Custom Attributes are not loading automatically even though the plugin works manually

Products

• Data Loss Prevention Enforce
• Data Loss Prevention

Issue/Introduction

The Custom Attributes will load manually when you click on Attributes -> Lookup, but are not loading automatically as expected.

Resolution

Custom Attributes are loading manually, which indicates the plugin is working.

Open the plugins.properties configuration file and check the values.  Review the following section:

# Automatic lookup.
# Specifies whether the lookup should be triggered automatically when a new incident is detected.
com.vontu.api.incident.attributes.AttributeLookup.auto=true

Make sure the parameter com.vontu.api.incident.attributes.AttributeLookup.auto is set to 'true'.

It is crucial that the value contain lowercase letters only. This value is case-sensitive!

After editing the file, restart Symantec DLP Manager Service and Symantec DLP Incident Persister Service service on the Enforce server to make the change effective.

See: How do you automatically reload attribute plugins?

 

 

 

Additional Information

Of note, in regard to incidents already created - changing the lookups to "automatic" will not modify the results for those incidents. Instead, it's a change that affects incidents going forward. This is mentioned indirectly, in the comments for the setting above "triggered automatically when a new incident is detected."

Addiitonally, be sure to confirm that plugins can be reloaded automatically (as per link provided above). Because if the existing plugins were to be unloaded (perhaps by a scripting error, or an LDAP login failure), and that setting to have the plugins reloaded is NOT enabled - any incidents created at that point would also not have their attributes loaded automatically. 

In such a case, previously generated incidents thus require a manual lookup to be performed. The good news is that once the manual lookup is done - the attributes should remain as part of the Incident Snapshot going forward.