You can see more details about an incident that is detected when a rule is triggered.
In ePO - SaaS Protection Workspace, click the incidents in the Data Protection Overview section to open the incident management workspace.
Search for and select an incident by using the filters.
Based on the filter and the search criteria you have selected, the Incidents pane displays the list of incidents.
Hover over the incident for which you want to see the details. Select the checkbox to see more details about the selected incident.
The Incident Details pane opens on the right. You can expand or collapse the panes side-ways.
The first section in the Incident Details pane shows the general information about an incident. You can change the severity, status, resolution, and assign a reviewer.
To view or update additional information, perform any of these actions:
To view additional information, such as URL details and the device details, expand the Additional Information section.
To view details of evidence files, expand the Evidence section and select a file name.
To view the justification information, such as justification option, text, and selected action, expand the Justification section. The Justification section will not appear if there is no justification information associated with the incident.
To view policy and rules that triggered the incident, expand the Policy and Rules section.
To view classifications, expand the Classifications section. The Classifications section is grayed out and the count is zero when the incident is not triggered by a classification rule.
To view collaborators, expand the Collaboration section. The Collaboration section only appears for incidents detected by Skyhigh Security Cloud.
To email the incident details, select Email Incident from the three dots menu in the Incident Details pane.
Click Save to save any updates to the incident details.