Preview Data Loss Prevention Incident Response evidence files in the DLP IR Analyst workspace.

Before you begin

Important: While using the Evidence files action in the DLP analyst workspace, the evidence files are temporarily stored in the ServiceNow database in an unencrypted format. If you don't want to store the evidence files, disable the Evidence Files preview feature. For more information, see Configure advanced settings.

Role required: sn_dlir.analyst

Procedure

  1. Navigate to All > DLP Incident Management > DLP Analyst Workspace.
  2. Open a DLP incident record.
  3. From the contextual sidebar, select the Evidence files icon (Evidence files icon.).
  4. On the Evidence Files tab, select the Evidence File card to preview the evidence files in the document viewer.

    The preview feature is different for each file type, as listed in the following table.

    File Format File Extension
    Image .bmp, .gif, .ico, .jpeg, .jpg, .png, .svg, and .webp.

    Image files open in the document viewer mode.
    Microsoft Office files .doc, .docx, .ppt, .pptx, .xls, and .xlsx

    Office files open in the document viewer mode.
    Text files .txt

    Text files open in text editor mode.
    Mail files .eml
    Note: The file size must be less than 5MB. You must first download the file to preview its content.
    PDF files .pdf
    • Enter a keyword to search the document.
    • Zoom-in and zoom-out features to adjust the view for better readability.
    • Rotate the page clockwise or counterclockwise to view the content more clearly.
    Note:

    Binary files won’t be rendered and have to be downloaded to preview their content. The preview evidence file feature also works for archived incidents.