Cloud Detection Server no longer replicating incidents

Products

• Data Loss Prevention Cloud Detection Service

Issue/Introduction

• You notice that your Enforce server is no longer receiving incidents from your cloud detection server although it has been successfully enrolled and operational for some time
• The CDS may show connected or disconnected state in the Enforce console
• Restarting the Detection Server Controller service on the Enforce server does not resolve the issue, although the connection status may now show connected if it did not before
• You have verified that you are able to access the appropriate gateway from the Enforce server, and that no proxy configurations are suppressing the connection - see resolution steps in this article for guidance
• You have verified that the Enforce DB has sufficient capacity to receive incidents and is connecting normally
• You have adequate free disk space on the Enforce server drives

Environment

Release : 15.x

Component : Cloud Detection Server

Cause

In rare cases, a corrupted incident may be preventing replication of the incidents to the Enforce.

Resolution

Please contact Broadcom support to raise a case.

Provide the Detection Server ID in the case. (View this by clicking on the details of the problematic CDS in the System | Servers and Detectors Overview page in the Enforce console)