Cybersecurity in a context that allows your organization to achieve more

Hey Gary, thank you for your question.

There are two important points:

1. Incident Correlation: Even if Sensitive Information isn't captured directly, it's crucial to correlate incidents with key apps to understand their mission-critical impact. You may focus on privileged roles, systems, and activities performed by "flagged" accounts.

2. DLP and Information Protection: The DLP and file governance features are used for retrieving sensitive information for the supported apps. The schema used can vary depending on the specific app. For the user monitoring there may be exceptions depending on what the system transmits in the user activity. But I do not expect you will see data types from the apps not supporting DLP.