Incident Persister fails to stay started after upgrading DLP Enforce to 26.1

Products

• Data Loss Prevention Core Package

Issue/Introduction

After upgrading Enforce to 26.1, Incident Persister fails to stay started.  The following error is logged in the Incident Persister log.

Message: Unexpected error starting Incident Persister.

org.springframework.context.ApplicationContextException: Failed to start bean 'incidentCommandEnvironment'

at org.springframework.context.support.DefaultLifecycleProcessor.doStart(DefaultLifecycleProcessor.java:408)

at org.springframework.context.support.DefaultLifecycleProcessor.doStart(DefaultLifecycleProcessor.java:394)

at org.springframework.context.support.DefaultLifecycleProcessor$LifecycleGroup.start(DefaultLifecycleProcessor.java:586)

at java.base/java.lang.Iterable.forEach(Unknown Source)

at org.springframework.context.support.DefaultLifecycleProcessor.startBeans(DefaultLifecycleProcessor.java:364)

at org.springframework.context.support.DefaultLifecycleProcessor.onRefresh(DefaultLifecycleProcessor.java:310)

at org.springframework.context.support.AbstractApplicationContext.finishRefresh(AbstractApplicationContext.java:1006)

at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:630)

at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:753)

at org.springframework.boot.SpringApplication.refreshContext(SpringApplication.java:439)

at org.springframework.boot.SpringApplication.run(SpringApplication.java:318)

at com.vontu.incidenthandler.IncidentPersister.start(IncidentPersister.java:143)

at com.vontu.incidenthandler.IncidentPersister.main(IncidentPersister.java:250)

at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(Unknown Source)

at java.base/java.lang.reflect.Method.invoke(Unknown Source)

at org.tanukisoftware.wrapper.WrapperSimpleApp.run(WrapperSimpleApp.java:325)

at java.base/java.lang.Thread.run(Unknown Source)

Caused by: java.lang.RuntimeException: com.vontu.command.loader.CommandRuntimeLoaderException: Error loading command instructions for command config "new-incident-commands".

at com.vontu.incidenthandler.command.IncidentCommandEnvironment.start(IncidentCommandEnvironment.java:176)

at org.springframework.context.support.DefaultLifecycleProcessor.doStart(DefaultLifecycleProcessor.java:405)

... 16 more

Caused by: com.vontu.command.loader.CommandRuntimeLoaderException: Error loading command instructions for command config "new-incident-commands".

at com.vontu.incidenthandler.command.enforce.PolicyInstructionSource.getCommandInstructions(PolicyInstructionSource.java:74)

at com.vontu.enforce.ModelCommandRuntimeLoader.getCommandInstructions(ModelCommandRuntimeLoader.java:173)

at com.vontu.command.loader.CommandRuntimeLoader.createCommandRuntime(CommandRuntimeLoader.java:128)

at com.vontu.command.loader.CommandRuntimeLoader.load(CommandRuntimeLoader.java:103)

at com.vontu.enforce.ModelCommandRuntimeLoader.load(ModelCommandRuntimeLoader.java:124)

at com.vontu.incidenthandler.command.IncidentCommandEnvironment.start(IncidentCommandEnvironment.java:155)

... 17 more

Caused by: java.lang.IllegalArgumentException: CommandConfig "new-incident-commands" does not contain a definition for command "email-quarantine-connect-reject".

at com.vontu.enforce.CommandInfoConverter.createCommandInstruction(CommandInfoConverter.java:139)

at com.vontu.enforce.CommandInfoConverter.createCommandInstruction(CommandInfoConverter.java:192)

at com.vontu.enforce.ResponseRuleCommandLoader.getSingleRuleInstructions(ResponseRuleCommandLoader.java:202)

at com.vontu.enforce.ResponseRuleCommandLoader.getResponseRuleInstructions(ResponseRuleCommandLoader.java:163)

at com.vontu.enforce.ResponseRuleCommandLoader.getCommandInstructions(ResponseRuleCommandLoader.java:87)

at com.vontu.incidenthandler.command.enforce.PolicyInstructionSource.getCommandInstructions(PolicyInstructionSource.java:69)

... 22 more

Environment

Symantec DLP 26.1 + SMG integration with flex resposne rules

Cause

Symantec DLP 26.1 released with a new first class native SMG response rules to replace the old 15.x plugin response rules; however, DLP 26.1 did not have a direct replacement of the automated SMG rules as it had for the manual response rules leading to the invalid argument exception.  

Resolution

The fix is targeted for 26.1 MP1.  Please create a ticket with support and attach the output of the following sql query.

select * from commandInfo where commandName in ('email-quarantine-connect-approve', 'email-quarantine-connect-reject', 'email-quarantine-connect-custom') AND configName = 'new-incident-commands';