{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":43967,"path":"security-management/data-loss-prevention/using-dlp-ops-portal.md","title":"Data Loss Prevention Incident Response Analyst Workspace","bundle":null,"doc_type":null,"release":"australia","body":"\n# Data Loss Prevention Incident Response Analyst Workspace\n\nUse the Data Loss Prevention Incident Response \\(DLP IR\\) Analyst Workspace to view the DLP incidents. Assign the incidents to end users for resolution and more.\n\nThe DLP workspace consists of a home page with dashboards, list views, and form views that let you monitor DLP incidents.\n\n\\[Omitted image \"dlp-ops-homepage.png\"\\] Alt text: DLP Workspace Overview page.\n\n**Parent Topic:**[Data Loss Prevention Incident Response Incident Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/data-loss-prevention/data-loss-prevention-incident-management.md)\n\n**Related topics** \n\n\n[Data Loss Prevention Incident Response User Workspace]()\n\n[Data Loss Prevention Incident Response Dashboard]()\n\n## Review and assign your DLP incidents\n\nAccess the Data Loss Prevention Incident Response \\(DLP IR\\) Analyst Workspace so that you can review the DLP incidents and assign or resolve them. You can track trends on incidents by severity, top offenders, incidents by scan source, and incidents by policy.\n\n### Before you begin\n\nRole required:\n\n- sn\\_dlir.analyst - Edit and view DLP incidents.\n- sn\\_dlir.analyst\\_read and sn\\_dlir.read - View DLP Incidents.\n\n### Procedure\n\n1. Navigate to **All** > **DLP Incident Management** > **DLP Analyst Workspace**.\n\n The DLP Workspace My Incidents ops list page opens in a new tab.\n\n2. Click on the **DLP Workspace** home icon to view the workspace homepage view.\n\n3. Review the dashboard widgets to identify trends by incidents by severity, top offenders, incidents by scan source, and incidents by policy.\n\n4. Click the appropriate filters on the home page to view the widgets by their various categories.\n\n |Filters|Description|\n |-------|-----------|\n |Open incidents|View all open incidents.|\n |Overdue critical incidents|View the incidents that have the critical severity label and that are overdue.|\n |Incidents assigned to end users|View the incidents that are assigned to end users.|\n\n5. You can review and assign the DLP incidents using two ways:\n\n 1. The first way is to locate and select one or more DLP incidents that you want to review, and click the check box next to the incidents.\n\n 2. Choose the option that is appropriate for you.\n\n\n
\n\nOption\n\n\n\nDescription\n\n
\n\nRefresh List\n\n\n\nOption to refresh the list of DLP incidents when you make an update.\n\n
\n\nList Actions\n\n\n\nList of actions that you can perform. Choices are as follows:- **Save as**\n- **Edit columns**\n- **Reset widths**\n**Note:** When you have your own custom list which is created under **My Lists** section configured for your workspace, you will be able to perform the below additional list actions as well:\n\n- **Rename**\n- **Save**\n- **Delete**\n- **Share**: Share the custom list with your team so that other members can view and use it.\n\n\n
\n\nCopy URL for All\n\n\n\nOption to copy the URLs of all the DLP incidents.\n\n
\n\nShow filter panel\n\n\n\nOption to drill down the required incidents using the filter option.1. Click the filter on the top-left of the page, and select **Advanced view**.\n2. Use an existing filter or build your own by adding conditions that contain a field, operator, and values.\n3. To add more conditions, click **AND** or **OR**:\n - If **AND** is selected, all conditions must be matched.\n - If **OR** is selected, either condition can be matched.\n4. Click **Update**.\n\n\n
\n\nAssign Incident\n\n\n\nAction to determine whom to assign the DLP incident to. Choices are as follows:- **Assign incident to**: Option to assign the incident to an analyst, end user, or someone else.\n- **User**: Option to determine which user that the incident should be assigned to.\n- **Incident state pre-user response**: Option to determine which state that the incident should be in before the user responds. It can also be a custom state.\n- **Attach assessment**: Option to indicate whether you want to attach an assessment to the incident. If enabled, below options will be available:\n - **Assessment template**: Option to select an assessment template for the DLP incident.\n - **Incident state post user response** Option to select which state that the DLP incident should be in after the user responds.\n\n\n
\n\nRespond\n\n\n\nRespond to an incident by selecting an incident response option. For example, user delete a file violating a DLP policy, the user can choose the option **Deleted File** to submit manual acknowledgement that the file has been deleted and provide comments. From here you can also select advanced response options. For example, **Request email release from quarantine**.\n\n
