How to identify which incident ID triggered Event 1818 for a particular message ID.

Products

• Data Loss Prevention
• Data Loss Prevention Enterprise Suite
• Data Loss Prevention Enforce
• Data Loss Prevention Endpoint Suite
• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention Endpoint Discover
• Data Loss Prevention Discover Suite
• Data Loss Prevention Data Access Governance
• Data Loss Prevention Cloud Storage
• Data Loss Prevention Cloud Service for Email
• Data Loss Prevention Cloud Service for Discovery/Connector
• Data Loss Prevention Cloud Prevent for Microsoft Office 365
• Data Loss Prevention Cloud Package
• Data Loss Prevention Cloud Detection Service for REST
• Data Loss Prevention Cloud Detection Service for ICAP
• Data Loss Prevention Cloud Detection Service
• Data Loss Prevention API Detection Virtual Appliance
• Data Loss Prevention API Detection for Developer Apps Virtual Appliance
• Data Loss Prevention for Office 365 Email and Gmail with Email Safeguard
• Data Loss Prevention Form Recognition
• Data Loss Prevention Network Discover
• Data Loss Prevention Network Email
• Data Loss Prevention Network Monitor
• Data Loss Prevention Network Monitor and Prevent for Email
• Data Loss Prevention Network Monitor and Prevent for Email and Web
• Data Loss Prevention Network Monitor and Prevent for Web
• Data Loss Prevention Network Prevent for Email
• Data Loss Prevention Network Prevent for Email Virtual Appliance
• Data Loss Prevention Network Prevent for Web Virtual Appliance
• Data Loss Prevention Network Protect
• Data Loss Prevention Network Web
• Data Loss Prevention Oracle Standard Edition 2
• Data Loss Prevention Plus Suite
• Data Loss Prevention Sensitive Image Recognition

Issue/Introduction

There are a number of  Event 1818 generated in the Enforce console Server Events that show a message ID but don't mention which incident ID it relates to. 

Resolution

The Incidents table in the database stores both the messageID and corresponding Incident ID.

Run this query against the database as the Protect user while replacing x with the messageID from the Event 1818 to determine the corresponding incident ID:

select incidentID from Incident where messageid='x';

Additional Information

Article ID: 161913 - Enforce Shows System Event Code 1818 - "Incident is oversized"