To protect medical forms using DLP where blank forms are permitted to circulate but completed forms containing patient data must not leave the organization, the first and most critical step is to create a baseline reference of the blank form templates using document fingerprinting via the Netskope Secure Forwarder.
Fingerprinting creates a hash-based digital profile of the blank form. When a user attempts to transmit a form that has been completed with sensitive patient data, Netskope's fingerprint engine detects that the document has diverged from the blank template baseline and applies the configured DLP policy action. This technique is particularly well-suited for structured document types such as medical forms. Exact Data Match and ML Models serve different use cases and would not effectively differentiate blank from completed forms without additional configuration complexity.

When designing a policy for AWS S3 bucket scans with a custom DLP profile in Netskope, the available policy actions are Alert and Quarantine. These actions allow you to be notified when a policy violation occurs and to quarantine sensitive data to prevent potential data loss or exposure. The Alert action will notify the designated personnel or system when a match to the DLP profile is found during the scan. The Quarantine action will move the offending file to a secure location where it can be reviewed and dealt with appropriately1.
The information about policy actions for AWS S3 bucket scans is available in the Netskope documentation, which provides guidance on creating API Data Protection policies for scanning S3 buckets and the actions that can be taken when a policy is triggered1.

The reason for the activity being NULL in this scenario is likely because a user accessed a static Web page. In Netskope's Advanced Analytics, when the activity is reported as NULL, it often indicates that there was no dynamic interaction or transaction to record, which is typical when a static web page is accessed1. Static web pages do not generate the kind of events or activities that are tracked by policies, hence they appear as NULL in the activity field.
This explanation is supported by the Netskope Knowledge Portal, which mentions that applications fields with null values indicate incidents generated from web traffic, such as accessing static web pages2. Further information on interpreting NULL values in Advanced Analytics reports can be found in the Netskope documentation1.
In Advanced Analytics, the Activity field is populated only when Netskope can identify a specific app activity (e.g., upload, download, edit, share, delete).
When the traffic is simply generic web browsing - especially static web pages (HTML, images, CSS, JS)
- Netskope cannot map the request to an application-level activity, so the Activity field becomes:
## NULL
This is expected behavior for traffic that is:
Not associated with a sanctioned/unsanctioned cloud app
Does not contain a user action like upload/download
Classified only as generic web content (static website)
Why other options are incorrect
A). The SSPM policy was not configured during setupSSPM configuration does not impact the Activity field in Analytics for inline events.
B). The REST API v1 token has expiredAPI token expiration would impact API logs collection, not inline event Activity values.
C). A policy violation was identified using API ProtectionAPI Protection events always include an activity type (e.g., "Download via API"), so they wouldn't show NULL.

The appropriate rule type to use in the DLP profile for a document that is considered confidential when filled out isfingerprint classification. Fingerprinting is a method used to identify and protect sensitive data within documents. It works by creating a digital fingerprint of a file, which can then be used to detect any copies or derivatives of that file.In this case, fingerprinting would allow the hospital to differentiate between the blank patient form, which can be freely shared, and the same form with patient information filled out, which is confidential1.
Netskope's DLP rules can contain elements such as predefined data identifiers, custom data identifiers, keyword identifiers from a dictionary file, RegEx expressions, and exact match criteria1.For this specific use case, fingerprint classification is the most effective method as it can accurately detect the presence of filled- out information in the forms, which is crucial for maintaining patient confidentiality as per HIPAA regulations1.