\n\nEscalate\n\n\n\nAction to escalate the incident. You can escalate the incident by selecting the user that you want to escalate it to. You can also any additional information in the Comments field.\n\n
\n\nUpdate State\n\n\n\nAction to update the state of the incident. You can update the state of the incident by select one of the states from the drop-down options. It can also be a custom state.\n\n
\n\nClose\n\n\n\nAction to close the incidents. Select the corresponding **Closure code** from the drop down list and add closure comments.The **Close** feature in Data Loss Prevention Incident Response is done both asynchronously and synchronously from the list view.\n\n1. Synchronous closure: When closing incidents synchronously, it means that the closure action is performed immediately. When you select multiple incidents for closure and if the incident count is less than or equal to 100 then the incidents are closed foreground from the DLP incidents list view. Here 100 is the default value.\n2. Asynchronous closure: This implies that the closure request is submitted and the application runs the request in the background if the selected incidents count is greater than 100.\n\nYou need to refresh the DLP incidents list view to see the updated the incidents status.\n\n**Note:**\n\n - The selected incidents count for both asynchronous or synchronous closure is configured using the system property `sn_dlir.closure_sync_count_limit`.\n - By default the incident count is set to 100.\n\n\n
3. The second way is to click a particular DLP incident to open it.\n\n - **Details** tab: Displays the following sections:\n - **Details**: You can view the details of the DLP incident such as Incident number, Severity, File name, and so on. You are also provided with the ability to modify the Severity, State, End user, and DLP Analyst group fields respectively and save them.\n - **Compose**: To add comments about the DLP incident that is visible to everyone, enter the comments in the Comments tab. To add comments that are visible to certain people, enter the comments in the Work notes \\(Private\\) tab.\n - **Activity**: You can view the details of the different activities on the DLP incident.\n - **Attachments**: If you have any attachments related to the DLP incident, click **Browse** and select the attachment from your local drive.\n - **Additional Details** tab: Displays all the additional information about the DLP incident including custom fields.\n\n **Important:**\n\n - Custom fields for DLP incidents are supported only on the San Diego version or later.\n - You can use the **Additional Details** tab to see if any custom fields have been created for a particular DLP incident or not.\n - **Custom attributes** tab: Displays the list of custom attributes related to the DLP incident.\n - **Other incidents from end user**: Displays the incident from the same end user. One can consolidate incidents by performing the **Add as child incident** action from this related list.\n - **Detected Sensitive Information type**: Displays the incident detected sensitive information.\n\n **Note:** This related list is visible only for the DLP Incidents created for Microsoft or Symantec integrations. Within the Microsoft or Symantec incident record, whenever the user accesses the detected sensitive information type record, the highlighted match content with respect to that integration is displayed.\n\n - **Child Incidents**: Displays the child incidents created manually \\(by performing the ‘Add as child incident’ action\\) or from the DLP consolidation rules. One can unlink the child incident by performing the ‘Unlink child incident’ from this related list.\n - **Cloned incidents**: Displays the cloned incidents from the parent incident. By clicking on the **Clone incident** action of the form view, you can create a new cloned incident.\n - **Assessments** tab: Displays the list of assessments that are assigned to the DLP incident.\n 4. Choose the option that is appropriate for you.\n\n\n
\n\nOption\n\n\n\nDescription\n\n
\n\nAssign Incident\n\n\n\nAction to determine whom to assign the DLP incident to. Choices are as follows:- **Assign incident to**: Option to assign the incident to an analyst, end user, or someone else.\n- **User**: Option to select which user that the incident should be assigned to.\n- **Incident state pre-user response**: Option to select which state that the incident should be in before the user responds. It can also be a custom state.\n- **Attach assessment**: Option to indicate whether you want to attach an assessment to the incident. If enabled, below options will be available:\n - **Assessment template**: Option to select an assessment template for the DLP incident.\n - **Incident state post user response**: Option to select which state that the DLP incident should be in after the user responds.\n\n\n
