DLP Incident Response integration with ICAP
DLP Incident Response integration with ICAP
Install Trend
View Install Data
| Date | Install Count | Change |
|---|---|---|
| 2026-09-09 | 0 | - |
| 134 days of no change | ||
| 2026-04-27 | 2 | -2 |
| 335 days of no change | ||
| 2025-05-26 | 1 | +1 |
| 128 days of no change | ||
| 2025-01-17 | 0 | +1 |
About
An integration between ServiceNow's Data Loss Prevention Incident Response product (DLP-IR) and vendors who provide their DLP alerts information using the Internet Content Adaption Protocol (ICAP).
Key Features
- **Ingestion of DLP Alerts from Amazon S3:**
- Users would be able to configure and schedule the ingestion of DLP alerts from specified Amazon S3 buckets. This includes the capability to perform delta imports to ensure only new or modified data is ingested.
- **Display DLP Alerts in the DLP Workspace:**
- Once alerts are ingested, they should be displayed in the DLP workspace by providing the key details on each alert such as the match content, alert severity, and relevant metadata.
- **Evidence File Download:**
- The system would allow users to download associated evidence files directly from the DLP workspace for further investigation or review.
- **Automation and Response Workflows:**
- Advanced workflow automation should be available for handling alerts, enabling users to apply automatic responses based on predefined criteria. This might include actions like alert escalation, notifications, or enforcement policies.
- **Advanced response options:**
- These could include remediation actions such as blocking or quarantining sensitive data, or sending out alerts to stakeholders.
- **Dashboards and Data Trends:**
- Users should be able to visualize ingested data in the DLP workspace through dashboards and trend reports. This would help track the number and type of DLP incidents over time, offering insights into potential data loss patterns or vulnerabilities.