How to export incidents in Symantec DLP

Exporting Incidents

To export incidents, first select which incidents you would like to export via the relevant filter options (see How to Filter and Summarise Incidents).

1. Once these have been selected you can then go to the Export Button at the top of the page and then select whether to export them to a CSV or XML file (If exporting a summary, only CSV will be available).
   
2. A window will pop up at the bottom of the page, select Save.
   
3. Once the download is complete you can then choose to Open it or Open the folder it’s contained in.
   
4. Alternatively, you can select individual incidents by clicking the box(es) next to said incidents. You can also select all incidents on the current page by clicking the box at the top next to Type, and lastly you can click the Select All box to select all of them.
   
5. Once selected, go to the Incident Actions box and then choose to export via CSV or XML.
   

*Please Note – Only 10,000 incidents can be exported at any given time*

If you are trying to export more then 10,000 incidents at a time, you will have to break down the number of incidents to ensure they are at or below 10K in order to export them.

For instance, if you have a report based on the Policy filter and one of those Policies has over 10K incidents, then you would have to break down said Policy even further in order to get groups of incidents which don’t go over 10K. There are several ways this can be done.

Using the filter options, you could choose to filter by Severity in order to separate the High incidents from say the Medium and/or Low, Info incidents. You can also filter by File Name, File Owner, Policy Group, Policy Rule and Incident Match Count to name but a few.

It is up to the user to determine which method of filtering works best given the situation. When the respective filters have broken down the incidents below/equalling the 10K threshold, they can then be exported and subsequently combined if need be after the export has been completed.