$INCIDENT_SNAPSHOT$ response rule variable points to the old incident snapshot UI URL

Products

• Data Loss Prevention Core Package
• Data Loss Prevention Plus Suite
• Data Loss Prevention Enterprise Suite
• Data Loss Prevention Enforce

Issue/Introduction

The DLP $INCIDENT_SNAPSHOT$ response rule variable points to the old UI Enforce incident snapshot page instead of the new UI page. This applies to both automated and smart response rules and any response rule type that can use the $INCIDENT_SNAPSHOT$ variable including "Log to a Syslog Server" and "Send Email Notification" etc.

The old URL has the following format:

https://enforce_server_name/ProtectManager/DarIncidentDetail.do?value(variable_1)=incident.id&value(operator_1)=incident.id_in&value(operand_1)=36

The new URL has the following format:

https://enforce_server_name/ProtectManager/enforce/ui/incident/snapshot/36?type=DISCOVER&reportId=84

 

Environment

DLP 16 RU2 - 16.1 MP1

Cause

The URL in the $INCIDENT_SNAPSHOT$ response rule variable was not updated to reflect the new incident pages.

Resolution

This issue will be fixed in DLP version 25.1.

Workaround:

Manually locate the incident by looking up the incident id in the incident list pages in the Enforce Console which will load the new UI page for the incident snapshot.