Rest Action policy with multiple responses rules failed for external DLP incidents

Products

• CASB Gateway
• CASB Gateway Advanced
• CASB Security Premium
• CASB Security Standard
• CASB Security Advanced

Issue/Introduction

DLP incident reports "REST action failed" icon when a policy contains more than one response rule.

In one documented test case, there were both a Quarantine response as well as a break-links response. 

Cause

DLP does not support external DLP policies containing more than one response rule.  

Resolution

Engineering is looking into enhancing CASB and DLP to handle similar scenario's. Currently, there isn't a mechanism to control which response is first and what happens when the second response rule is no longer valid.

The quarantine response scenario is not currently supported with other responses. The quarantined file will not longer have a valid shared link.