Application Detection never changes "Sync Pending" status
Article ID: 185832
Updated On:
Products
Issue/Introduction
You are using 1 or more Cloud Detectors, and have previously integrated it with a WSS tenant, aka the Cloud SWG.
You currently have a second Detector for REST, integrated with the CloudSOC solution (Elastica CASB).
In the "Manage > Application Detection" section of the Enforce UI the "Sync pending" status for your CloudSOC applications never completes successfully.
Environment
Release : All supported versions
Component : Enforce
The MonitorController0.log may reveal the following:
=========================================================================================
May 7, 2020 8:33:28 PM com.symantec.dlp.communications.applicationcommunicatorlayer.ApplicationCommunicatorActivityNotifiableImpl onRetryUponRecoverableApplicationException
WARNING: OnRetry after encountering a recoverable applcation exception for com.symantec.dlp.communications.applicationcommunicatorlayer.ApplicationConnection@2bef934e and the replicatorId is Replicator(21,'SPI_RESPONSE'). Will retry in 10 seconds.
May 7, 2020 8:33:38 PM com.symantec.dlp.communications.applicationcommunicatorlayer.HomogeneousReceiverApplicationCommunicator$HomogeneousReceiverDataAcceptor$ApplicationProcessingTask run
WARNING: Unexpected exception occurred for com.symantec.dlp.communications.applicationcommunicatorlayer.ApplicationConnection@2bef934e
org.springframework.dao.IncorrectResultSizeDataAccessException: query did not return a unique result: 3; nested exception is javax.persistence.NonUniqueResultException: query did not return a unique result: 3
=========================================================================================
Cause
The original versions of the Cloud Detector for the CloudSOC were also capable of accepting traffic from a WSS proxy.
That is no longer the case (we have dedicated "ICAP" Detectors for WSS traffic).
If the previous Application Detection option for Cloud Web Proxy is still loaded in the database, and has been removed and replaced, it's likely there is more than one of these configurations stored in the ScanFilterGUID table.
This is causing the Sync operation to fail to complete.
Resolution
There is a defect in the hard-coding of the ScanFilterGUID for the Cloud Web Proxy entry which is scheduled to be fixed in a coming release of DLP.
Use the following SQL query to confirm the issue:
SET COLSEP |
SET PAGESIZE 10000
SET LINESIZE 115
SET TRIMOUT ON
SET WRAP OFF
SELECT RESTCONNECTORID,ISDELETED,SCANFILTERGUID,FILTERNAME FROM RESTCONNECTOR WHERE SCANFILTERGUID='bluecoatwss';
The result should appear similar to the following output:
RESTCONNECTORID| ISDELETED|SCANFILTERGUID |FILTERNAME
---------------|----------|------------------------------------------------|---------------------------------------
21| 1|bluecoatwss |TEST WSS
23| 1|bluecoatwss |TEST WSS Config
22| 1|bluecoatwss |WSS Whistle Test
In the above example, there have been 3 "Cloud Web Proxy" configurations, each saved and deleted from the Enforce UI - and these all have the same value for the SCANFILTERGUID ("bluecoatwss"), when there should only be 1.
This issue only occurs if more than one of them was created, and deleted, such that there are at least 2 "bluecoatwss" entries stored in the database.
The following steps should correct the issue.
- If there are any entries having a "bluecoatwss" GUID like the above configurations - but they are NOT currently shown in the Enforce Server:
- Create a New Configuration with an Identical Name to those in the database - e.g., the "FILTERNAME" results from query above: e.g., "TEST WSS", "TEST WSS Config", and "WSS Whistle Test". The name needs to be identical so the old entry will be updated.
- For the "Type", don't use Cloud Web Proxy - instead, select Cloud Detection API Service. This will overwrite the incorrect entry in the table.
- If there are any entries having a "bluecoatwss" GUID like the above configurations - and they ARE currently shown in the Enforce Server:
- Change the "Type" of config from Cloud Web Proxy to Cloud Detection API Service.
- Save all updated configurations.
- Re-querying the table in SQLPLUS with the same script as above should now have a result of "no rows selected".
- You can then delete all of the new configurations from the Enforce UI.
- Wait for a period (~10 minutes) - then perform the "Sync to CloudSOC" operation.
- The sync should complete successfully.
Recreating a previously deleted Cloud Web Proxy configuration as a Cloud Detection API Service type:
To prevent this issue recurring, do not add any Cloud Web Proxy configurations in the Application Detection settings.
The new DLP Cloud Detection Service for WSS ("CDS for WSS", which uses ICAP) does not use this method to assign policies - instead, use the "System > Servers and Detectors > Policy Groups" configuration to send policies to a WSS Cloud Detector.
Additional Information
Feedback
