Protection Workspace is an ePO - SaaS feature used by several Trellix cloud-based products.
Because Protection Workspace is a shared feature used by several ePO - SaaS products, some of the options and data displayed might not apply to Trellix DLP – SaaS. Protection Workspace → Data Protection Overview shows only the incidents generated in your network environment by Trellix DLP – SaaS.
The original ePO - SaaS account already has the permissions to manage incidents and operational events.
Users need to be assigned the Incident Management permission set (Users & Roles → Users → Assigned Roles). Incident Management includes separate permissions to:
Manage Data In-Use/Motion incidents
Manage Data at Rest (Local) incidents
Manager Data at Rest (Shared) incidents
View and access evidence files
View and access match string files