DLP Cloud Policies have a Warning Alert about unresolved references
Article ID: 246918
Updated On:
Products
Issue/Introduction
Your DLP policies that were created specifically for the CASB Cloud Detection Service keep going into a warning status.
You are able to resolve the warning by editing the Policy Group, and adding a different Cloud Detector to the list of servers assigned.
If you later remove that second Detector from the Policy Group, however, the warning alert returns.
Text of alert:
"This policy has unresolved references, it may not be fully functional. Click here for details."
When clicking on the link for details it shows:
"Policy Group '<Name Of Policy Group>' is missing monitor assignments."
Environment
Release : 15.8
Component : Cloud Detection Service for REST
Cause
Situation requires 3 circumstances:
- The Policy Group is not assigned to "All Servers and Detectors".
- The Policy Group is not assigned to a specific detection server, which can be either in-cloud or on-premises.
- There is no Network Discover on-premises detection server added to the list of server managed by Enforce.
Resolution
This is actually a known defect, and intended to be fixed in a future release:
DLP-42909 = "Policy group missing monitor assignment dangling reference check not excluding polices group used by cloud Application Configurations".
This issue is cosmetic only, and should have no impact on policy assignment and detection.
It will be fixed in a future release.
Additional Information
This issue is not the same as a similar one that was resolved in DLP 15.8 MP2. For a description of that issue, please see Cloud policies have an Alert icon after upgrading to DLP 15.8 (broadcom.com).
Feedback
