Configure the match content for the incident

Provide the configuration to store the sensitive information internally, on the ServiceNow® storage, or on the external cloud storage, such as Azure Storage or AWS S3 bucket. Retrieve the stored content while accessing the DLP IR Incident.

Before you begin

Role required:

• sn_dlir.admin
• sn_dlir.analyst

Procedure

1. On the progress bar, click the Match Content Configuration step.
2. On the form, fill in the fields.

   Table 1. Match Content Configuration

   Field	Description
   Store Match Content	Option to store the matched content. Important: Enable this option to store the match content, and retrieve and display the match content when a DLP incident is opened in the workspace. For information on the External Cloud Storage configuration, see Install and configure the Microsoft DLP integration.
   Storage Source for Match content	Option to choose whether to store the matched content internally, on the ServiceNow® storage, or externally, on the cloud storage.
   External Cloud Credentials	The External Cloud Storage where the match content gets stored. You can refer to the External Cloud Credentials added for the Storage configuration. This option is visible only when the Store Match Content field is selected.
   Delete Match Content on Incident Deletion	Option to delete the incident match content from the external cloud storage. This option is visible only when the Store Match Content field is selected.

3. Click Continue and move to the Scheduling section.