Hello community,
We are investigating an inline DLP visibility issue using two small, synthetic TXT files uploaded through Google Drive in Microsoft Edge on Windows with Netskope Client. No real business data was used.
Google Drive reported both uploads completed. However, more than 30 minutes later, we had not located corresponding Upload application events, DLP incidents, or file metadata in the searches described below.
What we have confirmed:
- A Google Drive Page Event spans the browser session. Its start time is earlier than the actual file submission, so widening the time range was necessary to find it. Bypass Traffic is “no”.
- Transaction Events show two requests at the submission time to drivefrontend-pa.clients6.google.com/upload/v1/items:upload.
- Both requests are OPTIONS, HTTP 200, classified as Browse, allowed by an existing browse policy, with SSL Bypass: No and SSL Action: Decrypt (DefaultAction).
- Both show no object name and File Size 0. We understand these are preflight requests and do not prove that either file body was inspected.
- We also searched all applications for the same user in a 20-second window around submission. The nearest three transactions with blank application/path fields were unrelated Microsoft traffic.
- The actual POST/PUT carrying the file contents has not yet been identified. We have not concluded that DLP failed or that a steering exception caused the issue.
Questions:
1. For the current Google Drive web upload flow, which transaction fields, hosts or session relationships should we use to trace the actual file body after these OPTIONS requests?
2. Are there known operation-recognition or logging limitations for this endpoint, or other conditions that can leave a successful upload visible only as Browse/preflight in the searched records?
3. Beyond the documented up-to-five-minute batching delay for Transaction Events, which event timing/aggregation behavior should we account for when correlating Application Events and DLP incidents?
4. What minimum sanitized evidence should we collect for Support to distinguish steering/SSL exceptions, upload-operation recognition, and event-generation issues?
We are preserving the existing evidence and avoiding repeat uploads or policy changes during diagnosis. We can provide identifiers and sensitive logs privately through an authorized support channel if required; none are included in this public post.
Thank you.
