Data Loss Prevention

I am charged with writing a flex response script to quarantine confidential information in Network Protect based off of last date accessed in Data Insight. Does anyone have any insight or suggestions?

A flex is used on 1..n incidents. Therefore you check the condition first (last access in Insight), than either do the quarantine action or not. Make sure, you not the result of the decision either by "failed flex" in the history, writing a note or set a custom attribute.

Since last access is also an attribute of DLP, you can also filter the incicents in DLP an apply a smart response?

Thanks