Can Endpoint Prevent capture destination email addresses in an incident?

Hello-

I have a customer request that while I spin up a lab to test this I figured I'd throw this concept out for discussion in parallell.

With 12.x DLP Endpoint Prevent, I can create a policy that alerts on certain file types that are being attached to webmail (i.e. Google Mail). While the event is created in the console, is there a way to capture the destination email address from the web mail client or force a screen capture to attach to the incident?

Certainly this can be done through Network Prevent for Email however, given their infrastrcuture it's not an option on the table unless they radically overhaul email and pull it all back in. I'm not sure that Network Prevent for Web could handle the level of granularity their looking for. Thoughts?

Thanks

Eric