\n\nCancel Approval\n\n\n\nAction to cancel the approval request. This action will be visible to analysts on the form view only when the DLP Incident is in **Pending Approval** state. The available options are:\n\n- **Assign incident to**: Option to assign the incident to no one, to an analyst, or to someone else.\n- **User**: Option to select which user that the incident should be assigned to.\n- **Post cancellation incident state**: Option to select which state that the incident should be in after canceling the request.\n- **Comments**: To provide additional details for cancellation.\n\n\n
\n\nAssign Assessment\n\n\n\nAction to attach an assessment while assigning the incident. Choices are follows:- **Assessment template**: Option to select an assessment template for the DLP incident.\n- **Incident state post user response**: Option to select which state that the DLP incident should be in after the user responds.\n\n\n
\n\nDownload File\n\n\n\nAction to download the file or email that has the violating content. This action can be performed for incidents created for Microsoft OneDrive, SharePoint Online, or Exchange Online.\n\n
\n\nSave\n\n\n\nAction to save any changes that you made. You have an option to modify the Severity, State and End user fields of the DLP incident and save them.\n\n
\n\nRespond\n\n\n\nRespond to an incident by selecting an incident response option. For example, user delete a file violating a DLP policy, the user can choose the option **Deleted File** to submit manual acknowledgement that the file has been deleted and provide comments. From here you can also select the advanced response options. **For example: Request email release from quarantine**.\n\n
\n\nEscalate\n\n\n\nAction to escalate the incident. You can escalate the incident by selecting the user that you want to escalate it to. You can also any additional information in the Comments field.\n\n
\n\nClone Incident\n\n\n\nAction to create a clone incident if the incident record impacts multiple users. You can assign the cloned incidents to multiple stakeholders such as legal/IT.After you create a clone incident record, a new **Cloned Incidents** tab gets created under the parent DLP incident and all the cloned incidents are listed in this view.\n\n**Note:**\n\n- If the parent DLP incident record is closed, then all the cloned incident records will close automatically.\n- If a DLP incident record contains a cloned incident, it cannot be assigned to end users. The Parent DLP incident records can be managed only by users with the Analyst role.\n- You also have an option to automatically update the parent state based on the state of the cloned incidents in the Default Configuration module. For example, if all the cloned incidents are moved to the Escalated state, then the parent incident will also be moved to the Escalated state.\n\n\n
\n\nClose\n\n\n\nAction to close the incident. You must select the corresponding **Closure code** from the drop down list and add any closure comments, if required.\n\n
\n\nClose as false positive\n\n\n\nAction to close the incident as false positive. You can also add any additional comments before closing the incident.\n\n
6. You can see the List view from the homepage by going to the top-left of the page and clicking the **Lists** tab.\n\n The Lists category consists of the default and customized list pages for DLP incidents.\n\n - **Lists** tab: Default lists for DLP incidents. The following are the default lists:\n - All\n - Open\n - My Incidents\n - Assigned to my group\n - Escalated\n - Overdue\n - Pending Assessments\n - User action pending\n - Cloned Incidents\n - Archived Incidents\n - **My Lists** tab: Displays any lists that you’ve renamed and any lists that you created. You can also share the lists you create with your team members so that they can view and use them.\n\n## Work with lists in the DLP IR Analyst Workspace\n\nManage DLP incident lists in the Data Loss Prevention Incident Response Analyst Workspace. Save copies of default lists, create custom lists, and share lists with your team.\n\n### Before you begin\n\nRole required:\n\n- sn\\_dlir.analyst\n- sn\\_dlir.analyst\\_read and sn\\_dlir.read\n\n### About this task\n\nThe Lists category in the Data Loss Prevention Incident Response DLP IR Analyst Workspace consists of two tabs:\n\n- **Lists** tab: The default \\(predefined\\) lists for DLP incidents, such as **Open**, **Escalated**, and **Pending Assessments**. You cannot rename, delete, or share a default list, but you can save a copy of it to your My Lists.\n- **My Lists** tab: The lists that you create or save a copy of. You can rename, share, and delete the lists in this tab.\n\n### Procedure\n\n1. From the home page of the Data Loss Prevention Incident Response DLP IR Analyst Workspace, go to the top-left of the page and select the **Lists** tab.\n\n The default lists for DLP incidents are displayed.