Cloud Detection Server cannot connect to CASB CloudSOC, will not load EDMProfile

Products

• Data Loss Prevention Enforce
• Data Loss Prevention
• Data Loss Prevention Cloud Detection Service
• Data Loss Prevention Cloud Detection Service for ICAP
• Data Loss Prevention Cloud Detection Service for REST
• Data Loss Prevention Cloud Package
• Data Loss Prevention Cloud Service for Email

Issue/Introduction

A DLP Cloud Detection Server (CDS) is not connecting to the Elastica CloudSOC (aka CASB), despite the CDS appearing as "connected" in Enforce.

Separately, an existing CDS for Email is not able to load any User Group indexes despite the Data Profiles being sent to other on-prem detection servers.

(There are not usually any errors when a Database Profile replication fails to be sent to a CDS.)

Environment

DLP 14.6 or higher with Cloud Service for either Email or Application Detection

Cause

ALL indices for two-tier detection need to be completely error-free in order for Enforce to push any completed index up to a Cloud Detection Server.
Note that Directory Connections are also a form of Database Profile - with their filenames appearing just like EDMs in the Enforce "index" directory.

The example excerpt below shows a database profile for a Directory Connection which is successfully replicated to a DLP Detection Server.

16/07/2018 15:55:26 com.vontu.logging.LocalLogWriter write
INFO: Replication completed. Completed replication of database profile "DirectoryConnectionName" version 154 to the server DLP_Detection_Server_Name.
Files DataSource.43322.154.rdx.0, DataSource.43322.154.rdx.1, DataSource.43322.154.rdx.2, DataSource.43322.154.rdx.3, DataSource.43322.154.rdx.4, DataSource.43322.154.rdx.5, DataSource.43322.154.rdx.6, DataSource.43322.154.rdx.7, DataSource.43322.154.rdx.8, DataSource.43322.154.rdx.9, DataSource.43322.154.rdx.10, DataSource.43322.154.rdx.11 were transferred successfully.

Resolution

Cloud Detection Servers will not load indices for two-tier profiles if any of the profiles have corrupted indexes or missing files on re-indexing attempts. One corrupt index will prevent all indices from being loaded to the CDS, though this does not occur for on-prem Detection Servers.