You can view the exact file or the embedded file that caused a violation.
Embedded files may contain sub-files within them as attachments. The number of sub-files that an embedded file contain varies, it may contain a single file or multiple files. For example, zip files, a word file within a word file, a pdf file within a pdf file, pdf in a word file, pdf in an excel file, and so on.
Trellix DLP Discover extracts the text from embedded files to a separate file and scans (including the scanning of document properties and XMP properties) in isolation to create a single incident. For each embedded file, Trellix DLP Discover generates separate match details such as File Type, Match Count, Matched Fingerprint (auto regdoc), Unique Match Count, Short Match String, Unique Match String, Matching Classification, and Path of embedded file that caused the event. The incident is generated only after the scanning of the base file and sub files.