\n\n - All\n - Open\n - My Incidents\n - Assigned to my group\n - Escalated\n - Overdue\n - Pending Assessments\n - User action pending\n - Cloned Incidents\n - Archived Incidents\n2. Save a copy of a default list to **My Lists**.\n\n 1. Select a default list, such as **Open**, **Escalated**, or **Pending Assessment**.\n\n 2. Select the Menu item actions icon \\[Omitted image \"dlp-menu-item-actions.png\"\\] Alt text: Menu item actions icon.\n\n 3. Select **Save a copy**.\n\n 4. Enter a name for the list and apply your changes.\n\n The copy of the default list is saved under the **My Lists** tab, where you can rename, share, and delete it.\n\n3. Create a list under **My Lists**.\n\n 1. Select the **My Lists** tab, and then select **Add new list**.\n\n 2. To create a different version of an existing list, select the **Start from existing** tab in the New List dialog box and specify the required details.\n\n 3. To create your own list, select the **Create your own** tab in the New List dialog box, add the conditions for the incidents that you want to show, and select the columns to display.\n\n 4. Select **Create**.\n\n The list is saved under the **My Lists** tab.\n\n4. To manage a list under **My Lists**, select the list, select the more actions \\(**...**\\) icon, and then choose the option that is appropriate for you.\n\n |Option|Description|\n |------|-----------|\n |Save a copy|Save a copy of the list under the **My Lists** tab.|\n |Rename|Change the name of the list.|\n |Share|Share the list with one or more team members so that they can view and use it.|\n |Delete|Remove the list from the **My Lists** tab.|\n\n5. Share a list with your team.\n\n 1. Under the **My Lists** tab, select the list that you want to share.\n\n 2. Select the more actions \\(**...**\\) icon, and then select **Share**.\n\n 3. Select the users that you want to share the list with.\n\n 4. If your list contains more than one filter, select the specific filter that you want to share.\n\n Only the filter that you share is visible to the recipients.\n\n 5. Apply your changes.\n\n The selected filter is shared with the users that you chose. The shared list appears under the recipient's **Shared with me** tab, along with the name of the user who shared it.\n\n6. Locate your lists using the tabs under **My Lists**.\n\n |Tab|Description|\n |---|-----------|\n |Created by me|The lists that you created or saved a copy of. You can save a copy of, rename, share, and delete these lists.|\n |Shared with me|The lists that other users shared with you. Each list shows the name of the user who shared it. For a shared list, you can only select **Copy**. To make changes to a shared list, copy it to your **Created by me** tab, and then rename and manage your copy.|\n |Opened by link|The lists that you opened by using a shared link.|\n\n\n## Preview evidence files\n\nPreview Data Loss Prevention Incident Response evidence files in the DLP IR Analyst workspace.\n\n### Before you begin\n\n**Important:** While using the Evidence files action in the DLP analyst workspace, the evidence files are temporarily stored in the ServiceNow database in an unencrypted format. If you don't want to store the evidence files, disable the Evidence Files preview feature. For more information, see [Configure advanced settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/data-loss-prevention/configure-advanced-settings-dlp.md).\n\nRole required: sn\\_dlir.analyst\n\n### Procedure\n\n1. Navigate to **All** > **DLP Incident Management** > **DLP Analyst Workspace**.\n\n2. Open a DLP incident record.\n\n3. From the contextual sidebar, select the Evidence files icon \\(\\[Omitted image \"icon-evidence-files.png\"\\] Alt text: Evidence files icon.\\).\n\n4. On the **Evidence Files** tab, select the **Evidence File** card to preview the evidence files in the document viewer.\n\n The preview feature is different for each file type, as listed in the following table.\n\n\n
\n\nFile Format\n\n\n\nFile Extension\n\n
\n\nImage\n\n\n\n.bmp, .gif, .ico, .jpeg, .jpg, .png, .svg, and .webp.Image files open in the document viewer mode.\n\n
\n\nMicrosoft Office files\n\n\n\n.doc, .docx, .ppt, .pptx, .xls, and .xlsx Office files open in the document viewer mode.\n\n
\n\nText files\n\n\n\n.txtText files open in text editor mode.\n\n
\n\nMail files\n\n\n\n.eml**Note:** The file size must be less than 5MB. You must first download the file to preview its content.\n\n
\n\nPDF files\n\n\n\n.pdf - Enter a keyword to search the document.\n- Zoom-in and zoom-out features to adjust the view for better readability.\n- Rotate the page clockwise or counterclockwise to view the content more clearly.\n\n\n
