search cancel

Rest Action Failed for external DLP incidents with multiple responses rules in the policy


Article ID: 244066


Updated On:


CASB Gateway


DLP incident reports "REST action failed" icon when a policy contains more than one response rule.

In one documented test case, there was both a Quarantine response as well as a break-links response. 


DLP does not support external DLP policies containing more than one response rule.  Engineering is looking into enhancing  CASB and DLP to handle similar scenario's.  Currently, there is not a mechanism to control which response is first and what happens if the second response rule is no longer valid.

The quarantine response scenario is not currently supported with other responses. The quarantined file will not longer have a valid shared link.