In the Symantec Data Loss Prevention (DLP) Enforce console, the subject line in the incident details is not showing the correct subject.
This is seen only with emails that have attachments.
And only in emails that go through CloudSOC (CASB).
For O365:
Incident details for risk in email body; Subject field is available and showing the correct subject
Incident details for risk in email attachment; Subject field is available and showing the incorrect subject
With an attachment, the subject line being displayed is for another email.
The correct information displays in CloudSOC but it is not passed to DLP.
Release: DLP 15.x and CASB versions prior to 3.139.
CASB engineering is targeting a fix in version 3.139 which is due for release in late October 2021.