search cancel

Understanding incident dates in Data Loss Prevention


Article ID: 215084


Updated On:


Data Loss Prevention


You want to understand what the "Occurred On" and "Reported On" dates in incident snapshots mean, and how they relate to the following timestamps from the Incident table in the database:

  • MessageDate
  • DetectionDate
  • CreationDate


DLP 15.x


Occurred On / MessageDate

Network Prevent for Email (SMTP Prevent) Incidents

Occurred On is the date from the email header itself.

All Other Incident Types

The date when the violation was detected within the message that generated the incident.

Reported On / DetectionDate

Enpdoint Agent Incidents

When the DLP agent sent the incident to Aggregator service on the Endpoint Detection server (not the local time on the Endpoint Detection Server).

Detection Server Incidents (including Endpoint TTD)

When FileReader generates an incident. Detection Server incidents should generally have very similar Message and Detection timestamps. FileReader writes .idc files (incidents) to the C:\ProgramData\Symantec\DataLossPrevention\ServerPlatformCommon\<ver>\incidents directory, which is monitored by the IncidentWriter service, which in turn picks up the .idc files and ships them to the SymantecDLPDetectionServerController service on the Enforce.


When the IncidentPersister service on Enforce first persists the incident into the database (stage 1/peristence).


In an Incident Snapshot's Incident Details section, the MessageDate and DetectionDate timestamps are represented as "Occurred On" and "Reported On" as shown in the screenshots below:

In the case of Endpoint Agent incidents, the MessageDate corresponds to the persistDate field for the given Incident as found in the is.ead (IncidentStore) database, DetectionResultData table.

Additional Information

See also: Incident Persister stages overview