your Netskope tenant." This document specifies that a forensic profile is a configuration to be associated with a policy

confirming it is not a dashboard for viewing incidents.

3. Carnegie Mellon University

"Cloud Security" Courseware (18-731): In discussions on Cloud Access Security Brokers (CASBs)

the principle of immutable logging for security events is emphasized. An incident

once logged by the security platform

serves as a permanent record for audit and forensics

irrespective of the subsequent state of the asset that caused the alert. This supports the concept that deleting the file does not remove the incident record.