---
sourceDocument: Australia Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Create a Profile for Proofpoint DLP integration

# Create a Profile for Proofpoint DLP integration {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Create an incident profile in your  ServiceNow AI Platform instance. Determine the  Proofpoint DLP incidents that are suitable for creating DLP incidents.

## Before you begin

Role required: sn_dlir.admin

## About this task

Configure the ServiceNow AI Platform to populate DLP alerts of Proofpoint. Store the alerts as DLP incidents in your ServiceNow instance.

## Procedure

1. Navigate to Proofpoint DLP integrationIncident Profile.
2. Click New.
3. On the form, fill the fields in the Name section.  
   {#create-profile-proofpoint-dlp-integration__table_jxg_fb2_ltb__entry__2}

   | Field | Description |
   |-|-|
   | Name | Name of the profile. This name helps you to identify the profile. Note: The name must be unique for each profile. |
   | Source | The Proofpoint DLP instance that you configured to ingest incidents. If you have multiple instances configured, select the appropriate instance for the incident types that you are planning to ingest for the profile. |
   | Active | Option to make the profile active. When the profile is active, your ServiceNow AI Platform instance is ready to receive the incidents from Proofpoint. |
   | Description | Description to help distinguish this profile from other profiles. |
   [Table 1. Create a profile for Proofpoint DLP integration form]

   {#create-profile-proofpoint-dlp-integration__table_jxg_fb2_ltb}
4. Click Continue and move to the Filtering section.
{#create-profile-proofpoint-dlp-integration__steps_gp2_ywv_3tb}
* **[Define filters to apply for the Incident creation](https://www.servicenow.com/docs/duShitShfo3ewEsCcxEO6A)**   
  Define and set filter conditions to filter the incoming  Proofpoint DLP  incidents. Control which DLP incidents should be created on ServiceNow®.
* **[Configure evidence file storage](https://www.servicenow.com/docs/TzE3zTrr7ZXfvMgirH9ePA)**   
  Configure evidence file storage to securely store the evidence files in the ServiceNow instance or external for the Proofpoint email DLP Incidents.
* **[Download DLP incidents evidence files on Proofpoint](https://www.servicenow.com/docs/DQZ7PP5wRn_XvBuPbJcinQ)**   
  Download DLP incident evidence files that violate the DLP policy on Proofpoint.
* **[Preview evidence files](https://www.servicenow.com/docs/IEqzFCO1sar2Omm2bTfQvw)**   
  Preview Data Loss Prevention Incident Response evidence files in the DLP IR Analyst workspace.
* **[Email remediation actions](https://www.servicenow.com/docs/gVB9Q~7WRCq8RVc_FQ8G~Q)**   
  Perform the remediation action on the email quarantined for Proofpoint.

*[\>]: and then