Our integration with Netskope was improved with new additional DLP fields:

• netskope.dlp.action: The action done on the DLP incident
• netskope.dlp.forensic_id: The identifier of the forensic
• netskope.dlp.policy: The policy that triggered the DLP incident
• netskope.dlp.profile_name: The name of the DLP profile
• netskope.dlp.rules: Rules that triggered the DLP incident