Correlations Disabled in DLP 16.1 Enforce Console.

Products

• Data Loss Prevention
• Data Loss Prevention Enforce
• Data Loss Prevention Enterprise Suite
• Data Loss Prevention Network Prevent for Email

Issue/Introduction

Since upgrading to DLP version 16.1 from 15.8 MP3 the Correlations tab in all incidents shows no correlation detail but instead the statement "Correlations Disabled" is present. 

If we modify the URL to use the legacy 15.8 GUI to the same incident the Correlations information is present. 

Cause

Any Network SMTP Incident whose message subject contains a single quote will fail to display the Incident Snapshot Correlations tab in the new angular based UI introduced in 16.0 RU2, and will also break the new Web Archive process in 16.1.

A 500 error code is reported by the correlations REST API in the Tomcat localhost access log :

127.0.0.1 - Administrator [02/May/2025:14:40:51 -0700] "GET /ProtectManager/webservices/v2/incidents/691/correlations HTTP/1.1" 500 158 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0" - 108

Resolution

[Date: 11/06/2025] - A fix is currently being targeted to be included in the upcoming DLP 25.1 release. 

Additional Information

To use the legacy 15.8 GUI to check for this issue, please change the URL change in your browser like the 15.8 example for incident number 691 below to enter and replace with your Enforce server FQDN or IP address and the incident number: 

The 16.1 URL: https://domain.example.com/ProtectManager/enforce/ui/incident/snapshot/691

The 15.8 URL: https://domain.example.com/ProtectManager/IncidentDetail.do?value(variable_1)=incident.id&value(operator_1)=incident.id_in&value(operand_1)=691