Cloud Prevent for O365 Email Incident Reconciliation slows processing of messages

Products

• Data Loss Prevention Enforce

Issue/Introduction

The IncidentPersister0.log shows Incident Reconciliation is taking 5 minutes to process an email incident.

Cause

Incident Reconciliation is designed to manage duplicate copies of emails, thus creating duplicate incidents.  For example, a user sends an email through O365 Exchange to multiple recipients, cc's and bcc's.  Incident reconciliation "reconciles" these  to a single incident, avoiding multiple incidents for the same email.

Resolution

It is not recommended to reduce the 5-minute timeout, as this could shorten the amount of time necessary to reconcile multiple incidents into one, thus having more than one incident for the same email.