Incorrect Symantec DLP Incident URL

Products

• Information Centric Analytics

Issue/Introduction

When viewing a DIM event in the Information Centric Analytics (ICA) portal, a user clicks on the View In DLP button which returns a 404 error, indicating a bad URL.

Is there a way to edit the incident URL used by ICA for the data source connection?

Environment

Release : 6.6

Resolution

Beginning with version 6.6, the incident URL is automatically set in the DetailXml column of the LinkedServers table for the data source connection's linked server entry. If this URL is incorrect for any reason, it can be corrected manually by following this procedure:

1. Open SQL Server Management Studio (SSMS)
2. In a new query editor window, execute the following query:

   SELECT LinkedServerID, LinkedServerName FROM RiskFabric.dbo.LinkedServers;

3. Note the LinkedServerID of the linked server in question
4. In a new query editor window, execute the following query:

   SELECT LinkedServerName, CAST(DetailXml AS xml) AS "DetailXml" FROM RiskFabric.dbo.LinkedServers WHERE LinkedServerID = <LinkedServerID from step 2>;

5. Click on the hyperlinked DetailXml output for the linked server in question
   
   A new query editor window containing the DetailXml content opens
   
   
6. Locate and edit the IncidentUrl string
7. In a new query editor window, execute the following statement, replacing <DetailXml> with the entire DetailXml content from steps 4 and 5:

   UPDATE RiskFabric.dbo.LinkedServers
   SET    DetailXml = N'<DetailXml>'
   WHERE  LinkedServerID = <LinkedServerID from step 2>;