ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

Cloud Detection Server cannot connect to CASB CloudSOC, will not load EDMProfile

book

Article ID: 172163

calendar_today

Updated On:

Products

Data Loss Prevention Enforce

Issue/Introduction

A DLP Cloud Detection Server (CDS) is not connecting to the Elastica CloudSOC (aka CASB), despite the CDS appearing as "connected" in Enforce.

Separately, an existing CDS for Email is not able to load any User Group indexes despite the Data Profiles being sent to other on-prem detection servers.

(There are not usually any errors when a Database Profile replication fails to be sent to a CDS.)

Cause

ALL indices for two-tier detection need to be completely error-free in order for Enforce to push any completed index up to a Cloud Detection Server.
Note that Directory Connections are also a form of Database Profile - with their filenames appearing just like EDMs in the Enforce "index" directory.

The example excerpt below shows a database profile for a Directory Connection which is successfully replicated to a DLP Detection Server.

16/07/2018 15:55:26 com.vontu.logging.LocalLogWriter write
INFO: Replication completed. Completed replication of database profile "DirectoryConnectionName" version 154 to the server DLP_Detection_Server_Name.
Files DataSource.43322.154.rdx.0, DataSource.43322.154.rdx.1, DataSource.43322.154.rdx.2, DataSource.43322.154.rdx.3, DataSource.43322.154.rdx.4, DataSource.43322.154.rdx.5, DataSource.43322.154.rdx.6, DataSource.43322.154.rdx.7, DataSource.43322.154.rdx.8, DataSource.43322.154.rdx.9, DataSource.43322.154.rdx.10, DataSource.43322.154.rdx.11 were transferred successfully.

Environment

DLP 14.6 or higher with Cloud Service for either Email or Application Detection

Resolution

Cloud Detection Servers will not load indices for two-tier profiles if any of the profiles have corrupted indexes or missing files on re-indexing attempts. One corrupt index will prevent all indices from being loaded to the CDS, though this does not occur for on-prem Detection Servers.