Incidents are not being generated as expected and a large number of warnings are in the filereader log

Products

• Data Loss Prevention Enforce

Issue/Introduction

Incidents may not be generated as expected, or not at all.  Reviewing the logs will also show a large amount of errors in the filereader log.

Jan 21, 2016 11:06:00 AM com.vontu.detection.DetectionChain processMessage

WARNING: Error processing message [3B933232-599B-4379-924D-0D7673797FD5]

com.vontu.util.config.ConfigurationException: No suitable constructor was found for validator: null

        at com.vontu.detection.dataidentifier.PatternValidatorFactory.loadValidator(PatternValidatorFactory.java:93)

        at com.vontu.detection.dataidentifier.PatternValidatorFactory.loadGlobalValidator(PatternValidatorFactory.java:34)

        at com.vontu.detection.dataidentifier.api.DataIdentifierValidatorBuilder.getGlobalValidator(DataIdentifierValidatorBuilder.java:86)

        at com.vontu.detection.dataidentifier.api.DataIdentifierValidatorBuilder.build(DataIdentifierValidatorBuilder.java:37)

        at com.vontu.detection.dataidentifier.api.DataIdentifierBuilder.getValidators(DataIdentifierBuilder.java:69)

        at com.vontu.detection.dataidentifier.api.DataIdentifierBuilder.build(DataIdentifierBuilder.java:55)

        at com.vontu.detection.policy.engines.dataidentifier.DataIdentifierService.lookup(DataIdentifierService.java:37)

        at com.vontu.detection.policy.engines.dataidentifier.DataIdentifierCompiledCondition.execute(DataIdentifierCompiledCondition.java:121)

        at com.vontu.detection.policy.engines.dataidentifier.DataIdentifierCompiledCondition.evaluate(DataIdentifierCompiledCondition.java:97)

        at com.vontu.detection.policy.engines.dataidentifier.DataIdentifierCompiledCondition.evaluate(DataIdentifierCompiledCondition.java:74)

        at com.vontu.detection.execution.HephaestusExecutor.execute(HephaestusExecutor.java:254)

        at com.vontu.detection.execution.HephaestusExecutor.execute(HephaestusExecutor.java:221)

        at com.vontu.detection.execution.HephaestusExecutor.execute(HephaestusExecutor.java:116)

        at com.vontu.detection.execution.HephaestusExecutor.execute(HephaestusExecutor.java:82)

        at com.vontu.detection.DetectionChain.processMessage(DetectionChain.java:102)

        at com.vontu.messaging.chain.MessageChain.processMessage(MessageChain.java:170)

        at com.vontu.messaging.chain.MessageChain.run(MessageChain.java:96)

        at java.lang.Thread.run(Thread.java:745)

Cause

Reviewing policy settings may reveal that under 'Optional Validators' one of the options maybe be selected, but no information has been put into the content box.

Resolution

Remove the checkbox if the Optional Validator is not being used, or enter the appropriate value into the contect box for the validator being used.