You are seeing multiple incidents from applications monitored by CASB and DLP
Article ID: 228793
Updated On:
Products
Issue/Introduction
You are seeing multiple incidents or violations being created everyday by users whose file uploads are monitored by CASB and DLP.
Because of this, you are running out of storage for the Oracle Database which is part of your Symantec Enforce Server DLP solution.
Environment
Release : Any DLP version
Component : CASB CloudSOC
Data Loss Prevention Cloud Detection Service for REST
Cause
This is likely due to circumstances where a 3rd party tool is reattempting uploads of files either blocked by the application, or simply reuploading via "autosave" actions.
Resolution
This is neither a CASB nor DLP issue per se, but a fact of many applications and the way APIs work in relation to file uploads.
This is not resolvable by Broadcom.
Additional Information
(Final comment from CASB Engineering): "This is neither a DLP issue nor CASB Gateway issue. It is Evernote feature. When an upload is failed, Evernote retries 5 times and hence you can see multiple events. This can be solved only if Evernote changes their implementation."
Feedback
