CloudSoc Securlets show Sync Failure in DLP when 2 REST Detectors are present

Products

• Data Loss Prevention Cloud Detection Service

Issue/Introduction

After a second Cloud Detector has been added to your Enforce Server in a version earlier than 16.0, the Sync to CloudSOC operation is not successful after one or more Securlets have been added (e.g., Office 365 OneDrive and SharePoint).

When selecting Manage > Application Detection > {configuration} > Sync to CloudSOC, the "sync" operation changes to "Sync Pending" then "Sync Failure".
This failure only shows itself on the Application Detection page (i.e., not visible anywhere else, such as the System > Servers > Overview).

Environment

Release : 15.x

Components: DLP Cloud Detection Service (CDS), aka a REST Detector

Cause

1. The DLP Cloud Detection Service which integrates with a customer's Custom REST API Client, is one type of REST Detector.
2. The DLP Cloud Detection Service which integrates with the CASB solution (aka the CloudSOC, formerly known as Elastica) is another type of REST Detector.

In DLP 15.8 and earlier, there can only be one REST Detector enrolled with any one Enforce Console. In 15.8, the Cloud Service Gateway cannot distinguish between 2 REST Detectors when both are installed in the same Enforce server - so the filters which are responsible for detection will fail to load properly.

Resolution

If multiple "REST" Cloud Detectors are required, upgrade to DLP v16.0 - which supports having multiple "REST" Cloud Detectors in the same Enforce Server.