Incidents with an unknown URL are created intermittently.
One minute it is working as expected, the next an unknown URL will surface. This is happening amongst all different web browsers.
DLP 15.5 and later versions have the ability to increase the timeout value.
Once an incident is triggered, the DLP agent reaches back out to try and identify the URL in use at the time of the incident.
If the time limit expires trying to retrieve the URL, the agent will fail open and send the incident with an unknown URL.
If NetworkMonitor.URL_TIMEOUT.int is not an available option please contact support for assistance.