Error: "too many incidents selected for a response rule invocation the limit is set to 100."

Products

• Data Loss Prevention Enforce

Issue/Introduction

When apply a smart response rule action to a large set of incidents the error "too many incidents selected for a response rule invocation the limit is set to 100" occurs

Environment

Release : 15.7 / 15.8 / 16.0

Component : Enforce

Cause

This is based off of a configuration value.

Resolution

As per the documentation below you can increase the incident limit by updating the Plugins.properties file.

Adding a Server FlexResponse plug-in to the plug-ins properties file - 15.7 / 15.8 / 16.0

The Plugins.properties file is located at:
Windows:

<drive>:\Program Files\Symantec\DataLossPrevention\EnforceServer\<version>\Protect\config

Linux:

/opt/Symantec/DataLossPrevention/EnforceServer/<version>/Protect/config

Edit the file and add or adjust the following setting to the desired value:

com.vontu.enforce.incidentresponseaction.IncidentResponseActionInvocationService.maximum-incident-batch-size = 1000

Max value is 1000.

After saving the Plugins.properties file, restart the SymantecDLPManager service.