Limit the import set of DIM incidents

Products

• Information Centric Analytics

Issue/Introduction

You wish to limit the initial set of active Data In Motion (DIM) incidents imported from Symantec Data Loss Prevention (DLP) into Information Centric Analytics (ICA).

This procedure is appropriate for circumstances in which the Oracle database engine is unable to initially retrieve all active incidents in response to ICA's staging query, or when the DLP database contains old incidents you don't wish to import into ICA but you aren't yet able to attend to through incident cleanup in DLP.

NOTE: ICA employs a watermark to retrieve only those incidents that have been created since the last time the import process ran. Because of this, ICA imports only new DIM incidents during each processing run, and this procedure is generally not needed. The duration of the first import process will be the longest and is not indicative of a problem or failure. This procedure should only be used to enable the first import to complete in those environments in which performance and resource tuning have failed to resolve process completion failures.

Environment

Version : 6.x

Component : Symantec DLP Integration Pack

Resolution

Contact Broadcom support for assistance with this procedure.