Parameters being passed to a custom script, as defined by Plugins.properties, are presenting the below error in the IncidentPersister log.
"Warning: The attributes below were stripped from the script arg list as they contain characters that are not permitted."
The error indicates that the incident attributes include a non-permitted character, as indicated by TECH219114.
Scripted lookups need to be configured to avoid sending non-permitted characters.
This can occur if multiple lookup chains are in place. Verify the list of parameters associated with the lookup plug-ins, which are defined in the properties associated with the plugins in the Enforce Server console.
The base list of defaults includes: attachment, incident, message, policy, recipient, sender, server, status; but each of these properties contains larger sub-sets of attributes which can be individually selected. Determine which attributes are essential for lookups, and delimit those that are causing the script to err.
For instance, the "sender" parameter includes a subset with the following attributes:
If the "endpoint-user-name" is returning a disallowed character (such as "WinNT://domain/username"), then one can instead set the following parameters specifically:
More information is also available in the chapter on "Implementing lookup plug-ins" in the DLP Admin Guide.