search cancel

When does the lookup plug-in run to populate custom attributes?


Article ID: 160560


Updated On:


Data Loss Prevention Enforce


When are lookup plug-ins or scripts run to populate custom attributes for an incident? 


When an incident is received on the Enforce server it is put into the database.  Then the lookup plug-ins and/or scripts are run to populate custom attributes in the database.

Custom attributes can also be re-populated at any time by clicking on the Lookup option in the Attribute section of the Incident Snapshot screen. This action replaces the existing values that are stored in the custom attribute fields with the values returned by the new run of the lookup plug-ins or scripts. (Note that if the new lookup returns null or empty values for any custom attribute fields, those empty values overwrite the existing values.)