Use Case: Find a Policy Incident Generated by a Custom Classification

Create a custom classification, use that classification in a Shadow/Web policy, and find the incidents it generates.

1. Create custom classifications.
2. Create a Shadow/Web Policy with the Policy Wizard.
3. To view the incident generated in Skyhigh CASB:
   • Go to Incidents > Policy Incidents.
   • Select the corresponding incident in the Policy Incidents table. The Policy Incident Cloud Card appears, with the details of the selected incident.
4. To view the incident generated in Trellix ePO:
   NOTE: Shadow/Web incidents viewed in Trellix ePO are read-only. To manage Shadow/Web incidents, use Skyhigh CASB.
   • In Trellix ePO Protection Workspace, click the incidents in the Data Protection Overview section to open the incident management workspace.
   • Search for and select Shadow/Web DLP in the Detected by filter. The Incidents pane displays the list of Shadow/Web incidents generated.
   • Hover over the incident for which you want to see the details. Select the checkbox to see more details about the selected incident. The Incident Details pane opens on the right.