Enable Forensics in Netskope and you'll have access to the actual content people submitted to ChatGPT. 

Doing DLP without Forensics enabled is extremely risky since there is an extremely high ratio of false-positives with pre-built DLP profile/rules. You want to be certain your matches are working as expected before enabling block actions.

@thomasmichael,

As @nduda mentioned, the Forensics capability of the Netskope platform captures this data as the incident is generated and forwards it to a repository you own (AWS S3 Bucket, Sharepoint, etc) as Netskope does not store this data.  For additional info on this capability see:

https://docs.netskope.com/en/netskope-help/data-security/forensics/

Once enabled, this data can be viewed in DLP Incidents page.  One other item to keep in mind is that you can optionally enable Original File Access which also takes a copy of the original object and stores it in Forensics as well but this is behind a feature flag that you can request be enabled:

https://docs.netskope.com/en/netskope-help/admin-console/incidents/about-dlp/downloading-dlp-incident-files/

It's not applicable for ChatGPT as the original object is a message in the browser rather than an actual file but it's helpful for file based objects. 

By enabling the Forensics capability will this have any performance impact?

@thomasmichael,

I am not aware of any performance impact with this change.  This forensics capture happens in conjunction with the DLP scan so it's not adding additional data processing beyond the copy from the DLP engine to your forensics repository.