1. A method, comprising: identifying an occurrence of a data loss prevention (DLP) incident triggered by content and a DLP rule, wherein the content includes at least a data element and a position element; generating a first signature representing the DLP incident based on the content, wherein the first signature is generated from a plurality of text strings in the data element and wherein the position element comprises offsets between pairs of the text strings; comparing the first signature to one or more second signatures generated from other DLP incidents associated with the DLP rule; upon determining the first signature matches at least one of the second signatures: assigning a status of the matching second signature to the first signature, wherein the status of matching second signature is a false-positive, and performing an action with the content associated with the DLP incident that would otherwise be blocked as a result of the DLP incident; identifying a collection of DLP incidents matching the second signature; identifying a root DLP incident in the collection of DLP incidents; and grouping the collection of DLP incidents relative to the root DLP incident.