When there is a violation of a Trellix DLP policy that uses synchronized classifications fromTrellix DLP, an incident is created in Skyhigh Security Cloud. Additionally, this incident is synchronized back to ePO - On-prem because ePO - On-prem allows you to view and manage all Trellix DLP incidents (both on-premise and in the cloud).
Policy limitations
If there is a need to perform further manual remediation actions on the incidents generated (for example, releasing a file from quarantine), these actions need to be taken from the Skyhigh Security Cloud interface.