API Protection features - Netskope Technical Documentation

Quarantined Profile: defines which repository is to be used for quarantined files and if any custom tombstone files will be used. Quarantined files are moved to the specified repository and replaced by a tombstone file (placeholder). Once quarantined, files can be downloaded for inspection, encrypted, restored or permanently deleted pending outcome of incident analysis.
Forensic profile: determines where the DLP Incident metadata is stored. Each zip file contains the extracted text from the document and incident violation details.
Legal Hold Profile: defines the repository where legal hold policies will write duplicate copies of any files affected by Legal Hold policies