You want an overview of the DLP Incident Persister service stages.
DLP 15.x
IDC files (incidents) arrive at Enforce via the Symantec DLP Detection Server Controller service, are written to the C:\ProgramData\Symantec\DataLossPrevention\ServerPlatformCommon\<ver>\incidents directory, get picked up by the Symantec DLP Persister service and go through the following 3 stages while being processed: