What is the LOB_TABLESPACE used for in Symantec Data Loss Prevention (DLP)?

What can I expect the size of the LOB_TABLESPACE to do in production?

The LOB_TABLESPACE is used to hold Large Objects that are saved for incidents.  These "Large Objects" include email messages and their attachments, as well as files that created incidents from discovery scans.  The objects are retained until the incident is deleted.  The object space is then reclaimed by Oracle and reused.

As you run in production, the LOB_TABLESPACE will grow.  If you start deleting incidents the growth rate may slow down or stop.  Be aware that Oracle does not return disk space once it has allocated it so the tablespace will never shrink of its own accord. Oracle maintains an "undo" tablespace that acts as something of a "control-z" or undo function that is typically encountered in many productivity applications. While this undo segment is made to accommodate most data types, LOBs greater than 4k need to be dealt with in a different manner. LOB columns will store information that takes up 4k or less within the table that contains the columns, which is to say, in-line.  Data that exceeds 4k get stored in LOB segments outside of the tables.  This is known as storing out-of-line.

The data that goes into a LOB column can be of any size making them unpredictable.  As such, conventional undo segments can't be used.  To provide undo functionality to LOB segments, Oracle will process a record deletion of LOB data by marking the segment as deleted, but not ACTUALLY releasing the segment for reuse until three hours later.  If not explicitly specified, the default value is determined by the initialization parameter "undo_retention", which is 10800 seconds (3 hours) out of the box.  If during three hours post deletion the need arises to back out changes involving deleted LOBs, the data is available.