Define Filters to apply for the Incident creation

task brazil Updated Sep 10, 2026 1 min read define-filters-incident-creation-netskope.md

Define and set filter conditions to filter the incoming  Netskope DLP  incidents. Control which of these incidents should be created as DLP incidents on your ServiceNow instance.

Before you begin

Role required: sn_dlir.admin

About this task

This type of filtering helps you to isolate DLP incidents and to limit the number of DLP incidents that you create. If additional filtering criteria are set, only incidents that match the conditions are created.

Procedure

Select the Filter based on conditions option and define the criteria that an incoming Netskope DLP incident must satisfy so that a DLP incident is created.
Using the lists and fields of the condition builder, set the filters in the Filter Conditions field.

The options in the first field in the Filter Conditions match the fields that are available in the Netskope DLP incident import table. The criteria that you enter are case-sensitive. Verify that the criteria you define match the values of the incident.
Add more conditions by clicking  AND  or  OR.
- If  AND  is selected, all conditions must be matched.
- If  OR  is selected, either condition can be matched.
Click Continue and move to the Scheduling section.

Parent Topic:Create a Profile for Netskope DLP integration

44 lines · 2.3 KB Wrap lines

---
title: Define Filters to apply for the Incident creation
description: Define and set filter conditions to filter the incoming Netskope DLP incidents. Control which of these incidents should be created as DLP incidents on your ServiceNow instance.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/security-management/data-loss-prevention/define-filters-incident-creation-netskope.html
release: brazil
product: Data Loss Prevention
classification: data-loss-prevention
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Create a Profile for Netskope DLP integration, Data Loss Prevention Incident Response Integration with Netskope, Integrate, Data Loss Prevention Incident Response, Security Operations]
---

# Define Filters to apply for the Incident creation

Define and set filter conditions to filter the incoming Netskope DLP incidents. Control which of these incidents should be created as DLP incidents on your ServiceNow instance.

## Before you begin

Role required: sn\_dlir.admin

## About this task

## Procedure

1. Select the **Filter based on conditions** option and define the criteria that an incoming Netskope DLP incident must satisfy so that a DLP incident is created.

2. Using the lists and fields of the condition builder, set the filters in the **Filter Conditions** field.

The options in the first field in the **Filter Conditions** match the fields that are available in the **Netskope DLP incident import** table. The criteria that you enter are case-sensitive. Verify that the criteria you define match the values of the incident.

3. Add more conditions by clicking **AND** or **OR**.

- If **AND** is selected, all conditions must be matched.
- If **OR** is selected, either condition can be matched.
4. Click **Continue** and move to the Scheduling section.

**Parent Topic:**[Create a Profile for Netskope DLP integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/security-management/data-loss-prevention/create-profile-netskope-dlp-integration.md)