drop purview dlp incident export · parse policy + sensitive info types + actions · runs locally
drop purview dlp incident export · local only
heuristic screener · vendor schema varies · not definitive proof