The DLP LDAP Attribute lookup plugin does not work automatically, but works when executed manually

Products

• Data Loss Prevention
• Data Loss Prevention Enforce

Issue/Introduction

The LDAP attribute lookup incident plug-in no longer automatically populates the data after upgrading the Symantec Data Loss Prevention Enforce server to 15.8 MP1  and later.

When an incident comes in, all attributes are blank.

Administrator

Attribute Lookup Completed Assigned To= Username= Mgr Last Name= Employee Code= Name= Mgr First Name= Sender Email= Title= Mgr Title= Region= Department= Mgr Email= Group= Mgr Phone= L1-DLP Analyst= Mgr Department= City= Review Status= Mgr Division= State= Tuning Opportunity= Country= Mgr Country= Location= Email= Mobile= Phone= BU= Domain= Category= VIP=

 

If you manually press the "Lookup" button the attributes are populated correctly.

 

xxx

Attribute Lookup Completed Assigned To= Username=xxxx_a Mgr Last Name=xxx Employee Code= Name=xxx, xxx Mgr First Name=xxxx Sender Email= Title=Expert xxx Mgr Title=xxx Region= Department=xxx Mgr [email protected] Group= Mgr Phone=+xxx L1-DLP Analyst= Mgr Department=xxx Operations City= Review Status= Mgr Division=xxx  State= Tuning Opportunity= Country=xx Mgr Country=xx Location=xxx [email protected] Mobile= Phone=+xxx BU=xxx Business Unit Domain=xxx Category=Employee VIP=

 

The plugin has a green checkmark, the directory connection is working and indexed, all user data sources have been indexed.

Environment

Release: 15.8 MP1 and Later.

Resolution

These attempts to resolve this issue failed:

• Reloading the plug-ins.
• Restarting the Enforce services.

The Enforce server had to be rebooted for the LDAP plug-in to start working automatically again.