DLP Incident Response integration with Netskope release notes

  • Release version: Store
  • Updated June 11, 2026
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of DLP Incident Response integration with Netskope release notes

    The DLP Incident Response integration with Netskope enables ServiceNow customers to import and manage Data Loss Prevention (DLP) incidents from Netskope within the ServiceNow platform. This integration supports seamless incident ingestion, status mapping, evidence handling, and user access control to streamline incident response workflows.

    Show full answer Show less

    Key Features

    • Incident Ingestion: Supports importing DLP incidents from Netskope, including near real-time and on-demand scans, while deprecating alert ingestion to focus on incident-based workflows.
    • Status Mapping: Maps DLP incident status between Netskope and ServiceNow, preserving manual customer updates to incident states without automatic overwrites.
    • Evidence Management: Provides preview and download options for evidence files directly within the DLP Workspace, facilitating easier evidence review.
    • Access Controls: Implements Access Control Lists (ACLs) on the DLP Incident Response workspaces, ensuring proper permission management for analysts and end users.
    • Field and Security Enhancements: Upgrades read-only dictionary fields to Strict Read-Only, enforcing consistent security across user interfaces, scripts, and integrations.
    • Correlation and Archival: Adds correlation ID mapping for better incident tracking and supports archival of DLP incidents within the platform.
    • End-User Portal Actions: Enables end users to perform incident response actions directly from the DLP end-user portal.

    Key Outcomes

    • Improved security and data integrity through strict enforcement of read-only fields and controlled access permissions.
    • Reliable and accurate incident ingestion from Netskope, eliminating issues like missing integration source or domain information.
    • Enhanced incident management experience with preserved customer updates, streamlined evidence handling, and status synchronization.
    • Greater operational efficiency by enabling direct actions on incidents within ServiceNow and simplifying evidence review workflows.

    Practical Considerations

    ServiceNow customers should review the application listing on the ServiceNow Store for system requirements and compatibility details. The version history reflects continuous improvements and fixes, addressing access, data mapping, and user experience issues to ensure a robust integration.

    Version history for the DLP Incident Response integration with Netskope on the ServiceNow Store.

    Important:
    For details on system requirements and family compatibility, view the application listing on the ServiceNow Store website.

    Version history

    Version 1.2.2 - June 2026
    Fixed: Access issues for analysts while querying tables.
    Version 1.2.1 - January 2026
    Fixed: Fixed accessing match content.
    Version 1.1.0 - December 2025
    New: Upgraded all dictionary-level read-only fields to Strict Read-Only to enhance security and prevent unauthorized changes. This update ensures the server consistently enforces read-only behavior across all UIs, scripts, and integrations.
    Version 1.0.30 - August 2025
    Fixed: Resolved an intermittent issue during DLP incident ingestion from NetSkope, where incidents were being created with empty values for Integration Source and Domain fields.
    Version 1.0.18 - July 2025
    • Fixed:
      • Netskope DLP Status Mapping Overwrite:
        • Resolved an issue where updates made by customers to the state of a DLP record in the sn_dlir_incident table were being automatically overwritten by the system user. With this fix, the system will no longer override the state field if it has been manually updated by the customer, ensuring customer changes are preserved as expected.
    Version 1.0.17 - May 2025
    • Fixed:
      • Updated Netskope's acting_user field for End User Lookup mapping.
      • Ingestion of Netskope DLP Incidents from when status mapping enabled.
    Version 1.0.16 - February 2025
    • New:
      • Evidence File Preview with Download Option:
        • Added a preview icon for evidence files in the DLP Workspace.
        • Users can now preview evidence files and download them directly from the preview interface, simplifying evidence review and retrieval.
    Version 1.0.14 - December 2024
    Fixed: Access Control Lists (ACLs) applied to the Data Loss Prevention Incident Response(DLP IR) end-user workspace to regulate and manage user permissions and access.
    Version 1.0.12 - August 2024
    • New:
      • Added support for ingesting DLP incidents.
      • Deprecated support for alerts ingestion.
      • View the forensic details (violating content) of the DLP Incidents in both DLP IR Analyst workspace and DLP End user workspace.
      • Downloading evidence file directly from Netskope on demand.
      • Map the DLP incidents status between Netskope Object Status and ServiceNow incident status.
    Version 1.0.4 - February 2024
    • New:
      • Added correlation ID mapping for DLP incidents in the transform map.
      • Added support for the DLP incidents archival.
    Version 1.0.3 - June 2023
    Fixed: The existing fields in Netskope are not mapped to ServiceNow, this issue is now fixed.
    Version 1.0.0 - May 2022
    • New:
      • Import DLP incidents from Netskope to provide an incident response workflow for customers
      • Support incidents created by data-at-rest scan from Netskope: both near real-time as well as on-demand scan
      • Provides the ability to perform actions from within DLP end-user portal for end-users