We have Web Gateway v7.6 ICAP connected to a new nDLP v11 Prevent for Data-in-motion key word detection. The nDLPs are administered through ePO v5.9.
When an event is triggered on the DLP, (such as from a POST event to a WebMail account), the ePO shows the incident, and ip address of the Client PC, but the username is not picked up by ePO.
This all worked OK , with nDLP v9.3, but then we were using a Management DLP not ePO.
So what am I missing?