Users are receiving MIP label recommendation popups when saving files, but no corresponding incidents are being generated

Products

• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention
• Data Loss Prevention Enterprise Suite

Issue/Introduction

When a policy with a 'Recommend the MIP label' response rule is triggered by save to local drive, the MIP Label recommendation popup appears as expected. However, there is no corresponding incident generated for this save event.

Environment

16.0+

Cause

Incidents are only generated when the agent configuration is set to monitor the specific channel where file save activity occurs. Consequently, if Local Drive monitoring is disabled, no incident will be recorded for those actions.

Resolution

Enabling Local Drive monitoring will ensure that incidents are generated for local drive save.