> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-dlp/cortex-dlp-threat-detection-and-issues.md).
# Cortex DLP threat detection and issues
The Cortex DLP module prevents sensitive data exfiltration. If instances of data-in-motion rules have been violated, a DLP issue is generated. To view the DLP Issues, go to **Data Security** → **Data Security Issues** → **Threats**. The **Detection Method** is set to DLP.
DLP issues provide visibility into instances where [data-in-motion rules](/cortex-xsiam/protect-your-endpoints/endpoint-dlp/configure-dlp-end-to-end.md#create-data-in-motion-rules) have been violated.
From **Data Security** → **Data Security Issues** → **Threats**, you can view the DLP issues. The **Detection Method** is set to DLP.
{% hint style="info" %}
### Note
Access to this page is restricted to users with the roles: Data Security Admin, Instance Administrator, and Account Admin.
{% endhint %}
The parameters configured during rule creation are shown as issue attributes on this page. These include:
* **Name**: Taken from the **Raised Issue Name** field defined when creating the rule.
* **Severity**: The assigned severity level of the Issue.
* **Description**: The predefined description from the rule.
* **Detection method**: When an issue arises from a data-in-motion rule violation, its **Detection Method** is **DLP**.
* **Action**: How the rule responded to the issue: **Prevented (Blocked)**, **Allow**, or **Report**.
{% hint style="info" %}
### Note
If the default action configured in **Endpoint DLP Settings** is set to **Block file movement (fail-close)**, an issue is raised where the assigned severity is set to low, and includes the **Name** Data movement blocked by Endpoint DLP default action
{% endhint %}
**View the DLP issue card panel**
Click a DLP issue to open the DLP security card, where you can investigate the issue, take any required actions, and view remediation suggestions.
From the three-dot menu, you can open the issue in a new tab, copy the issue URL, retrieve the file, or view raw data (JSON).
Some other important actions:
* **Retrieve File**: From the asset card, click  to obtain a copy of the file that triggered the security alert.\
**Note**: Files remain available for retrieval until they are deleted.
* Click  to open the related rule that triggered the issue.
At the top of the card, you can view information about the issue, including the severity, detection tags, category, and detection method. In the tabs, you can see more information about the cause of the issue, take any required actions, and view remediation suggestions.
You can also see the details of the user who logged into the browser.
Overview
Displays a description of the issue and provides key information, such as the assignee, status, action taken, and the time that the issue was created and updated.
You can also see the following:
* **Evidence**: which includes data classification details such as **Data Profiles**, **Data Patterns**, **Classification Status,** and **Profile Indicators**.
Click the **Profile Indicators** link to view the list of sensitive data contained in the file.
The graph enables you to view information on the relevant file and logged-in user details.
* **File** that includes the **Name**, **Hash**, **Path**, and **Data Volume** of the file.
The path shows the full path of the uploaded file.
* **Local Applications**, which include **Process Name**, **Signer**, **Application Name**, and **Application Group Name**.
* **User Interaction** that includes **User Response**.
War Room
A comprehensive collection of all investigation actions, artifacts, and collaboration. It is a chronological journal of the issue investigation. For information, see [Use the War Room in an investigation](/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/use-the-war-room-in-an-investigation.md).
Work Plan
A visual representation of the running playbook that is assigned to the issue. For more information, see [Use the Work Plan in an investigation](/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-issues/use-the-work-plan-in-an-investigation.md).
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-dlp/cortex-dlp-threat-detection-and-issues.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.