Send Email Notification response rule is not working on the Endpoint Agent

Products

• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention

Issue/Introduction

Send Email Notification response rule is not working on the Endpoint Agent when combined with other Endpoint response rules.

Environment

Release : 15.7

Component : Endpoint Agent Prevent

Cause

The Endpoint Agent is unable to send the email notification response on its own.

The Enforce server sends the notification when the incident is received.

However, after failing the Email Notification, the Endpoint Agent moves on to the next response rule.

Since the Email Notification has already failed, the Enforce Server does not process the response rule. 

Resolution

Change the order of response rules to put the Endpoint Notification first and the Email Notification last.

After the Endpoint Agent successfully triggers the Endpoint Notification the incident is sent to the Enforce server to trigger the Email Notification successfully.