DLP incidents skipped during staging and never pulled into ICA

Products

• Information Centric Analytics

Issue/Introduction

Looking at the sequence of incident IDs pulled into Information Centric Analytics (ICA) from Symantec Data Loss Prevention (DLP), some IDs appear to be skipped.

For example, of the ID sequence {10000, 10001, 10002, 10003, 10004, 10005}, only this subset appears in ICA: {10000, 10001, 10003}. This remains true after multiple staging and processing job runs. This is also true even when all incidents are created in response to message violations of the same policy, and that policy is enabled in ICA.

Environment

Release : 6.x

Component : Symantec Data Loss Prevention Integration Pack

Resolution

Contact Broadcom support for assistance.