Detection stops working in DLP 16.0 Agents if a Contextual Attribute rule is included in policyset

Products

• Data Loss Prevention

Issue/Introduction

DLP 16.0 has introduced a new policy evaluation engine which is using memory in a more efficient way during evaluation and has a higher performance than the legacy engine. This is described here:

https://techdocs.broadcom.com/us/en/symantec-security-software/information-security/data-loss-prevention/16-0/About-What-s-New-in-DLP-16-0/Detection-features-in-Data-Loss-Prevention-16-0.html#concept.dita_aab8c3ed-e816-4f35-b129-fc96763c950a_section_2

However, it has been seen that if a policy rule which cannot be processed by an Agent - for example, a Contextual Attribute rule - is included in a policy which is assigned to an Endpoint Prevent detection server, it will be included in the policy tree sent to the Agents. The detection will then be completely broken on the 16.0 Agents for all policies. 

Below errors will be seen in the Agent log upon every detection request:

Sending error result: ConditionID[XX] is in the tree but not in the compiled condition store - C:\VontuDev\workDir\Agent\DetectionCore\Executor.cpp:142

[req#XXX FAILURE ConditionID[XX] is in the tree but not in the compiled condition store - C:\VontuDev\workDir\Agent\DetectionCore\Executor.cpp:142 no incidents]

Exception occured while performing detection. Message from detection : ConditionID[XX] is in the tree but not in the compiled condition store - C:\VontuDev\workDir\Agent\DetectionCore\Executor.cpp:142 | C:\VontuDev\workDir\Agent\ApplicationConnector\DLPFileOperationMonitorServer.cpp(595)

Cause

This is caused by the Endpoint Prevent detection server not filtering out the non-Endpoint rules from the policy tree which is built and sent to the 16.0 Agents. 

At the same time, any pre-16.0 Agents in the same environment and with the same policyset will continue to see working detection because the legacy engine is used to build the policy matrix for the older Agents. 

Resolution

This is a defect which is fixed in DLP 16.0 MP1.