Schedule the ICAP DLP incidents retrieval

  • Freigeben Version: Australia
  • Aktualisiert 12. März 2026
  • 1 Minute Lesedauer

    • Set a schedule to retrieve ICAP DLP alerts that match the criteria in the profile.

    Vorbereitungen

    Role required: sn_dlir.admin

    Warum und wann dieser Vorgang ausgeführt wird

    You can plan how often you will poll for net new ICAP incidents that match the incident profile configuration. To enable automated incident ingestion, you must configure the scheduling and incident retrieval before you activate the profile. The profile can be configured to do one-time retrieval using the One-Time Retrieval check box.

    Prozedur

    1. Configure the schedule to define how and when you pull incidents from ICAP.
    2. On the form, fill in the fields.
      Tabelle : 1. Schedule the ICAP DLP incidents
      Field Description
      Ongoing Incident Ingestion Ongoing incident ingestion that your ServiceNow AI Platform instance pulls from  ICAP for new incidents. If there are triggered incidents found, which match with the incident filtering criteria, then DLP incidents are created.
      Polling increment (minutes) Polling frequency that is defined in minutes. This default value is set to 5.
      Set Initial Incident Ingestion Time

      Option to set initial incident ingestion based on the configured date and time.

      You can use this option to define a specific date and time for the initial ingestion. Subsequent ingestions are based on the polling interval period.
      Input Initial Incident Ingestion Time Date and time that you specify for the incident ingestion.
      Initial Incident Ingestion Time The first time when data is ingested.
      Hinweis:
      The value is visible only if the Set Initial Incident Ingestion Time option is selected.
      Next Incident Ingestion Time (estimated) The next estimated incident ingestion time.
      One-Time Retrieval Option to enable one-time historical data pull.
      Hinweis:
      If selected, then historical data will be pulled from ICAP DLP according to the date added in Since Date.
      Folder Name Name of the folder from which you want to retrieve the data. All the folders whose names are lexicographically greater than the provided folder name will be ingested in one-time retrieval.
    3. Click Finish.
    4. On the pop-up, save the created profile configuration by clicking Finish.
    5. Activate the profile.
      1. Open the created profile.
      2. Set Active to true.
      3. Click Update.

    Ergebnisse

    After the successful creation activation of the profile, incidents will be fetched periodically as per the configuration set in the profile. The alerts will be added into the DLP incident table.