You want to understand what the "Occurred On" and "Reported On" dates in incident snapshots mean, and how they relate to the following timestamps from the Incident table in the database:
DLP 15.x
Occurred On is the date from the email header itself.
The date when the violation was detected within the message that generated the incident.
When the DLP agent sent the incident to Aggregator service on the Endpoint Detection server (not the local time on the Endpoint Detection Server).
When FileReader generates an incident. Detection Server incidents should generally have very similar Message and Detection timestamps. FileReader writes .idc files (incidents) to the C:\ProgramData\Symantec\DataLossPrevention\ServerPlatformCommon\<ver>\incidents directory, which is monitored by the IncidentWriter service, which in turn picks up the .idc files and ships them to the SymantecDLPDetectionServerController service on the Enforce.
When the IncidentPersister service on Enforce first persists the incident into the database (stage 1/peristence).
In an Incident Snapshot's Incident Details section, the MessageDate and DetectionDate timestamps are represented as "Occurred On" and "Reported On" as shown in the screenshots below:
In the case of Endpoint Agent incidents, the MessageDate corresponds to the persistDate field for the given Incident as found in the is.ead (IncidentStore) database, DetectionResultData table.
See also: Incident Persister stages overview