You can use the incidents API to query incidents details and based on user authorization you can view the decrypted strings instead of viewing them on Trellix ePO → DLP Incident Manager.
GET request URL
https://<epo_server_name:port>/rest/dlp/incidents/{incident id}?incidentNature={n}
Where
epo_server_name:portis the server IP address and port number.incident idis the number assigned to an incident.incidentNature={n}incidents generated for data-in-use/motion and data-at-rest can have the same incident IDs, based on the value of n specified, incidents generated for different data vectors are retrieved.