Configure evidence file storage

  • Release version: Xanadu
  • Updated September 19, 2024
  • 1 minute to read

    • Configure evidence file storage to securely store the evidence files in the ServiceNow instance or external for the Proofpoint email DLP Incidents.

    Before you begin

    Role required: sn_dlir.admin

    About this task

    You can configure the evidence file storage to securely store files. This provides an option for internal storage in ServiceNow instance or store externally, ensuring that files are stored and encrypted using Column Level Encryption. For more information, see Field Encryption on NowPlatform documentation.

    When a DLP analyst performs the Download evidence files for DLP Incidents action from analyst workspace, the file will be downloaded from the selected storage if evidence file storage option is enabled. Otherwise, the file will be downloaded directly from the Proofpoint source and will not be persisted in ServiceNow instance. For more information, see Download DLP incidents evidence files on Proofpoint.

    Procedure

    1. Select Evidence Storage section on the Incident Profile form.
    2. Select Evidence File Storage check box to enable the file storage.
    3. Select the preferred storage type.
      FieldDescription
      Evidence file storage Option to enable the evidence file storage.
      Storage type Option to select the preferred storage type. You can use either internal or external storage to store the evidence files.
      • ServiceNow Storage: This will store the evidence files in the ServiceNow instance in an encrypted format.
      • Evidence File Storage:

        This storage provides a flexibility to manage the evidence files, allows you to choose the preferred storage method. Internal storage offers quick access within the application, while external storage supports both Blob storage and Amazon S3 storage options and allows the increased capacity and backup options. When you select this storage type, a new field is displayed: External File Storage Source.
      External File Storage Source This field supports both Blob storage and Amazon S3 storage options. This is in reference to the existing DLP Core configuration tiles for S3 or blob storage which are being used in Microsoft integration for match content storage.
    Internal Storage

    Internal storage view

    External Storage

    DLP Proofpoint external storage view.

    1. Click Finish.

    Result

    If the Evidence File Storage option is enabled and ServiceNow Storage is selected then the evidence files will be stored internally in an encrypted format, after the incidents from Proofpoint are fetched and if you perform Download File action for any of these Proofpoint incident then the system will get the evidence file from this table.