ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

Subject incorrect in DLP Enforce Incident for integrated DLP + CASB Securlets

book

Article ID: 227541

calendar_today

Updated On:

Products

CASB Securlet SAAS CASB Securlet SAAS With DLP-CDS

Issue/Introduction

CloudSOC Securlet (Gsuite-Gmail & Office365-Outlook) integrated with DLP Enforce

The 'Subject' contains incorrect information (unrelated subject) in DLP Enforce > Incidents > Incident view per below. The same event 'Policy violation' in CloudSOC shows the correct subject information.

 

screen print 1. Shows the Subject information is correct in Incident List View in DLP.
screen print 2. Shows Subject information incorrect in the Incident Details (upon opening the incident).

 

Cause

CASB sends incorrect values for this field in datastream to DLP CDS. 

Environment

Integrated CloudSOC Securlets & DLP CDS

Engineering confirmed issue affected both Office 365/Outlook & GSuite/Gmail

Resolution

CASB release 3.139 resolved this issue and subsequent testing confirmed the correct value in DLP Enforce per below:

 

Attachments

Powered by Wolken Software