Duplicate incidents are being created when using Network Monitor and Email Prevent

book

Article ID: 184688

calendar_today

Updated On:

Products

Data Loss Prevention Network Monitor

Cause

This is caused when Network Monitor is setup to monitor SMTP traffic. If it is, this is normal behavior, as the Network Monitor detection server will capture the same traffic as the Email Prevent detection server, and each of these servers will generate their own incidents.

Environment

Email Prevent and Network Monitor are both setup, with Network Monitor setup to monitor various protocols

Resolution

Disable SMTP monitoring in Network Monitor. This can be done by taking the following steps:

  1. Go to System > Servers and Detectors > Overview
  2. Click on the Network Monitor server
  3. Click on the "Configure" button at the top
  4. Click on the "Packet Capture" tab
  5. In the list of which protocols to monitor, uncheck SMTP
  6. Click the "Save" button, then click "Done"
  7. Recycle the services on the Network Monitor server (this can be done by clicking on the Network Monitor server from the main server overview page and then clicking the "recycle" link next to the "Status" which will stop & restart all of the services on the server in their correct order)