Remediation actions in Slack Securlet are happening days after the message

Products

• CASB Gateway Advanced

Issue/Introduction

In Investigate, there is an alert with a Scanned At or Recorded at date that is days or weeks after the message says the content violated the policy.

Cause

The message was originally sent and did not violate policy. But the original message was modified and violated policy. The Scanned At and Recorded At dates show the time of the modification that violated the policy.

The message section for the event shows the date of the original message.

Resolution

There is an enhancement to make it more clear in the event message that the policy was violated by a modification to the original message.