Preview evidence files for ICAP

Preview DLP incident evidence files in the DLP IR Analyst workspace.

始める前に

• Navigate to All > DLP Administration > Advanced Settings.
• Make sure the sn_icap_dlp.enable_evidence_file_preview property is already enabled.

重要:

While using the Evidence files action in the DLP analyst workspace, the evidence files are temporarily stored in the ServiceNow database in an unencrypted format for the duration you have selected using sn_dlir.preview_temp_files_cleanup_interval property from the Advanced Settings page. You can disable the Evidence Files preview feature if you don't want to store any data in the ServiceNow database. For more information, see Configure advanced settings.

Role required: sn_dlir.analyst

手順

1. Navigate to All > DLP Incident Management > DLP Analyst Workspace.
2. Open a DLP incident record.
3. Select the Evidence Files icon, which is available on the contextual menu.
   A tab opens which fetches all the evidence files. Once the download is finished, you can view all the evidence files in the Evidence Files tab.
4. Select the Evidence File card which you want to preview.
   The preview feature is different for each file type.
5. Preview pdf and office docs in the document viewer by selecting the Expand icon on the top right of the evidence file to open the pdf in full screen.
   Office Extensions for which the document viewer opens the evidence files include- doc, docx, ppt, pptx, xls, xlsx.
   1. Locate the search bar and enter the keyword you’re looking for.
   2. Use the zoom-in and zoom-out features to adjust the view for better readability.
   3. Rotate the page clockwise or counterclockwise to view the content more clearly.
   These control options enhance your ability to understand the evidence file comprehensively. Only the pdf has control options in the header.

   

6. Preview eml files.
   Select the attachments in the email and preview them.

   注:

   If the selected evidence file exceeds the 5-MB limit, it can’t be previewed in the analyst workspace. You have to download the file to preview its content. This limit is only for .eml files.

   

7. Preview images in the DLP analyst workspace.
   Images only with the .bmp, .gif, .ico, .jpeg, .jpg, .png, .svg, and .webp extensions are supported.

   

8. Preview text files in the text editor by selecting the Expand icon on the top right of the evidence file.

   

   注:

   Evidence Files apart from the office docs, eml files, text, and image extensions won’t be supported for preview. Binary files won’t be rendered and have to be downloaded to preview their content. The preview evidence file feature also works for archived incidents.