Upgrading ICA to 6.6 retains SOAP API in the DLP connection string

Products

• Information Centric Analytics

Issue/Introduction

When upgrading a deployment of Information Centric Analytics (ICA) to version 6.6 and ICA has an existing Symantec DLP 16.0 integration, the DLP connection string is not updated to use the REST API. This results in failures when attempting to perform any API-based actions (e.g., writeback), and these failures are recorded in the RiskFabric Server log, similar to the following:

[36:ERROR] LogUtils.LogActivity() An exception was thrown by _UpdateIncidents while processing remediation set DIMRemediationSetID=32 for DLP Writeback on LinkedServer 3. Abort all processing for all LinkedServers.
System.ServiceModel.FaultException`1[BayDynamics.SymantecDLP.DLPIncidentService.BasicFault]: Uncaught exception see DLP logs for more details. (Fault Detail is equal to BayDynamics.SymantecDLP.DLPIncidentService.BasicFault).
[36:ERROR] LogUtils.LogActivity() An exception was thrown while processed remediation set for LinkedServer 3. Continue processing next Linked Server.
System.NullReferenceException: Object reference not set to an instance of an object.
   at RiskFabric.Web.Library.Utils.LogUtils.GetHostAndIP(String& ip, String& host)
   at RiskFabric.Web.Library.Utils.LogUtils.LogActivity(String sLogType, String sLogDetail, Boolean bIgnoreSecurityContext, Exception ex, Nullable`1 userId)
   at RiskFabric.Web.Library.DIM.DLP.DlpIncidentRemediation.DLPIncidentRemediationProcess()

Cause

DLP's SOAP API is deprecated with version 16.0 and the ICA installer defaults to setting the API type to SOAP for DLP integrations.

Resolution

To resolve this issue, follow this procedure:

1. Open the ICA console
2. Navigate to Admin > Integration > Data Sources > Choose Data Source | Symantec Data Loss Prevention
3. Edit the DLP data source connection
4. On the Database Settings page, enter the DLP database password under Symantec Data Loss Prevention Credentials and click the Next button
5. On the API Settings page, change the API Type to REST
6. Click the Next button to navigate to the end of the Edit Connection Settings wizard
7. Click the Finish button