**Note:**\n\n Binary files won’t be rendered and have to be downloaded to preview their content. The preview evidence file feature also works for archived incidents.\n\n\n## Playbook for Data Loss Prevention Incident Response\n\nA Data Loss Prevention Incident Response Playbook is a step-by-step guide for addressing and mitigating data loss incidents, which can include unauthorized exposures, leaks, or breaches of sensitive information that can compromise your organization’s security.\n\nThe following table lists the activities and stages available for creating a DLP Playbook. For more information, see [Add a DLP Playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/data-loss-prevention/using-dlp-ops-portal.md):\n\n|Activity|Description|\n|--------|-----------|\n|Detection|Identify and confirm unauthorized access or exposure of sensitive data.|\n|Containment|Isolate affected systems or users to prevent further data leakage or unauthorized access.|\n|Investigation|Investigate the breach to understand how it occurred, what data was affected, and the potential impact.|\n|Notification|Notify internal teams, external stakeholders, and regulatory bodies as required by law or policy.|\n|Remediation|Apply corrective measures to address vulnerabilities, update policies, and prevent future breaches.|\n|Recovery|Restore systems from secure backups and validate the integrity of data post-incident.|\n|Post-Incident Review|Analyze the incident to identify root causes, improve security controls, and strengthen policies.|\n\nThe following figure shows the workflow of activities and stages involved in the creation of the Sensitive Data Breach Playbook. Playbook steps vary depending on the workflow.\n\n\\[Omitted image \"sensitive-data.png\"\\] Alt text: Playbook design workflow\n\n**Related topics** \n\n\n[Add a DLP Playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/data-loss-prevention/using-dlp-ops-portal.md)\n\n[Cancel a DLP Playbook](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/data-loss-prevention/using-dlp-ops-portal.md)\n\n### Add a DLP Playbook\n\nAdd a Playbook in the Data Loss Prevention Incident Response Analyst workspace that can act as a guide for addressing and mitigating data loss incidents that can compromise your organization’s security.\n\n#### Before you begin\n\nRole required: sn\\_dlir.analyst\n\n#### Procedure\n\n1. Navigate to **All** > **DLP Incident Management** > **DLP Analyst Workspace**.\n\n2. On the DLP Analyst Workspace - My Incidents page, open any DLP incident.\n\n3. Add the Playbook.\n\n 1. Navigate to the **Playbooks** tab.\n\n 2. In the UI actions menu, select the **More actions** icon and select **Add Playbooks**.\n\n 3. In the dialog box, select a Playbook from the drop-down menu.\n\n 4. Select **Add Playbooks**.\n\n4. Select each lane to explore the tasks this Playbook performs.\n\n\n### Cancel a DLP Playbook\n\nCancel a Data Loss Prevention Incident Response Playbook to stop a business flow when it is no longer valid.\n\n#### Before you begin\n\n**Note:** Playbooks are automatically canceled when the associated DLP incident is closed.\n\nRole required: sn\\_dlir.admin.\n\n#### Procedure\n\n1. Navigate to **All** > **DLP Incident Management** > **DLP Analyst Workspace**.\n\n2. Open any DLP incident.\n\n3. Navigate to the **Playbooks** tab.\n\n4. In the header of the Playbook that you want to cancel, select the Playbook actions icon and then select **Cancel Playbook**.\n\n5. Provide a reason for canceling the Playbook.\n\n6. Select **Cancel Playbook**.\n\n\n#### Result\n\nA banner appears below the Playbook header confirming that the Playbook has been canceled.\n\n## View archived DLP incidents\n\nUse the DLP Analyst workspace to view or reactivate the archived DLP incidents.\n\n### Before you begin\n\nRole required:\n\n- sn\\_dlir.analyst\n- sn\\_dlir.analyst\\_read and sn\\_dlir.read\n\n### Procedure\n\n1. Navigate to **All** > **DLP Incident Management** > **DLP Analyst Workspace**.\n\n By default, My Incidents section is displayed.\n\n2. Click **Archived Incidents**.\n\n The archived DLP incidents list is displayed.\n\n3. Click **Show Incidents Count** button to view the archived incidents count.\n\n **Note:**\n\n - By default, the archived incidents count is hidden to improve the list loading time. Select the **Show Incident Count** button to view the incidents count. An information message is displayed that shows the incidents count.\n - The system property glide.ui.list.seismic.omit.count is enabled in the base system for the archived incidents to hide the incidents list count.\n4. Select one or more DLP incidents that you want to view.\n\n The DLP incident displays the incident details section.\n\n **Note:**\n\n - **Other incidents from end users** includes the archived incidents.\n - **Match Content** is supported for all the archived incidents \\(which will be supported in all the integrations as well\\) but **Download file** is supported only for Microsoft integrations.\n5. To reactivate an incident, change the **State** field to an active state, such as Open or In Progress.\n\n\n"}}