Administrators can use log queries to generate and export DLP auditing logs. Perform a log query as described in Querying Logs and configure the following:
Log type: Select User Access
Advanced filters: Add the following activities (Activity) to custom criteria:
Download DLP incident file
Update DLP incident