Response rule cannot be deleted because it is used by at least one policy - but no policies are active
Article ID: 184501
Updated On:
Products
Issue/Introduction
You are trying to delete a response rule in the Enforce console but received the red error message, "Response rule cannot be deleted because it is used by at least one policy".
However no active policies are listed in the response rule editor window, so you do not know which policies to remove from the response rule in order to proceed.
Environment
DLP 14.x, 15.x
Cause
Only active policies are listed in the response rule editor window. If the response rule is still associated with a policy that has since been deactivated it will not show up, but will still prevent the response rule deletion.
Resolution
To work around this you must:
- Enable all policies
- Open the response rule editor and note the names of the active policies
- Edit each policy to remove its association to the response rule you wish to delete
- Disable the policies you previously enabled
Alternatively, if you are familiar with making SQLPlus connections to the DLP DB, you can run the script below, as the protect user, which will return the names of all the non-active policies that are associated with a given response rule name. Note you will still need to remove the response rule association in the policies yourself.
Modify the yellow highlighted parameters (output file name and response rule name) for your needs. :
SET PAGESIZE 40000
SET FEEDBACK OFF
SET MARKUP HTML ON
SET NUM 24
SPOOL c:\temp\sqlplus_output.html
---- Execute your query
-- CHANGE HIGHLIGHTED TO REQUIRED RESPONSE RULE NAME
SELECT POLICY.name as "Policy", RESPONSERULE.name "ResponseRule name" FROM POLICY
inner join POLICYRESPONSERULE ON POLICY.PolicyID = POLICYRESPONSERULE.PolicyID
Inner join RESPONSERULE on POLICYRESPONSERULE.RESPONSERULEID = RESPONSERULE.RESPONSERULEID
WHERE policy.activestatus <> 1
AND responserule.name like '<Your Response Rule Name Here>';
SPOOL OFF
SET MARKUP HTML OFF
SPOOL OFF
Feedback
