This counts DLP policy violations detected in HTTP/web traffic, for example an employee attempting to upload a file containing sensitive data (like a spreadsheet with SSNs) to a personal cloud storage site. This is functionally the web-channel equivalent of dlpSMTPIncidents but reflects a very different exfiltration vector (browser uploads rather than outbound email) that often needs a different remediation conversation with the user. For example, the counter might read 3 incidents this period.