search cancel

Rest Action Failed for external DLP incidents with multiple responses rules in the policy

book

Article ID: 244066

calendar_today

Updated On:

Products

CASB Gateway

Issue/Introduction

DLP incident reports "REST action failed" icon when a policy contains more than one response rule.

In one documented test case, there was both a Quarantine response as well as a break-links response. 

Resolution

DLP does not support external DLP policies containing more than one response rule.  Engineering is looking into enhancing  CASB and DLP to handle similar scenario's.  Currently, there is not a mechanism to control which response is first and what happens if the second response rule is no longer valid.

The quarantine response scenario is not currently supported with other responses. The quarantined file will not longer have a valid shared link.