Hi Salim, I hope u have discussed with Symantec
Please refre below
https://www-secure.symantec.com/connect/forums/dlp-incidents-managing-user-security
https://www-secure.symantec.com/connect/forums/correlation-support-incident-management-workflow
https://www-secure.symantec.com/connect/forums/dlp-incident-handling-methods