Performing an incident action based on a filter may result in that action being applied to more than the displayed incidents


Article ID: 159805


Updated On:


Data Loss Prevention Enforce


Executing one of the "Incident Actions" a dialog will show the current number of incidents to be processed.  A green banner  shows the actual number of incidents processed.  Why is the actual number larger than the current number?


After you "okay" the current number of incidents to be processed, incident filtering and selection actions are rerun.  This will cause any new incidents in the database to be selected and processed.