Incident attributes fail to load

Products

• Data Loss Prevention

Issue/Introduction

After configuring the custom CSV lookup plug-in, incident attributes fail to load.
The following error is observed in the localhost.log
"incident attributes contains null keys, hence there is no key to query the database"

Cause

DLP could not find any usable value for the key  due to which the lookup failed.“Email” was mapping to null, so we changed our mapping to use the system variable “sender-email”

Resolution

To resolve the issue, we ensured that the incident had a valid value for the key field by mapping the custom CSV column Email to both:

• The custom attribute Email

• The internal system attribute sender-email

This allowed DLP to successfully perform the lookup using the value from the Email column.

Sample working configuration: 

attr.First\ Name=First\ Name
attr.Last\ Name=Last\ Name
attr.Email=Email
attr.sender-email=Email
attr.OU=OU
keys=Email