How to associate conditionid with policy via SQL query
search cancel

How to associate conditionid with policy via SQL query


Article ID: 214940


Updated On:


Data Loss Prevention Enforce Data Loss Prevention Endpoint Prevent Data Loss Prevention Network Discover Data Loss Prevention Network Protect Data Loss Prevention Network Monitor and Prevent for Email Data Loss Prevention Endpoint Suite


You've noticed some detection issue, performance, false positives, false negatives, etc. The relevant logs point you in the direction of a specific condition based on that condition ID, and you need to find the name of the condition and policy it is associated with. 


Release :

Component :


When problematic conditions show up in the logs, there is no reference to the policy that condition is a part of, nor the name of the condition itself. 


You can run the following SQL query to list the Policy and condition names, as well as their associated IDs. Simply replace<list of condition ids> with a comma separated list of conditionids found to be causing issues. 

    , "PolicyName"
    , "RuleName"    
    , dr.toplevelconditionid
    , cv.conditionid
    , "ConditionName"
    , cv.type 
from policy p
join detectionrule dr
    on p.policyid = dr.policyid
join conditiondetectionrule cdr
    on dr.toplevelconditionid = cdr.toplevelconditionid
join conditionview cv
    on cdr.conditionid = cv.conditionid
where cdr.conditionid in (<list of condition ids>);