CASB Enforce Managed DLP 100% Errors in Submission - DLP Enforce not showing new messages

[Rigo]

Team

We have opened a case from more than month ago because the CASB Console is not sending incidents to an On-premise DLP Enforce, so far the case still opened with no results.

CASB shows a green mark for the Enforce Managed DLP but all the messages submitted by two different Securlets ends on error in submission.

The request limits are the default (30 MB and  4 minutes) .

Do you have any recommendation that we can use for troubleshooting or at least guide to the Broadcom Support Engineer to find the answer??

[Stephen Heider]

Hi Rodrigo.

In some cases, this means the DLP Appliance needs to be re-activated.

From the same view where you can see the Errors in Submission (edit option), choose "De-activate" from the drop down "Actions" menu.
Do not choose "remove" as you won't be able to re-add it without Support assistance.

After De-activation, then choose to "Activate" afterward, and see if that helps.
You might also try the following in Enforce, after the above steps:

1. Recycle the DetectionServerController service (either from the Enforce UI or via the OS)
2. Go to your Manage > Application Detection screen and do the following:
   • Ensure the policies you are testing are in the assigned Policy Groups for your respective Securlets
   • Then perform a "Sync to CloudSOC" operation.
3. After the above, if the "errors in submission" don't go away (or incidents don't occur), keep working with Support!

Thanks,
Stephen


------------------------------
Global Support Lead, DLP
Broadcom, Symantec Enterprise Division
------------------------------