Prevention policy failed to apply with sigflag errors

Products

• Critical System Protection
• Data Center Security Server Advanced

Issue/Introduction

While testing a prevention policy on Symantec Data Center Security (SDCS) and using signature flags the policy failed to apply. The policy never translates fully.

Policy Translation Failed: Driver failed to load new policy: Error adding sigflags.

Cause

This issue caused by the signature flag in a custom rule is not correctly applied.  Signature Flags need to be selected by the drop down menu or they will not properly function.  Each signature listed is mapped to the specific identifier for that component.

Resolution

Review the last rules configured with signature flags and check the field to ensure it is selected from the drop down menu and there are no extra spaces or characters manually entered into that field.

Here is an example of how it should look when properly selected.

Save the policy after confirming that the signature flags are all correctly selected.

Reapply the policy and test to ensure the policy fully applies.  

 

If you continue to have issues or cannot identify the rule that is causing the issue please open a support case with current agent logs.