DLP Application Detection showing sync failure status in v15

Products

• Data Loss Prevention Enforce
• Data Loss Prevention Cloud Detection Service

Issue/Introduction

After one or more entries for Application Detection has been configured in the Enforce console, the sync status in the list of configured applications shows "Sync Failure"

Sync Failure

Cause

This is different from the issue described in related article TECH248993, where the sync status is stuck in "Sync Pending".

In this case, the Cloud Detection Server is configured correctly, but there is likely some issue on the Elastica CloudSOC which is preventing successful sync with DLP.

Environment

DLP version 15 or above, with a Cloud Detection Server enrolled, connecting to the Elastica CASB CloudSOC.

Resolution

Login to your Elastica CASB CloudSOC, and look for the "gear" icon in the upper right of the screen:

From the new Settings column on the left, choose "SymantecDLP", and the registered Cloud Detector will appear.

There are 4 options under the "Actions" section of that configuration. The 3rd option is regarding the "Activation" of the appliance, as is shown in this screenshot from the "Provisioning Symantec DLP Cloud Detection Service in CloudSOC" documentation:

1. Click once to De-Activate the appliance, then save the configuration.
2. Click again to Activate the appliance, then save the configuration.

As per the column to the left, the "Status" of the DLP Appliance should be green after this is performed (note - it may have shown as green previously, but the steps above should still be taken).

Again, as per the Elastica CASB documentation:

Important - it is not necessary to remove the DLP Appliance (first option under "Actions", given by an "X" icon). If that step is taken by mistake, you will need to contact Technical Support, to have the DLP Cloud Operations and Elastica CASB teams reset the DLP appliance and Elastica CASB hosted systems before you can re-register it successfully.