When does the lookup plug-in run to populate custom attributes?

Products

• Data Loss Prevention Enforce

Issue/Introduction

When are lookup plug-ins or scripts run to populate custom attributes for an incident? 

Resolution

When an incident is received on the Enforce server it is put into the database.  Then the lookup plug-ins and/or scripts are run to populate custom attributes in the database.

Custom attributes can also be re-populated at any time by clicking on the Lookup option in the Attribute section of the Incident Snapshot screen. This action replaces the existing values that are stored in the custom attribute fields with the values returned by the new run of the lookup plug-ins or scripts. (Note that if the new lookup returns null or empty values for any custom attribute fields, those empty values overwrite the existing values.)

Additional Information

More information about Incident Persister stages can be found in the below article Incident Persister stages overview (broadcom.com).