ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

Symantec DLP writeback errors

book

Article ID: 212777

calendar_today

Updated On:

Products

Information Centric Analytics

Issue/Introduction

The following error is returned when performing incident remediation in Information Centric Analytics (ICA):

_IncidentUpdate exception: Processing of the HTTP request resulted in an exception. Please see the HTTP response returned by the 'Response' property of this exception for details.

The ICA ActivityLog table and RiskFabric web server logs show the following:

Execution Timeout Expired. The timeout period elapsed prior to completion of the operation or the server is not responding.
_IncidentUpdate exception: Processing of the HTTP request resulted in an exception. Please see the HTTP response returned by the 'Response' property of this exception for details.
DLPIncidentRemediation: Thread was being aborted.

The Symantec DLP webservices_access and webservices_soap logs show successful authentication attempts via the API.

Cause

DLP incident remediation in an ICA installation with writeback enabled first initiates a lookup of the last action date and time in DLP to determine the databases' time difference. This is handled by the stored procedure spLDW_UpdateSymantecDLPTimeDifferenceForLinkedServer. In certain large environments, the performance of this procedure's query is slow and eventually times-out, causing the writeback call to fail.

Environment

Release : 6.5.x

Component : Symantec DLP Integration

Resolution

This will be addressed in an upcoming release of ICA.

For assistance, please contact Broadcom support.