Incidents generated with incorrect severity.

Products

• Data Loss Prevention Core Package

Issue/Introduction

A policy is designed to have a staggered severity level based on policy matches. Incidents well under the high severity match count threshold are still being generating with a high severity, or resulting in the default severity if it is set to a level other than 'high'.

Cause

On rare occasions a DLP policy can lose its default severity conditions. 
This is impossible to view in the policy details screen, as 'severity' is built into the policy UI so it is always present when observed in policy details. 
You may see this as a server event in the form of "Event Code 1803 Policy has no associated severity"
You may see this in DLP agent logs as "Received incident w/o severity. Setting to High. Incident ID: N/A. Policy ID: 3"

Resolution

If the problematic policy is identifiable such as in the aforementioned agent log entry, simply open that policy and click 'save'
The following SQL query will identify any policies with a missing default severity. 

SELECT policygroupid,p.name policy,p.policyid,version,activestatus,isdeleted,rootconditionid,
cg.name,cg.type,cg.conditiongrouptype,
rcc.conditionid as topconditionsid,c.name as contidion, c.type,ccc.compoundconditionid,c.conditionid
FROM policy p 
JOIN compoundconditioncondition rcc ON p.rootconditionid=rcc.compoundconditionid
JOIN conditiongroup cg ON cg.conditionid=rcc.conditionid
JOIN orcondition oc ON oc.conditiongroupid=rcc.conditionid
LEFT JOIN compoundconditioncondition ccc on ccc.compoundconditionid=oc.orconditionid
JOIN conditionview c ON c.conditionid=NVL(ccc.conditionid,oc.orconditionid)
LEFT JOIN commandinfo cid on cid.commandname='set-severity' 
   AND cid.metadata='conditionID='||oc.orconditionid||CHR(38)||'policyID='||p.policyid 
   AND dbms_lob.instr(TO_CLOB(cid.data),'incident.severity.is.default',1,1)>0
   AND dbms_lob.instr(TO_CLOB(cid.data),'<value>'||c.conditionid||'</value>',dbms_lob.instr(TO_CLOB(cid.data),'incident.condition.ids',1,1),1)>0
WHERE p.isdeleted=0 AND cid.commandinfoid IS NULL 
ORDER BY p.policyid,oc.orconditionid,c.conditionid,cid.commandinfoid,cid.commandinfoid;

If any policies are identified by this query, open those policies and click 'save'

 

Additional Information

https://knowledge.broadcom.com/external/article/160638/event-code-1803-policy-has-no-associated.html