In DLP 15.x need to stop smart response rule job created by a user incorrectly updating incident records

Products

• Data Loss Prevention Enterprise Suite
• Data Loss Prevention Core Package

Issue/Introduction

If you need to stop a smart response rule job in DLP that was created incorrectly by a user and is incorrectly updating incident records.

Cause

User Error

Resolution

1) In the Enforce console delete the smart response rule that is incorrectly updating incident records.

2) Log all users out of Enforce Console

3) Restart Enforce Server Services in the following recommended order

Stopping services in DLP
            1. SymantecDLPDetectionServerController
            2. SymantecDLPIncidentPersister
            3. SymantecDLPManager
            4. SymantecDLPNotifier

Starting services in DLP
            1. SymantecDLPNotifier
            2. SymantecDLPManager
            3. SymantecDLPIncidentPersister
            4. SymantecDLPDetectionServerController

4) Log back into Enforce Console to confirm that the deleted smart response rule has stopped running and updating records and if required recreate a new version of the smart response rule.