Some incidents have evidence items associated with them. You can store the evidence on an evidence server.
The evidence server must be a CIFS or WebDAV share with read/write permissions.
Perform this task to configure the default shared evidence storage settings. The settings entered here are reflected in the policies configured in the Policy Catalog → Data Loss Prevention <version> → Server Configuration, Policy Catalog → Data Loss Prevention <version> → Windows Client Configuration, and Policy Catalog → Data Loss Prevention <version> → Mac OS X Client Configuration pages. You can update the settings for the Trellix DLP Discover, Trellix DLP Network Prevent, Trellix DLP Network Monitor, and DLP Server in the Server Configuration policy.
In ePO - On-prem, select Menu → DLP Settings → General.
Enter the path to the evidence server in Shared Storage to save the settings and activate the software.
The evidence storage path must be a network path or a URL, that is
\\[server]\[share]orhttps:\\[server].Provide the user name and password to access the server, and click Save.