When customer uploads sensitive file to "Office.com" website, in Web CDS incident snapshot, attachment filename is incorrect.
Data Loss Prevention Cloud Detection Service for ICAP
File uploads to websites like "Office.com" are completed in chunks. Symantec DLP cannot seamlessly process file contents that are split across multiple HTTP messages. Hence, you will see incidents with different filename than uploaded file in attachment.
This is a product enhancement currently under review and will be addressed in future release of DLP. This enhancement is to reassemble chunked file and perform detection on entire file.