Data Loss Prevention Network Monitor and Prevent for Email and WebData Loss PreventionData Loss Prevention EnforceData Loss Prevention Endpoint PreventData Loss Prevention Endpoint SuiteData Loss Prevention Network Prevent for EmailData Loss Prevention Network Prevent for Web
Is it possible to strip/delete attachments from incidents?
Oracle DB is still using BasicFiles (not the SecureFiles), is it required to run the reclamation tool to free up DB space after removing attachments from the incident?
How to prevent DLP from storing incident attachments (especially in terms of taking space in DB) in Network incidents in the future?
Navigate to Incidents.
Choose the incidents for which you want to remove attachments.
After marking one or more incidents, under Incident Actions, choose Delete Incidents.
Under Delete Options, select Retain Incident, but Delete Original Message/Attachment(s)/File(s), and check Delete Attachments/Files.
DB space can be reused after removing attachments, but in case of BasicFiles it's not fully available for all types and sizes of new data coming due to BasicFiles technical nature. Information about available space is not visible when checking space allocation for tablespaces.
To fully release space after deleting incidents (or just attachments) use the reclamation tool or change DB to convert to using SecureFiles which will make reclamation automatically every time you delete data from DB.
To reduce the number of attachments stored in DB apply response rule Limit Incident Data Retention with setting to Discard Attachments and apply them (depending on the severity and other additional parameters, if needed) to policies that need the reduction of incidents with stored attachments.
Due to the fact, that this response rule (same as most of the automatic rules) is executed on the detection server - it will reduce space allocation of DB because incidents with attachments will not be added to the DB at all.
In case of BasicFiles, this solution will reduce the number of times the reclamation tool will need to be used.