Response rule cannot be deleted because it is used by at least one policy - but no policies are active

book

Article ID: 184501

calendar_today

Updated On:

Products

Data Loss Prevention Enforce

Issue/Introduction

You are trying to delete a response rule in the Enforce console but received the red error message, "Response rule cannot be deleted because it is used by at least one policy". 

However no active policies are listed in the response rule editor window, so you do not know which policies to remove from the response rule in order to proceed. 

Cause

Only active policies are listed in the response rule editor window. If the response rule is still associated with a policy that has since been deactivated it will not show up, but will still prevent the response rule deletion.

Environment

DLP 14.x, 15.x

Resolution

To work around this you must:

  1. Enable all policies
  2. Open the response rule editor and note the names of the active policies
  3. Edit each policy to remove its association to the response rule you wish to delete
  4. Disable the policies you previously enabled

Alternatively, if you are familiar with making SQLPlus connections to the DLP DB, you can run the script below which will return the names of all the non-active policies that are associated with a given response rule name. Note you will still need to remove the response rule association in the policies yourself.

Modify the yellow highlighted parameters (output file name and response rule name) for your needs. :

 

SET PAGESIZE 40000

SET FEEDBACK OFF

SET MARKUP HTML ON

SET NUM 24

SPOOL c:\temp\sqlplus_output.html

---- Execute your query

-- CHANGE HIGHLIGHTED TO REQUIRED RESPONSE RULE NAME

 

SELECT POLICY.name as "Policy", RESPONSERULE.name "ResponseRule name" FROM POLICY

inner join POLICYRESPONSERULE ON POLICY.PolicyID = POLICYRESPONSERULE.PolicyID

Inner join RESPONSERULE on POLICYRESPONSERULE.RESPONSERULEID = RESPONSERULE.RESPONSERULEID

WHERE policy.activestatus <> 1

AND responserule.name like '<Your Response Rule Name Here>';

SPOOL OFF 

SET MARKUP HTML OFF

SPOOL OFF