Unable to create incident report filter for all DLP Incidents triggered by OCR

Products

• Data Loss Prevention Cloud Package
• Data Loss Prevention
• Data Loss Prevention Core Package

Issue/Introduction

There currently is no option to create an incident report with a filter for only OCR incidents.

Environment

Release : 15.7, 15.8, 16.0

Component : OCR

Resolution

If necessary, a query can be run on the database to view the desired incidents.

This can be done using the following query as PROTECT user:

SELECT COUNT (DISTINCT inc.INCIDENTID) FROM INCIDENT inc, CONDITIONVIOLATION cv, CONDITIONVIOLATIONLOB cvl WHERE inc.INCIDENTID = cv.INCIDENTID and cv.CONDITIONVIOLATIONID = cvl.CONDITIONVIOLATIONID and inc.ISDELETED=0 and cvl.CRACKEDCOMPONENTMARKERS like '%CrackedComponentMarkerWithImage%';

or

SELECT COUNT (*) FROM CONDITIONVIOLATIONLOB WHERE CRACKEDCOMPONENTMARKERS like '%CrackedComponentMarkerWithImage%';

It will allow you to determine how many incidents were created involving OCR server.

Additional Information

Note: These queries are limited to incidents with LOB data kept in the database itself. If LOB data is externalized, ie External storage for incident attachments, this query results in 0 incidents since the queries are pulling from the CrackedComponentMarkerWithImage field within a LOB table.