CASB detector incident queue taking a long time to process

Products

• CASB Security Advanced
• CASB Security Premium
• CASB Security Standard
• CASB Securlet SAAS With DLP-CDS

Issue/Introduction

The on-prem Enforce server encountered a situation where new incidents could not be written to the database. After bringing the database and Enforce server back up, queued CASB incidents are slowly being processed.

Resolution

There is no CloudSOC involvement when Enforce is syncing with CDS for queue incidents. The backlogged incidens should appear in Enforce. However, unlike CloudSOC, there can be a maximum number of backlogged incidents, as a result, it is necessary to keep Enforce connected to the CDS to receive all queue incidents.