Incident status does not show block icon even though a block occured

Products

• Data Loss Prevention Core Package

Issue/Introduction

Incident status does not show block icon even though a block occured.

Resolution

This is usually working as designed, some other rule with the same priority as block ran after the block rule which updates the incident status to show the other rule icon. This can happen with flex response rules running after the block occurs. 

Note that flex response rules often run on the Enforce and will always run after the block occurs on the detection server.