Incidents based on Securlet policy have delay more than SLA 6h

Products

• Data Loss Prevention Cloud Detection Service for REST
• Data Loss Prevention
• CASB Security Advanced IAAS

Issue/Introduction

Incidents based on Securlet-based policy have delay more than SLA 6h

Environment

Component: Data Loss Prevention, CASB

Resolution

There can be different root causes to this issue, it will be helpful to gather some information to help support investigating this issue. For instance you can share the following:

• Check if the Securlet's connection status in the Monitoring Dashboard
• Check DLP Enforce detector queue to make sure it is not queued up.
• Look for the file activities in Investigate, including files' resource id, the last known activity. 

Additional Information

You may find the below articles helpfull too:

Article ID: 184289 Service level agreement (SLA) on CloudSOC (CASB) Securlet response times

Article ID: 175089 Securlet not generating incidents from DLP Enforce policy