New DIM policies are ingested despite the setting Admin > Settings > General > The default setting for DIM policy enablement being deselected.
Release : 6.5.x
Component : Integrations
Policy ingestion from IW linked servers (e.g., DLP) is controlled by the global portal setting The default setting for DIM policy enablement; however, this setting can be superseded by the connection setting Enable Imported Policies at the individual IW linked server level.
User defined linked servers (e.g., Splunk) do not provide this setting, so there is no option to override the global setting for these individually. Instead, the ingestion of policies from user defined linked servers should be controlled at the query level.