---
sourceDocument: Zurich Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/security-management

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Download evidence files for DLP alerts

# Download evidence files for DLP alerts {#ariaid-title1}

* Release version: Zurich
* 
* Updated July 31, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Download files that violate the DLP policy on provider that supports ICAP. Download this file onto your local machine from the DLP IR Analyst workspace and DLP IR End user workspace for approvers.

## Before you begin

Role required:

* sn_dlir.analyst and approvers can download
{#download-icap-evidence-files__ul_krq_v5m_1cc}

## About this task

You need to enable file download for ICAP before moving ahead.

## Procedure

1. Navigate to AllICAP DLP IntegrationSettings.
2. Enable the property sn_icap_dlp.enable_file_download Enabling this property allows downloading the evidence file of the reported ICAP incident.  
   You will be able to see the Download File button on the DLP IR Analyst Workspace and DLP IR End user workspace.
3. Navigate to AllDLP Incident ManagementDLP Analyst Workspace.
4. Open a DLP incident record which is ingested from ICAP provider source.
5. Click Download File.  
   Note:  
   DLP admin can control the access of Download File action for all integrations by disabling the Should downloading the violating file of the reported incident be allowed option from the Advanced Settings page of DLP Administration. For more information, see [Configure advanced settings](https://www.servicenow.com/docs/IVVWVvbXSIP0Wqj8zNuRjA "Configure the advanced settings to customize the incident display and behavior. For example, enable displaying the sensitive data on an incident and its clone, or specifying fields on the incident to identify the end users. In addition, activate and customize the evidence files preview properties.").
{#download-icap-evidence-files__steps_ngd_3zw_rcc}

*[\>]: and then