What is the incident creation criteria of an alert in Netskope?

Hi Marvin, welcome to the community.

An alert type of DLP will generate a DLP Incident, so please check which type of alert you are seeing. You can do this by clicking the gear icon at the top right of the alert list and check the Type box. From here you should see what type of alerts you are seeing (policy, uba, DLP etc).

Also, don't forget you have the option of clicking the magnifying glass, this will display more info about the alert. Feel free to reply to this answer with screen shots if you are still unsure.

Regards,

Steve Foster

An alert in SkopeIT will be triggered if a Policy is matched (API or real-time inline policy).

This includes if malware is enabled for API scans.